{ "Event": { "published": true, "date": "2023-11-26", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-11-26", "timestamp": 1701043381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "b43a1279-2c7d-4acd-882b-390c60b8ad74", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7a4bc80-8c19-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700975284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700975284, "uuid": "ac6593f5-6fd1-4e85-acd8-74ed54509764", "comment": "Malware payload (Mirai)", "value": "b55910c6c5174b3d656ca85a96f06aee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700975284, "uuid": "5bbeb99b-2ae5-477e-b291-01072165056b", "comment": "Malware payload (Mirai)", "value": "0012ef615f67cb12b47b8c7aecdd8f986bb867fb5b805e4166d8bdf64b8ff5c3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700975284, "uuid": "6e368e56-b875-4098-86b5-1e6eb4ca9e7b", "comment": "Malware payload (Mirai)", "value": "ccdd3124db912f3dcd239d32d8e76f695a62be34", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700975284, "uuid": "2519312a-e4f6-4fc8-ac1a-4b8c326e0f73", "comment": "Malware payload (Mirai)", "value": "2b69337123aba281e04eca3c5149c4dbb11e9ca415bed035380ddd16499f89867931690eb4626f231ab8e1b3bd218c0f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700975284, "uuid": "53d5b1b3-d40b-4be1-abbc-42f120128418", "value": "T1AE633A33B6751E1BC4C1E87961F70B54B2B2574E2AB8890E7D730E8EEF606406547AF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700975284, "uuid": "5baf8db1-22df-40bd-8dda-0464704a12e1", "value": "768:8ghXg55hwnCLGl7n1+9FBDRSvkrTyJ4tjr03A5O+75VDQ+rEL8tczwzIV:8Mg5nMzz1eFBDYv2+J4tn03e75WEtbzC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700975284, "uuid": "e7c6f929-602b-45bf-8ddc-1aa44d9d5afc", "value": 73256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700975284, "uuid": "fc8f1143-8d3b-4b37-a71d-839b3df1a7f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700975284, "uuid": "f61df4f0-34fd-4a62-8215-4760b49366a4", "value": "b55910c6c5174b3d656ca85a96f06aee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb595ad0-8c6b-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1701010509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701010509, "uuid": "3fa58a4f-315d-4e0e-a08a-5054f9b2f816", "comment": "Malware payload (Stealc)", "value": "21c308db86617380826747ad0d0fc679", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701010509, "uuid": "8bbc3508-7690-4116-b9ef-9b7cc707f495", "comment": "Malware payload (Stealc)", "value": "006f113fcc6bf0f167030d01802706299abb1724560a96b9887c8febc96f4140", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701010509, "uuid": "e812cf09-a69e-4dad-986d-d3a1636ccc28", "comment": "Malware payload (Stealc)", "value": "49800d44aa3159533ff98fc787290959cd17eb32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701010509, "uuid": "af2fe43e-b824-4d13-8900-56054d0bb902", "comment": "Malware payload (Stealc)", "value": "940dc30fc4914d301a2b2220ee58d23143396758424594049f2f0099f868fb8f40ddd1360dc64a8f76e15d79da23b436", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701010509, "uuid": "747c8536-ec31-4156-b5ff-7c990b0065c6", "value": "T1E154E60382E13D44E9368B728F1FC7EC7B0DF6518E99BBA912189E5F04B107AE663715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701010509, "uuid": "9120f3db-1a28-438d-a202-7b3ab4b63af1", "value": "b8210609d726087fd0a34a5c2f7cc271", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701010509, "uuid": "c137207e-7f4a-40fb-86d0-39257b422bfc", "value": "3072:UtI5efC/qrW0PDUYjxhcrDTB6gAWi4LICaUJ9iNQj+x8:uI5efRrhrUYjxCzBq9sJ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701010509, "uuid": "27057bf8-2c69-43fa-98b3-a1e76a892269", "value": 298496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701010509, "uuid": "fca2ee1a-b454-4ab3-81fd-47b8a2d64aca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701010509, "uuid": "9df16daf-d781-4ecf-a75c-7f0b5e2114b1", "value": "21c308db86617380826747ad0d0fc679.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69d77fb8-8c7c-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701017647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017647, "uuid": "03db2ef1-bd6a-486a-a7c5-b58a63197fc8", "comment": "Malware payload (AgentTesla)", "value": "cf85ed5c37af15ed21ff9135cbb6ef5e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017647, "uuid": "77a21566-f8bf-403b-8424-8d1367585df7", "comment": "Malware payload (AgentTesla)", "value": "00cef063c80b8c496f33607001d99f7e993ddac7eadc1477d8cbd058943f98a5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017647, "uuid": "c753318b-e1b6-4877-89ce-d07cae1f3ca5", "comment": "Malware payload (AgentTesla)", "value": "5ada451390692ac332ae0514047df5e8574c1e98", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017647, "uuid": "01787afc-0dda-4209-abd7-2f354ab9a467", "comment": "Malware payload (AgentTesla)", "value": "0097ecc51c572b04332f445d66d8ce1abea0d384654cb268a67227e8b0bb8d24f2e4e77f1a5bd0975c3a6e1dcff09435", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017647, "uuid": "a561a07c-b182-46a2-949d-df4fa9f3df10", "value": "T12245AE05B2A68B44F57CC7F840526092A7B47C9FF26CCB8B8DC739DA3971F911509A2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017647, "uuid": "901d751d-f439-45b1-ae83-5d96b8d0d5ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017647, "uuid": "440a658a-597b-4053-b8c0-af1a81f59ca2", "value": "12288:wJjmzMJr5ECjK5EFg+hSWc1cFnlfn0GUDTrgahWuwDbAKrat8a7yagV:SjmzMTEWKiFfM5wnd0Gk1hq3Zat8+gV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017647, "uuid": "36029120-482f-4440-8338-49f91a8cc9c4", "value": 1168896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017647, "uuid": "d7530ae1-af55-4da5-b235-0ff26f3a23cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017647, "uuid": "76f594f7-35cb-4e4f-b170-3ace17a9bff0", "value": "ORDER RFQ23.11.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0683dd29-8c7c-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1701017480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017480, "uuid": "4d060b18-ed86-4be4-8bb7-fadc3262993a", "comment": "Malware payload (Formbook)", "value": "807a2bef885f3e9e2c67a0732a27764c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017480, "uuid": "f4927b72-ef0a-406c-a827-0c903f7e279b", "comment": "Malware payload (Formbook)", "value": "0270bf6f65f3621ce171f6f10083e4f4730c3b985968d7a1c8f003bed2662be6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017480, "uuid": "e2c3cad8-434b-46e0-8f6b-b456007ddba4", "comment": "Malware payload (Formbook)", "value": "8d613c79ed8566b676b8a4135ef98095b5140a6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017480, "uuid": "e822da5d-8fae-4b9d-bde7-52f4ba345f73", "comment": "Malware payload (Formbook)", "value": "f5fa754fc6d1de31c60fa51fbf87623955a36956b7072e0dfa525a08f75abd38bb69a8fe1907ec7dd9bbdf6eefc92982", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017480, "uuid": "d2cc181b-adce-4a90-b2bd-112e022a0188", "value": "T10BD4237D127447A8E8A7A3F01C51A26396B3A83B72B7B1153D500ACF4C72F448664BEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017480, "uuid": "e7c8e6fd-7622-46ed-bb88-c8a50087b107", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017480, "uuid": "7dea2bee-3fd5-475d-8abd-d689d8956326", "value": "12288:xzvy8oihURL73rko2mc2NJXpTWYpejfVcAdik+zGB/A3hgcb:FvFWj2Q9WYIjfVcSikB/Qhgcb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017480, "uuid": "d72d7f4a-0f62-48c8-bd4d-54a5894cf3b0", "value": 615936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017480, "uuid": "fd879eea-e4a8-45bf-8938-7c8f3a0599e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017480, "uuid": "6f4233c8-32b2-4add-a366-5aac6f8a9c5f", "value": "(DRAFT BL) 11-10 - SO-J234, SO-J234inv, SO-J234pkw #441427872.pdf.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a10866f-8c88-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701022721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022721, "uuid": "c9eca81a-5c67-45e8-87f1-06c7463a34c3", "comment": "Malware payload", "value": "bcf65ddf23f31f98d7ba1d6e23902552", "object_relation": "md5", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022721, "uuid": "8e346329-684c-45eb-97ab-0ed5a9679bc9", "comment": "Malware payload", "value": "035bcae10783495f0728eed772825acdd656acf71d7132927c54e2f6100aaf4d", "object_relation": "sha256", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022721, "uuid": "56dcf13d-971d-4168-9850-37410efb0b33", "comment": "Malware payload", "value": "649688f59006d75b40294caa1129f08bd57ea4fa", "object_relation": "sha1", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022721, "uuid": "652ecf2d-ff24-40f9-8151-d6124d473676", "comment": "Malware payload", "value": "332d83c91f054e6f04f193d5c3a723f426092358cc6e7d571e32f7ac7c10a24de123a75c1f14742b5aba8e39f2a034fc", "object_relation": "sha3-384", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022721, "uuid": "5307b6b4-a461-4c7d-8ccc-0441672f15ad", "value": "T1AA934A517244C872D6840B744DD69ADAB72BBC2ABE7B47073255F32F3E737A08D1260A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022721, "uuid": "4fc0540b-7a5a-4e21-b7f3-d3ba5dad2920", "value": "1536:erxEtjPOtioVjDGUU1qfDlaGGx+cL2QnAdyxFMU7DsFLmUXFmeLmi9AbG7jvhoix:erxEtjPOtioVjDGUU1qfDlaGGx+cL2Qh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701022721, "uuid": "cd0a5643-e522-4ffa-9d35-e1d7864348c9", "value": 94720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701022721, "uuid": "e7796ea2-a3eb-4744-8a6c-305deae3b799", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022721, "uuid": "096fcb00-df89-4736-b00c-470d0e2662f7", "value": "Fecha de pago. Estado de cuenta.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5704f6c4-8c62-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1701006448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701006448, "uuid": "af5d7161-e643-4d1d-8a4b-a3349bfacf9a", "comment": "Malware payload (RedLineStealer)", "value": "dd11c9f27b6b2144c2b29b8d586b9074", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701006448, "uuid": "e3979f1d-110a-4a40-b19a-77f8ae10e2f0", "comment": "Malware payload (RedLineStealer)", "value": "0368062bf42718cab6dd76c6676f01f14006550f028aaa835268fd79915dca4f", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701006448, "uuid": "ee27fe41-1a12-4dd5-93b9-e6f487ce0aac", "comment": "Malware payload (RedLineStealer)", "value": "17b22f4e077c60ef86630bb97a099c871047283e", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701006448, "uuid": "72b4ad60-89f8-40c8-966d-84d4fa46f003", "comment": "Malware payload (RedLineStealer)", "value": "686d655f414db7269717b8c5295bb314de474c463f1ad2e9a5e9e64d1aa2f357a2bfac8b9c36be3b5f0da0e2ce8f79d0", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701006448, "uuid": "812a1ba5-d14c-4ea0-88ab-24d1baf54f4c", "value": "T18B873334AE6AA5C3D495B379DCA30F08333184DA93404723E7AC51B98DC3BA96CDE5D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701006448, "uuid": "4db6aa2f-b68a-45b0-a8a9-67e122214dda", "value": "786432:G/gBkhBGsDRy2XsuvfIviHwJ+xNSF0AiI5tNQT84zZcw1PXWZY/R:GIoB5DUrowiS+xCnQ/P1fWZYJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701006448, "uuid": "637df3f8-4de8-4493-851c-93c5a3e57baa", "value": 36061260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701006448, "uuid": "6f7d2f4e-34a0-4724-a5a3-df6662b6dc6a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701006448, "uuid": "d4df9cbb-5014-4df1-b217-6038ddc3ddb5", "value": "sample.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a26fd6c-8c5b-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1701003313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701003313, "uuid": "8cee3ca2-41ea-434c-850d-0114f71ae4a1", "comment": "Malware payload (RedLineStealer)", "value": "0df6c40ad101397a9ff1c84e27ad06e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701003313, "uuid": "8536b603-22a3-4cfc-a308-87ce28c7f8f8", "comment": "Malware payload (RedLineStealer)", "value": "0373d74b4c022df6568117f21f8d7880d4aebd460ec2753e66814695c638c46d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701003313, "uuid": "924c45e7-ceff-451f-8a9a-f3d7c8638004", "comment": "Malware payload (RedLineStealer)", "value": "6924c80661e6a1d5da36c7090e4b8b05a9ba0fac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701003313, "uuid": "cb65f220-b7f0-477e-b453-b6c0528cd033", "comment": "Malware payload (RedLineStealer)", "value": "28877901d01d43e17c2377d06b18b90755114c06a35de7bdb527141f4faa439071c7d253daf4d91c20f86abfab7a1ae6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701003313, "uuid": "752ed1a0-ae15-4a59-bf0e-2f5f7d3ccbc5", "value": "T15125230BEBD495A2C8B113B068FA57832E7A7DA09DB4962723455F2D0DB25D0DC3436F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701003313, "uuid": "1b7be590-5d44-40a2-be69-81770e2ce1e3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701003313, "uuid": "5488f6bd-62c0-4868-8308-a7ac269e3427", "value": "24576:rywW4S9SLB7XZE7Jn6J9Ni5CvTLNrNoVsU:eR1SLpq7I9JLdN8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701003313, "uuid": "24665e14-aa51-4279-a5d3-919ad2fb702e", "value": 975872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701003313, "uuid": "ce1facad-3090-4313-bc95-5458f275fa0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701003313, "uuid": "a8bb8910-9290-421c-be1d-9f09591d5574", "value": "0df6c40ad101397a9ff1c84e27ad06e9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc7d00af-8c92-11ee-8907-42010a9c0042", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1701027261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701027261, "uuid": "a875129a-88b4-41e2-8d61-81468bb65bae", "comment": "Malware payload (Adware.Neoreklami)", "value": "8002c4a887d8aa7ea682309d9948dbec", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701027261, "uuid": "e396bca3-c735-496f-926a-21d16a4ec156", "comment": "Malware payload (Adware.Neoreklami)", "value": "065f0645b544af518c93089f20fa9912d13bf37c27a3643359596f5b3d064118", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701027261, "uuid": "e11f3d8e-4c49-463b-9abf-aa253a5427fa", "comment": "Malware payload (Adware.Neoreklami)", "value": "d8462f04b8f4ef257c06c74182ed7c2e84b62d6a", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701027261, "uuid": "2dd9f5bc-576b-40c0-be90-104b4757ec92", "comment": "Malware payload (Adware.Neoreklami)", "value": "94242717938dcc3ae83b7583cfaeb5dc1a79c30f3eb51de42ac1c21f56d031c11bfbae57fe43a0bf4152373e024c26e3", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701027261, "uuid": "147cde36-b3be-49c3-84d1-43e339ffcae6", "value": "T1267633393BC85839CA68853786B572D0B713FC2A5A7484B763C4849DBC2FB4771B252B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701027261, "uuid": "bfb9131e-d8a7-460e-b1a9-3ace18b81048", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701027261, "uuid": "9b646e7f-780c-40d8-bc22-f1b452fc8b68", "value": "196608:91OdKsJyc5Phl+8+a50Vwm+72fZoZtdgEPMj5PRJ15xEGRgL6Wc:3OdKsJXPhl+RayBzZytd3Uj5P33xEYg2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701027261, "uuid": "77e9d898-6e09-49bd-b8b1-bbc28dee8aa5", "value": 7518497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701027261, "uuid": "d56b97f2-5569-487d-9ded-22b6d9485293", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701027261, "uuid": "41a7a433-5f6b-4f4f-a67d-c794f9d5cbb4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ebe36c2-8c7b-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1701017065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017065, "uuid": "702226e0-7c22-49e0-9f61-dd101c7ee0ee", "comment": "Malware payload (LummaStealer)", "value": "0ddc70bab9470f31384582e27b00c511", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017065, "uuid": "d7b6d588-5c7f-4bb5-a9d6-401fa7550468", "comment": "Malware payload (LummaStealer)", "value": "06a6d676ed77b5f7758bf57329d6801b9dbb3a2813e059502f17a30dd90aed5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017065, "uuid": "96915d94-e38e-4ab0-8870-0093c75ad0e0", "comment": "Malware payload (LummaStealer)", "value": "dad133d158fa74372749ee0434615cf0838ca800", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017065, "uuid": "d70596ea-8d6b-41fe-acc6-7ff64d965902", "comment": "Malware payload (LummaStealer)", "value": "02c848924922a62128be18ca210f6b81de044ffe2e19f0709a48c358d045285844fbccf8f2070489fbe3ca8e2fa15f63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017065, "uuid": "11cb91e7-8f61-4bbd-b069-a5a8e70b2266", "value": "T148B5A11176F95B59F5F30FB86ABAB611083ABC6ADF10C2DF1961508E0D21AD08971B3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017065, "uuid": "5a7bd840-cb4f-4626-b3b1-ccf3c88aa9b5", "value": "8c258f040372dc83a7dc27d4d1112d61", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017065, "uuid": "bb4c8001-8fd4-47fd-8d6b-f4410033fed8", "value": "24576:Xc32c9YFBIkYNPmfMaDnWkZV6a9Dhvh5+O3OT3hrpbGkF/D:XcSIkYNPmfMaF6a3vCOoD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017065, "uuid": "45094431-5206-4bbb-af45-68860429bbaa", "value": 2388768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017065, "uuid": "2ae7bc5e-d2e4-4b69-90f5-7a25643c0843", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017065, "uuid": "e79e8daf-5d9f-4981-99b3-319eb733482f", "value": "0ddc70bab9470f31384582e27b00c511.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "491a84d9-8c76-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1701015015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701015015, "uuid": "832c6a2a-b950-4f45-a7f3-f5636ca8e1ef", "comment": "Malware payload (Stealc)", "value": "068e4f576371fde598a5fc1f823636f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701015015, "uuid": "b7d96c93-ba18-47ab-abc5-d70f7b91f9b8", "comment": "Malware payload (Stealc)", "value": "06efb9f04aa620775acf82f5f8cbe09c6d3d35e3740c8bc7068f2a72b2923b3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701015015, "uuid": "29440060-0d1e-48c2-9360-f8fe09a3173d", "comment": "Malware payload (Stealc)", "value": "9e52f941388d32061a10d21ff4792990d7531a4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701015015, "uuid": "10fb9db7-b0b5-4535-87c3-4a592fa6d521", "comment": "Malware payload (Stealc)", "value": "18c35e9cfafebcd6471345f1b46b7a537ada6196425322ae13905264be059767a31026f13ad4249b4a90fd471925f5a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701015015, "uuid": "5ef03325-0efc-479f-9387-5c3b6b4a6844", "value": "T14054D41382E23D40F9364B728F1ECBEC7B0DF6518E59BBA952189E5F04B107AC663715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701015015, "uuid": "14f8521e-d3ef-42b7-a819-69a1b9293830", "value": "92d94b459e4f1d52bbe65f88efe1e480", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701015015, "uuid": "0357129a-466a-4135-a30a-acc7acda40d2", "value": "3072:1NBrcvknJVAwKJmEMgfzmy6K5BzcWT7CxI9Ledf5njsZhUkQj+bs:bBYvMz6mEMmzzhDT7MGwG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701015015, "uuid": "e606ff97-0396-4bf5-a229-2811458727ea", "value": 297984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701015015, "uuid": "33ff5e9f-2db1-492e-9b74-9dc264a2a32d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701015015, "uuid": "6daa7836-7274-439d-bc4f-26b867ca88f3", "value": "068e4f576371fde598a5fc1f823636f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af73ce7f-8c7b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701017334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017334, "uuid": "13be16f2-41cc-4b00-a69b-e00d237ac7bd", "comment": "Malware payload", "value": "dd9f64abfebe523341dbca18603ebf29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017334, "uuid": "d2120c2f-40a4-4d6d-8172-c3221c4bfda4", "comment": "Malware payload", "value": "08565572f988f21203836b94975e3f6730deccbea8b3bd2176ba7af28a5b6055", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017334, "uuid": "f4cea69b-908e-4339-bd2a-9762c3fb0e09", "comment": "Malware payload", "value": "9fca1a19f444681549065a95750201296188ff37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017334, "uuid": "27579859-c696-4a21-9dc9-860ff4de7f4f", "comment": "Malware payload", "value": "f8a2de76232fd80af2896c51d0e2a3a1b2acd9146378129399b75528b5c29396ea8a4964331ad5ba13a19785d995833d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017334, "uuid": "ea0bfcf7-ef88-408f-b3d5-38d529899d9d", "value": "T15455A603BA878BA2D1792737C5A7881C9775D9817B13EB0F3D8A23E918C3B765D0161B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017334, "uuid": "22eed54d-df31-4ec5-9fe1-9ae84ba39c2e", "value": "12288:G4v0iSRSnXbXVvauzcT96YK6gb1PEGsQnuNLgZkfFKOAe1uuQkw8gSKCMiz9wq7L:GV3URaCagZsQjZgFKUW2aMqfhjD0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017334, "uuid": "98756ed9-ce52-4c63-9250-7c174e6d6aba", "value": 1284608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017334, "uuid": "41af1425-cc0d-40af-b716-65d6ac9938f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017334, "uuid": "c944f55f-120f-4856-99c1-cf68e229fe41", "value": "Kuynn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "946cbec0-8c36-11ee-8907-42010a9c0042", "comment": "Malware payload (DBatLoader)", "timestamp": 1700987654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700987654, "uuid": "8b821875-a11a-48ac-9753-a5fa790214f5", "comment": "Malware payload (DBatLoader)", "value": "95af57a740c5db3e1e52cdb5355daa28", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700987654, "uuid": "e14ef596-3556-4a9f-ac8c-3c556cb0cd8c", "comment": "Malware payload (DBatLoader)", "value": "091fbd8d1a58a54f7d71cb449a3da0ccd6a845950017209d88e25d7b685a1bb7", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700987654, "uuid": "eb6d283d-8588-4682-a026-e75991cfea13", "comment": "Malware payload (DBatLoader)", "value": "02fa230076b630be472086ffefa77a1a7a9a542c", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700987654, "uuid": "f313a7b2-ec6a-4df8-9324-3e9d1923d205", "comment": "Malware payload (DBatLoader)", "value": "7105e7d233f95381a69c0cfc80d25fc721b017910c399865985579fc859e4af0243e67fa219bb7dace6b79fbbd49a3b5", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700987654, "uuid": "795f6a95-e985-468e-b74a-a878326bfe58", "value": "T1F895F112DD620477E02316BD9A3B93519C3A6DA72F14AAD56AF43D684E7AFC03D1B033", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700987654, "uuid": "38a5a3e9-f0ec-4b12-a208-7f17b127de96", "value": "5346a12dcb49c1d1cdae222f054ffa7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700987654, "uuid": "17679223-034c-440e-be98-8a44d29d2e17", "value": "49152:bee0SeGwcSGQ3OvlzgzRlyYFT9xZdmPSw:blMGNQ3ywXFJQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700987654, "uuid": "1cb206e9-ecc5-4f23-b0c5-01eec08469e1", "value": 1877504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700987654, "uuid": "c423293e-4724-4205-af3c-61b036025989", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700987654, "uuid": "ee1d1331-9348-4672-96e6-da07962d647f", "value": "Call For Price f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "320e31c4-8c8a-11ee-8907-42010a9c0042", "comment": "Malware payload (PureCrypter)", "timestamp": 1701023566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023566, "uuid": "17245dc5-de17-49c7-86d2-c983e7ce21ca", "comment": "Malware payload (PureCrypter)", "value": "68fc069dffc9c4737a56b7faceeac521", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023566, "uuid": "0e5f92d3-ad77-4436-92b9-77828644901e", "comment": "Malware payload (PureCrypter)", "value": "0a7f1c8e3e3d786a2eda2f2efb2e3a8195fe62ccc170b3775d0989d220f55d28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023566, "uuid": "72492f2d-7573-4f14-a90e-405361541ee0", "comment": "Malware payload (PureCrypter)", "value": "16bafbdf59101966f714ee03dde674f8f38d7606", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023566, "uuid": "8a0a77f4-e700-4d64-91e4-2076633aebae", "comment": "Malware payload (PureCrypter)", "value": "e2c47a9fa7e6cb754d01976744b347f3a5feb4b43f5e594ca94a0473fcdd35872feb4ebb033c787ad6ec11b52a6637d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023566, "uuid": "89830b64-5829-4fca-8563-b7f3c3e49ed3", "value": "T1E1B28415BAE5846BD2F22230C133C11436ED3E18FFE4FE1E14859596A8FA70F692F916", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023566, "uuid": "3926c7da-3597-431a-a380-8405ea7b4b66", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023566, "uuid": "936aa98d-c3d0-46f1-a98e-061042a23a26", "value": "192:mqPh/60lOHaokQor7T/WE51EIKx18/S/XRKQ797xnMZOXYwuX6Kuw2lFNEQY:m+hleor7z51ozYmXRKMnMZi1G6K2NEQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701023566, "uuid": "3ce9b502-74ed-4294-a419-603a2ef4190e", "value": 23552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701023566, "uuid": "3ab089aa-2baf-43c1-8e7e-0cfe7a0f607e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023566, "uuid": "43b137e4-6084-458a-9ed6-202c749ced2f", "value": "Urgent RFQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "362ed38f-8c3b-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1700989643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700989643, "uuid": "b0e995f4-51f3-4f5c-b753-1b0a54e231e8", "comment": "Malware payload (Stealc)", "value": "1cb3a61bda12f936720f1c63bd35f373", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700989643, "uuid": "d5e800c2-9092-4558-b1d1-e244b54186fb", "comment": "Malware payload (Stealc)", "value": "0aa234562ce0bf67d4e737f8624d36246595aaada2600636f95edece48fe141d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700989643, "uuid": "a172e053-588b-40a7-9192-bd41f5ac327e", "comment": "Malware payload (Stealc)", "value": "b8a907e3b106603788c1ff9879692d2d8c24dbb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700989643, "uuid": "c9ee5500-bf2c-4004-9471-a87552344899", "comment": "Malware payload (Stealc)", "value": "51f14871ef8c998cea70050fabf4bcd474c2603a9c9aeaace439415ff632a2e17fd40290ad5191cdb20ba81665200008", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700989643, "uuid": "5f79537c-ae14-4252-9610-3c83066260a6", "value": "T1D154D70382E13D45EA264B738F1FC7EC7B4EF6618E597BA912189E5F04B017AC663706", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700989643, "uuid": "efe76602-7928-486e-92ea-f73cb2f9aed6", "value": "0a0289a4f27045b7c64ea101e69f4d9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700989643, "uuid": "57e91ee5-b4de-40cf-9cb2-1e6a61550fa1", "value": "3072:VzBM0u2/iOoF7YFxXW5nhdXSOaw4hEUeDlig67YUQ5mESU/ICQj+/:Bq0uCnI7YFx8xAX6/I8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700989643, "uuid": "2f9347ab-45f3-4f75-96dd-33bd49b78a1a", "value": 296448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700989643, "uuid": "5ef605ad-cc8b-480f-af68-689f1612bbcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700989643, "uuid": "bae58250-2f24-428f-b0cb-9f2836b936b7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "165b06c4-8c7b-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1701017077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017077, "uuid": "3892ffb5-1f26-43cb-9edd-3f04936ba7fa", "comment": "Malware payload (LummaStealer)", "value": "05aea19bc7105bd980bec2b0d8a83153", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017077, "uuid": "33842d4f-1e3d-4070-8f54-9eeb7644581f", "comment": "Malware payload (LummaStealer)", "value": "0aad2319e3cc0dd05602724b11841c2e323f5cc5a29ad12cdee18d02f749b9ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017077, "uuid": "3166c305-3ce2-4592-aabc-31994a315d68", "comment": "Malware payload (LummaStealer)", "value": "72bdcd5ef261c0ab75d378eeb8bb08bd63817c65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017077, "uuid": "094a60c2-1350-41df-842d-c4bfa6e15bec", "comment": "Malware payload (LummaStealer)", "value": "4c6eff8fab6deb9fcc93811ebdd4bd814c5949d903d979465ad5b4c34608754761b8e5da6b1b136d82536af6b6510ec1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017077, "uuid": "bb566a18-3935-4000-b2ad-a73f6f2ad32f", "value": "T148B5921176F9CB59FAF30BB956BAA611087AFC69CF11C2DF1251508E0823BD08971B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017077, "uuid": "a7446336-5239-4117-a5d0-efaeada695da", "value": "8c258f040372dc83a7dc27d4d1112d61", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017077, "uuid": "9dbd49ab-1245-4fc0-8399-19b5f602796f", "value": "24576:3yd3aEn2Y4+6EEyg+ikmBBGQFh86a9DhvhdVuCa1PmuDiiinnI6xQrJrH:3yx4+6EEyg+JmBla6a3vd4LrtH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017077, "uuid": "c7eddfc8-e00f-4d1b-b35e-513138af6b51", "value": 2395936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017077, "uuid": "21cb98b0-e5e1-43cc-85b6-6fd2c16ab27a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017077, "uuid": "868e3668-f02b-4072-8d31-aad023f5a6cf", "value": "05aea19bc7105bd980bec2b0d8a83153.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6ee58ac-8c88-11ee-8907-42010a9c0042", "comment": "Malware payload (STRRAT)", "timestamp": 1701022903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022903, "uuid": "e5bdfca5-852d-408d-945c-8ebb28f668f5", "comment": "Malware payload (STRRAT)", "value": "147056ef41389a1f59ba0ff32ddde8b7", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022903, "uuid": "17fe14e8-d0e6-4793-bf05-f29d20be7983", "comment": "Malware payload (STRRAT)", "value": "0c069059f9582da450ae00ccd6ba3e3d59eb4b02cb9aabc544e4808b7f94c234", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022903, "uuid": "463bf55f-6e25-4276-8392-0bda2f32af32", "comment": "Malware payload (STRRAT)", "value": "34d1f67a5a10afb224b8b5e06363a6e44ac5ee3b", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022903, "uuid": "b528f5bd-a36d-4428-a776-210246501af1", "comment": "Malware payload (STRRAT)", "value": "4f0ed8afb1086c782737f69ff0b65be84b4dd4a7a25e86c964134d2ed20084b834eacc79c83fb2fd07637c02a0c3c9a6", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022903, "uuid": "78f1eb15-7af6-4b08-b1bc-6c72e80ba5c4", "value": "T1EC63F16F6398B4E7E633E0FD3A4592237C44CA48C58861515236E16E7DB74CB4346DDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022903, "uuid": "37237ead-c229-40f6-8390-53035297ae26", "value": "768:ewL3z9DFCYOW9HfcmZmV93KKr8K/dC3cfKYRsOanopEt3OfoAiVK/f7SWPs+D5le:n7RQYF9Ume3K7KNdEGoNVKnb5z5s6oH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701022903, "uuid": "d051e2fb-393d-4f66-a0b3-7208b356b53d", "value": 69630, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701022903, "uuid": "22c31810-6d76-4f75-8d1d-cfa6a1ad649d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022903, "uuid": "c547c90c-ba28-4a5f-a0ef-c64cf32493dc", "value": "overdues-pdf.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "484c3df8-8c6f-11ee-8907-42010a9c0042", "comment": "Malware payload (DCRat)", "timestamp": 1701012007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701012007, "uuid": "384dbdcf-c27f-401a-aae9-dea54ee6296e", "comment": "Malware payload (DCRat)", "value": "a8369a27fbef07a1cc2c2f20e844b58f", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701012007, "uuid": "e86f9c16-2a49-4243-8cd2-a6b128db66c9", "comment": "Malware payload (DCRat)", "value": "0c580f2f9f3e2c64e1a23ab9f81e37e47fee22704d46a7bf7741802694cae951", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701012007, "uuid": "0b06ce33-b739-41a1-a155-6c03a6834c82", "comment": "Malware payload (DCRat)", "value": "737828caef2cd22845b001d247b1597f73835f4a", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701012007, "uuid": "72a768b3-290a-4a06-a913-f98acf2c5ab4", "comment": "Malware payload (DCRat)", "value": "7906d6518b0329ed45442e0ae4b1c4ae76daabb91f7c373cc160a6b60fab35a242ffdd251bb4fc6feb02fdf5f6baa953", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701012007, "uuid": "05b520d1-6cf3-4efa-93b3-3f80d08cd7fc", "value": "T13CE5E0027E44CA61F02A1633C2FF455447B4AD912BA5E32B7EB9376E15123937C1CADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701012007, "uuid": "d92acae6-165f-48d5-92c0-a1e6649702d2", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701012007, "uuid": "e1920b4e-85a6-402d-9428-a0ac71dec302", "value": "49152:UbA30KjqqxP86L9Vs419H1j0m7ulwYDOOtWOf/Th:UbeGqv2419H1j0mwHftrnTh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701012007, "uuid": "53342a20-11a4-4dfe-bb49-6c7be32913c7", "value": 3025030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701012007, "uuid": "0c7b59c5-3135-40fa-b948-818bc8a10d62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701012007, "uuid": "94563a4b-0030-461c-bd7c-6c2fa3ece068", "value": "a8369a27fbef07a1cc2c2f20e844b58f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78018dbb-8c7b-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1701017241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017241, "uuid": "a65c33bf-8a8b-420a-91f8-7b3f775ece84", "comment": "Malware payload (SnakeKeylogger)", "value": "5051aaf777adf442078cc253bd9b8cf0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017241, "uuid": "c2f60905-20c1-428a-9d35-8c0150ba1bb2", "comment": "Malware payload (SnakeKeylogger)", "value": "0d269c5bad8cff20c0b755f7fc1f712f92bf8344590f68c42e120d1c20d3cadd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017241, "uuid": "08dcca05-a72a-4153-9a1b-46b3d632cca3", "comment": "Malware payload (SnakeKeylogger)", "value": "2354257cf3d4ba747ad0546744e01508dc23b9a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017241, "uuid": "8bf79960-0dd5-456a-ab08-ebd45f359121", "comment": "Malware payload (SnakeKeylogger)", "value": "c7ae133f897f49567a6d20266893f381d10dca97d431360479b47d817f516932ccd7b2fcdd2a0ead589d3d12dcb73947", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017241, "uuid": "ca40a5ab-53db-4ad8-be5d-da1d87eb28d2", "value": "T1D7C412AA71A8AFD7E53A53F70D20810497F1BF385968E1982CC571D645F8BB0AFA1C13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017241, "uuid": "4809188f-740e-4c69-a610-b8f849b32aaa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017241, "uuid": "23243c87-1bb1-41b4-a5c8-ff593d323a5c", "value": "12288:8E6jD/f0WocBQBc9YsGSlwdh7CqYkMt9ENzr:8tD/CcBDfGSlwdi9ENr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017241, "uuid": "79475f71-0b34-4f38-a5eb-a3f9215317d3", "value": 583680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017241, "uuid": "b3db088b-585e-4223-8dfd-7318dd819606", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017241, "uuid": "cebf6030-e32a-4378-b06a-fe4664d78616", "value": "Purchase Order 257463-013.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c30e0bd-8c7c-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701017651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017651, "uuid": "8a6d6321-9a4c-4a33-a6ad-511672f48597", "comment": "Malware payload (AgentTesla)", "value": "81ba6001b61a1caf7a0a4b3fa153b2a1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017651, "uuid": "421eb0e9-c699-4d60-92e8-d247cde7c396", "comment": "Malware payload (AgentTesla)", "value": "0d5386ec112d97dd4597489aae6305cfedaf58bff85638140291b68b3708d621", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017651, "uuid": "cc8595fb-3a2f-454d-b48f-0a75f277ca7c", "comment": "Malware payload (AgentTesla)", "value": "0a892b878a5e03d43cd0e68b6dea9e47ab9ba633", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017651, "uuid": "b6d529b4-7160-4582-adb1-d525abcaaf13", "comment": "Malware payload (AgentTesla)", "value": "b6529028129614927fe86ee322e43b50130d7b8a6cf88b631303f333ce1646bced500123f7fd6ef10a53b1cb4002143f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017651, "uuid": "0e9652e3-2fbd-44ff-b7c9-2a4f0235f695", "value": "T13E459E05B2A68B84F57CC7F440526092A7B47D8FF25DCB8B8DC739DA3970F911909A2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017651, "uuid": "fa90b8d2-5282-42fb-9023-95f0e96caa7a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017651, "uuid": "99ae4c85-c553-4447-8bc4-905cc9f1d435", "value": "24576:KgWzMTrSQRMqUgIhRSszqU8SMtXk82H+WS1ogV:KgW4TrxXUgIXSgqUNM1kSj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017651, "uuid": "d464308a-8aec-4fcf-949b-de8310cfc819", "value": 1182720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017651, "uuid": "00509532-f436-4190-926a-b9e13989d76e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017651, "uuid": "5619b4a5-9260-4003-b877-1a7401d02539", "value": "\uc0ac\uc591\uc11c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f475f46-8caf-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701039641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701039641, "uuid": "2cd28a8d-34da-4bb0-be90-7bd4767a98fb", "comment": "Malware payload", "value": "9efdeebf19f4303a14f45d7c567a0f9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701039641, "uuid": "3c10b161-7d74-4172-9358-b46555367327", "comment": "Malware payload", "value": "0d5bdd21221bc97011cc58b081eed52dbcd75dbab396856a6fc94e891ad5553b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701039641, "uuid": "e2226707-4bbe-404b-9cf6-2132e6062cc1", "comment": "Malware payload", "value": "587c5015e55162b1476d1df18cd3b7a921b76d29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701039641, "uuid": "541d646a-41e3-4137-8eb8-26803a860c58", "comment": "Malware payload", "value": "d6e5f2646bc313d4ff85304a8d280ca8cf4eadf19c02f7d9ffe9f231d177ad57e854b1d64590b849b45b2a4beb91c429", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701039641, "uuid": "9eca9b18-5a1f-4ca4-83cd-e62ee5dc9cd5", "value": "T18C944BD4A9B795B0CB23C2FA97B8B6C7CB7F41800152ADB9776821F1244D49813B7B78", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701039641, "uuid": "39e4865a-2444-4279-bc28-d84d3fa35d6a", "value": "1300d813e0330ae3ab555e08426e3ffe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701039641, "uuid": "022f2057-fe6f-444a-8b81-73defe296508", "value": "6144:M8/nbYVMEaaR3Pio6PiUl6q6tt5x9H+t8pXB9KUVf+HM5:Ms+6h98p5Vh5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701039641, "uuid": "0e0a101f-ffef-4d9e-a610-ed8926942118", "value": 418940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701039641, "uuid": "423f6f37-cf52-4222-98f1-c56d4b0e2c31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701039641, "uuid": "d106c797-e22c-47ed-aefd-00a32867b8a6", "value": "Applicati\u043enSetupFile14.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b82b89a7-8c8a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701023791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023791, "uuid": "2ad647d1-cea6-43aa-9502-8177a78275e2", "comment": "Malware payload", "value": "e4d259564ea1bd2bf56e3d3c80efd060", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023791, "uuid": "ba1c1e45-c60c-43f0-aad3-a08cabf2099d", "comment": "Malware payload", "value": "0d9d29f9791135c9bff0a85bc33d59f0809a89451e922237c3dbd8b57c86bec0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023791, "uuid": "738026a1-279e-4269-9a27-6b0810e29fb9", "comment": "Malware payload", "value": "cb5106c20603da4e94369fdcb2d25b37f317d5f1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023791, "uuid": "b87382a5-a738-4ebc-87c5-9720852e9b04", "comment": "Malware payload", "value": "c16e7cd86390c8999e61f3635ddd084dd55d3252db63168a43ec1869c083de5342a9dd6b5931259be33f0c36bfc6077a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023791, "uuid": "9cda0242-58ec-481f-9e7f-cc16948942b1", "value": "T153C1652193D4944017F39F51BB57F6D2E999682B38E20C8AB4013F74AE68C10D7EAF39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023791, "uuid": "b6ccda82-33a0-407b-bcbf-5a79abb244bf", "value": "96:KWvHqfzYdb65UG/6mA0t4jTTV7pF57Hqiiwve9b8nuCMq1CerVEXo9XkI7Ed:KWA5UG/w0t4jPd5HrHvAb8uZiCex+wXc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701023791, "uuid": "1aeb64e1-bcca-4514-8bb7-f51ac373c1b2", "value": 6119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701023791, "uuid": "f283d4c7-18a5-4ac5-9da1-c811eb7597b6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023791, "uuid": "ca54a6ed-5b9f-4523-a050-a89b08d0b275", "value": "Update.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "986e05f4-8c36-11ee-8907-42010a9c0042", "comment": "Malware payload (DBatLoader)", "timestamp": 1700987660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700987660, "uuid": "6af0b992-c9c7-4830-84db-f4118ad421cf", "comment": "Malware payload (DBatLoader)", "value": "535b771dcc5a0db0c35b284b5bc0e52f", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700987660, "uuid": "1a55a3f2-3082-460b-a11d-4f7dfc4ac271", "comment": "Malware payload (DBatLoader)", "value": "0fc367790748591bca8d2d01ba1c189754183cacb4dd76a567e05f0ab45590ee", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700987660, "uuid": "c8a54aa6-129b-4f41-be5b-e54001131930", "comment": "Malware payload (DBatLoader)", "value": "845b7a40423a7685f0bc8ab9556afe475146cdaa", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700987660, "uuid": "8bf58a70-6f95-49ca-8da0-8981dd839257", "comment": "Malware payload (DBatLoader)", "value": "ac9a69227e16584c05feb6e457a861ba314531b5989a648254298cfc0f6ea646b265f9158a80dd371f86dd11575f743e", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700987660, "uuid": "7ff3d208-257c-4dcf-8124-45983a372435", "value": "T1AF95E112EE610473E06366BE5E3A93524C2A7DA32F1465D6A6F43D584EBEF803C1B133", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700987660, "uuid": "184fd457-d988-41e3-9cd2-5226721c6e1f", "value": "5346a12dcb49c1d1cdae222f054ffa7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700987660, "uuid": "fb48bdfa-fdc0-482b-ac4d-5043ed5e4d0d", "value": "49152:bee0SeGwcSGQ7OvlzgzRlyYFT9xZdmPSw:blMGNQ7ywXFJQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700987660, "uuid": "ef20bf50-ec33-4cb5-af60-0ba92d250e65", "value": 1876992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700987660, "uuid": "df1388c9-0522-4468-be60-d17a8e15c524", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700987660, "uuid": "6b60c967-7089-4dd5-ad83-3cf458f20060", "value": "535b771dcc5a0db0c35b284b5bc0e52f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e71eea3d-8c0e-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1700970613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700970613, "uuid": "44550c3d-1c76-47bb-8535-dea46c7c5c81", "comment": "Malware payload (RiseProStealer)", "value": "0fbf562fa3bdc9d3249b523e9d981549", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700970613, "uuid": "3416279e-6859-47d4-9d02-6a773b04b442", "comment": "Malware payload (RiseProStealer)", "value": "1026a00739ca860339392b6247c839f90b9b9ea0bee9965830ada7034c5c322f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700970613, "uuid": "bcd739ca-0dea-4203-9c64-cfee8ea54e4b", "comment": "Malware payload (RiseProStealer)", "value": "dba1c62bddb991113259702be170b0f9437bd6b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700970613, "uuid": "5d6fa14c-25e9-4a50-8740-262015b765f9", "comment": "Malware payload (RiseProStealer)", "value": "0cfca80808fe1b6170b6e36c2659e00ce8efa6c11c2103275ad747f98c7d54b0a483b984b205da8930c9b2ba1767c9c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700970613, "uuid": "6542f64e-5bb3-42d8-98cf-83fc1bbccbf9", "value": "T17545231BA7D4C033E4B4ABB061F302C31375FCA65639432616D495AA1CB1FDAB43A76A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700970613, "uuid": "69ad2671-1610-40c7-a202-a2f90c8484d4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700970613, "uuid": "a7e04600-5df6-40a1-b8c8-03f53aa5236e", "value": "24576:fyQIqBGTu9JJ60g1QUQuAurnhyQMWxHjtmUFTdGY:qQIq8T+JJTg1QUQulAnYDtmKw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700970613, "uuid": "33bbba85-2857-44d8-b91a-fc44e0ed1ee2", "value": 1218560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700970613, "uuid": "da6ecc23-e450-4ac5-b403-bb93e5450dd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700970613, "uuid": "9e5e8e4c-fb7c-4fdc-8099-335e70cd5dc2", "value": "0fbf562fa3bdc9d3249b523e9d981549.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "324b6e65-8c66-11ee-8907-42010a9c0042", "comment": "Malware payload (njrat)", "timestamp": 1701008105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701008105, "uuid": "7414d7f9-b047-4736-b4ff-e1e05b2845b6", "comment": "Malware payload (njrat)", "value": "a650ffe73f9994ad3844fedd49ba10f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701008105, "uuid": "e0353257-13c6-45df-88dc-226dd4107c02", "comment": "Malware payload (njrat)", "value": "1064502587b0806ba7b4c026520f1774e8b9446c68e511cf3edf1850132ae699", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701008105, "uuid": "cb93bba2-d49b-4534-86c4-3726ac781fae", "comment": "Malware payload (njrat)", "value": "958e2c74bdf856eeb7ca4dbbf9ab746d1c85e712", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701008105, "uuid": "211f9c0b-c46d-49a4-a800-1f0fdbcfc38e", "comment": "Malware payload (njrat)", "value": "57e84122119f43ed33731157bf366ca2d835e87c492877fe8ce299d95ffafc4830ba5b1678fa3f83ea31dbc45efe9b8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701008105, "uuid": "9da36f0d-ba22-41ea-aa30-616075bf074e", "value": "T1C8F22A4D7BE08168D9FD067B05B2E4130776E04B5E23DD0D8EF2A4EA37636D18B54EA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701008105, "uuid": "83ec6958-9376-4e6c-be0e-097a14b0e0b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701008105, "uuid": "13babfa6-f184-4415-aa8d-c80f9ce5d17d", "value": "384:OOtvEiTbTvpWNcZ0y8fvCv3v3cLkacpjrAF+rMRTyN/0L+EcoinblneHQM3epzX6:7t7TZ38fvCv3E1c1rM+rMRa8Numzt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701008105, "uuid": "fee77ee3-2ac7-4eff-9919-8df148e3671b", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701008105, "uuid": "f6bff19d-b8c0-4416-a3ec-7192e9e334c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701008105, "uuid": "c17372c9-b0c4-4ee5-8aec-2cd0a341f355", "value": "a650ffe73f9994ad3844fedd49ba10f3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f83e7fbf-8ca9-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1701037213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701037213, "uuid": "07d82978-2c4c-40d1-8bca-1b809235c63b", "comment": "Malware payload (RedLineStealer)", "value": "965df80c52bf0921a65cb460a179effc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701037213, "uuid": "1f1fd3a6-6499-4eb5-968c-1cf0e52f17d3", "comment": "Malware payload (RedLineStealer)", "value": "108bd316bbb0a3a800206928460787bd32da0d99b3f20e031cc5c814c3632cda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701037213, "uuid": "17ce5e59-1812-4023-ab15-8f5e8ebab976", "comment": "Malware payload (RedLineStealer)", "value": "eacc53c98e704a4933b13a152e7569753dbda73d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701037213, "uuid": "67b9a9d6-e4b9-494c-a22f-90793d8fd343", "comment": "Malware payload (RedLineStealer)", "value": "524aff81876b9c989163c972cc514bc4defdb2636c7d904fc1ffe3eb207178017c62b29d86e0183a006e92df3ed7ec4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701037213, "uuid": "28433c56-32c7-4e53-949f-a7c7460ea794", "value": "T11E35231BF2E8D133ECB113B055F716C3077BBC9B5DA9432A2694A6151C71AA9E43832F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701037213, "uuid": "a5bf4dd3-1591-4219-b736-34d0eff6ebfe", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701037213, "uuid": "716f49c3-6415-47dd-977d-1db7ec9b978d", "value": "24576:nyHjALSKCxKyaIzQ0g1gUQu9uVK/UDOuDX2AFg+qePFD:yD+tCKtIzlg1gUQul/UVDX2AiSd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701037213, "uuid": "aad66d52-eb69-4a37-a640-ad2bafcd1d6d", "value": 1089536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701037213, "uuid": "1123707e-bbdf-4d7a-9391-50d6d9717a17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701037213, "uuid": "a2bd03c3-0f9f-4eda-afdf-00271cbef685", "value": "965DF80C52BF0921A65CB460A179EFFC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd09a1fa-8c97-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1701029410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701029410, "uuid": "39c213e4-d953-438f-8429-ad567b6220f9", "comment": "Malware payload (RiseProStealer)", "value": "cfd56c64f0f5c2314538cec6f48f82bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701029410, "uuid": "29c58494-2324-4c5b-8a8c-d29df41dea70", "comment": "Malware payload (RiseProStealer)", "value": "10fc82fbefec4a3a41babb8b30a6ef883a8d41221a546c85e72f8d9297218df4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701029410, "uuid": "d9ffacca-18c7-4f27-8d12-00c853fb2f28", "comment": "Malware payload (RiseProStealer)", "value": "046de6d9fb5f9901be84a042ab66b586be484a28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701029410, "uuid": "f9482a42-8111-4663-99c4-6d4a32c1a8ab", "comment": "Malware payload (RiseProStealer)", "value": "62d004b3f975f30865cf8eab85343b1f3eb400bfa4656907c49f15fe3caee7f93ad9c09c65ba897dae94d75f58c95c16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701029410, "uuid": "949a8361-9e64-4cce-822a-56b0ee3f2589", "value": "T1B5852382B6CDD427E5B82F7058B713231F3B7CA1B9F4A1277219B90A2D53204E4B675B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701029410, "uuid": "05ae16ae-561f-483b-87cd-aa4a129ae633", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701029410, "uuid": "d1fb5d51-7b32-4616-98f9-11e232905131", "value": "49152:2BHiK4t1O2jA4nOqWtkMCmAAY+QFs2Pz:2CK4bVtkpG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701029410, "uuid": "f9149035-e12d-4fd9-a32e-42eb17c6dad5", "value": 1771008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701029410, "uuid": "dd13c74d-0250-4847-9d8e-e4a8ac1d54f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701029410, "uuid": "42a3f711-c0d1-4b29-bca8-1708324a7780", "value": "cfd56c64f0f5c2314538cec6f48f82bc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcb0ccb7-8c76-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1701015316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701015316, "uuid": "f68c5648-8eb3-4b76-b745-63886210df1e", "comment": "Malware payload (Stealc)", "value": "a78c881bf8c930fc5db3dfbe27920190", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701015316, "uuid": "be3adc0d-66b3-4ef3-b78d-cd7a7b4dcc0f", "comment": "Malware payload (Stealc)", "value": "112e5f2e5c1643920242b652487945e7fba17ff98e864dbad5b2535045d940c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701015316, "uuid": "9a71433d-f230-4c3c-bafe-d581a2e2d8bb", "comment": "Malware payload (Stealc)", "value": "3bbea7c27521218fede6e8c2ccc41763f26263ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701015316, "uuid": "fa8cb67d-dd59-48b6-97cb-1d79aa542ca8", "comment": "Malware payload (Stealc)", "value": "bd0289908b878952b6f72a9961420bfe0b6661d41d562d49207ca2c5e448ad8b3935894f0ff55f1b3fd3bb79a373a622", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701015316, "uuid": "f62f1aac-a375-4a3b-9c41-1a17ac6075df", "value": "T14254D60382E13D41E9368B729F1FCBEC7B0EF6518E597BA912189E5F04B117AC263716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701015316, "uuid": "79655724-55db-457b-9d16-5b021f00eb82", "value": "b79e8a13f3e64db949ba21efd0faecde", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701015316, "uuid": "50855071-c765-4f48-b241-902a52529eec", "value": "3072:UNvFPgAaFzutLnrZ9QRoGJuvTmFkHRTQ1vsZSURTOQj+bs:uvVgVER9yHzFkxTbFRTg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701015316, "uuid": "3000ef06-0674-4790-90c2-b15420164319", "value": 298496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701015316, "uuid": "2307e165-9c8d-44e5-a803-747b16991dcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701015316, "uuid": "fc3bb95d-f59b-4e30-983d-d14a6e253f78", "value": "a78c881bf8c930fc5db3dfbe27920190.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ceabd79-8c8b-11ee-8907-42010a9c0042", "comment": "Malware payload (MarsStealer)", "timestamp": 1701024041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701024041, "uuid": "4a96ff05-10d3-438a-8c4b-a858389a3805", "comment": "Malware payload (MarsStealer)", "value": "38512d57e3fd2f6aa82b09ff63e42fe1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701024041, "uuid": "0670e282-91d0-4b60-bb2b-0e39922da027", "comment": "Malware payload (MarsStealer)", "value": "112f97d7c003ffb148b0c0d7e539c813bfb41ca6838aaa9901348894485eac02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701024041, "uuid": "8cc9419a-2824-4c11-be8c-60092ad7af5f", "comment": "Malware payload (MarsStealer)", "value": "adb9f23d536f76f073a90470abc44c41f69312d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701024041, "uuid": "185829d5-7629-4fc0-85bd-ca1d01c482e1", "comment": "Malware payload (MarsStealer)", "value": "8146e73eb79b6240280af8ba92c5781ffa6c1f0c30dd7bcd106421759f5f76177356ddff85a4f033b007321006216633", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701024041, "uuid": "c73ef68a-2e9f-4930-83cd-4156f2f25873", "value": "T1C954D70382E17D41E9364B729F2FC7EC7B0DF6518E99BBA922189E5F04B107AC663711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701024041, "uuid": "f69d1253-f6b0-4211-8b8f-da92fc362ebc", "value": "1c1cf4a921a5454d88be29284face39b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701024041, "uuid": "e3eed2e7-99f3-4747-abe8-08e63cb37024", "value": "3072:EtetDmSoEPuCC0eP1fc9x71S9Q2KWm4nJ8kF9hrxYd9U05Qj+Is:eetSBEPuCreNf47YX9nJxxrAa0r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701024041, "uuid": "f34b9413-d460-44d7-8871-7900a244a362", "value": 297984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701024041, "uuid": "b2d47e23-41d0-4981-b002-f8bee41216b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701024041, "uuid": "1f56b4a6-0d68-4f7a-aa34-0d3c3adb10db", "value": "38512d57e3fd2f6aa82b09ff63e42fe1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "439866d2-8c7e-11ee-8907-42010a9c0042", "comment": "Malware payload (njrat)", "timestamp": 1701018442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701018442, "uuid": "7dc2136f-615c-4c1e-adff-fd29b9f42400", "comment": "Malware payload (njrat)", "value": "b98d7cf5b3dca9a05eb13599b003c14f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701018442, "uuid": "1ec6c98c-80bd-40b4-a610-553ce26fac6e", "comment": "Malware payload (njrat)", "value": "116152ecab73bbd46021c75c7febcf15926e294e1c2360cba3e4dc2b1b575d77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701018442, "uuid": "bf64325f-0ea6-4b87-85f9-7dfefad55816", "comment": "Malware payload (njrat)", "value": "66cfab9c3ab32becec8111d396936e450af76e33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701018442, "uuid": "1dc98ba5-fcc1-4c86-9be5-9d3b2d241858", "comment": "Malware payload (njrat)", "value": "cafa4f20a98e20dfe4d0ddf1c20b69b2b9237abccfa35da71f69e2710b1e9412cc01852000a563363154c384275ab4a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701018442, "uuid": "345d3966-814d-49af-b787-d219873def3c", "value": "T168C2195D3B908166D2EF2BB006B2DB2502F2E10B5A17EB5F4CD844FA6B773C14D819E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701018442, "uuid": "9aba61a7-43fa-4dc7-8192-f52a9d220571", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701018442, "uuid": "ca301b49-77e8-430c-9ee1-636ad51e6a6c", "value": "384:xLd6cufEYAA/XgWeyoHzCYe/iBY2OzRLTm3yilqr63+bMqtVvGD:xl8AA/6T5e/gsEKVvGD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701018442, "uuid": "eed5d169-fd72-47c6-a5f6-4ce08c6b3585", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701018442, "uuid": "e76e14e8-ac3d-41c0-bc97-bff7013018f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701018442, "uuid": "f9aa418c-dde6-4a34-9c7f-7409a7ea9612", "value": "bRSH.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd91a6ba-8c3c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700990353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700990353, "uuid": "3a609bb1-5248-4e8d-b84e-62f7c4967a22", "comment": "Malware payload", "value": "9d9904e7eb6759fbc3b88de3ee4ff0d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700990353, "uuid": "868ff4d3-5747-4aed-934c-abb4051586fb", "comment": "Malware payload", "value": "11bc95ae86743d11f613ac499036c60695fd64d30a94702e03338b04b710722b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700990353, "uuid": "ded361b2-bf47-40e1-946f-d2da9fa8c264", "comment": "Malware payload", "value": "5ad7e12df264bbcb8219b3601e5f23221dae55f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700990353, "uuid": "143ab3eb-6833-416d-826a-fb816167e37d", "comment": "Malware payload", "value": "c9cdaec50e07ef516f4a37436b63ef683e9ece14b8c23da7906cec6caa33979f5ef277d3d93f7b0bd15a6144b6bb77fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700990353, "uuid": "be72e376-1fce-476c-8d7f-78ce02759028", "value": "T17D958D32B9D0D077C93317319E8D736A72BDEB704B35528762D55E292DF04C2A92CAA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700990353, "uuid": "122ddd93-3b57-4c0e-b289-65b2547ce5d5", "value": "6b1ffe90ad110476cf5c441fe5eab249", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700990353, "uuid": "abee8acd-7246-4678-b63e-89779f72d3cb", "value": "49152:13YY1TeIqzMBjkRQjmxhDtzkvlpYbBTKPiD+MlnUj3:137eIqz6g0mxhDtzrbtKPiD+Ml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700990353, "uuid": "5908a517-cbc0-4987-b887-3463a67acc13", "value": 1944576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700990353, "uuid": "6a032bbc-f94d-4b20-b0e1-048cea2bccc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700990353, "uuid": "c9e5d0c8-9528-4c18-a49d-f8f264cbd130", "value": "9d9904e7eb6759fbc3b88de3ee4ff0d2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50a4f81a-8c04-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1700966065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700966065, "uuid": "cdc3e027-8722-424c-a53e-51a6fe28cb87", "comment": "Malware payload (RemcosRAT)", "value": "2c9f623c0e04ed8cee89b3d24d57252a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700966065, "uuid": "d3a2463e-b5e8-441e-b2c4-28059219c56f", "comment": "Malware payload (RemcosRAT)", "value": "1296d48e01eb21917aeacd0a70eb0bcccc53752ac6ce6bdc97ed1dcdf3298cb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700966065, "uuid": "a83d23e0-1e99-452a-8bce-f7e6fee24b84", "comment": "Malware payload (RemcosRAT)", "value": "2fec48c126059353981a0df2a74b8cf0a08341c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700966065, "uuid": "8bd69f70-617f-4ed3-ad66-7568a79c0650", "comment": "Malware payload (RemcosRAT)", "value": "91615fed5ad52c149fe5ca2d460955a23d3118731ea800630f2f7b36fd6512148d67f82199503d13326355f4bf1a8c52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700966065, "uuid": "6c2f3b0c-14a6-4454-95d6-187b0266ee8e", "value": "T144B49E01BAD2C072D57514300D3AF776EABCBD202826497BB3D61D5BFE31190B62A6B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700966065, "uuid": "34a73f13-6fba-42e9-8be2-b731f543c684", "value": "8d5087ff5de35c3fbb9f212b47d63cad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700966065, "uuid": "c4fd0359-3ab0-4dfb-85d8-dd447a41408c", "value": "6144:2/7iPrcL3ArwhBq7Kjsn9iHGXg0lwGS9MNNhdFvPxps9gsAOZZuAXec7Wo7ov:2/uPq3AfK496Gw0lwGXN3pvs/Zu28v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700966065, "uuid": "019ec4a8-f349-4a6c-adbb-779237eae63b", "value": 494592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700966065, "uuid": "e3ed7b66-959c-47e2-b7e5-126a5efaa63d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700966065, "uuid": "b3e5c7fa-2a0d-4701-bc64-977f92972ced", "value": "x4vHvrR5KfYz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52417f25-8c7d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701018037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701018037, "uuid": "6d2d22f6-771b-4d3e-becc-2ff2aca19014", "comment": "Malware payload", "value": "3610e8e2807dbb278d023de198076f6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701018037, "uuid": "5181e0bf-253b-4df5-b6d5-34442e46c347", "comment": "Malware payload", "value": "13a00ac5c9f88febef3a823f18e372ea29d631d28907394d14be21872536b494", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701018037, "uuid": "b31ac0b4-ad1e-47d2-ac7f-f1293bbb3c7a", "comment": "Malware payload", "value": "74398f842aaa8230854ad37142931463447c8a02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701018037, "uuid": "a9feeac8-3c43-4c9d-994f-b2ca84083a8e", "comment": "Malware payload", "value": "fd5abc3b042f3aaf3c6b0ebe1d83fc4b7e0100c0c71c2264d0b0fdb76ceaf2deb3e47b0f30262cd9e3d86425064f46ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701018037, "uuid": "bd4c76f4-b8c0-4e47-a777-4467fefa17a7", "value": "T12F7343A1B216CD98EC4657B10C76962010776E5C88E9E50D30EA3F2F77F33532867DAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701018037, "uuid": "59fb3c58-aef6-4143-9d38-3d2e09d38211", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701018037, "uuid": "8c0af342-b3de-49de-9825-b5a47365fd68", "value": "768:8KADWfMy+9GSU2Ip4jBqltCF0AxEjenoB69+Fx:DADV39GSFHBWAxEjc+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701018037, "uuid": "95d5dae1-5ac9-41ba-84ca-48f98389eb7f", "value": 79872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701018037, "uuid": "2f09a6c0-e44e-461d-9e1b-a9e4406711ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701018037, "uuid": "2fa64e7d-fe67-40a3-8130-a667dcd99184", "value": "documentpdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dd6bcf9-8c7b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701017305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017305, "uuid": "44581137-e5c1-48ee-b22e-5d9cd493fd3a", "comment": "Malware payload", "value": "d74756112bff9ca83b06cee9eb64a745", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017305, "uuid": "a81f3727-6604-4954-86ef-d328e05eeaf7", "comment": "Malware payload", "value": "13aa728816560a3027589dc2adc58735238ecde498bd032ad7075041dc307141", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017305, "uuid": "7caf47d4-5291-4fde-825a-e28b65b14bbc", "comment": "Malware payload", "value": "0b446420118fee3e637820302b7c4f87963c0696", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017305, "uuid": "40e3f604-23e6-4c74-ad49-39648fc034b2", "comment": "Malware payload", "value": "34431547a6e1f3abf2abc935a7632d982b53fc3e86d6ac9109b9841965f642ed85410336598112732d029ea5c54e4f76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017305, "uuid": "72ccd26f-85df-4e45-a878-23c9c20665fd", "value": "T1C6466B36D7852236CB8EABB8B725FF1A648AD2D27154B249790C7CE10E1C7254CF4E78", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017305, "uuid": "345ba436-811b-4b3d-ad36-86c30da238ff", "value": "3e108abbf5b70ba74c91cc0339a005dd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017305, "uuid": "31af545c-70ee-42ed-8031-55df70f2dcf3", "value": "98304:X7aOak1GMCI59TNQ68qfsnX511hJkAhmbxSt8TPcltMiEbC:fa909TNhfsnX511hJkeWItCkgi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017305, "uuid": "ccebb36b-c9e7-4ad2-b444-25162946b2ca", "value": 5552128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017305, "uuid": "0200de54-6f71-4e6e-b547-4eff0218b47e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017305, "uuid": "6ba36bd0-ec20-402c-bba8-f6cc1d02a90c", "value": "d74756112bff9ca83b06cee9eb64a745.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e537e54f-8c7b-11ee-8907-42010a9c0042", "comment": "Malware payload (PureCrypter)", "timestamp": 1701017424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017424, "uuid": "2e8da202-0334-4aac-8b80-2a2a7874dfc9", "comment": "Malware payload (PureCrypter)", "value": "58a6acecabac60d31bacdd30909101e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017424, "uuid": "ba7e5157-dc36-49e6-bfe6-86c820249cbe", "comment": "Malware payload (PureCrypter)", "value": "14b6181455c3e32793109b986099e80ccefa68fbc48b0fd5d07beb5cd4cc4520", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017424, "uuid": "1f59a6f4-5fcd-4ac9-af4c-f7ea232461ad", "comment": "Malware payload (PureCrypter)", "value": "f6c9c618ee74853355446711b64dd72f853d5297", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017424, "uuid": "cd4eeb76-57b8-4959-8c7a-ff1d30d45584", "comment": "Malware payload (PureCrypter)", "value": "521daabb44f3234ef80c7d50397d04dc6a526a162915215b416092655c776414b1cd18d9a899832bcbcb9a02f7cc2023", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017424, "uuid": "04565abd-a52f-419c-a007-2ca0a5449602", "value": "T1ABD33B4AE3B68A22CBEF1679F4E012001F71EDC56022F34B5AE865B52E533561F2536F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017424, "uuid": "f9251d2c-bedc-4633-a480-beeabe13ff19", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017424, "uuid": "82ac6b2b-aaa0-438b-8f35-88d0b34bd6c9", "value": "3072:YWpyRowPM+sfHoPIaPQuF5Bcd+NlBvCL:JUowPMPfHAbPQuHBcAC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017424, "uuid": "60b3bed1-15ff-4d2e-94f2-0617be7912e5", "value": 141312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017424, "uuid": "8670e0e8-f585-4fab-8bd8-28b46527548c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017424, "uuid": "b2fe99f4-11d0-4e26-ab5d-8d030166d359", "value": "Rsunmug.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1676ae4c-8c7d-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1701017937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017937, "uuid": "4bc2c280-7517-4bf9-b1cd-f67604193b47", "comment": "Malware payload (RemcosRAT)", "value": "30c8e46ec1ba7ff9c5a7649ff3486154", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017937, "uuid": "ba6ee550-52d6-4a30-ba0e-5c01594203c7", "comment": "Malware payload (RemcosRAT)", "value": "1592a15da607057998d44258e4892bbe0191a9fb4b0f688b9ecb8112016d387d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017937, "uuid": "11e6d890-9572-41f0-aba0-ab0592ff0f87", "comment": "Malware payload (RemcosRAT)", "value": "78958757d99fcba1ba7e02b1ebc38acd9cc57ed0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017937, "uuid": "e500ce80-12d1-4433-9e0a-159891fb96cc", "comment": "Malware payload (RemcosRAT)", "value": "b67cb9725f10e3d12554c7d69acb715fa39158571eedea8d35bbc2ba276882b88237778602898bea197cb1a688a80ce6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017937, "uuid": "0793a0af-2561-414b-bdb2-145796c5a4bd", "value": "T18615233D565DBFDAE0AA43FB4E34DA0057F0AE351521EA44AEC136C246E8B607B71C17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017937, "uuid": "7189bb02-971c-4aea-ae7c-9f450f4cadd6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017937, "uuid": "5707b832-da19-4da2-ab80-a37f66320bd1", "value": "24576:gtD/hHuQJIXisepH1+9TwNjPKhuBh5Q98UrV3tEN:Mhzug+8NjPHe2UR3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017937, "uuid": "44e8ee2b-ad25-48be-ae2f-6811f6dcad59", "value": 959488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017937, "uuid": "a6794155-db45-459f-bd3c-03c8def6ccfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017937, "uuid": "70b8928e-9cb8-48a5-a0fe-7c2eae7afc21", "value": "\u0110\u01a1n h\u00e0ng m\u1edbi_Randall Parker Food Group.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d94fa0a8-8c1f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700977891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700977891, "uuid": "2fb2a83e-bad5-4f32-8a99-2d5b00bcb74f", "comment": "Malware payload", "value": "25b7db2e9639ba61450f5cddf04fa4b5", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700977891, "uuid": "c44d0f75-ee74-44e3-8017-52b657a5d937", "comment": "Malware payload", "value": "15a05098b91575cb0da6964367040dc8a0051a4fa8a0db4d26fdb8aaa570ceae", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700977891, "uuid": "213d3b88-85c9-4c59-9a41-b2172e56d0e7", "comment": "Malware payload", "value": "f044a30b2b2f46b19dc373e56e391caa9d9fe5b5", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700977891, "uuid": "0a8e6c00-465f-4e0c-9e8e-0fb2e23161d7", "comment": "Malware payload", "value": "8b26646e5c43d4264482135e5e4b026c965d50108a5eed1ee465ee505a0952191c10cd66dc5e50d1a969185d406ed6f4", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700977891, "uuid": "0a60cc9c-d882-484b-ad2f-6d7e65e1162a", "value": "T1CE06F111FFD8995BD06FA372E5A307214FB8E8967263E78B495826D60C223746D013BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700977891, "uuid": "39451057-de8b-4e94-a28d-4baba35dd72f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700977891, "uuid": "afae7c42-58a0-4928-935f-0abeeb00af85", "value": "98304:3w9lSvzZOK2rOqoD4OUhUelI2ckBvkBk:3llORrODLUZqwvk6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700977891, "uuid": "a7494a29-161e-4c30-acc7-df1423aa475d", "value": 3858432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700977891, "uuid": "94aa0608-f02a-40c7-a32e-3f102e167e04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700977891, "uuid": "feeafc87-0023-4569-a622-69e6f3a00009", "value": "25b7db2e9639ba61450f5cddf04fa4b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5613603-8c74-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1701014418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701014418, "uuid": "9dad2580-2b1e-4fe4-ba98-9214c9477ded", "comment": "Malware payload (Stealc)", "value": "bee143ff3b867899472a1d6640360682", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701014418, "uuid": "f91c16af-5c25-4b4b-873d-f09383930c86", "comment": "Malware payload (Stealc)", "value": "15ab37d82d91db75183a0aea6b5d022e6af153f951184c83ccd9284ecf937568", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701014418, "uuid": "a9c10536-b598-4396-be8c-bd77b749a7e0", "comment": "Malware payload (Stealc)", "value": "fd2a36a742382fcf42ff6b9289a3ce6df179fd08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701014418, "uuid": "8a76203d-6943-4921-ada0-ed78fbc9ed96", "comment": "Malware payload (Stealc)", "value": "bc5437e87f798b3fc5087dfc078d8970371865e6b866e189521707159d360cf47de0893992bce26201d00aa59366d3eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701014418, "uuid": "44b4124e-f80c-4ce5-87ba-ab03defe383d", "value": "T11054D40382E13C45E9368B369F1FC7EC7B0EF6518E59BBB912189E1B04B11BAC663715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701014418, "uuid": "ee510258-5565-4439-b6e7-689bfb2c4f83", "value": "92d94b459e4f1d52bbe65f88efe1e480", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701014418, "uuid": "c19dd4a9-fe88-45e4-b0cd-31f57971a347", "value": "3072:1NHbhC+iaZwpaBXNpMzKJ0SrSw6yrWGOJNjsZEUwQCkQj+bs:bHtC+imueXrMzc0S/6yrWGKyPwQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701014418, "uuid": "71ceed2c-7c54-48e5-b762-901f9c8fed7d", "value": 297984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701014418, "uuid": "e6a21fa6-2b1b-4df5-bb5d-f10511e08576", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701014418, "uuid": "c4e20b3b-161c-4a68-9a70-db7f87e5330c", "value": "bee143ff3b867899472a1d6640360682.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffda7a8b-8c89-11ee-8907-42010a9c0042", "comment": "Malware payload (StrelaStealer)", "timestamp": 1701023482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023482, "uuid": "d8f9e691-9d3f-4cfd-a712-ddbadcb6caf2", "comment": "Malware payload (StrelaStealer)", "value": "8e75c8837c8288c2abd1c4ae364bb553", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023482, "uuid": "851a7337-807d-4a9f-882a-731e882f7228", "comment": "Malware payload (StrelaStealer)", "value": "15cacb4f952177a2bbe3834a8c2217aa6ef5b78a8cd8af42ada9ff5a992292fc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023482, "uuid": "42765f3d-d508-4ec1-9b2b-40947a17c5c4", "comment": "Malware payload (StrelaStealer)", "value": "5cf4550318b5f2eaca312149f06f5872f531785a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023482, "uuid": "5790175f-d57b-4a86-8968-8d9fbde25b30", "comment": "Malware payload (StrelaStealer)", "value": "28b0b7403eea0d1b9daa39a56e128672b88bdf6ed0ddf64622c8ed9794f65ac5199f772567b55356e0e4bf10afbf6bbf", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023482, "uuid": "8aae587b-9c66-4d72-8846-f5b338a8f136", "value": "T10E6619F07661BEE20F74181DF38F40B63D27B85AF0799E8A32162A5DD6C4244E6E6D70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023482, "uuid": "140024e4-b914-4ccb-b341-358889ca2e2f", "value": "24576:aM28t5oydiys4k1XWk6uyBWXJCirWqXNGLH5HvuVLptpWqm6xVowk8dppKEvzVBi:Ns47TiwQ5x2uA1Y0fm1nmlUiUbUN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701023482, "uuid": "1cea18bb-fb4d-463c-9392-f761a2635269", "value": 6790440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701023482, "uuid": "6990307a-7dd2-4d3a-a8ab-b7632d0968c5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023482, "uuid": "31fdf7df-4659-41df-a0f5-19bcf8636545", "value": "11074822014705.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca564699-8c8a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701023822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023822, "uuid": "6e231861-5ba7-48df-a02c-3985e8cf3ada", "comment": "Malware payload", "value": "0724c46c9113a19c8efac3e09e9f785c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023822, "uuid": "e51358a1-7a42-4d09-9813-f9e1d479b0fc", "comment": "Malware payload", "value": "171012ded58cbdb879e7263076d98af6a6da882b0aaa21205d040c91ff32cf29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023822, "uuid": "090b3579-0c40-4a45-97c2-e3ce16f2f436", "comment": "Malware payload", "value": "0e79414f1dd62fa60b7292aeec07477e35fc2cc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023822, "uuid": "2d10914c-f40c-4b3c-bc92-fb7b4d9a5dcb", "comment": "Malware payload", "value": "75465b6a73d804eef309d9016ac95f9e8f46f7d978a3bd391e37ef7b98412565a7c3a250e6533e8ab11548bf659361b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023822, "uuid": "2bb7ee0a-fc32-46c7-aa82-320d30dfe706", "value": "T1D8D533A379EAE836E4B954B86B946954C33F6ED0DF720B466CAC1F050F73870981871B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023822, "uuid": "0e0f9abb-ba8f-46b2-a054-417c79adff53", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023822, "uuid": "4486eb15-7970-45af-8618-99a1a1de0908", "value": "49152:72aAwjmznffYq4ZXMyagsNeBl+xNKAgcNSjTb5VMTVScq8EdyjdRY0E:SUqzxWMqQeBl+zDQbPMhSpyjdlE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701023822, "uuid": "5c52ca7e-6aa9-4872-9c60-82cf2c4a982b", "value": 2888150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701023822, "uuid": "fe0acdbe-0070-42aa-8b62-c0f62df7956e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023822, "uuid": "d11e121c-8f70-4fa6-a3ba-139ae0b316fc", "value": "0724c46c9113a19c8efac3e09e9f785c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60f5b7d7-8c88-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701022786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022786, "uuid": "e3501de8-229d-443b-9e82-d2325e0ddb19", "comment": "Malware payload (AgentTesla)", "value": "69e5acf01035fec083b4026d0e5b40ea", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022786, "uuid": "ec74f803-81fc-45e0-887a-08ef059f0bfe", "comment": "Malware payload (AgentTesla)", "value": "171bb3a32643bf34a6f444b876178e38f519f4b6ea527226957029dc29e6056a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022786, "uuid": "cd1863f1-6828-48c1-be13-db760a5a3a47", "comment": "Malware payload (AgentTesla)", "value": "034965c2a3d89abbf3860cf28f75ac537b77fe3e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022786, "uuid": "b9c553a5-8d01-4abc-812f-c2a0e28bbfde", "comment": "Malware payload (AgentTesla)", "value": "19e252abc616c8efc298b1da03628edc59ca4947e8bd2cb9c169f4e7a57add55c64118586eb0193073f37a2aebf1b839", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022786, "uuid": "dc167355-24a6-4168-abb7-a164ff34a203", "value": "T166841211BFA1D927C97205734E721763DA6D5C7228A4DB6B2380FD5E3C722D1A22E3C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022786, "uuid": "8a49af3d-8b41-4c76-b7a8-2075ce9e772a", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022786, "uuid": "a2ca542e-a1fe-4544-a1c0-931f1a1a35e4", "value": "6144:ficFyaue+c+AlzcnvVRkBTAgExMX7f2VO2Nhg0O9vm887zWTwvb8FlUw5/kC:aGB+Al4nvVRk+ArfOCJ8XW0Dgl7/p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701022786, "uuid": "804ef9c1-c5e9-482a-a89f-3f628a078f8f", "value": 374391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701022786, "uuid": "8b12a11d-493b-4589-8f26-96ffff8403e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022786, "uuid": "8c513826-42f5-4d51-bbec-5ad46c1d29c8", "value": "htbSIV2410401.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1178c24a-8c89-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701023082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023082, "uuid": "1c8bd182-cb2e-4bea-ad62-7004f7f140ef", "comment": "Malware payload", "value": "d70197852e8577d4cb1f0dc8695a4337", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023082, "uuid": "cd63f158-a53d-4c15-b740-3e1f61aa100e", "comment": "Malware payload", "value": "18408ab00fb2d0aecc9a6f65e1fe9510627e59274d954b135f69da34ac56579a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023082, "uuid": "d3345e13-b472-4c2d-abd8-96ab9e0f79f0", "comment": "Malware payload", "value": "93d3d0801a219e08277d02276edd9cc7fcfe1cbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023082, "uuid": "938f00b8-752f-41d6-95fc-941668b9d0b8", "comment": "Malware payload", "value": "f6ee092a4b00923967c8c44457caa2badf900331f71da784f15105970a8a85b9f93303bb371559cdb52bfbff9efdabb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023082, "uuid": "fc0b0dba-4c4f-434b-8f0a-4f5ad851bcce", "value": "T13B25AF01B68282F5E64A197004F66737EB3A96870B22CFD7E7A4DD385C33691E13B25D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023082, "uuid": "e8c4f59a-c782-4458-a7d1-f2b82c93bd43", "value": "de6a340ccaab4aa62f1436825c99450b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023082, "uuid": "b7b0fecb-5960-4595-bfca-673265911759", "value": "24576:iM02vFb1W0ZJdlevZPamfhE/Um7D1fUggepjfJ+gaELmeZS:iM02vFb1TJAUmfhtIaEJo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701023082, "uuid": "4be0486e-6a60-4720-af79-a8daddd4c36e", "value": 1056768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701023082, "uuid": "3f4850de-27b3-4f1c-9528-88eba03a7487", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023082, "uuid": "32f87209-fb74-412a-ab0a-2c8370bb12d6", "value": "d70197852e8577d4cb1f0dc8695a4337.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd3ffc67-8c7b-11ee-8907-42010a9c0042", "comment": "Malware payload (DCRat)", "timestamp": 1701017411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017411, "uuid": "c3a1fdc9-eba4-4782-8a31-7e7d4815d9c3", "comment": "Malware payload (DCRat)", "value": "aaf4f7396f97237c62122db5ec4031ae", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017411, "uuid": "3f517166-d75a-4ba1-979e-0c6d05440ea2", "comment": "Malware payload (DCRat)", "value": "189a5a34e99c66355da0eb5c04636ac3a06404723cc2de86a22bda42aadeea21", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017411, "uuid": "4d4d8737-063c-4f4a-8cfd-6342f4a739e9", "comment": "Malware payload (DCRat)", "value": "323855282b12d599fe5a31c11b73fd963b373efd", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017411, "uuid": "e6849c20-a5f4-4c4e-9f97-af10a955a745", "comment": "Malware payload (DCRat)", "value": "6722f32e92fd0be31cf5cb1c63c0b68ea9c444b1a7466ee7879e4edd61000b1c520cb6a073f693f9824bcf4ba44e5f9f", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017411, "uuid": "60daf2b4-bfad-4d1e-9e07-32115607f6b9", "value": "T127F5E0053E44CA12F0481233C2EF454487F099516BA6E32B7DBA376E59133AB7C8D9EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017411, "uuid": "c2f8c362-1800-4dd9-916a-884e7386a4a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017411, "uuid": "c600c3d4-2966-4158-85ff-f1b18a135f82", "value": "49152:nC0Fl8v/911bwaEYpdYUVsk3DZGAy55kBsfJGAW6KyWUcPmWQpE:nC0Fl8v/qXYrv5tG9uKJGAWl5N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017411, "uuid": "f703e858-2e77-430e-9280-916a44074b37", "value": 3357696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017411, "uuid": "b9825cb5-5ca1-481a-8f70-172adcc1113a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017411, "uuid": "c118166b-aee7-4714-8190-f2eb96dfe776", "value": "aaf4f7396f97237c62122db5ec4031ae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5287367a-8bf0-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1700957478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700957478, "uuid": "005e8e11-9d5f-4866-bebd-aedf8a744bcb", "comment": "Malware payload (Amadey)", "value": "8df50cf52274c76c80901ea6f29ac7f3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700957478, "uuid": "c44db6fa-4952-420d-a79e-2b91dcfb9cf2", "comment": "Malware payload (Amadey)", "value": "190a3b8cb53cc76a04666d9453d30527902b0ea67d56d6462d9732b91768d106", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700957478, "uuid": "d0c8af29-a890-44d6-840d-10f5c84f6b27", "comment": "Malware payload (Amadey)", "value": "d95b8221dd9054f36775237f164bfd16bf4a4467", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700957478, "uuid": "28f3962b-18cb-4c6b-9645-15422cf1736f", "comment": "Malware payload (Amadey)", "value": "b31266f45003f4a6be6fd6ba2897309e71698a4aeddca2abaabdde028558286bc060da9f55f4cc8347054e855193484e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700957478, "uuid": "1319e47e-f59a-4f52-869e-ebc4d1131f94", "value": "T14E54D643D2E13E44E9268B7A8F1FC6EC778DF6508F597BA922189E1F04B10B6C263750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700957478, "uuid": "91d0f969-9421-4540-a5ed-73795d09ceab", "value": "32e191367f9932caeeb9bed9a82d73da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700957478, "uuid": "e1b30b66-7e8b-48b3-9979-08b441e07642", "value": "3072:usxu5M2SGMFJz+M9E251tCyCa4N1xfepQ5mgYXDR5kVyBk3eFx/RiPB:Po5DMzzZ/nCagfex5XD9+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700957478, "uuid": "08a7ab0e-470e-495d-a427-dae34cc20743", "value": 295424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700957478, "uuid": "880c9db4-f4a1-4e5e-ac6b-4c8e1565a40d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700957478, "uuid": "458c68df-2e08-4f53-bad7-f4d8f983edd2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "374c170c-8c78-11ee-8907-42010a9c0042", "comment": "Malware payload (Vidar)", "timestamp": 1701015844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701015844, "uuid": "3335f8d6-d5a6-43aa-a2f2-168de4d56f50", "comment": "Malware payload (Vidar)", "value": "0c4b93248f879c55af0dbadabbfbcbd3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701015844, "uuid": "07cd5920-f34a-4226-a9a5-3f421372a5a8", "comment": "Malware payload (Vidar)", "value": "193cd25a701fee258502ce638347a3a94ca4dcb82acba581fb3faafdf4dfe9ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701015844, "uuid": "bfa3e25c-5eec-4dfa-8370-d4042cfaed39", "comment": "Malware payload (Vidar)", "value": "28f43c6a01ca3ee74ca1fc05bb37524a63fcc3da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701015844, "uuid": "4babbd52-3cc3-4e02-b335-463450666570", "comment": "Malware payload (Vidar)", "value": "e375fc4034e9f44aa221187819dca6a4cbc0f82014bf5459f0a9d6247ff2afb6aad007446207364afa131ff57f529633", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701015844, "uuid": "ede4a23a-9565-44cf-bf60-d4f7a1f17e04", "value": "T1CB147D6078E2C472D573153508E4DBBA5A3DB9210FA589EF67E80F7E4F302C19731A6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701015844, "uuid": "a1d5a16d-4df9-43c3-8128-c59c7c939b42", "value": "6e31b8e659f913bfd1a348e27e0551f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701015844, "uuid": "b7a3ff31-9505-49f6-9876-8681b497d130", "value": "3072:bc7PTlvaUu4eCdxG7psbiIbhou3QepC/tcIZQjSgbE77mOAg0Fuj0nRgrV9:bsLgCyC513QepUcmZ7RAOnV9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701015844, "uuid": "b71358f3-ff1e-4bc3-828e-140cff92b7e9", "value": 205312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701015844, "uuid": "d55ce291-2069-4134-bac0-125624ecbb34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701015844, "uuid": "3908ab2f-0372-4977-8c90-dea59f46d523", "value": "0c4b93248f879c55af0dbadabbfbcbd3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f67c8dd3-8c3c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700990395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700990395, "uuid": "a5c60417-0cf6-4332-910b-eb1beb32a8e1", "comment": "Malware payload", "value": "0c83780f4e84047cb272c0043b33a207", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700990395, "uuid": "380071eb-2270-4496-8da8-733f4904f557", "comment": "Malware payload", "value": "1962e1ad21afde8f394e37cfc6d5982f170392c59a532da734f5d6a5ea927d86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700990395, "uuid": "db304c26-870a-471e-9cb8-7a2e81e88e39", "comment": "Malware payload", "value": "137ace653701622ac56792c7099b30f285121f7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700990395, "uuid": "2534c08a-a103-43d4-9f22-e69d486dfee6", "comment": "Malware payload", "value": "3d63564e47615df09eff2f22702efaab238423d6915e0c83f5f99c0e04bf7dd94df75e9ac2623a10c89966ad17ba2790", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700990395, "uuid": "4f7f4864-e6ab-4a76-bb8e-353fda202d30", "value": "T1C356BE90FB46C472C1015530A0B2EB69C665BE56ABE686AF32503F3CFE75382395C35B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700990395, "uuid": "2b267045-adb9-49c0-8e9d-6cca388e39b6", "value": "eba6ea3eb54d77d517181e99ff8c9533", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700990395, "uuid": "0ca6d844-add5-4e2e-bb1b-c5e1aa933b6e", "value": "49152:PaQO4TTa/KgEUqdTifVItLc8awm7tjm7SaQO4TTa/KgEUqdTifVItLc8awm7tjm7:oKFg407tjmVKFg407tjm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700990395, "uuid": "d5afca32-eb84-4708-846e-0f082dfed646", "value": 6029312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700990395, "uuid": "c1e5e1c1-612d-497a-adf8-28d1b84bce8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700990395, "uuid": "47f43ebe-f0a1-411f-93a0-86f2a412a8cf", "value": "0c83780f4e84047cb272c0043b33a207.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "658d79b4-8c52-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1700999601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700999601, "uuid": "68c417ef-3641-49c4-a00d-59f55ae0e295", "comment": "Malware payload (RiseProStealer)", "value": "ad754a5d375ef1599c3f4712594579c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700999601, "uuid": "ba69ad5b-bbc4-49c2-b66c-13d268621bc2", "comment": "Malware payload (RiseProStealer)", "value": "1a0bcc06476afba449d62f377d5ddb8140e945c49ccee84bc7728dc49c4d1441", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700999601, "uuid": "77bbdb94-0186-4949-835c-a6fc4b8cc7e0", "comment": "Malware payload (RiseProStealer)", "value": "5e26f4ff18eaa485ef9373573466ee679c522ceb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700999601, "uuid": "ecd48500-7201-4cdd-9de5-5ee2dc84fa82", "comment": "Malware payload (RiseProStealer)", "value": "a72fdda9da2902fe54a2393191fa94c87f33e7732ec9f882e4613fc77bbcb168aeeccd51a1c923f0cca487e7b0831a1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700999601, "uuid": "ef2ecfae-85f5-4281-87df-2353289c8fdf", "value": "T11E658C31FA08D4B6D09210B0916D6A7B91587A322BAF4CD7F3C05E6E41B52D2F235F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700999601, "uuid": "7f0d9ac9-c6cb-468c-b596-c9b281af1cf8", "value": "078471ac5a76189ffe465abe0c89c6b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700999601, "uuid": "f367c2af-eac5-447c-a00f-2d214c0ad0b1", "value": "24576:2opGDjnvrPpkjos0OtjcFc5kM49dj+IuxWQOIjuJuVvhbqL0HtFcgekRP9dT0WNI:OnvrPGT0Egyudc4tI3bqL0NFchaP9dTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700999601, "uuid": "b75520e7-b5ee-4c5d-b553-b0fe3cf52382", "value": 1539965, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700999601, "uuid": "f81f98b0-7421-42fd-aed5-d5001e5f996e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700999601, "uuid": "4a2d9013-71ea-49fe-98df-810b32cbde0c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d64ee86-8c7d-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1701018029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701018029, "uuid": "05cd3680-2ab1-4ed3-828f-0a1eab91b936", "comment": "Malware payload (Formbook)", "value": "a7d3995a758ac04c2b179ba544a41492", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701018029, "uuid": "1e03de22-fc39-4c91-ba2e-d366165acf91", "comment": "Malware payload (Formbook)", "value": "1a4909112720fec4f89f1cf1b6469ce825a93e42e43f2da1e61a3d536f8603c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701018029, "uuid": "bdaf5d6b-6c33-4067-b255-bbb4e4152065", "comment": "Malware payload (Formbook)", "value": "451064733660c39cce20e1fb55445c93e2731567", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701018029, "uuid": "620ef42d-594e-4731-bf43-886c70119d57", "comment": "Malware payload (Formbook)", "value": "eab4d4f8033634a77a2405b4e1775185accbe6b450bdeabf482a6c287248020a1141164dbfb29f5f7561a02201fc1584", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701018029, "uuid": "e42be38f-6c27-4848-8c1f-b58faf1c1828", "value": "T177E412E2B217DDAAEC4746B2082E962041774E5C48D5D40F21E93F3BB3773536893E9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701018029, "uuid": "3a038181-04d1-4a59-9df5-50c19c6c911a", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701018029, "uuid": "5515a7af-9a8a-42ee-a3a3-1c04559baace", "value": "12288:UjEAmDohuWtD28EO1X1KoVyu98jdoPUzus2xTQIkiTWn2e:w1huWtDXEOJ1OkcdoCBT9DF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701018029, "uuid": "1c3d9e79-32b5-47a4-9a08-fcfd0f10fe47", "value": 657869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701018029, "uuid": "bb5dfb72-66f9-47a6-a6a0-fbe4f0043f35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701018029, "uuid": "6e7edcb1-e466-4850-ac70-bafb940e5c59", "value": "PAGAMENTO INV-85732.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b20f5a8f-8c89-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701023352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023352, "uuid": "402c9e97-ae3b-4a06-8194-98eddaee3f92", "comment": "Malware payload", "value": "525bb87165e3c4a621f85344f52e8963", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023352, "uuid": "bba73cc2-30b9-40f6-b8b6-6892624fd169", "comment": "Malware payload", "value": "1a52a4575c64eb604618082fab7db45020c4827df8aa2962905eb8a5c1a5bbd6", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023352, "uuid": "d25d9409-f297-47bd-bcca-c8fe8d0c2fc4", "comment": "Malware payload", "value": "7e5117f5ef343e23030eba6d1be43245de26a08e", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023352, "uuid": "30a4c40b-d95b-40b7-b02b-9b15dcab97ac", "comment": "Malware payload", "value": "2a683f7c971075c4c3f2bda943a3bf30a11864f2f572023f14df07aa44ea2ed31e41307670f6a367f3389467360d49a2", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023352, "uuid": "bc5ff36d-b6f9-46f0-bebb-be2ad30e30aa", "value": "T10AD4230C8F44CA548DCF2868F113259EC9A63AF7029693F636D76838CA69FE45C4F1E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023352, "uuid": "0e409e7a-c8dc-43f7-9a07-1685315e6c95", "value": "12288:Gefd25kasyuJWYtZB5yrfOzSuwYaFkJEN5/SpL4hCRq4S9kwFkOs:vgRVEHZuroSqEqo7G2FkP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701023352, "uuid": "1591baad-fa08-4c53-85d6-f4232d375069", "value": 638651, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701023352, "uuid": "0c002738-4dd7-4811-a66c-e8a69d270efb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023352, "uuid": "dd50e02f-27ae-41bc-a04c-13dd1e8ec066", "value": "(24.11.2023) BT BANK DETAILS.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0b480a7-8c3c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700990385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700990385, "uuid": "be1ebf47-c0e1-4e44-a43d-b4c0519b065b", "comment": "Malware payload", "value": "13d6fcfd40b70dd18841a8676ec9089a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700990385, "uuid": "40c8e603-d477-42fa-99b6-c4e868cb3af8", "comment": "Malware payload", "value": "1ab2cc9808cb96c5eccce714563fba616fdd673b402cf22af1beda998d99a058", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700990385, "uuid": "02eff31d-16d1-459c-90bb-993eb911c575", "comment": "Malware payload", "value": "32c0717006471b4feb35a9d98cd3ebbaff9b4643", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700990385, "uuid": "068474c3-0914-4346-b618-3334ad939e75", "comment": "Malware payload", "value": "d5a336c94300483ea9b5dae25b19bd0f513adaf88ed81983f00fcd40a0e56ce55c8b0e370d90fe24793551db8acca916", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700990385, "uuid": "f717b17e-9008-4885-8c29-7fddf7a8dd1d", "value": "T192858D32B9D0D077C93317319E8D736A72BDEB704B35528762D55E292DF04C2A92CAA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700990385, "uuid": "3f19235d-f91c-4167-9cfb-4b17240f0643", "value": "6b1ffe90ad110476cf5c441fe5eab249", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700990385, "uuid": "30235448-1163-4446-96f2-015c357ec082", "value": "49152:g/YY1TexqzMBjkRQjmxPDtzkvlpYbBTKPiD+M2/+Ujga:g/7exqz6g0mxPDtzrbtKPiD+M2/6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700990385, "uuid": "3ff67860-48b8-4f05-9f77-f0dda37fae03", "value": 1842176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700990385, "uuid": "c41fb654-2d2e-4b28-9921-ad69b1cbaa79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700990385, "uuid": "a276d4fc-426f-4c85-a8ad-e8390fb642f9", "value": "13d6fcfd40b70dd18841a8676ec9089a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7c64184-8c3c-11ee-8907-42010a9c0042", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1700990397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700990397, "uuid": "4da50ebc-92af-4d57-ba68-d575d63615a5", "comment": "Malware payload (RaccoonStealer)", "value": "1dfc25b41bddbb8f77db2e932d521aae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700990397, "uuid": "90dd5553-c629-40b2-83d5-26a78a7807cc", "comment": "Malware payload (RaccoonStealer)", "value": "1adbec6750be50faf1e5f8cddf9d0555afbe1a21289013cac49931004ffb8547", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700990397, "uuid": "fdf64613-e248-4b48-8c9a-ef3de02943b4", "comment": "Malware payload (RaccoonStealer)", "value": "12e919f0c28f95fee382509b21d5fddd0af08132", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700990397, "uuid": "8ced8468-392d-4039-874e-9cfb841ff98f", "comment": "Malware payload (RaccoonStealer)", "value": "8d8023da2bc1430fc5bd9b8fc7d098bc1bd981d15171fd8235c0826610a0549af24b3e1b5ea40c62e1eb2f63606e60f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700990397, "uuid": "451287d8-f1e0-4336-8ecb-99e7da1e921d", "value": "T17A7602A0FB5BD472D1425430A0B6AB688AA5BE13A7E6855F33603F3CBE353C2355C356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700990397, "uuid": "06e9a8e4-9a18-4f2b-b285-7ce6968019c2", "value": "eba6ea3eb54d77d517181e99ff8c9533", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700990397, "uuid": "89d97692-2330-4e99-9a41-d2463ca37ccc", "value": "196608:8qv2hFs8ZSVVwkUGc/1/PxDGbfH/78407bm:zMeuSV6kUGqTGbfAv/m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700990397, "uuid": "e813c112-b1a4-4a7e-8a25-692af48cc722", "value": 7177216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700990397, "uuid": "923fdad1-ffe6-44dd-ab16-3fa7ec3efb7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700990397, "uuid": "a04bd845-5155-4ee2-98a3-13e0c31d90b0", "value": "1dfc25b41bddbb8f77db2e932d521aae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fe912aa-8c8b-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701024153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701024153, "uuid": "1a6873eb-90a8-4829-a2b8-eaf8d2477424", "comment": "Malware payload (AgentTesla)", "value": "d2bdc91605309ec56123e40679f4cbdb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701024153, "uuid": "0c6c3e24-398d-4f73-805c-b3767b3fdd5b", "comment": "Malware payload (AgentTesla)", "value": "1c0b0cfca9a02707a6f7510c8b47e4769b7c6871f9525c24145bd47e3ec2209b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701024153, "uuid": "31558164-5a45-4880-992d-f80180d65e25", "comment": "Malware payload (AgentTesla)", "value": "0a6a90c8394c3ab3aacd056faf6583558b6772ee", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701024153, "uuid": "aebb51f8-4dca-427a-be34-28506b53e638", "comment": "Malware payload (AgentTesla)", "value": "3c34b293db61aa8cc92c7477b2dd48e03f03670f60f6a48e7fa89e5b39f85cb35f43b4aa8bb9cc34c13eb8159fd8d5eb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701024153, "uuid": "db9245c1-83a8-4aed-846e-76913226fd0e", "value": "T132E41223266E9FDBE55B53FE0820601863F0BD36A824F96C6CC231DA4AF5B51DF11953", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701024153, "uuid": "f052e5de-063f-4b96-9ec6-a32565f6cd18", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701024153, "uuid": "11914370-3988-4523-804e-9fb749772943", "value": "12288:NE6jD/DdqqTyl3MLLKrtHe4pAPxDiWgpen6R1RU1iyBQ2kbRBU4nmS9Z+IHyENzC:NtD/RRTEcLSt+eA1iWgpen6R1RU0yBQC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701024153, "uuid": "011863de-c8c6-47a3-81eb-7c395c0202f5", "value": 694272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701024153, "uuid": "0329fe89-fd18-45b9-a31b-47c508b33542", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701024153, "uuid": "b5054e16-ab20-4d0a-b7d9-9fd002f1c383", "value": "d2bdc91605309ec56123e40679f4cbdb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12fded6f-8c7b-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1701017072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017072, "uuid": "1dbe6262-2a0f-4013-8678-2dc1a1a35759", "comment": "Malware payload (RedLineStealer)", "value": "4e8c621795667abafd6ca419cdb60880", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017072, "uuid": "e991b344-522c-450e-9896-d2a901aa8d59", "comment": "Malware payload (RedLineStealer)", "value": "1cbf1d152736ee040a3eeebb69eb613fe34bdb5ab5995afb08894b1434d6a461", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017072, "uuid": "904d35e7-e8b2-4917-a25d-0e25b337f116", "comment": "Malware payload (RedLineStealer)", "value": "1ca825968fb02be4e94760909da5305a56101033", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017072, "uuid": "6919216a-22fd-4a9e-8922-7b03f3a4a437", "comment": "Malware payload (RedLineStealer)", "value": "f4c839c667e33db60b3e87182c5bfbc34119a4e92f07c8fae7f8533c1978c3c945c9abeadc6ff3e4b97da5a7f50acaa9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017072, "uuid": "030b0d2b-b630-4942-bda0-a0b4ba88b0b1", "value": "T1B4459DF13884D0F1CEA220B346ECB531526DD1A1CB6155CBC6B81BEBB72D7D17A319A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017072, "uuid": "3283c7da-1cbe-478f-8e39-39980b4db228", "value": "bbe2990d8b692a2bc3e523d54929d6fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017072, "uuid": "90f55831-f36d-4dc8-9a26-5e6c6ddcb900", "value": "24576:vuF4ZYWzHZCLuJZZZM91FFtVg5XSporD5zDcVH6SdXt9:jYWzHZ6u8M96x9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017072, "uuid": "f6d2a0a2-61f8-4b5a-862a-8f5b43c35d0a", "value": 1188128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017072, "uuid": "6c189487-6d07-470f-a75e-7f32eeb88ce6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017072, "uuid": "34fa1f2a-fefe-44d3-9c93-fb74ded2f118", "value": "4e8c621795667abafd6ca419cdb60880.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2b6048e-8c79-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1701016508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701016508, "uuid": "04aa4736-533f-4535-b0e7-8d99c595a706", "comment": "Malware payload (LummaStealer)", "value": "aee33bd68c717670ae12809740991b09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701016508, "uuid": "4ee1e983-c46d-467e-9fc2-31ff9ba21910", "comment": "Malware payload (LummaStealer)", "value": "1d456d0972e2de6cc7d5865c00710a3aa75ee4bde546281387c2b5c73244ef5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701016508, "uuid": "8b8a283f-5f0f-43ab-b2b6-5fb3ebeb4be8", "comment": "Malware payload (LummaStealer)", "value": "2baadc4c17a4355da5dbe1fce026deb1f1b1b040", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701016508, "uuid": "e92f50d2-5e37-4dd6-b25b-318f44c0bcd3", "comment": "Malware payload (LummaStealer)", "value": "c243e63c9237fc783b68cd5be3b8a8d97c2567021e56157492045394cee02563ad6affb666b801061728a6eca971f05d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701016508, "uuid": "368e3b72-156b-48ba-acce-f81cf5ecb796", "value": "T1B8851B1136F94B59F9F31BB95ABAA619083AFC69CF11C2DF1261548E0D21BD08970F3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701016508, "uuid": "14e2846c-67ab-454a-8f11-2b63669d51b7", "value": "c7fb2b0f7d1b9bb69de473555ebdc92c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701016508, "uuid": "9bcae800-685d-4fac-9c4e-3ece4c330ed0", "value": "24576:NziwJJIRDgPFGXnI3WMKC9ej6a9DhvhSuW:Nziw7PFGXnI3WMA6a3vQH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701016508, "uuid": "03404650-72c2-4998-9382-9588470ddad9", "value": 1794848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701016508, "uuid": "3dac0f7b-980e-4265-90fd-1e775c6a2fd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701016508, "uuid": "82b0982a-141f-457b-af8d-83ba43620365", "value": "aee33bd68c717670ae12809740991b09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f960ae59-8c89-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701023471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023471, "uuid": "e7df406e-2baf-4818-b552-fc7cf04b44fa", "comment": "Malware payload (AgentTesla)", "value": "7ccf3f24e7b101ff08209f6d0e8daa1b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023471, "uuid": "ec083577-a0ee-446a-89fb-e52c5cd9c77a", "comment": "Malware payload (AgentTesla)", "value": "1d771168055464e85c265a8879adcec881018f4a36cf33eb05adf407c66989e5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023471, "uuid": "faf713a0-8c78-4c38-aa01-c34937fb903a", "comment": "Malware payload (AgentTesla)", "value": "a6e08ec960ef3bd4860f54a7bb22bf4951038ba2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023471, "uuid": "8c850fb7-0210-44be-b2e7-22d179be49fc", "comment": "Malware payload (AgentTesla)", "value": "316c221d4bd3419627198091de0a649b47edccc0f185b1e25c5cef1da5ed2ea6e35907fcf5a04a93ff82a18840d19a02", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023471, "uuid": "a86d8f6c-b5e5-4415-ad8f-cc73dc2218a2", "value": "T19803FE2139FF900DB1B3BF611FE9B9E54E6FBB712A69905D1004430B8A63E41CDA2B35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023471, "uuid": "c53f5fb9-a5bc-43aa-b4c6-77286965d7ce", "value": "768:ldVeh01TL64TPnTXTbemBtgIKPiNiVXdVeh5lPVeh0oVehj7reSjVehKZej/:l2QTRTfTXTVKIqX2vW2ZkDz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701023471, "uuid": "eb8f9a7a-efa7-43ab-ba69-2be07351bac4", "value": 38564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701023471, "uuid": "0dae5d7c-9d82-41b8-b091-f9c67e0826fd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023471, "uuid": "eaff3623-f51c-4b56-9c5b-702b8189cb5b", "value": "transfer\u00eancia interbanc\u00e1ria santander.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5fd6929-8c7b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701017345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017345, "uuid": "2c27741f-df79-47a9-8cb3-b07a71987b46", "comment": "Malware payload", "value": "8fb5d9e98b4567388989a82adda8b3df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017345, "uuid": "61073bc9-5f7d-4958-b25e-300b06fd0691", "comment": "Malware payload", "value": "1d7d948492127537e808c0735395ac5b37c404e829287b0fc2145fac212b47b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017345, "uuid": "9c6f326c-5cd1-4df2-9f7b-826469c07a72", "comment": "Malware payload", "value": "34dbf366b8aa9a960ec2ffb96b6e3ebae3700e26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017345, "uuid": "789cfe6f-f952-4226-af99-347017d328ea", "comment": "Malware payload", "value": "64d8691d7638c6b9c5571165e82aeab0e4f9757e50885a6452a16d042ba72222c41802bbbc04b12e542847f75d296b41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017345, "uuid": "c3468b75-62d9-4627-b1ea-7c9293c233b6", "value": "T1F0D45B193F78462FCC8F43B6C65024699BF0C965E297E78EC988B4F86906B44BF1D097", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017345, "uuid": "cd46817e-880a-4099-b08d-ebb93dc80a22", "value": "12288:UwS8rmnzt80rU/eZ2mkLJYFRd+5V7oiIOULMD7zf:U+BLJYFRd+5VUnfY/zf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017345, "uuid": "7c6daebd-09bc-4b6d-a0be-5c1d548ddd14", "value": 604160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017345, "uuid": "9fa12cfc-60b1-44fc-aa2d-ab4e7ea8101f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017345, "uuid": "7c09b7bf-d41d-46b4-a5d0-7b07f3d0e51f", "value": "8fb5d9e98b4567388989a82adda8b3df.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51c2bea3-8c8a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701023620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023620, "uuid": "cf9004bb-dac1-4624-952b-27847ee2c6a1", "comment": "Malware payload", "value": "7a196feae0983ab30f1397f5547f9efd", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023620, "uuid": "5b501b05-d918-4e28-88c2-3d73ac0690b9", "comment": "Malware payload", "value": "1dad6f40b5c39c5d1a2acd84f10ae0ccb277450f02f5a2e3f8e011701887d57a", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023620, "uuid": "ebbadc9a-a5f7-4da0-8626-5222b5b1c7c7", "comment": "Malware payload", "value": "b1af9b559b804861a6706caf6f2acc8904f38731", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023620, "uuid": "7c4f188e-a8ee-470d-b495-f23c869de31f", "comment": "Malware payload", "value": "727643e946108b2d6ee49c8223d89900757f56695198b29d41cb8a62d8863edabf9addc7844727231cac5fd3db4db981", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023620, "uuid": "52c846ca-66cd-4677-ba1f-3db0bd880966", "value": "T1D7240229770BD419C083BCBD88C981DB5368BDB2EE4AE60B30D4771E053C6D6D78B5A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023620, "uuid": "b0f44278-0663-486b-addc-5f34a9009f69", "value": "6144:hWunN6XRS/eu3YsRQmDGHPv5h0IpMRtlOE:hHwX09amDG3b0ICRLOE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701023620, "uuid": "3be532dc-222d-4158-bf52-532262c087be", "value": 227840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701023620, "uuid": "38090002-513b-4e20-b9d1-e95c219500b2", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023620, "uuid": "d35ddb8f-252e-42a5-955b-3f429038e35d", "value": "RFQ_PO_december_order_sheet_design_and specification_24_11_2023.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91859679-8c36-11ee-8907-42010a9c0042", "comment": "Malware payload (DBatLoader)", "timestamp": 1700987649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700987649, "uuid": "895e6247-4987-4fc7-bf5a-2ce6a787587c", "comment": "Malware payload (DBatLoader)", "value": "dd985ad6ff3a38972aa87834407f9e62", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700987649, "uuid": "cb625c48-8102-41fa-9a5f-46430903e603", "comment": "Malware payload (DBatLoader)", "value": "2159cbace070eda555164924c4bf646924d95a7dcbc3cf7ab44d2c918d0abe0b", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700987649, "uuid": "bd18eabb-830c-4507-ac7a-2f43f5d86aab", "comment": "Malware payload (DBatLoader)", "value": "980e4e4f22d48c0e336bbf9b5fca0e7320461720", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700987649, "uuid": "cc237494-daa2-4a0c-b1ab-78f97e1e05e5", "comment": "Malware payload (DBatLoader)", "value": "951230b056cffefb278a5d70f3af44244b5d9efdb11389a445dff9e7f341abfee1142996ad899fce92bdcaa7b1e0c1e5", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700987649, "uuid": "d1fa0a26-5afa-4852-9a9a-c1a0210ab118", "value": "T17495E012DE610033E06357FD9A3BA3125D2A6DA32F2469D6A9F43D584E7AF843D1B133", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700987649, "uuid": "ad7f48d7-2a53-4595-83ef-124044d71b14", "value": "5346a12dcb49c1d1cdae222f054ffa7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700987649, "uuid": "42c75a72-e335-4891-9370-129a2cfdea38", "value": "49152:bee0SeGwcSGQuOvlzgzRlyYFT9xZdmPSw:blMGNQuywXFJQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700987649, "uuid": "b7e681e6-799f-44fd-907e-9c2f47cc8f3d", "value": 1877504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700987649, "uuid": "3aa7643b-cf90-42cf-a99c-ca77cf7f5423", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700987649, "uuid": "5bda850e-5c75-4e56-a754-f20954e4f6ed", "value": "003786546788765.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "199b6e42-8c7d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701017942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017942, "uuid": "1ee888ff-a026-434d-a19d-97d61b0277d2", "comment": "Malware payload", "value": "de237777518dc9c0b7a03c536746d878", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017942, "uuid": "63265fa2-21fb-4b08-b51b-963746b8b37d", "comment": "Malware payload", "value": "23c6e8163646ba03c0a5c6dcdf0f0df5688ec4a91c8bd9b663888440254bc12f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017942, "uuid": "baa04913-8702-4dff-b806-bad78bb07fad", "comment": "Malware payload", "value": "a357466573e35d634a119b7f2e7a8a18f5018811", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017942, "uuid": "4893a524-c5f0-4764-8250-d3a27fae5860", "comment": "Malware payload", "value": "8886aefa1980ee082e9402f670852aff697fb5af1741faa8f3cbaa8f29793aeebd465bc2be1b2348e0cb0df084b856d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017942, "uuid": "d615803e-22e0-40b4-a278-5ca35fc34932", "value": "T10853F105E4526CCDEBF68275A6650489E134CB524B033CE323E13DBA1D4EEC9A1B7626", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017942, "uuid": "010f9745-ffce-4ef8-8e9b-c7f13fb4fc24", "value": "f9e0f22dd6f41da7f3579c559466fbd0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017942, "uuid": "2f7d8a9b-75d6-4915-a999-8661589c6540", "value": "1536:2mLuy2AtwhCC3P43iyGS5lzYAfQzf/3ma9cS3:2qJzC3Ki5ylUA4zf/3mocC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017942, "uuid": "736ab7e7-15f8-46a9-bde3-c7ccf0a095ef", "value": 63824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017942, "uuid": "ac3eb96c-ec5a-40bb-8c8d-9605d0866f80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017942, "uuid": "495d424f-5ff8-44fb-b43c-a7511b560e41", "value": "de237777518dc9c0b7a03c536746d878.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e55cc3ef-8c6e-11ee-8907-42010a9c0042", "comment": "Malware payload (Vidar)", "timestamp": 1701011841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701011841, "uuid": "9cef5526-4099-4598-8bb8-7e2fb42d100d", "comment": "Malware payload (Vidar)", "value": "4ae6e509138d9525ca9d01c477958d4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701011841, "uuid": "54db63e7-5d97-4b76-8f10-c125a58ab5f3", "comment": "Malware payload (Vidar)", "value": "23f0dc130aa22ad54a6935965d52a146a239ca9b7f4eca531cd74d3bdcde210e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701011841, "uuid": "86e2f74b-ad4b-4315-ad7b-122b76cb4994", "comment": "Malware payload (Vidar)", "value": "e107c8f02e496220cd5f35ce1f562e2324cd929e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701011841, "uuid": "f385f63a-b36b-4c5d-91f4-411ff72f3a48", "comment": "Malware payload (Vidar)", "value": "bb571ee65b00ca2a5997efe2362fb11036ef316520c49a479b1c4069e54513bb905c2d16d6143f8673c9a669f97ab5e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701011841, "uuid": "5a634a8e-d62c-4bb2-8762-a6d503c1c9d4", "value": "T16054C52382E13D45E9368B729F1EC7EC7B0EF6518F19BBA912189E5F04B107AC663711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701011841, "uuid": "d3c8dd52-4ee8-4eac-b474-095c59c65b62", "value": "b8210609d726087fd0a34a5c2f7cc271", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701011841, "uuid": "e96c511a-15d2-47f4-addd-1ecfb3a7eb2e", "value": "3072:ctkj5VahNCFFVORTxlRp3+EnNEoD+LIyHUGtXQj+x8:mkVgdVlT+SDGr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701011841, "uuid": "ae499ecf-7e5b-4638-8ffe-f3fd2b46cc85", "value": 297472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701011841, "uuid": "0191da28-fc60-4439-9d79-0469aa6048da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701011841, "uuid": "5e144a94-a9cd-447f-af1a-f78191bfe50d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16aa38ae-8c8e-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1701025238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701025238, "uuid": "ffd66b81-e9fd-40e5-9eb9-b896570bb0d9", "comment": "Malware payload (RedLineStealer)", "value": "26b004f38de3715b99d3efe39f8171ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701025238, "uuid": "5acc5278-6466-45e1-b5b1-e3311def0275", "comment": "Malware payload (RedLineStealer)", "value": "23f86022fb875c47e2b02f5934550a04a8c5c901a3059017f54f59130ce92e3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701025238, "uuid": "63b17735-ce5f-4e49-bba2-0b72327cda71", "comment": "Malware payload (RedLineStealer)", "value": "5a5b90ce44336bdad70a45f7a3c6a67fe097915a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701025238, "uuid": "e7bb0194-8a44-4eae-a028-7e26d0b06abc", "comment": "Malware payload (RedLineStealer)", "value": "1e37f63dc54e9d94408ac3d9b428488d43961d836b01bd339170d1b429d264bc963c61a680673bd4b13c013c62e5814b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701025238, "uuid": "cc89b6ff-5bd5-4d9c-b46b-daf13d6318d2", "value": "T115C512C1B3C39806E076193A86B587A20D727C5545718E29B2C8332FDEB2F8659F9F53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701025238, "uuid": "8dcb35ff-7368-41f2-a1b6-6111565ef7de", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701025238, "uuid": "3059f865-1429-441c-9e62-dd3d39143ab6", "value": "49152:b5ZszS3vv3jirr3jjWiTaOvifviOrokYa1AhD7HmN35ytczrBHI2rVqmIUo1eDzR:b5ZszS3vv3jirr3jjWiTaOvifviOrRFv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701025238, "uuid": "b5b622f2-a1f8-4127-bb55-2af956c468df", "value": 2674688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701025238, "uuid": "f062c0ba-d0ad-479e-963b-af8cb89359ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701025238, "uuid": "87ef21af-5531-4508-8edc-f28874bb2af5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab904591-8cb1-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1701040521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701040521, "uuid": "16196439-bde7-43ab-af42-6c8364ecafda", "comment": "Malware payload (Stealc)", "value": "2e8b08a2beab97ad2a4ef3cf44f37572", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701040521, "uuid": "60f7c099-ffde-4694-bf76-153c578eb61f", "comment": "Malware payload (Stealc)", "value": "24235af9579b94d0c4691dde3bb6d03ffae0731e55ededc9397360139484b005", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701040521, "uuid": "608e9a37-0b2e-45be-b1db-4bcfff5c69b3", "comment": "Malware payload (Stealc)", "value": "9c95635c25e9bb3d67e038a3a4ad84cc171c8e46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701040521, "uuid": "43846977-de88-4e18-95dc-0203db70ac94", "comment": "Malware payload (Stealc)", "value": "2c65809eaffa36d362923a74f9318715579c1b7766aae142d5fc6f9fb04e854a04e8b2f406be62d41ec6431c7d2c1b32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701040521, "uuid": "28e5e945-6b1d-4440-b131-69456780af83", "value": "T19054C54382F17D55E6368B729F2E86FC772EF6908E59BB651218DE1F04B1072C2A3B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701040521, "uuid": "cc454c02-6ff8-4ac2-8e4b-f7026ce074d3", "value": "bf239f08d0ec234f337a28373e606928", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701040521, "uuid": "1a05358d-d57e-4a9c-81c9-2c9510d19e9a", "value": "6144:TXGppstEFwmKsY2mpnrpBUpUnTlelkwiLklfSml0BmR:TXVtmKsY2C3Upqea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701040521, "uuid": "3edf1fdf-fc84-4cc4-8a8f-563e85bd8a1c", "value": 284672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701040521, "uuid": "1a1713d3-927a-4283-a83f-1fa13db1954f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701040521, "uuid": "0393f4e9-3552-4303-a1a6-09e1d3b4d083", "value": "2e8b08a2beab97ad2a4ef3cf44f37572.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "431c8614-8c7a-11ee-8907-42010a9c0042", "comment": "Malware payload (PhemedroneStealer)", "timestamp": 1701016723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701016723, "uuid": "74f1a1e1-f201-4263-a15f-52ad313de333", "comment": "Malware payload (PhemedroneStealer)", "value": "40b4fd44b1b1fe4a813db1368712cc01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhemedroneStealer", "colour": "#645F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701016723, "uuid": "20718657-57b7-4a25-b337-f15eb0e53e15", "comment": "Malware payload (PhemedroneStealer)", "value": "24fd2f8f77815c0ed4d40bb687b985060149390b7c830bfcdee1796f2df75db6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhemedroneStealer", "colour": "#645F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701016723, "uuid": "86ee7da3-a861-4d88-b457-a1f9df6cee89", "comment": "Malware payload (PhemedroneStealer)", "value": "95546293032b69cf6c58e334c38381882f5d49a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhemedroneStealer", "colour": "#645F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701016723, "uuid": "b126ccba-83bf-418c-840d-ec5b8fccd1d5", "comment": "Malware payload (PhemedroneStealer)", "value": "6159b114bf0e5dc0b35ea14a63f493166def53ac1281a12631681b42cf91a71aa1e2137ec651cf4bac9604c56859a454", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhemedroneStealer", "colour": "#645F55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701016723, "uuid": "767236b4-2ae1-43e0-acb4-1379e7a3097a", "value": "T114C3279B72E01188EBB581F6D5920786EB7074721711A3DB1B7863B71B2B8C59F3D3A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701016723, "uuid": "8ad1438a-b321-4594-bddf-2bd2c9dbafc3", "value": "f326f88ca83c9aacaa44acfb8884f1d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701016723, "uuid": "f1c3124e-bbd6-4488-be40-9783b4e453fc", "value": "3072:8/25jvDSgsqsb5Uh28vAbTV1WW69B9VjMdxPedN9ug0z9TBfFSvE:ftzsb5Uh28+V1WW69B9VjMdxPedN9ugk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701016723, "uuid": "49535b94-ed6d-4043-bc6b-0d5809b1843a", "value": 125440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701016723, "uuid": "eeb1469a-c095-4038-88f3-1446156b4982", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701016723, "uuid": "e9c6149e-355a-44c9-b90c-18a4c004705d", "value": "40b4fd44b1b1fe4a813db1368712cc01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "873a190e-8c8a-11ee-8907-42010a9c0042", "comment": "Malware payload (Merlin)", "timestamp": 1701023709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023709, "uuid": "bfdb0b49-fb41-4300-b8fa-cb973c84644c", "comment": "Malware payload (Merlin)", "value": "8e9ccb4c6a576f1015647ab8f7d24b44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Merlin", "colour": "#73E764", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023709, "uuid": "227347bf-1468-401d-93d0-eb5f342ba84b", "comment": "Malware payload (Merlin)", "value": "25558d5f071fc7c76b500e9c97d867bf8e1f809b64c1a781afebcfbc3e44d8ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Merlin", "colour": "#73E764", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023709, "uuid": "87a7d867-0d31-4e50-9ba0-73dfaff89690", "comment": "Malware payload (Merlin)", "value": "c70ec3a9888821d088f75505a62d9e74006999f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Merlin", "colour": "#73E764", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023709, "uuid": "0c6a1336-0bf0-4b97-aa28-e70c7c329856", "comment": "Malware payload (Merlin)", "value": "9db930d65a6faf326bea9896924f965fdfdb2ba5d3e1a3a9792b834218d3755f02da8bfae784ab2dfe2b6ab8b8b086e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Merlin", "colour": "#73E764", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023709, "uuid": "5ca03a75-346e-4313-8495-6c1a5688714b", "value": "T158863A43F85181E8C2EDD274C626D2A2BA717C494B3033D72B50FAB92B76BD46E79314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023709, "uuid": "9f165052-aa9a-48ae-aad3-dd208975ac92", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023709, "uuid": "1d186938-ab8a-4e7e-b369-8b89697ba85b", "value": "49152:6nmv2KJwoFQrb/TivO90d7HjmAFd4A64nsfJcwZbywBuHY7w7fHx2vYnf8Lsc/5L:6hEwR3B2nk9BycAREv+llRgZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701023709, "uuid": "ad5b959e-307d-4dbb-a5e9-9d59def4dbc5", "value": 8207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701023709, "uuid": "8c7d5538-7219-4422-9b25-9e86a572ff45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023709, "uuid": "d7ed5f19-f5b5-4383-a24a-72345e188144", "value": "8e9ccb4c6a576f1015647ab8f7d24b44.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acae912a-8bfa-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700961925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700961925, "uuid": "84ffb38c-89e4-4857-9ecb-f5c9b41071a2", "comment": "Malware payload", "value": "88cab3797c0732b59b840a1f2ca53559", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700961925, "uuid": "824e6b4d-eb23-466f-9503-12486a95589a", "comment": "Malware payload", "value": "25fc58d2222f7a3bb6899cbead48ee5d5d3bfa14f955ca6d04f9a16384f866c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700961925, "uuid": "2f114ac9-781a-4639-86f0-b32cd1b874d7", "comment": "Malware payload", "value": "054469e351fddb63e6854c1c5a09f3ee59fd86e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700961925, "uuid": "c85a45ca-d178-4e50-98ce-107470efc14f", "comment": "Malware payload", "value": "b4e3bd2bdcc292919dea4fd64575b1cfcc72daba8acc8694382b884f231a8d655ff6dbd74deb1c356c6000f22ff6fc60", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700961925, "uuid": "c954ac7d-99bc-4347-9ee3-612fb878df90", "value": "T1D2439407AF41CFA7C81FDDB306F6861134CDB8972564276A3270EEACB52A58745E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700961925, "uuid": "421bd1d0-eddf-4b99-844f-fbe082c08e81", "value": "768:vfDptexXOW1gbAiw1uYb4hZQmvXi36XetRNzpegefbV6T5I9s:vfDadOWjZMhZQmBwzpZobVS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700961925, "uuid": "d7b941f5-38de-43bc-bd6a-9120c2cc29c5", "value": 55200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700961925, "uuid": "76468ce9-57ee-4c6a-a4bb-d77797b0d6be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700961925, "uuid": "0dd0a0a5-6ec1-4fe2-8cea-63b6c0e3f668", "value": "SecuriteInfo.com.ELF.Mirai-CLZ.14797.9662", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c310b37-8c95-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701028442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701028442, "uuid": "7cec7f4d-f69c-4c62-a2ed-195ccb12ad1e", "comment": "Malware payload", "value": "b71e450ffacb598c63c57314df83aac3", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701028442, "uuid": "751faabe-0588-4bd5-bb66-4c0f0b17f178", "comment": "Malware payload", "value": "2a128afa514f3bebc1f34006868543273712dfb7a6a3b603d30e37ca3511fde2", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701028442, "uuid": "35bbc1d1-7c51-41bc-86cf-d8be03c467ec", "comment": "Malware payload", "value": "0ad8b76af0f2e131ddeb3c5f7d16638faea99cbd", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701028442, "uuid": "0eae2e40-a9db-4477-8332-23a0bbc4d7fa", "comment": "Malware payload", "value": "0e4ce2740c770526f3d7637053364d45a410f27650382e470c6b077c6b3d0def71cc8fba0403c7af6c8429b46dcc0181", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701028442, "uuid": "bf3af901-dcae-4ad6-9db0-e5e96e8e7ead", "value": "T1942733E8217D164F9AE0D76236F84BC95185A6AFB00D0A6D203542F37DCE422FE97B74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701028442, "uuid": "22ef301d-daab-408e-b725-91f5578786bc", "value": "393216:nU/tV9sfIldr6PH9LQE0e/t1pUNxBpqdeM4yS+MT1C6JW8dOCTbPrm:AYP9L5vtMNjp3xZRdscfm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701028442, "uuid": "a8547c82-115b-40fd-bdfd-3b49ce44762f", "value": 20757390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701028442, "uuid": "f1c0a028-cf74-444f-9596-aaf3709abe4d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701028442, "uuid": "ef1bca4a-e473-4cea-8c4f-36bdacdce93e", "value": "Launcher.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97ca8397-8c7b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701017295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017295, "uuid": "16572b96-5e96-4a52-a72c-51b70ae30401", "comment": "Malware payload", "value": "22a2e65369be52eca1e19f7ebd55af1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017295, "uuid": "28b1ef54-104c-4159-b965-5e511a6169e7", "comment": "Malware payload", "value": "2b208f4e3d4c5988d3da88af00e69270ec291f647fc01fdb1f03ddb76b4c9654", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017295, "uuid": "5d126264-11c9-47b2-ad98-0b116467e3bf", "comment": "Malware payload", "value": "5a9d30ccfa790e31a9e230ff0453cfc49ba0d862", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017295, "uuid": "38c44204-b060-43ff-b179-5067b843fae4", "comment": "Malware payload", "value": "105ae3d477817df46f82d18140106b50b84e0f4496a5683e4dad30526f17f326d3ceaa23363f07ab7883fa6e8fef06e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017295, "uuid": "f7084e13-90ed-4a78-8ecd-2d3c4ca20e9d", "value": "T1A9C517157A5A5C6EC55AC4B083478BA21A3130CB1B36BAFF41C496343EAEBF46F2D354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017295, "uuid": "91908a21-959c-48b1-8025-2924ca800e79", "value": "fd4d25833a183d8c1f425ffeadaf4180", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017295, "uuid": "fdf3e477-a0dd-4c3c-bdab-8c4011d0a89c", "value": "24576:/z/hHpKYWs3wSciyJAPLBr+ZsxU/PbvCpDROhGdw+WKT6w9cTBK7hpFYhHAfCQnp:/z/XKlewS6N/PbW8C+Mdp2E58lAv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017295, "uuid": "e92f8861-d638-4ed3-b615-c6c8958152ad", "value": 2727920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017295, "uuid": "e8cdc385-1973-4e9e-9b05-6dc9622cab41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017295, "uuid": "312d54fa-9bed-4812-ae44-a8bc51b4c985", "value": "22a2e65369be52eca1e19f7ebd55af1e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2db6fd8e-8c96-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701028713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701028713, "uuid": "233940b8-4119-47f3-984a-d82bb2750821", "comment": "Malware payload", "value": "320100f762d1a6fc644f5a5532a25878", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701028713, "uuid": "246ddccc-b459-4f73-967e-d133d867000c", "comment": "Malware payload", "value": "2b440e0172af971d457b3b79123b7b478b8d15cb0ebbbbe473fe928af08880e3", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701028713, "uuid": "3e118928-c46e-43b1-b8f2-b3f36e86b884", "comment": "Malware payload", "value": "fe830edf4c2b31e29422069260ea2a018385fe5d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701028713, "uuid": "1841c7d3-cb67-4338-9820-e9105b4a2b8f", "comment": "Malware payload", "value": "27908a11b2831670a7ca06aebbdbbfc71b1b0be69cec5e70e18c1adf2a3f84ab5d46be885c2cfb2923332a0d886942ff", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701028713, "uuid": "547b78b3-24d8-4cd8-baa1-b718dc203b76", "value": "T117D3B46F29CBC236F8ABC674681ACF7AA4116E8E560D417260EC7F1BB9363119CD1353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701028713, "uuid": "571f0269-d39f-4954-be71-c5c6f2813ec5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701028713, "uuid": "36f1dcda-0310-40dc-bbb7-0d8df6ac8d38", "value": "1536:hxG29suranxH2ufS/yb7zXYmk09iVn8/3atWLRwVcl:hxG22gaxH2zyb7oCLRqY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701028713, "uuid": "98074c22-e1eb-4058-8a2a-d72a29bbf7c9", "value": 142336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701028713, "uuid": "13d46ba0-c7ca-407b-9448-faabc83fb675", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701028713, "uuid": "9bdf9aa7-b270-4e8e-8529-370f416db955", "value": "DarkFN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3c55ece-8c89-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701023354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023354, "uuid": "331a394f-517c-410f-b7b8-d492690de324", "comment": "Malware payload", "value": "0785cf59ff28b121888042ab9ecde27a", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023354, "uuid": "2aeb796f-2d03-474f-a095-72a8beeaf508", "comment": "Malware payload", "value": "2ce631253c0d23b592da99be9f52d6e8f584391a7c39b7c67d494447b660692c", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023354, "uuid": "3355ad7f-3a0a-40b6-bff4-5a80dec8f3ce", "comment": "Malware payload", "value": "37c83744064d0a1103862a30caa04ad53fc77251", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023354, "uuid": "526dcceb-316c-4c3f-a5a5-f1900685adaa", "comment": "Malware payload", "value": "afec82edf27a5c5831b4343c41259a2dd9cad07bb656b7f40ddc353758c0f9a2d15a76977b3287cc97212bd1d1a63169", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023354, "uuid": "7e361106-969d-412d-ab33-68521bb66b1b", "value": "T19BF4337AD5142447F47D8E363374EAA2558B637988A9C732F0890BD70923116CDFE3BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023354, "uuid": "2860f468-b68b-4c00-ae66-807637c58184", "value": "12288:WVqZ1ch5QtLK2g/egTvXSye+cqBYIeYiYl5EiwEBbuJlx26UXt4e1oz0H:WVqZCboKagTv5JTYdD4EivElx26213", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701023354, "uuid": "b1b63704-8dce-4a0f-80d9-f271d635e236", "value": 749815, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701023354, "uuid": "8277451b-9d3b-4772-bae4-af5755b8af4a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023354, "uuid": "0321d9fc-5872-4076-9a05-edcaba834b2d", "value": "Our PO#PO106223-Vendor Ref. # OFFER.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5323b071-8c7d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701018038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701018038, "uuid": "3dcf1eb6-c41c-4d68-adf2-54d01705e9f7", "comment": "Malware payload", "value": "a43c64002f14cc7e327166e497d21d0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701018038, "uuid": "ba93ce2c-4878-4278-99ec-73f3dceca496", "comment": "Malware payload", "value": "2d2ce6729c02c033ffbf783cccc7fd592e7a672926a9f84919205b11e4b94e20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701018038, "uuid": "6b6e452c-236f-4624-a89f-dcb73b9193d4", "comment": "Malware payload", "value": "58a35bafa8cbe155cd63823b5a523eba09e1f8ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701018038, "uuid": "85be7c6c-9602-485a-9efd-dab3686dce6d", "comment": "Malware payload", "value": "58ae6066370440396e7ee9c4e439c8d24680ce5b7d5933f5f0a9de8bd231cca3bd4755b0a36364c84b23a9b107ecbb5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701018038, "uuid": "2f6df4da-11fb-42e8-8c7c-6515321db482", "value": "T13615F112B6C689B1E4632A320D399B20557B7C244A79884F639C7E1FBF733C15932B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701018038, "uuid": "5526eaf8-65a8-4deb-987d-a4ae3cd01c98", "value": "aac51396886833dc961fcd7aab7711e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701018038, "uuid": "293a4345-116e-45a0-9b5a-021108bc8840", "value": "24576:lgZXoZUTVdt7KEA1SZsflCxjah+6Vr2x3aAq12JQf8fe:QASclC4AxKAB+Efe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701018038, "uuid": "226218fa-869d-410f-838d-eef851139a8a", "value": 938944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701018038, "uuid": "60fe5454-0486-475b-8535-a7aaf0a2db4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701018038, "uuid": "a23ec656-149b-4052-b0ed-bc2e1c17fb7e", "value": "PAGAMENTO_COMMISSIONI_MBS_Settembre_MGpdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dab372b-8c91-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1701026512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701026512, "uuid": "9866ca1c-accf-4d52-9ac5-e47b4d7e826d", "comment": "Malware payload (RedLineStealer)", "value": "fb1791631e701c9e26440210cd57a706", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701026512, "uuid": "bcfb4485-e59a-4e73-a1ea-a01861aaed05", "comment": "Malware payload (RedLineStealer)", "value": "310aae93b9114e3f68d175e514e1f023b648ef1d30f2b1614857258e301dbec7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701026512, "uuid": "57c1d5a9-1c6d-41ef-9908-76ced5ed95a1", "comment": "Malware payload (RedLineStealer)", "value": "ca808e7cddee8c1c0e189dece09761ab78f5d3ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701026512, "uuid": "9cce5b3d-6fe8-45c7-a24a-f56b2b7daa28", "comment": "Malware payload (RedLineStealer)", "value": "41e2399bc5f7a0be3966c32774c4a0edc792cf5d8704247783a3db187630494a24277d5c2346d8e01bca4d6926ab026f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701026512, "uuid": "46a5a58a-336c-4a18-a993-552d562251f6", "value": "T1EEE533BB13125A9EC39295BEC0FA129C85348B5371C99EA66C8D140EF533F81DF94673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701026512, "uuid": "878437e3-a161-416a-83ee-170329ac43f1", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701026512, "uuid": "3f3f9fcd-37b7-4ba9-9d80-5468a799cd82", "value": "49152:8nlnBPRdwY+81mT9bGEZubLh3WHdsSWK53mM3ulu6Tbx2ntvHCKzIu6mCV:Yf0YzAT0GsxWdsiFa/TkRiKzIACV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701026512, "uuid": "5e3a4ad6-2632-4f63-b94f-2847d32648d5", "value": 3124232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701026512, "uuid": "820b92bb-1a16-4de7-be75-ff556eeb1529", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701026512, "uuid": "b77d1201-aab9-4baf-ad48-8b3981a856dd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f577653f-8c89-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1701023465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023465, "uuid": "f189b8ad-746c-498e-af53-3471154e4c67", "comment": "Malware payload (Formbook)", "value": "61ae1980076d560350e52fa74d2d8bac", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023465, "uuid": "ff098e55-76f8-4e8b-96c6-ba12f3a72683", "comment": "Malware payload (Formbook)", "value": "31113125df52ddf2a12755459cb67da219dc7a2e588b7d8d64cb55190b155259", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023465, "uuid": "ad90a5a6-d4c6-48c4-9367-be04e43b4160", "comment": "Malware payload (Formbook)", "value": "980719b274b58f2f1dfda354d85baccb39fb3806", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023465, "uuid": "a9da45af-878f-43a5-b71a-f6c59e231e07", "comment": "Malware payload (Formbook)", "value": "2b02025b77f29d8328c90f7bfc634a3b75a5d7818baa494d662e79b2283d6faebefaa0ed31f96307d320a790ec22c609", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023465, "uuid": "3b01230c-aa3e-44e9-adc7-4580cea9a004", "value": "T1AE15E02922B44F8AE4BB53F58968420507F6BE99152BF39D5DC170DB4E32B811A0BF37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023465, "uuid": "8f443232-38c5-4cdc-9a8d-4a4ae0a5eee7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023465, "uuid": "e9e6630d-4555-47d3-ad40-e9d28348061d", "value": "12288:tDwMaylvcV2SguDil5YE6jD/62iNVZsd6bBKQDsooSRBd6QrKSrssMo1b0ojqPVD:BatD/61idr9wFos7eymcENa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701023465, "uuid": "8690ca49-1c76-4e1f-ab8a-bdec0868b86c", "value": 962048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701023465, "uuid": "61c5e088-6a5e-4e95-a69c-d63c5f166684", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023465, "uuid": "68833bdc-ce48-4248-8a00-2f6fac1203c0", "value": "DHL9407155789.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c51ce043-8cac-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1701038416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701038416, "uuid": "9774eac7-7e23-4a43-a4af-d89003cf11e4", "comment": "Malware payload (LummaStealer)", "value": "f96b8db3d00a361ab6b088d0ea7c0e21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701038416, "uuid": "496cca1d-a0d5-4df8-a879-9e68ef1f3966", "comment": "Malware payload (LummaStealer)", "value": "334ef60e9bb7777b9d313034350310f0f491b159454f67356fb33745d198d42d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701038416, "uuid": "1df1bfd6-f340-404a-a5b4-cf7a89e7e9af", "comment": "Malware payload (LummaStealer)", "value": "562a142d29d07f4ea4f5832c9d6adc3fe25b8f82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701038416, "uuid": "7589043e-9a4b-4b20-b1a1-85cb2842d20e", "comment": "Malware payload (LummaStealer)", "value": "ab522d9a9a55344d4e9495a220344be6c2ff94a07449d9902d157827c2dd8abd156160311d31ac6200bb73b43983d67e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701038416, "uuid": "cc3b5223-c839-44d6-a43e-513bb999d6ba", "value": "T189852303B2ED8031E4653F705CFB47470A313CB2BEA09BA6535A995B5D226D1A371B2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701038416, "uuid": "53539adc-4b81-496f-83f7-918a401386be", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701038416, "uuid": "2745915c-3e3d-4f33-91b7-0a57c9e36f52", "value": "49152:Sf4n7PYFNvUwhnHZC7gVnVuHxjBN+Tt2jMAQ:m47PYFdUwh52xjj+RQM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701038416, "uuid": "3b46aeaf-6733-4667-a51a-5710b5534402", "value": 1768960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701038416, "uuid": "103b590a-cfdb-4934-bcb2-d8684ad1ab6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701038416, "uuid": "756a8a4c-19a2-44cc-bc55-8cbdb0d30a29", "value": "f96b8db3d00a361ab6b088d0ea7c0e21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1d24509-8c72-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1701013526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701013526, "uuid": "ce3640ca-7c54-4233-8ae7-49d3b8efa0d9", "comment": "Malware payload (LummaStealer)", "value": "03edcc6fa1a6c4087078ebd6e0b9e582", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701013526, "uuid": "cc8f9379-592c-4d0a-903f-9b5591e2d9b9", "comment": "Malware payload (LummaStealer)", "value": "346186ece8ef2ec4229c3f4bbdbecc4fd3aa6fcec3ca8c34601af5b896eecd6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701013526, "uuid": "42e4f5e8-44d7-4e3e-a521-05b58d7b059d", "comment": "Malware payload (LummaStealer)", "value": "eab72c5f24db3ce69464bb439d8934fa0b8bfef5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701013526, "uuid": "761481bd-20e4-4909-bbad-cdb3693dafd7", "comment": "Malware payload (LummaStealer)", "value": "d13cb7d0845e44b79609d7758307d48ba892d6697c3389ecd128c6f5f8499a2c5aabf6fe83bc710ddbcc1cee8e0b6d34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701013526, "uuid": "fddaf82f-0e2b-4723-b91a-860918e82d87", "value": "T17A03D08344796A18CA15BE36011188E2F6D5B394F6582101F7CC9CFBBF2E784E75BA09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701013526, "uuid": "61d5c7d0-138b-4a9d-ad75-1c36235ef6d4", "value": "768:f8FhylJE+hwr5hN7F0I0bQyvUgq65DQVi:f8qlJEQwrDNuIyvD5sV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701013526, "uuid": "3feecf03-e2f1-4e31-b17c-321e6904f8de", "value": 38387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701013526, "uuid": "1482b7f1-1392-4f18-b91a-bbb04717c727", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701013526, "uuid": "bfd8a3f8-2392-44a7-900f-76b7cca88616", "value": "03edcc6fa1a6c4087078ebd6e0b9e582.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2ed47ae-8c89-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701023353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023353, "uuid": "531f2d96-d104-44df-93ac-b73f21d03c46", "comment": "Malware payload", "value": "9d00a480a23c7f81932a1bb23499e66d", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023353, "uuid": "df58ab26-a6ec-40a6-9b07-f6badd747533", "comment": "Malware payload", "value": "3550992a37c06b303471930dc6b93ca2356ef71b88cf9143079d65d79bb9d2ab", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023353, "uuid": "e212dbc0-14a8-431b-b264-779c39d5554c", "comment": "Malware payload", "value": "ff54e71305fdb68101839dac8f7d5f55fc2dd2eb", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023353, "uuid": "06da5acc-6b15-4895-9d29-3c9a982e7c82", "comment": "Malware payload", "value": "067418cb79347ee61fbec17eba3739cad2d8dede58eebd3b796d0b3941d94149beb1f3f8c7de927792e1cce84302d7a0", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023353, "uuid": "5678c9ae-d586-4f25-b69d-9eb119c05997", "value": "T19DF4238D5CA3C4AF06349B747E4AC2F559D5AB8738251C1CCAB27B60DCE7E4F09521E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023353, "uuid": "e60f0bc3-521e-4809-b222-95c8c7e32569", "value": "12288:YujIbBtqaYw5/7lpxk1QP2iwOcWcyOZpP0LaypInEQX1bWXUR3LoIfpBi:ljMB0a/HkY2XOU9nC/InEa1bR7oci", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701023353, "uuid": "7e5a61c5-4e93-433f-8a5a-d44877c76035", "value": 757681, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701023353, "uuid": "9e1f506e-0458-450e-b04a-732031c70311", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023353, "uuid": "c749c054-9952-4d93-b88d-950d00bf3250", "value": "Transferencia.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "332b3eaf-8c99-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1701030011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701030011, "uuid": "6193454a-c4b5-426e-9c13-3132f515e7f5", "comment": "Malware payload (RiseProStealer)", "value": "fe0de9c031ca9cb46e94baa499a4fa1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701030011, "uuid": "f5527727-3a35-448e-abfa-249f7a789bf1", "comment": "Malware payload (RiseProStealer)", "value": "36d029749a6a8e45926ef07651cef020dee0df3d48153d104cecd7fb78e7e5f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701030011, "uuid": "f3dacf02-fda5-4f57-bf0f-63f818fcfd34", "comment": "Malware payload (RiseProStealer)", "value": "b9823c31efefb70b9845df9377fc85bb8bbd4b3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701030011, "uuid": "bdc87da6-966a-4f15-bd1b-e0b7fe1727b8", "comment": "Malware payload (RiseProStealer)", "value": "dd51fae776b87a32b45bfe7ad1da555514814d53b05d03d9305939808b5a9f940ee119b371781f902ee7284877d1848a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701030011, "uuid": "bddfb43e-c02b-4b7f-9f2b-af81ab973e93", "value": "T1768523037ED98032D3761FB04CF7AB930575FC91EAF893DB6389280A2553519E9B532A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701030011, "uuid": "f4ba67ee-3a52-41e6-acdb-0b34ae50e0ca", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701030011, "uuid": "5a58a4de-b8ac-44e0-bdf4-bbc62b65ccb3", "value": "49152:ZKBSNh0//6KG0MhWTMYIz+03YPqHq67Sockdj:sB6hw6KG0oZNHf7S3m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701030011, "uuid": "4122937d-dcdf-4323-8072-5abe2c4f659a", "value": 1770496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701030011, "uuid": "3e49f434-97d4-4d8e-bf65-650e62067648", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701030011, "uuid": "8e8cd70a-e0e4-42b6-92df-cc30c74e25d3", "value": "fe0de9c031ca9cb46e94baa499a4fa1e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f879481e-8c41-11ee-8907-42010a9c0042", "comment": "Malware payload (Loki)", "timestamp": 1700992546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700992546, "uuid": "76df012f-3bfd-4802-939f-6b67ea1f7160", "comment": "Malware payload (Loki)", "value": "d5d3b3c188fec49b76049605f607d04a", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700992546, "uuid": "d2bfda45-2ca5-4713-b79f-ff8d69d7cfa1", "comment": "Malware payload (Loki)", "value": "36dac2773f7e83619a7c2aadb578e78ae39f671bb342a4245fbc078d2d311600", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700992546, "uuid": "f4ddc3bc-e39f-4f0a-a1a9-f3c28fb38c80", "comment": "Malware payload (Loki)", "value": "ab0c74711f581be01dd6aa5dca9de714470ae90f", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700992546, "uuid": "73830347-4dc3-410f-8b0a-c500f78c9e98", "comment": "Malware payload (Loki)", "value": "277448518202422650bfe0d94d3ec43b42c1d6bc4d2152b36b5af73e94997cdf9a96439fa1493cc42da0aadd56ce935c", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700992546, "uuid": "20518c28-ffb4-4c89-870f-5dde2e95b0a5", "value": "T1F5841C1136EF511CB2B3BF615FF5B9AA4D6BFAA2163AE06D1048074E4B63D80CD61732", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700992546, "uuid": "d645bc66-7599-49aa-974b-3f33b3ab80c3", "value": "6144:GXTg6kOUa89eGjTg6kOUa89eGSqNl9nBUYcoUIaI8iQ8qxy74MTYMjSeXGYiJjN/:xyHGYiJjuglFWDYsJmkJYiJmqCKo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700992546, "uuid": "b53c1542-e127-4792-9abe-605c5c6fe352", "value": 407262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700992546, "uuid": "f4d4b6d8-12e4-4a70-8abc-8eba63727bd7", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700992546, "uuid": "8147517e-8958-4b7b-bfd2-6232604f8a47", "value": "citar9775368797987989.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0afd176f-8c84-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701020924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701020924, "uuid": "552575fb-53c3-49a3-936e-f7583ca719dd", "comment": "Malware payload", "value": "8fbc76400035b2d130c3bda71bbd023b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701020924, "uuid": "cd86e79c-c394-4d02-8696-f998546e2301", "comment": "Malware payload", "value": "375367274cf5ec2a759e8b43f79c0cec546751f9f68c4cb8ea2006a29bf10e52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701020924, "uuid": "41edfdaa-3a68-4f71-9158-de70af4db95e", "comment": "Malware payload", "value": "6010ee22b5c4c6faa1b944cbee6b1f58a6af12e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701020924, "uuid": "4bf10d1e-db0e-467f-994b-e79d1e85374b", "comment": "Malware payload", "value": "c8504264eeedc436be2d8e9ed7e375e873b143d43988f8c5598e045b92a2087b8331788e6f8419eae1a4a89e56a8c7ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701020924, "uuid": "ff624cd0-b806-472e-8ee5-cc432e11ed99", "value": "T1BF771216E2F901E8D57BD1B8C9575627E7B23459133097DB12A48A292F37FE0AE3E310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701020924, "uuid": "d80486b9-83c7-484e-a9d4-d077d1f005a7", "value": "7878e4daa75d8a1f8fa3237b352d715d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701020924, "uuid": "b3c03f4b-529e-40b1-97c4-95a8429b2a70", "value": "786432:SddgWoT3f/IPpNiW8t3IMvcfZtq6oIYKcezr:qduLkiWI3HcxtEo3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701020924, "uuid": "e7b6a151-6182-45a7-b36b-80986bbeeb5b", "value": 35977717, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701020924, "uuid": "3e4628d0-3ba3-4081-826a-67eb75015d58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701020924, "uuid": "0c587339-6a75-4b45-9c0c-86a3517b693d", "value": "SecuriteInfo.com.Generic.Trojan.Athena.s.Marte.C.04EE0EFC.15134.637", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9fae3dc-8c77-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1701015607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701015607, "uuid": "a0e597f8-2b8f-47c1-97f9-a795d39ddf95", "comment": "Malware payload (LummaStealer)", "value": "af012e8e2d7901ecc651c1a3fe3e2e74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701015607, "uuid": "084c556b-4cbf-4adf-9164-10ae30015d8a", "comment": "Malware payload (LummaStealer)", "value": "379008f3cf6b96277d0b545dd967dc969d7ef02534afd4a68a4488a805126d13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701015607, "uuid": "ac0deaf8-5bfc-43a0-b00b-e98a78b94eb0", "comment": "Malware payload (LummaStealer)", "value": "f8f9c3fbc9b45b26bb8ed11bd623995a88644d10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701015607, "uuid": "e20d8f55-384e-4129-8d70-e55a7adfb625", "comment": "Malware payload (LummaStealer)", "value": "3283c8e53bcd18846626c93efe3ebb003e91b6a824274dd3d4342a97c7adb405f84ab277ba65e2694f2634bd8720d9ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701015607, "uuid": "01e0c824-6680-4176-8aef-7a31b0d29020", "value": "T142851B1132F95B59F9F39BB956BAA611083AFC69CF11C2DF126094AE0D21BD08970F37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701015607, "uuid": "6202df91-d7a7-45ba-90f2-32441e250ad1", "value": "c7fb2b0f7d1b9bb69de473555ebdc92c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701015607, "uuid": "6c9b03b8-7f02-472f-bafc-fcb98fde2b58", "value": "24576:3HMBMJIR6FC97GkbnwqjWr7eyh6a9DhvhoyhX:3HMB0FC97GkbnwwWV6a3vLhX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701015607, "uuid": "7b51f833-7f2f-4d36-9b07-a9b3bc7ecb60", "value": 1794848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701015607, "uuid": "b61ee3f7-2071-43c5-b9b4-43fb66d7abc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701015607, "uuid": "76780710-6cfb-4517-89b1-635dcc700220", "value": "af012e8e2d7901ecc651c1a3fe3e2e74.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f788807d-8c87-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701022609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022609, "uuid": "27ed5cc2-d638-488d-9f67-6a3ccd566760", "comment": "Malware payload", "value": "40d60eaae05ad8fe9422f73b220b4714", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022609, "uuid": "0432fc69-2172-4c68-9881-1ba88678ade1", "comment": "Malware payload", "value": "385081d633028843513b65627faf769bd86e132eaeb85189a48bffbab22425fe", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022609, "uuid": "02981647-7f76-4352-ab3a-69bc1153f35a", "comment": "Malware payload", "value": "ee4149fa0c67562df5efb92fcece66c4f7e0bacc", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022609, "uuid": "17c7d127-d229-485f-b578-e5654cf5b85d", "comment": "Malware payload", "value": "266c4f0ef7cec5656554f55fb3a8359a61215a074f5e1fe05fc1cfec59d3642a85de59f39523e1612e0b8c530900eb12", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022609, "uuid": "befcec25-8ca5-4721-8b32-8205d40083fa", "value": "T1EA8318EDDE1535190C4FA7BADC0148C1E5BB812D69360169AD9A239D630784CB3FFB3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022609, "uuid": "8e0f7047-ddbc-40ed-8320-521df87e8565", "value": "1536:S5ba33+NpDl19OL8fR4i7AOczBopVq3nZWHFiHNltOHfXSHK7tJpPHKIHy:S5ba3ONpDl19OwfRGzBkqJnt3IfXF7tc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701022609, "uuid": "1591c5f6-a9a4-4abd-b429-c67bc43938c5", "value": 82263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701022609, "uuid": "33fcf19f-b3fb-4da3-a951-1d39b3b96889", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022609, "uuid": "f7e2cb2c-3fe7-45cf-ba32-48d6208539f8", "value": "awb_shipping_documnts_delivery_20112023_pdf_00000000.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91b39b20-8ca8-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1701036612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701036612, "uuid": "667684df-fc8b-457c-9e51-4b7498a65bed", "comment": "Malware payload (LummaStealer)", "value": "7851ec670ec33d2b4a1da502cdb6b6ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701036612, "uuid": "4cd261ef-267f-47f7-9eea-364f96cff17c", "comment": "Malware payload (LummaStealer)", "value": "39090220e7f3aebb889c42c6be8a76aacad14dd1a8300985b3573a062355e4a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701036612, "uuid": "53cc8597-453c-44cc-a17c-2a4a1b9cfc2d", "comment": "Malware payload (LummaStealer)", "value": "76e030052df997e174f64201bc7ff335f80f1fd7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701036612, "uuid": "dd09c758-5ec1-4d8a-bdc6-8b26d05fb319", "comment": "Malware payload (LummaStealer)", "value": "b77204a1c700504447ff1570189bc05a012c264eb51da9c6564b7319724ce165a2d92f5465fd83f9cae67c73ad0d107f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701036612, "uuid": "4b25876a-7cf0-4a87-b6ae-d329e47ac76b", "value": "T11C158E2179C09072DDE220B743ECFA3642ADD4B0072546DF46DB7BEED6606C26F36686", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701036612, "uuid": "86a046d1-a4e4-462b-8705-5cf5eb260ff8", "value": "9484afe6da674c93e28b2a435d059ca0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701036612, "uuid": "02765fea-d88f-4345-91bf-360bcabfc660", "value": "12288:TDRpruKN0YWKQDIMpp5pcnfw53mw9FDrAQC80JUu1D8mi9ctGrI5K:TDRYKN0hKQDIM35u23mOfS88i9ctGrI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701036612, "uuid": "f5f28ce6-9074-4355-a8f3-c19660c009b5", "value": 954368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701036612, "uuid": "eec06eb3-fc8e-42c1-8fb9-f04c25351522", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701036612, "uuid": "42ca852e-54c5-46a8-9a8c-6eef78e0c9fe", "value": "7851EC670EC33D2B4A1DA502CDB6B6EE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7f1b841-8c42-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1700992921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700992921, "uuid": "bfd70eba-780d-44a9-b820-9c34dfdb27ae", "comment": "Malware payload (Stealc)", "value": "53924ca2caa957a4f549e45be6ef38c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700992921, "uuid": "e02e066f-b2d4-49c1-b7fc-09a566738a28", "comment": "Malware payload (Stealc)", "value": "39e0d9c8beb12b8fa99310db9c8474d7ebcfd75d9c592f7f6fb97cc469b5e5e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700992921, "uuid": "b94fd1d6-caf7-48c1-acf3-c5cc5fe21bf4", "comment": "Malware payload (Stealc)", "value": "aec6674e33519c9773a4f9fbe725544ef612a47c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700992921, "uuid": "86e8f0fa-2b1e-43ff-96f6-8ba075e82698", "comment": "Malware payload (Stealc)", "value": "0935b23a9a355817fde71514184b40f77a3e5646abb5ce71b6da4a3c4876c9fffad345604931e0d4d8f4a0eaeb980ac8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700992921, "uuid": "72ee7712-d923-4581-b71b-4cd820db3d88", "value": "T11C54C40382E17D41E9268B739F1FC7EC7B0DF6518E09BBA91218AE5F04B10BAD663715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700992921, "uuid": "57ec8778-edd0-4877-b052-9a09b3a4f071", "value": "2982b8e2da4df297bf73bfc93d77b7d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700992921, "uuid": "d76072c1-3e54-45f9-9367-bd0511bc50f7", "value": "3072:uyKaNZHVdLE5xs6oHITyfURE7hZ5m/wUU0+XQj+b:hNNxLEfGoTyfT6lU0I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700992921, "uuid": "da392744-c8d7-4f0d-b37b-4d126fa52da7", "value": 296960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700992921, "uuid": "c6f79168-61c3-4e6b-bae1-ef7c02142dd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700992921, "uuid": "eeaa731b-f439-4d78-b3c7-9607c636791a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39b945cf-8c7a-11ee-8907-42010a9c0042", "comment": "Malware payload (QuasarRAT)", "timestamp": 1701016707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701016707, "uuid": "03d213c1-2177-471f-8497-7825597b14b0", "comment": "Malware payload (QuasarRAT)", "value": "376a3dc05bfe42276458069cc4f94f9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701016707, "uuid": "68d4ee8f-392e-4b54-b59c-352856694bd1", "comment": "Malware payload (QuasarRAT)", "value": "3a8a3be6bfb60b2b9b2d02cc6ddf57e2ff0cb001b764df199026adc4e287ec4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701016707, "uuid": "e4add139-282a-4c56-9f75-b5b638076c02", "comment": "Malware payload (QuasarRAT)", "value": "f8aa05b336f47e781309675272df96053db152f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701016707, "uuid": "102e34ec-2637-480b-9548-e2539588e6fa", "comment": "Malware payload (QuasarRAT)", "value": "b918a816496c9a57fc751a24da03b5d0ea5da7bb9691fe5d0cf802898eb83b04d018001a87515ba3bb429ea68daee10c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701016707, "uuid": "e4557ab1-45b7-4eae-85f6-7cf2f1938f60", "value": "T1A105D1A82BE58BA9F2EF1F7798F17A179735FA91D62FC30D18400C9C0C62B566940B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701016707, "uuid": "64e4c6c8-3935-402d-934a-07ae4bae4c70", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701016707, "uuid": "fba21d9b-7ee7-4ced-9d2a-b94d272bda44", "value": "12288:JD0ICaVWX5FQIoltjK0uchaqhCAEAL3zMM8ULpRReMadlkRcu5GN1x+5B/5pvGr:evQIUpTCaL3zMZULTReMawN5GTcrGr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701016707, "uuid": "8ad56938-a19e-4e54-a126-3b7ab214cb91", "value": 860672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701016707, "uuid": "a3a9e908-e7e0-4334-9b46-162114a68a3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701016707, "uuid": "0d9bd7a2-63e5-47f0-85c3-a1d214bf9e97", "value": "376a3dc05bfe42276458069cc4f94f9f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6204a47-8c82-11ee-8907-42010a9c0042", "comment": "Malware payload (Phonk)", "timestamp": 1701020406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701020406, "uuid": "f4cef696-5efe-4d83-91a0-c05f5a0053a2", "comment": "Malware payload (Phonk)", "value": "8c86599cf0a55ab0a54fc6784f54c475", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701020406, "uuid": "31b46f7b-28b7-4646-8144-49ff76f50acf", "comment": "Malware payload (Phonk)", "value": "3ae3872da165258fb763aec5659bf4fc309ca360e37b295c1912d1c0b1e91cda", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701020406, "uuid": "3b616bb5-dfd7-416a-ba04-f174ec8c54f9", "comment": "Malware payload (Phonk)", "value": "51cbca510da76683a4e191b0a3d385c77d328b8c", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701020406, "uuid": "0541fb52-12e2-4234-9836-95af08c55d69", "comment": "Malware payload (Phonk)", "value": "4e881815da4d45a884207ca97466d3a5aa99c53705d8876e4c90867551247589668a2fccb7aaf52e2e14910f2f5c94ee", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701020406, "uuid": "3354c8d6-d543-4740-98b5-1d68bb65e26a", "value": "T1F616596C7C620C6CCD6D16F1A16C1A9B8F45CC720F2165C963AF7BD86F7E2C3858906A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701020406, "uuid": "1cb3776a-4cec-426c-a042-316bb950d38f", "value": "98304:r6aK388T5gQKzzMniyzS3vv3jirr3jjWiTaOvifviOr:r6a6lK0i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701020406, "uuid": "bff4a43a-a00f-49b3-9bc7-3d38b88f04b7", "value": 4200960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701020406, "uuid": "f0cfd9c5-e451-4c2b-8fc2-6ef467c07336", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701020406, "uuid": "2c143850-3369-4d0b-b111-ce8156b383cd", "value": "8c86599cf0a55ab0a54fc6784f54c475", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3279e49d-8c37-11ee-8907-42010a9c0042", "comment": "Malware payload (DBatLoader)", "timestamp": 1700987919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700987919, "uuid": "cc9b96ac-aa70-42f4-82ca-1fb074d6bc9a", "comment": "Malware payload (DBatLoader)", "value": "0cc7dbc2765838b8049a8240a74b7f0d", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700987919, "uuid": "dbbca909-259a-491d-a512-2c201973dd1d", "comment": "Malware payload (DBatLoader)", "value": "3c049c22293a2ca0d2529b8bf1f8956ca99cf0c428c12eb625b4e8d614e056c0", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700987919, "uuid": "341ade75-35d1-4edf-aece-f602051ae581", "comment": "Malware payload (DBatLoader)", "value": "caed5646626b5a15cfd4762b313bf83a45eb4478", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700987919, "uuid": "1307e4e9-ac8a-4934-9306-aba637ca1e80", "comment": "Malware payload (DBatLoader)", "value": "199c4755b7b2f895864b4c391b2a4bc2969ad1ca68e9f1c9612aa8a97e1eddd0f981581e5a8f93ae9d9bda022f609412", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700987919, "uuid": "b58468af-adfe-4d23-b24f-2ade2352a50c", "value": "T1B685E1729F60C172DC673AFF6C1B8185C8293D656E5938761FE835C84A7A7807C3A287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700987919, "uuid": "a719f0d0-f044-4494-beb3-0e419c96ce12", "value": "64246ffa312721d4dcd10d9cecd821df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700987919, "uuid": "6f028190-f380-4a01-8324-1621818f5b5a", "value": "49152:bZAtX8IxTqh0eJa3DZEe9sRuCVCW4cMyqChsQ:bZmXX8Za31CuCcIMXC+Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700987919, "uuid": "a9366dec-36c9-420b-9b19-5612826f66fc", "value": 1740800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700987919, "uuid": "dcdef864-e123-4cf7-928b-2913f6ee8a43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700987919, "uuid": "b95ee524-03bd-4b3a-ba24-9631afaf39bf", "value": "Acknowledge_Letter.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a583215-8c8a-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1701023527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023527, "uuid": "0c7adf23-7406-4ad4-bec5-b37acbd952d8", "comment": "Malware payload (SnakeKeylogger)", "value": "d6373bb449c618767f149376007d8531", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023527, "uuid": "5652ab87-b425-4b26-9a2b-3e78562a1ae7", "comment": "Malware payload (SnakeKeylogger)", "value": "3c6ab74c9de7c47f9376589eeb4806c3a1fbc24591833f7b008284c8afe5078f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023527, "uuid": "f9ca0853-08cc-4b69-966c-a7a06064ef4b", "comment": "Malware payload (SnakeKeylogger)", "value": "398289daac94086f60320644ba3f8ef8b4fb04ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023527, "uuid": "c8aa07d5-da4b-4eaa-a096-fbed92de308a", "comment": "Malware payload (SnakeKeylogger)", "value": "6d14d2d19537846986e5d680970d4c0f0f7128871a7b96aa169c3259c10ad033f9bdf20dbfc1b977abbf8e30d4cbe2c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023527, "uuid": "78abba4c-8a19-46ee-bae2-293d5148d935", "value": "T190B412247A2C5F97D6780CF28015218407FBE6FA5589E6DA9CC131CF29E7BD91B01AB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023527, "uuid": "0ce00c4a-3b10-4396-8c4d-d006c90e42ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023527, "uuid": "062ae197-e542-45bf-b77a-6aca49591404", "value": "12288:FN8oX0F3P1NMLwlfVgZ/mDnIroFUETfRWoJCWv:cQ03NJfVgOIroG0RdJdv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701023527, "uuid": "3d257e45-7545-46cc-b872-69c6bcf884c1", "value": 504320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701023527, "uuid": "4c0de96d-789d-4507-8294-c6bf7512c6e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023527, "uuid": "3556f8d6-9ac0-437a-a12a-bcbda39bcf4e", "value": "Ziraat Bankas\u0131 Swift Mesaj\u0131.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1464a7a8-8c8a-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1701023517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023517, "uuid": "05158161-6a07-4137-9021-cf95148d3c70", "comment": "Malware payload (GuLoader)", "value": "77c894e6216cbe51198bdd43a32f4e1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023517, "uuid": "c33f74f3-0753-42b5-8601-38c39ab9377a", "comment": "Malware payload (GuLoader)", "value": "3d74765a14482437a5fb7f6dd1e910aa92e47027a8395de4b317e81d4a01b44f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023517, "uuid": "1c03b68c-f588-46ec-af68-7bcbd8a3265d", "comment": "Malware payload (GuLoader)", "value": "5b9e8596c1e546910ab0e2a4f3eeeb7586a73289", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023517, "uuid": "7fb32d38-b7d2-4a88-a82f-2ceeab60f54b", "comment": "Malware payload (GuLoader)", "value": "8902c242d3d279f2793a6ef91a7e4faa4f96425adc1ac21042c7528b57505b710ae4b8791780436d65de7151e052f36b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023517, "uuid": "76a2e47a-bd87-4f67-a900-1cdc913b0303", "value": "T1861512204E86C42BE22E897962B0FA71CA4FDC6805E3C463D6FF9D53F2707C1796A165", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023517, "uuid": "e33c64a4-f917-4cff-8e1a-fdcf25748249", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023517, "uuid": "447acb46-8683-4c6c-a4fa-7013dcfad420", "value": "24576:W2B5tRh4f4ZOY47+4r0O5fgih3ihW9NVBDxyPvAYZs:hBrRh4gZN4h9/3ZOPv9s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701023517, "uuid": "6b07804f-73a8-420c-a98e-f7900be41f91", "value": 936850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701023517, "uuid": "624e61c4-f36c-441f-ba64-10a3a07bfaf9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023517, "uuid": "bffd5c4d-e075-49d3-9057-47acefba7e74", "value": "Ziraat Bankasi Swift Mesaji.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "756dd33f-8c7a-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1701016807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701016807, "uuid": "f0eedfea-70ab-4da4-8b20-f30d51368559", "comment": "Malware payload (LummaStealer)", "value": "af70c85c42788d138305e621e2b212af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701016807, "uuid": "b97de8a4-c64e-4ca7-82c2-9441281f2990", "comment": "Malware payload (LummaStealer)", "value": "3daf8e60d80ec99e94054839d8cbd1f2f4ce3c8660a1084b9f7164fede1919b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701016807, "uuid": "4bf58337-2923-4082-8edd-889fd0897470", "comment": "Malware payload (LummaStealer)", "value": "e81cfec2a9c8c50be845d8cdc7140c850a0d3498", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701016807, "uuid": "2edf3b9e-6869-43f6-b44b-50c6053f1e59", "comment": "Malware payload (LummaStealer)", "value": "08e0cff98fdc1b89fd26b8d8ab364e07989c8c4c60e24613c5404c4a4a744dda4ab753eefc240de039a9553c2ca145fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701016807, "uuid": "d2e00840-3e64-4ef0-9d71-85c0e129fa25", "value": "T1F3252311FBD9807AC0B943B038FB429717327D969E78835F2712CB1F1AB21D46975B2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701016807, "uuid": "d5ed4740-b886-4123-8b09-42e60aceb5ac", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701016807, "uuid": "6a0e20b6-c9b0-4526-bc90-6d5909e7d27a", "value": "12288:aMrNy903NoGffqB1LcDv49if8WYwC0GGhJIcGiYfj6o1LEGI+lNcTvhj9OD:DyafzJf8NwC5jKGJrcTZj9u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701016807, "uuid": "a718c34f-d303-4e11-ba06-fbd1d0795576", "value": 975872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701016807, "uuid": "b9c415a8-0f7b-443e-a9d5-6297b5269981", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701016807, "uuid": "80cb42a4-4821-44a4-a9d8-db911fbc280c", "value": "af70c85c42788d138305e621e2b212af.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9115485d-8c7b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701017283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017283, "uuid": "96cd0b2a-72bb-4a78-9957-5fb330e20b3f", "comment": "Malware payload", "value": "55d5b7b9820b45137816fdeed3a545c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017283, "uuid": "62a5dce3-a97b-4d73-b487-6a2dda8c730f", "comment": "Malware payload", "value": "3e9934d83d5ed6102c456fc4288e12dba08e13874c7b7f6c619516b06349cf1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017283, "uuid": "7f745466-c3b1-4c9a-a8ea-c6f8f0fd4948", "comment": "Malware payload", "value": "52f0e983a763bf4edf7fdc9f6ecc3a44bdc81080", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017283, "uuid": "1fadc0c4-4e2f-4009-9e6d-f1811b7f1464", "comment": "Malware payload", "value": "1fcac32dd23144a4d82b8f50ef7999a7c9d5e68af302530d15f57a4d53d36e8f3885d0183bade17f0e1b196c2026f8f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017283, "uuid": "fa3f0fec-1c5f-4252-a924-388128829825", "value": "T112355C5AB36401E9C1BBC16DCB069517E7B074590730ABEF5AB08AA31F23FE1A53E711", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017283, "uuid": "dd719d5b-dcc7-4d05-be3c-5dc7a0087a7b", "value": "24576:OXWPXIFrmU8iIeg8FsnPUMJ5MXe7wcpymH/xcGmQJhl:OGPXINuiBg8FsUMLMX/mH/xnJhl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017283, "uuid": "d3bbbbca-82e1-4998-8d1f-4e6251272178", "value": 1087960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017283, "uuid": "74a8180b-39cc-429c-b288-f29b6ae5f5ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017283, "uuid": "09efa6e6-5814-4f5c-bd01-50d9f5cdacf0", "value": "55d5b7b9820b45137816fdeed3a545c3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1612c9e-8c25-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1700980508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700980508, "uuid": "31122e17-c1f1-4c13-ac24-9426ccfe21b2", "comment": "Malware payload (RedLineStealer)", "value": "638c8e2ad7df3a5dc6e5fd42e9a6aa69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700980508, "uuid": "9936a549-9299-4bc4-af21-575032fe9604", "comment": "Malware payload (RedLineStealer)", "value": "3f3db5abfb02754f3e57374c328736c80664abea892a397018ae5e91257edae0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700980508, "uuid": "e8cb63ea-fc73-4b2d-9556-34858186d520", "comment": "Malware payload (RedLineStealer)", "value": "d85a3cacda2b2a4898c200d2be72574c292b6ff1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700980508, "uuid": "477a932f-2974-45e1-bf08-7851d7616d0f", "comment": "Malware payload (RedLineStealer)", "value": "1e0c55f5946c689cef1f3aa48b90fc770a248e612baac04b5ea8e8df4e17bf364a9b52efef48077dd6b99cc5a13a22fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700980508, "uuid": "ae6d5e91-25cd-4d3a-ae6d-bd97560def33", "value": "T1949533519AD54496EDA42FF48CB31BD3193A78E9FCF0A33B132DA14D1D22685B5B032E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700980508, "uuid": "f0a9e857-de8c-4ea3-896c-d280419fb8b9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700980508, "uuid": "a3a1160c-2895-45b0-827e-cff19b767b37", "value": "49152:YNxQL08sqMYRjwKRMPPvcY06qD1s4t/Kmu:f08sqMY9ZFD1su", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700980508, "uuid": "b42cfe0e-4264-480d-ae44-5cdf00dadd28", "value": 2028032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700980508, "uuid": "a906eacc-ec77-4331-9580-c341e2b91471", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700980508, "uuid": "7f4b53b1-437d-4913-96df-9177ebf90f6e", "value": "3f3db5abfb02754f3e57374c328736c80664abea892a3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd7fac94-8c1c-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1700976609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700976609, "uuid": "14c4f152-d6b2-4ef3-a478-dd643f27e351", "comment": "Malware payload (RiseProStealer)", "value": "1cfc8480cb65c8287664c7569266e77d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700976609, "uuid": "5fba5113-cc69-4346-a141-784ccd1ee737", "comment": "Malware payload (RiseProStealer)", "value": "4056e8171d006f7d74f94ff54ee023a3fdfe9e1d61feaefd5838a247205e3b59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700976609, "uuid": "7d2038bf-f92e-47ef-962b-684eefd4f120", "comment": "Malware payload (RiseProStealer)", "value": "aaaee55fabbccf78ff5d85609d73770ad5eac50c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700976609, "uuid": "25216c42-57c7-4343-9923-7915da8faebb", "comment": "Malware payload (RiseProStealer)", "value": "200efcdc54b3324fa719b1df4cd7f7139d873a9dc3af6a4d629390adc5673a725b574890dcfd7dfcfb16d51701d9788a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700976609, "uuid": "8d26f702-a1bd-419e-b0fa-15dd37ade53b", "value": "T10E45231BE6E8903BE8B05BB024F316D32775BCA21DB517262765F41A0CB2E9A703571F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700976609, "uuid": "962ae0a6-0fd8-4d5d-896f-35767ead3565", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700976609, "uuid": "5dc0b041-b859-4fb1-a311-ef337d8492c4", "value": "24576:Uy0oWojV3s0g9AUQuru7sVTFE4615nq0noG06zC1Yw:j0vIV3pg9AUQut211JReqC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700976609, "uuid": "7fd79a80-db15-4db5-ac7e-a908e45bd539", "value": 1220096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700976609, "uuid": "8230bb9e-e018-4cac-acbe-2c32510fc620", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700976609, "uuid": "bba46658-1d54-4e7a-a918-74bab68298a1", "value": "1cfc8480cb65c8287664c7569266e77d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3e79f52-8c89-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701023462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023462, "uuid": "dd39c36e-0538-464f-8c9b-dfd8a2679092", "comment": "Malware payload (AgentTesla)", "value": "6540ef77b6de6a071ca2697789a88b07", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023462, "uuid": "a353df1e-d5c2-4169-906b-3494d412f606", "comment": "Malware payload (AgentTesla)", "value": "417c014bc55b923fc390e5db0a1c3ec3cc666440e16f20adc049e3bb1c3fbbdc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023462, "uuid": "ac3203d5-e9c9-4685-815f-82e38ac69647", "comment": "Malware payload (AgentTesla)", "value": "be477a163a70e88ba6b15c4152cf4731ea82d655", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023462, "uuid": "de64d99b-4e4e-4c38-9454-1050056ecbc4", "comment": "Malware payload (AgentTesla)", "value": "b68efe0e75f1640035be100722c743f3fcc531ac261e41531fccc08694641b315ebc51a65322f1ad4f5c9ef609f065c7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023462, "uuid": "bbcf1e30-f6d9-4763-a4c3-6c2d390ef534", "value": "T10E05CFAC761075DFC85BC8768AA45C24AA607C7B930BD243A467369DDA1DAD3CF240F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023462, "uuid": "9203a459-305f-4238-818d-d8b61dc7fa59", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023462, "uuid": "661afbe9-29b4-4ffa-8365-49dbdc988a98", "value": "24576:hf719tD/IazAZV235EMVVWqsFhsIUwYEN:hfZ/nzA7G/sExw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701023462, "uuid": "1ed64b55-512c-4284-83c6-3f82731515d1", "value": 796672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701023462, "uuid": "f15cbe88-6a0f-4b14-92d0-1f555cfe3eb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023462, "uuid": "def8e08b-01a7-494b-a0a5-1825acbd118b", "value": "DHL Delivery Invoice AWB2774038374.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dba59c7-8c96-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701028740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701028740, "uuid": "3ad0a51f-5291-4008-8913-a5fb48b9a71c", "comment": "Malware payload", "value": "3b2fe02f4b36e21fcf91271b0822c55d", "object_relation": "md5", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701028740, "uuid": "249590ca-638d-4315-b697-1dda01e98c05", "comment": "Malware payload", "value": "4251aaf2974de65933d918bede1e98c25292e7be424e750ab580fb85c50e0923", "object_relation": "sha256", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701028740, "uuid": "e3e3cf5e-c5a1-49c3-8450-068edad6354a", "comment": "Malware payload", "value": "9fc2b266a797ed84b5fc2ea3167d8e592a74de88", "object_relation": "sha1", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701028740, "uuid": "1c8e2c7c-2170-4100-afcd-fab7395e25ab", "comment": "Malware payload", "value": "5016da5e29b3d1ea2c2d0789c439ee718eb3795a82032c74eeb62b08683d4229a19cbf594bbfede054f27ec14f837899", "object_relation": "sha3-384", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701028740, "uuid": "1256b7af-852c-42be-82c5-fb6715871ebe", "value": "T189053312E19F68582368A1F0A2F1BC73AA5670EC6493E5F462F1712DB015E9E30357BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701028740, "uuid": "2847c1d0-23ff-4c7d-909d-fc3ecf50a7c4", "value": "24576:tNkh1d1UiUtb0PG+yg+0J7wfKQ7EICqQIiZqXwyka:tyr3utb0u+yCtwf7CqQLZqdka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701028740, "uuid": "ded2d262-adf7-4b17-8d40-f702a792d6a5", "value": 848833, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701028740, "uuid": "e81dd2a7-1751-41c2-b9fc-6062dbfdba62", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701028740, "uuid": "1c57e1c8-a132-48cb-87d4-b3f0c6c66304", "value": "RATIONEb.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35b9b96e-8c8a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701023572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023572, "uuid": "e5a655c6-de1c-426e-8d3e-6e638db39e3d", "comment": "Malware payload", "value": "c0125f46f51d36a7f844cc3c6c641eab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023572, "uuid": "1be3a751-02ac-49bb-8334-32bcdd536c3b", "comment": "Malware payload", "value": "427805d6bad2ca577d4b45dcea2c2ef1abaa96453a987ab31f80e5468ff78597", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023572, "uuid": "607580fe-395f-4789-825e-e1e4e96abec8", "comment": "Malware payload", "value": "72a6fe47f06b1c8693f213df882702c3e0d0cbf5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023572, "uuid": "9b6c5aa3-cb39-4b23-a19f-f82e79928580", "comment": "Malware payload", "value": "5da5c56df849bc4e49fa5040b940a3c5d925f212c5c2ab609d311a21d29ac4ac946ce7e636c5c7a243bc103fa996df93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023572, "uuid": "c12c408e-22f8-4ed0-a202-1dfbf88b1234", "value": "T1882412127AC29927E6F662725EF75377D371E6284011480B0F9C1F6D2A223879B3B2D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023572, "uuid": "287d45d3-1d22-40f4-a833-4a4cb76e4745", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023572, "uuid": "ad25ad28-69f4-4d41-b7db-9f6f211a0e52", "value": "6144:BPKyLLMCz1uZcw3y8UJkP3lQFTMTGwphrA8Q:o3Pcz8U4qNMTlc8Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701023572, "uuid": "1adae5e8-cc49-4f04-9df5-41a5772f6437", "value": 214689, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701023572, "uuid": "9ef3e512-be05-4884-922e-13b7645af205", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023572, "uuid": "d18a3647-17a2-492a-9743-37d1d499324b", "value": "SWIFT COPY HSBC BANK-73893708.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd17fa0f-8c8a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701023826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023826, "uuid": "2e52f4ce-0930-48a4-bbad-d669734adc02", "comment": "Malware payload", "value": "003ec1dd0a2315552f5616b5f60500ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023826, "uuid": "5c859e1b-3e3e-44e0-bdfd-ecea3188e986", "comment": "Malware payload", "value": "4290d87e3888e6d86606f1141549b043e32ff7039f8f3cbc0ff4317603ce567f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023826, "uuid": "08ff3e25-304a-4e1b-9b1e-bb5408d435c0", "comment": "Malware payload", "value": "20756c171c7456c9b1d554fbd69175bbf7150c9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023826, "uuid": "8020a0d3-bda1-4d27-a284-093248085041", "comment": "Malware payload", "value": "91913cd8a078015f35cd2e831b370a07b33b90efb0a3b204cb083aed634d9238be7148ce55fc0d1a1f3fbfd81d8bce09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023826, "uuid": "f0439850-48da-4a83-8dbe-691a5a553f5a", "value": "T134D5338B52809131D413EAF82BB1F7285AA77ED119614C6A7DFF1DDE0EAF551002CB2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023826, "uuid": "82c3aa6c-56a5-437d-9f04-4276372faa60", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023826, "uuid": "f05f3d23-99e8-4a78-b5ee-c7ac50ad80de", "value": "49152:c21yF0cd1E2n6faeHD6tn+VloJh5JtUt30blsBDI2t4OojvCH9zEAnR0R+S0WD5A:R60cd1Pnknl8X6BzKJgEAnR0R+0TlE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701023826, "uuid": "1fb2bc89-5ce1-4e82-89bc-149e25297e48", "value": 2869227, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701023826, "uuid": "b1ca8e95-5238-4a79-8d95-32fbee96c022", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023826, "uuid": "71e209da-0abd-45e3-b278-e51568802c2a", "value": "003ec1dd0a2315552f5616b5f60500ed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75748093-8c88-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1701022820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022820, "uuid": "0d994f5c-2307-4f67-af5c-ceacff82c2bc", "comment": "Malware payload (GuLoader)", "value": "53981e94bf9b125871ff3d555fcb6e18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022820, "uuid": "f38a8733-b2ee-4528-a9ca-ae4914032bb5", "comment": "Malware payload (GuLoader)", "value": "42bb4ea726a68142140dbe3953e6027f5176aeb359d06ca71652bfd61a3a4898", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022820, "uuid": "60d7ece7-f77f-4e6d-91b9-f6d299d223b6", "comment": "Malware payload (GuLoader)", "value": "9d4ba161bf60e243951b436feb14c2c0d3284a73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022820, "uuid": "5d0bdf43-6474-4b5b-88f9-da594dcc7c97", "comment": "Malware payload (GuLoader)", "value": "41d78fac3893c43bc3fbd644c03ec529ad5ea3e828ddf78747931da5b4b9a06c386c0c889d71b285912a13eb6fc7b8eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022820, "uuid": "72c3bfe8-3b74-4639-979d-85490699c216", "value": "T1568412816344D09EE56A16325F3BAEE617A93C3D19547A8BB6B4F32D383F252C70E305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022820, "uuid": "2cc91643-2f50-4ed0-9b7c-b9a0633a0a90", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022820, "uuid": "704d804e-cc2b-43cd-802f-5ca88b402589", "value": "6144:bNDlOltlhJka8EOHDn7m8aviLBdRIdpoqgYT83+KAmfL3:but7JkzEOjn7mHviPlA8OxU3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701022820, "uuid": "6ba4b392-2c0c-4cbd-8da7-97f1a4c66c6b", "value": 377884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701022820, "uuid": "b37e40ac-fc13-4518-84c9-1384e94e5fd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022820, "uuid": "cd20e10f-f42f-46fa-b682-c964df7c64c6", "value": "OFFER REQUEST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0be0a263-8c19-11ee-8907-42010a9c0042", "comment": "Malware payload (Vidar)", "timestamp": 1700974969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700974969, "uuid": "6db5fb7a-1045-4229-899b-d7038061819e", "comment": "Malware payload (Vidar)", "value": "7d58c4cda8d8bd1adc2815fac5d375d3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700974969, "uuid": "652ce097-311b-4c41-bde9-81545a5a36cf", "comment": "Malware payload (Vidar)", "value": "42e2ad1b0ae1c68d812cc652e0167b2b51d51fc33712fba712223704ea609435", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700974969, "uuid": "52e0a522-f81f-4d19-a19b-981cba0bb13f", "comment": "Malware payload (Vidar)", "value": "6930f407789a62615afe768b49004cb2417718cd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700974969, "uuid": "d3749574-c6b9-4fcb-a4d4-08626dce2bee", "comment": "Malware payload (Vidar)", "value": "399494bc2e32c81ffe12aeca0b92af80108ff27eba60b587718b79cadac5afc56f61b3283c15d4059f085e0baf7ef73e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700974969, "uuid": "0362be4a-c1aa-46e5-b212-5d5896fd1244", "value": "T1E2258C4C97EC4A5BC68C17B5E012C74F4BB4C51696C3A7A6F8C9A6701CCA7929ECD2C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700974969, "uuid": "a1d6cdd9-389b-44b3-848f-c86d64fefdd1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700974969, "uuid": "a9fe11fe-5610-4496-be03-b7ae4ef40156", "value": "24576:yvIBSE0pqRvQ/oZI/odwn4EPNNlgDs1W/ejMK:o88MvQ/oZI/odwn4EPNXis1Uej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700974969, "uuid": "e1f47330-0890-4fc3-b27e-5aec1a3f1096", "value": 1024512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700974969, "uuid": "39f317f0-c86e-4808-80f4-e9de6ebb564b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700974969, "uuid": "abe53a88-8890-4a0e-899d-4630ba299856", "value": "7d58c4cda8d8bd1adc2815fac5d375d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c022f7aa-8c7b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701017362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017362, "uuid": "ab4ddba3-0023-420c-9403-370b1847f85b", "comment": "Malware payload", "value": "46248a971ff607229c9baef0f4833712", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017362, "uuid": "c106219e-1601-45f7-b7e7-728142dfb13a", "comment": "Malware payload", "value": "48472100bf2e9756df7afb1716886390e13ffcea03d18db32baa4721373bafcd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017362, "uuid": "47694d2d-c41d-43e2-a535-7dc10c6fcc2e", "comment": "Malware payload", "value": "c648fee3f742c73d688bfcd2101e8aa4edb0db8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017362, "uuid": "34c62c0c-c4ba-4d46-bd0c-961c258934b2", "comment": "Malware payload", "value": "1c836d17dfd5a271ec595d0a7b8ebebec2579ab42ba640c3bac9331f9155144a22a238136c9d00b18f46be2a2a1e15d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017362, "uuid": "3e51d49c-8af8-4733-b160-ba12b9820b42", "value": "T1C145B403B7C78BE2C16A573EC6975A0C8371DD816393EB4A7B8A236918837BE5D41607", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017362, "uuid": "277c19ae-ffce-469d-8adc-d36c489104cb", "value": "12288:tDXSev6lR4AkO4hfpwXzM5GR7jpT7ZmlG3CrjJIkpEakSGoCSbi0BE481KD1gUH7:JsEhfnMB7ZmlI7ar3i0W4U6Ry/c1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017362, "uuid": "0099eff2-3a42-4b23-90d7-02153499d67f", "value": 1270784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017362, "uuid": "0ac2af8a-30b2-46e0-97e0-e850dfd3b267", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017362, "uuid": "eeebca64-1996-4a03-904d-bb802fb31e08", "value": "Vbcob.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80673f03-8c0d-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1700970011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700970011, "uuid": "994ae400-1eac-44ec-86b4-de6aab2a65ca", "comment": "Malware payload (Stealc)", "value": "d365ab658ae81292e5b2a53160656bea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700970011, "uuid": "8c4dbc4b-d9b0-4552-be4f-35e56fde664f", "comment": "Malware payload (Stealc)", "value": "484da5003c2635306e7fed565b9b0f53186ccaf21888b4050ab5ee3116c09c4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700970011, "uuid": "be941740-fa05-456b-89a0-4c2beaf37871", "comment": "Malware payload (Stealc)", "value": "d6ca0e5bbde12af2499a31d4ff728a6baed9d571", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700970011, "uuid": "e49ca2a2-94d5-4866-bc79-cba54f349eda", "comment": "Malware payload (Stealc)", "value": "f0bed219dc7b03fe2d9e6696c1a7296709451cd3719ad404c8a8ceb05d8d0ddd4e1b9da2cce13d452dc358d418e21d16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700970011, "uuid": "a8ddfe0b-bb80-4153-b812-3d58f87b9be1", "value": "T17954D65392E13E44E9268B72CF1FC6EC774DFA509F597BA92218AE1F04B11B2D263710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700970011, "uuid": "f9068923-7abe-4b50-b656-08279085cd72", "value": "c0846180de212a99e5224d9162840371", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700970011, "uuid": "df7ef912-e9f1-4033-9e40-342ca85203b7", "value": "3072:hIzesrVmZ+4HMyau1yKeRClRD4eRRGQ5mgjnFT6C5kVyBk3eFx/RiPB:wPrIZ+4HMyau5ewBvSKFn+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700970011, "uuid": "49134087-dee4-4577-bb84-c6ad17462107", "value": 295424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700970011, "uuid": "17df310b-8ac1-4800-9561-a7d89ad9148b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700970011, "uuid": "0f7e88b5-c173-4583-a19e-a6283d454dbf", "value": "d365ab658ae81292e5b2a53160656bea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "306196d7-8bf4-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1700959139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700959139, "uuid": "399715e5-fd17-44bc-915a-8705a4ebecd8", "comment": "Malware payload (RiseProStealer)", "value": "fe272079b7ec50fa88cc260a56eaeff9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700959139, "uuid": "b8fb44f7-380a-4259-b5c3-c061e0239341", "comment": "Malware payload (RiseProStealer)", "value": "4b5dba699513ecdcd56e01278e41f3e587e98db26bd145c85ec3ca03d59acdd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700959139, "uuid": "6784235a-66e0-452c-971d-b2ae40c8c709", "comment": "Malware payload (RiseProStealer)", "value": "a7fe14fae9d8525c9fda4b3a45fee834a5c85d20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700959139, "uuid": "6ef6674d-4126-4f1e-bb7b-82bf56a225be", "comment": "Malware payload (RiseProStealer)", "value": "102f28b20fc21364b22f045159de47395f9daf9b6cbce12d29b2ee9f96004346b6b39066b074aa783b3569f9f5321094", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700959139, "uuid": "9f00e92c-9223-4581-b3f9-d4200fc3545a", "value": "T126658C31FA08D4B6D09210B0916D6A7B91587A322BAF4CD7F3C05E6E41B52D2F235F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700959139, "uuid": "d9e631ad-5813-44ff-babd-06e8a6f77880", "value": "078471ac5a76189ffe465abe0c89c6b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700959139, "uuid": "2c0842fb-fa12-46db-a51d-c341a4194479", "value": "24576:2opGDjnvrPpkjos0OtjcFc5kM49dj+IuxWQOIjuJuVvhbqL0HtFcgekRP9dT0WNI:OnvrPGT0Egyudc4tI3bqL0NFchaP9dTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700959139, "uuid": "03adc230-8135-4262-8252-5ecef8d60bd2", "value": 1539764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700959139, "uuid": "dfb59617-b89d-41f6-a935-80582f5bbe0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700959139, "uuid": "dba456cb-3a2e-402f-9e76-f29466160396", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bcaae31-8c88-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701022777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022777, "uuid": "9a506a84-738c-43d9-8edc-39c3601dc84c", "comment": "Malware payload (AgentTesla)", "value": "ad039648ce4e9af03693c329132023c0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022777, "uuid": "cc8ef062-1fb2-436a-a261-0c05b9341dd9", "comment": "Malware payload (AgentTesla)", "value": "4b829090c73292ec0db9fd7f3eb6bf386ff101065477fe3caa7c5f00d513f089", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022777, "uuid": "3b41a460-d323-4981-b86a-f7038ff27971", "comment": "Malware payload (AgentTesla)", "value": "53a5cb9065c4a98fcf2c9d9870c11e426d7ed5de", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022777, "uuid": "c67321c3-66bf-4169-a8b7-987ecb1bf621", "comment": "Malware payload (AgentTesla)", "value": "e5bbfa026297f53f5f100596d4756bfca38507e37b49ec086a896e0c038bcaee167033aa4280454cfecb7b96c8728239", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022777, "uuid": "82a84b7c-8e7b-43f0-8e70-d3e00a405dae", "value": "T15B8402826754E16ED0A78B327B76ADD646F43C2E2461350EB3B0FB5E347F602860B725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022777, "uuid": "e1c28cf9-bd7a-4be4-a9ba-bd3f3ea14932", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022777, "uuid": "b0fe7110-2e2f-40aa-b55e-816cfbc625ed", "value": "6144:bNDlOltlhgyorPXMBxixIgYihgQyYSHuSLPRn+4lC6prZcV28dfiBWkFYlP/S:but7gy0fMxixXYihgQTSOSLo4l9pt2f4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701022777, "uuid": "b0741e97-4fbf-42c9-a277-5506676cf2b3", "value": 380373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701022777, "uuid": "c211cbae-e436-4e65-9bbf-0f284c49ef07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022777, "uuid": "51b0cad3-1c76-4cc7-b11f-1abef270e4eb", "value": "PEDIDO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12fe7778-8c3e-11ee-8907-42010a9c0042", "comment": "Malware payload (Pikabot)", "timestamp": 1700990872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700990872, "uuid": "f28320d9-2852-4d38-b644-d5fa0d54162d", "comment": "Malware payload (Pikabot)", "value": "1b8361e2f1b058a9791047dce0df57c4", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700990872, "uuid": "c51a89db-c3f4-4167-b60e-d706f534ef2b", "comment": "Malware payload (Pikabot)", "value": "4c267d4f7155d7f0686d1ac2ea861eaa926fd41a9d71e8f6952caf24492b376b", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700990872, "uuid": "72dd48c1-2437-40f5-ab4a-f5c6607af474", "comment": "Malware payload (Pikabot)", "value": "3cd3750507971e8f9eef55249e5b2646855652c6", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700990872, "uuid": "c5838dcd-cd03-4994-9c08-9b5a6225660d", "comment": "Malware payload (Pikabot)", "value": "940d86cd403464c4ea7aee5a9ae7b5785b252d0ebc0bb0a50a3a6557432b49b54a5bea1b0d2f52d0dce3319fcdacd701", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700990872, "uuid": "16d2854f-2ce5-40ee-9abf-49d3663f7821", "value": "T12531DA0863E12B65D2A2993398A35F11DA72FC45E227CF2E40C142856866F10DC76FAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700990872, "uuid": "d6f5b196-2f6c-4e9c-a0c2-020d602f37f4", "value": "24:8WXhtiZ/SxOlTyAfPe6+/ClqadNZZ3WCZZYp6bQ8iNm3:8WPFxOltf24lqadNZZ3WCZZN5iNK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700990872, "uuid": "52d46014-88fe-4802-8696-8dd6e63f4f4d", "value": 1870, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700990872, "uuid": "28f208bb-05e6-4bcb-9eb6-d6f3cfa967ea", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700990872, "uuid": "187539f7-0058-44c8-ac11-f1a891e65077", "value": "document.docx.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "550e0260-8c47-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700994849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700994849, "uuid": "1796573d-1569-4253-aec8-cfdf92c3e140", "comment": "Malware payload", "value": "a95b3832d347b17bc3eda2a3f375f83e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700994849, "uuid": "2543c80d-0b82-4bbf-b4e2-20ae52dd6a44", "comment": "Malware payload", "value": "4cab466bf472e4ce5d2e6b0ecffb148618d4281ecf5c3bfd9572f7475361ae88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700994849, "uuid": "e344fa1b-348d-4855-a5c7-7d96b3cb7e2d", "comment": "Malware payload", "value": "f9339e6f1a4301186175f4196e37bb7c525a1445", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700994849, "uuid": "689709ce-df70-469f-8df0-bffad5d719f0", "comment": "Malware payload", "value": "ddb394b93e345a16b2964971de29fe15b702c2fa98b0f5e8b53391b388109fc0bc13ffd81a477d44279b2b4d249c297e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700994849, "uuid": "c88f5425-25a0-4314-94b0-09fad60cb7c7", "value": "T1B044F81392E13E54D9268B728F1FC6EC778EF6509F49BBAA2218DE1F04B1172D263750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700994849, "uuid": "4aa5716a-fa9d-408f-b521-50fbc09ccc65", "value": "32e191367f9932caeeb9bed9a82d73da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700994849, "uuid": "35bb1a5a-6b27-4400-882f-2de01a460163", "value": "3072:dtoXESmqt/BYYoHu55nSu1FrLvsLZSIyJ0Xb7IXZJ9mQ5mgVmQWmZ5kVyBk3eFxe:L+Ebqb95FrjsL9yJQbsXZDGMimy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700994849, "uuid": "9732ad22-2c2f-4652-aec1-f1391aff623b", "value": 273080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700994849, "uuid": "82d144b5-6a72-4bf0-ad67-d7413abcdedb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700994849, "uuid": "9318ce19-6178-4f11-8998-fec562f00143", "value": "a95b3832d347b17bc3eda2a3f375f83e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26ca44de-8c8a-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701023547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023547, "uuid": "6cdff906-3bc7-4a79-8acd-5a4090f3d6cd", "comment": "Malware payload (AgentTesla)", "value": "78bc80152f20b3e8411b0e15fbd2853d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023547, "uuid": "dbf4a667-e1ad-4236-befc-e7a439880ed3", "comment": "Malware payload (AgentTesla)", "value": "4e38578b5c0bfa9b222837756d0c2387d218aaa990b47befb98571cec82f6b32", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023547, "uuid": "5c6feb8d-f860-4915-ab47-8de948dea17f", "comment": "Malware payload (AgentTesla)", "value": "3848dd4a8c4f17ff58bf738432895239a896a98d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023547, "uuid": "4911c3e2-ee4f-47c0-afba-9685637174e6", "comment": "Malware payload (AgentTesla)", "value": "776153ca87a6d25af04b6a2dee2e3a91eeb5c697089f2f2e58be5b559b1fccadaf04118083dec7296e25302cd07c72cf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023547, "uuid": "5095e6ab-ef02-4c87-8c00-34ff342a84a3", "value": "T1BBF4F1113A695E1BC37950F6518110442BF4086A77A9FAC4BCC393DA6AF2FF959C3C4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023547, "uuid": "c5f97e9c-6e22-4cc8-84da-415862750244", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023547, "uuid": "7832a3c8-46e9-4834-8902-8aa5aeba414d", "value": "12288:gGbqLXGkJlFOJ51Rwn/toaBm263cUJoxm+IomrEeCSbqRVmr6mEIY3p4lp:82k7Fjn/ndUJoxGomrETSbq/mmAY5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701023547, "uuid": "2768bc5e-e566-48af-9221-e6b00f371e90", "value": 769024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701023547, "uuid": "f272ba8d-d0bc-4317-b9df-5a43ea52561b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023547, "uuid": "508f97e5-9b86-4156-b61d-e07fa077a2e5", "value": "hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae72bfdf-8c44-11ee-8907-42010a9c0042", "comment": "Malware payload (CobaltStrike)", "timestamp": 1700993710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700993710, "uuid": "481089c7-950f-459b-b464-f7c6b0cf9d99", "comment": "Malware payload (CobaltStrike)", "value": "15f15991fba07eaa67f5f98179b27886", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700993710, "uuid": "f728ebc2-67a2-47c7-8188-5e97e78f7450", "comment": "Malware payload (CobaltStrike)", "value": "4e82f832520dc2707893158e1abeb9a18a5f8fcb6fd32432c1c6ed1d422b7b3c", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700993710, "uuid": "956b3bc2-753c-449c-b66e-41174a6027c0", "comment": "Malware payload (CobaltStrike)", "value": "6910653d078a7f9a5f6a3b2f2d8b0da64bc31bde", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700993710, "uuid": "239f18ab-923a-4abb-af67-e045f011676f", "comment": "Malware payload (CobaltStrike)", "value": "bda9a5d5719819a086edbeab228b306f34bb15aef74c5b3409cd71204b6f9385ac010744404e692b2bff72f62860cf04", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700993710, "uuid": "a7f159b1-a555-46bd-a39d-93e20d050094", "value": "T1C4D44A237121C0A7D4612BF916921B28BCF867152A3A5927BFD48E6FFDB4532CB3640D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700993710, "uuid": "0fe8e7b8-1265-4bd2-a73e-b92ea64082e5", "value": "532b086b71248040e801fe2106955544", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700993710, "uuid": "ab696263-6ba3-472a-8d2a-a202ca0120d8", "value": "12288:Y3X3ybRxUcJ9RVqpiR/AeYAsNPk6YR/aT0pAMmS+wWt/qy3zotuiX5d:Y3Sb/UcJ9TqpiR/AZAsNPk6YR/aT0pA8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700993710, "uuid": "a29626da-b53d-41fa-83a5-322c72a67513", "value": 655360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700993710, "uuid": "ee67ccb2-e328-4061-bb26-7e5e211e56ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700993710, "uuid": "f9b9e5ae-8698-4b27-80dc-2a58311058ec", "value": "15f15991fba07eaa67f5f98179b27886.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59c39f6f-8c8b-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1701024062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701024062, "uuid": "f169927b-f3ac-47b7-8b4f-3c721a02b3b4", "comment": "Malware payload (LummaStealer)", "value": "55b151f5eb325a72233de85d0fa357a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701024062, "uuid": "f5040c9d-4eb3-4b22-8e82-9dba941b676d", "comment": "Malware payload (LummaStealer)", "value": "4e98921af16d88f726f89e67e42e524d5f5ca6ef489714766c452aa78709721d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701024062, "uuid": "a4c4c422-3fca-4404-8228-2ab40862b185", "comment": "Malware payload (LummaStealer)", "value": "4e201a8d9646e8df2dfaa35257f70afd54276121", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701024062, "uuid": "dd019462-566f-47fc-ac62-d909924a9941", "comment": "Malware payload (LummaStealer)", "value": "cab71e85f12df60a579645a456c03b22918e0e0a02799e986aff50164a885ee98bfe074f0761a8fa587fe3e896ab1495", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701024062, "uuid": "477edf89-c5e2-4128-96d6-cde971d617ee", "value": "T18906CF007B32EC3DE18E1631E1E2D02853F7F8E2AB91FB4B72D5521A5E917DD4C6291A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701024062, "uuid": "a0750729-e4f0-49ee-8b4a-f840c946177a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701024062, "uuid": "528584b8-e5b1-446e-8145-4f8f8a5b64d6", "value": "49152:UX2JWJuWy4rOP78N2xTS/Q6TNMAeGG+wqkDdWcuZC9baVhLKIyOnxLy5/INYO:8AqA4bNMAeLVdWRC9bO2IyOnhJYO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701024062, "uuid": "deac8947-8ef4-4ed1-b37f-24c209e397fa", "value": 3846316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701024062, "uuid": "941bee15-1b75-4985-bcc9-fa5c7f99bad5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701024062, "uuid": "97286393-f952-4707-9145-7069ef94ea7f", "value": "55b151f5eb325a72233de85d0fa357a0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "297a6f21-8c7b-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1701017109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017109, "uuid": "79782018-18e3-41b4-aeff-fd0a2c624da6", "comment": "Malware payload (RedLineStealer)", "value": "ad6edb574078b7f249ce128f8d94865d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017109, "uuid": "8d6c3ecb-8c01-47ca-9ee4-ac0cc8eca5fe", "comment": "Malware payload (RedLineStealer)", "value": "5000f9b1e4517c9e74ccd95d2ef72bec0d748c61f506fdc91b1471af3163c364", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017109, "uuid": "bd3f0d3b-efd8-40e5-90ed-791984162894", "comment": "Malware payload (RedLineStealer)", "value": "91494fc28761e8fbb2b1dd9d3fb8e0d255612cf2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017109, "uuid": "03bf9a07-1148-48a4-81d6-abbc41ed0166", "comment": "Malware payload (RedLineStealer)", "value": "31b94059a4ac3495949241a88aad6daa9f50efae8737f03f7bcdabe2b45cd1d9af72c8490c399a83389afaae91a5d549", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017109, "uuid": "a0bbdabe-3deb-4bb6-bfdd-88c6d9e08aa5", "value": "T1A503D08344796A18CA15BE36011188E2F6D5B394F6582101F7CC9CFBBF2E784E75BA09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017109, "uuid": "03bc7437-13c2-4195-ac86-90755d1de5f1", "value": "768:f8FhylJE+hwr5hN7F0I0bQyvUgq65DQVi:f8qlJEQwrDNuIyvD5sV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017109, "uuid": "4e9f2aab-7d1a-4fbd-a6ad-e25c42678ca1", "value": 38282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017109, "uuid": "c0e39bee-6d08-4696-b418-71e49d8c2d4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017109, "uuid": "8db903a5-ee70-4506-97fa-d64b0c0798ee", "value": "ad6edb574078b7f249ce128f8d94865d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72cd65a9-8c88-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701022816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022816, "uuid": "3bd4a787-6c38-4072-916b-dfb60c52a585", "comment": "Malware payload (AgentTesla)", "value": "0da64b8f3b901ac087bc75324b941d78", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022816, "uuid": "f29a6b61-9901-4394-b425-079aa083490c", "comment": "Malware payload (AgentTesla)", "value": "5176f4e21f6a391ecc422afe5407d99d98caaecfbdcfaaaec8fc67df9ce4ec81", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022816, "uuid": "e59f5203-dabb-4ef7-b645-88421694bfab", "comment": "Malware payload (AgentTesla)", "value": "bc561540dc9cd8242f7961354d1d159bab84fc09", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022816, "uuid": "a99446a4-3989-48ee-a7a9-b9de090e0263", "comment": "Malware payload (AgentTesla)", "value": "541f6ab91a2bc3d4241a33728331ec0fb20b6bf27b7bf438a53dcca30544d5cbb1805c4d2dc232c0252608070dbcca3e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022816, "uuid": "246f98e3-fabc-4f49-ae67-4b88cb007391", "value": "T1958401423B84C4AEE42245327B37ADC642E63C3E28247A5B7770F70E763F652861EB55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022816, "uuid": "d2a1d924-8c1b-4798-9b7b-a522e9c0e76b", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022816, "uuid": "b4c07af1-74ec-446b-974f-9e1abd14210d", "value": "6144:bNDlOltlhkujOalGmeGFtlpAn4qLmUoGex0sZ6W9yWhvQCvAwY/+IIRiiZ:but7gGwn94lZr9yWBQC9YsZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701022816, "uuid": "390a6fb5-b182-4819-930b-60dfb2ffe858", "value": 377418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701022816, "uuid": "51432f23-e13c-4cc6-a2ad-5a5d7eada59e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022816, "uuid": "2b845cc8-7e23-4fe1-a863-b2cf16b3474e", "value": "SOLICITUD DE OFERTA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "117c81b0-8c72-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701013204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701013204, "uuid": "a91852aa-a1a0-4804-94cc-5ba895c497bb", "comment": "Malware payload", "value": "ff4979e644dd8106bbd5116897ea8991", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701013204, "uuid": "2eb73577-0da9-4434-b414-9358a818c024", "comment": "Malware payload", "value": "52ee679abc852d5cd01605fe1f11b989866f0f2d5394c86ed2e5f86974b198f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701013204, "uuid": "4945adb1-61e1-49cd-8771-1af0925511b5", "comment": "Malware payload", "value": "c420f667984c41370e34dfe97d46335fe7dac414", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701013204, "uuid": "c7964277-ec03-4e68-af8c-2839e49362a8", "comment": "Malware payload", "value": "41150ceb7cf900f1bd37bd6e6aecfd7b75772a77d750eec6b655118a42697ea64d8d94a87106bf342a556c961c13a5cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701013204, "uuid": "52226efe-6e65-4e09-bc2e-af81755a2a5d", "value": "T172336B0B66C14171CEDE89F442F7315BCA72F78183E344D7B7D92BA08A572D09AB41EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701013204, "uuid": "7cfaf070-fada-42c6-bfd0-85172b4df3ff", "value": "a95cf55288e9a476e469e5f85e7d24ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701013204, "uuid": "7aa70e5a-c1be-493c-8ac1-8963e591d387", "value": "1536:OGnGYzq+5hRpfvc7ImuFnME0erTwkqDS5vm3unyhjxNtqeed945:OX6munMENwkHvmFhjLAr45", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701013204, "uuid": "b146b37b-b31d-4a6e-84a6-c48b31f87dd7", "value": 50176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701013204, "uuid": "a8a01f3d-4295-48f9-ba2b-1af8be540ece", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701013204, "uuid": "1de8d346-a9e7-4118-ae67-7e21f2372b08", "value": "SecuriteInfo.com.Trojan.Winlock.7960.169.24039", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cd3779b-8c7b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701017276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017276, "uuid": "47f7ce51-8d33-425c-bc75-5e2ffe48c5d1", "comment": "Malware payload", "value": "11e88bb1201b97db81e835e7ded53745", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017276, "uuid": "1fa99333-d701-4550-b674-2fa696e80aa0", "comment": "Malware payload", "value": "540b0156724131c13e908cea44ca9cee15a260d4bbb609b78b0c05abad39bd12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017276, "uuid": "1166110f-3ec7-46a4-88c0-5b7772328fa8", "comment": "Malware payload", "value": "0bd3eabc679cddfd3ac21dfc2b50b5214f996cac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017276, "uuid": "c500a475-aece-4527-b204-a9a47337c8d1", "comment": "Malware payload", "value": "0750b313c2a4d9813ae3929ee4015a8338312787e0dbbc1ff6621c3308586d2b869866f4716cdd46bac5cc3c721fca86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017276, "uuid": "2ee192d4-209a-4a0c-82ed-bf1f179d36da", "value": "T17BD59ED37661EF1AC09D043AA6CE580C07FCE915B313DB6B6A55B6BCB4D23218C16CDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017276, "uuid": "1c0b5a45-c23f-49ba-b1b1-c41a95881333", "value": "49152:4UWqGNW3lx9yQOnqn8zvNMHn+mxVJqsOdP53:PHqilwq8zvCHnxVpW53", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017276, "uuid": "deafeacd-ddea-4c2c-ae8d-a7e1d9d5cad0", "value": 2975734, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017276, "uuid": "958429ce-7a15-4c8c-b7f0-7bc3eea76433", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017276, "uuid": "feabf8a7-b4fd-44a5-9ded-34a3ad9f3549", "value": "11e88bb1201b97db81e835e7ded53745.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b105d003-8c6f-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1701012183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701012183, "uuid": "23e877cd-b5f9-4017-a3b5-7c1ce5007c82", "comment": "Malware payload (Mirai)", "value": "ef83aa8638f3537f780921533ab8817a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701012183, "uuid": "aa9a7809-32dd-4ce3-a821-fba707957646", "comment": "Malware payload (Mirai)", "value": "546146a9a5a350ee117002605b9eb059a866daa323a97906a188ffb3309249f8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701012183, "uuid": "dc6b4f8c-174b-44f6-a7a5-e13a9a949992", "comment": "Malware payload (Mirai)", "value": "44dd7c66a290a0be3265876e5de8eb3455c1788b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701012183, "uuid": "de7035eb-03a9-428c-aaa5-3131569a90e1", "comment": "Malware payload (Mirai)", "value": "09819f71052d41f1abff8c513612260a204f9d7be33443cd02a431a3d60639b2fea5a3f920be7f65503c3727d993952f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701012183, "uuid": "2bcb50ee-6131-4d98-8c72-293d218bc7c2", "value": "T1FB339E7AC46EADD8C6458234B82A4A740FA3E104D1E76EFA5B85C6A54043FBCF61C3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701012183, "uuid": "c3704448-186d-4766-afb6-c6894dafa179", "value": "768:0wa9Qm7OGyCaIR3efUk3eOugwtNlM0Gd+IY6u87outMsY34Cqo1BJu7CwMV:0IdCr17YJwtNsY6u803734q1C7CwC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701012183, "uuid": "c585c051-de3a-47ae-8695-b0d7a253634e", "value": 51920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701012183, "uuid": "e6731736-f501-4f27-8654-36936a101f74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701012183, "uuid": "52bc4b87-a44c-447b-a184-81405bc7eed7", "value": "ef83aa8638f3537f780921533ab8817a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0d5e526-8c89-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1701023430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023430, "uuid": "241aebae-633d-402a-972b-ef5d5426212a", "comment": "Malware payload (Formbook)", "value": "2a9e6fabb75eb23747dcd319e0aabbb3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023430, "uuid": "75f12d6c-0bf8-43f3-9665-e8c5ef1f3da2", "comment": "Malware payload (Formbook)", "value": "55660c34fc05105b48a20bbd58b80c5889dfd3f3f46fff24f3eaea19c5ec036c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023430, "uuid": "8356b014-a0ca-4f2a-84fa-ee999f115b45", "comment": "Malware payload (Formbook)", "value": "3eb348838b6ee3cb2500b37051d20f4ba393c6c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023430, "uuid": "e938bc30-f31f-49e7-b2e6-712b2ff812da", "comment": "Malware payload (Formbook)", "value": "a32cf7b80a09df209687f5f183103721ebe49b71893b210c82a714f994e069cae9c02d3789af0b97af464168573f6d56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023430, "uuid": "e241a69a-963b-4266-8d8b-8799f3633f6d", "value": "T1D1E42276315D7FDBE17A13FA9E70E00A43F1FE3A84A8F1245E8271CA45B5750AA91C43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023430, "uuid": "4ef723e2-f6f0-4fa2-bd2c-f14612c56792", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023430, "uuid": "1fb515d2-2a09-41d4-bc25-3a8b19dd8697", "value": "12288:zE6jD/arA24kGL2OdqJk3Ir3jLEbf+uRUacC2HT9+l0kHX9Hhm3HIAz8ENz:ztD/arAEG/tajQ+uapHTglr31hmYAYEN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701023430, "uuid": "d7ec96f9-b865-4e26-8f55-c37d3e0bbbac", "value": 706048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701023430, "uuid": "fa922320-b6e5-4543-8cd8-2410fd7c00d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023430, "uuid": "0159bb15-eec0-4150-8e36-42b51d0159c5", "value": "TNT Invoice_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bd8f1af-8c7b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701017087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017087, "uuid": "bd62d3da-e414-4a6e-bd61-5e7253b154fc", "comment": "Malware payload", "value": "5707ee4eb2192c65b563ef9224c03fee", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017087, "uuid": "c83df4fa-18dd-41ac-be7a-ef487e918ec0", "comment": "Malware payload", "value": "55d70490e0b2cf2d557c87f4fa33040d13a1b4b150bb080b8dd9c4384076efef", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017087, "uuid": "64d2735e-3a64-483f-93a5-70de78a3a93c", "comment": "Malware payload", "value": "22162407620fe321a9a18a36f8f0ff0bc3978ffd", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017087, "uuid": "75f121ec-2518-47bb-972d-61a5b14dca1a", "comment": "Malware payload", "value": "d179b1978aff0abed9b05aa5af6e6108a150922a242762ebeca5441209cddf146acd92dc3dc1c9fd8d7f2ddda4e3b707", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017087, "uuid": "a42ee175-4dad-4ada-8df8-384354978d4c", "value": "T1ABC55B55B3B801A8E1F3C27CD9A6425AEAB178454B30E7DF16A0465E1F33FE19D39322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017087, "uuid": "77351e0d-d4fb-481c-95d3-f218929ae380", "value": "5f091eecefc1b49cd7a2a9cf6847cbb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017087, "uuid": "fcd3173f-05e2-40f5-8610-5c6704a3632f", "value": "49152:71PX0ONuiBg8FsUMLMX/mH/xnJhMrq/3Ie7rPpHfCTM:7luirsUMMi/jC2Ai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017087, "uuid": "54c1207b-3ffe-4512-9d26-d3a4633db802", "value": 2503168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017087, "uuid": "f6ca2e09-ef27-445c-a455-3c2a3ec968c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017087, "uuid": "5c2de271-eb34-4182-ad28-813ada622820", "value": "5707ee4eb2192c65b563ef9224c03fee.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56d2cbd8-8c7d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701018045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701018045, "uuid": "0be9f07e-1093-4d14-b76a-cec65d33ef69", "comment": "Malware payload", "value": "08e79ed07451fe90202e9ba889c666c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701018045, "uuid": "60a68801-1278-4c55-a069-103e9bff18f3", "comment": "Malware payload", "value": "566f66f4e8761bfc99cfac5234b277c8742ac7a13e9d262a92e6bfb55f95f390", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701018045, "uuid": "5a23b83b-dfc8-4359-9b82-6e1fd1a968f8", "comment": "Malware payload", "value": "941893c8c8c355a942085a68b8cead258750895a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701018045, "uuid": "84a99402-b96d-45c1-b2f1-231c801f4cc4", "comment": "Malware payload", "value": "a7355874788d0b2ed81b3dc9f86147085473e912e22fc0264a05b03c1eb4158f5097f9da6cd2db48b68c94db7afd2a8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701018045, "uuid": "f13f7a20-0450-4c3d-a937-dee2267ba2e9", "value": "T10615F142B6C549B0E4632A721D369B204A7F7C140E75898F639C7D2FBF732816932B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701018045, "uuid": "a660a68f-3742-4c31-8232-8292a78e4c38", "value": "aac51396886833dc961fcd7aab7711e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701018045, "uuid": "3a15e3d1-9d47-47ad-81ae-626529382fe0", "value": "24576:lgZXoZUTVdt7KEA1YtVVvOi1L7Z+ri2JQf8/:QAMVV2i1B8N+E/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701018045, "uuid": "b5337be0-83bf-4c59-bd32-182841543ae3", "value": 958353, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701018045, "uuid": "bc9c9fde-4fdd-4b66-b2cb-e2d970112d09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701018045, "uuid": "600de40b-5fb5-4196-9ffb-2cca63e97a64", "value": "Ordine_Frode_1027797000003171_Ordine_Frode_1027797000003171pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "329c78f3-8c78-11ee-8907-42010a9c0042", "comment": "Malware payload (Vidar)", "timestamp": 1701015836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701015836, "uuid": "89db21a9-8e01-4f6e-bd42-310eeb671830", "comment": "Malware payload (Vidar)", "value": "5bbca20584728ec523a27c5df985d7b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701015836, "uuid": "144bd075-2ef1-4eb9-8d24-64589552f630", "comment": "Malware payload (Vidar)", "value": "5688e4325f1ebf2a37404cdba80a7fcd8ef0f879d56699f04f396419c4a708eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701015836, "uuid": "527a97e4-77a2-41cc-8f3b-247e00559821", "comment": "Malware payload (Vidar)", "value": "34030de2418bb874d362ef750a93ec88d8618dc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701015836, "uuid": "40375cf5-cc0a-497d-ad92-9421c34c448d", "comment": "Malware payload (Vidar)", "value": "b7796ca69cde29e085f56f1324b2ad8e6530561d2d6a63078d93e53b8dccdcfd21cae9e43a66bb60de2e40847543a95a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701015836, "uuid": "9b6a09bf-baf6-4011-a380-1cbe0f23a736", "value": "T1C4547C1353F1AC61E5234673AE2EC6F47B1EB8708F596B9B3319AE2F09711A1C562313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701015836, "uuid": "f8733a19-8fa6-4642-a36d-abb773c30b59", "value": "45a628a3f2a65058697af6d92bbbc920", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701015836, "uuid": "c0fa60c6-557d-4e11-9914-f8201c52d529", "value": "3072:iLgCo/W2wMzO4uhjSdPVSSQVWVY9msWuaPf11CEBZ210Cw5x5n59vt1ZqR:uupbyhOdUSyWOchuaDCEv21yv0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701015836, "uuid": "4ef32f82-317a-4321-8331-909758ce7a07", "value": 288768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701015836, "uuid": "ecee7a3a-4169-49e8-8aa1-454084ef2fe4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701015836, "uuid": "e4fceeba-1d21-4e87-a38d-53c979661e9f", "value": "5bbca20584728ec523a27c5df985d7b0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f211043b-8c3c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700990388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700990388, "uuid": "66db0b11-9a16-415c-af44-e795f7619092", "comment": "Malware payload", "value": "03eb47eecf445117704cea2e4f4fa0dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700990388, "uuid": "bff49f9f-63cb-40a4-8bd3-674781726bc4", "comment": "Malware payload", "value": "585fa7563fb66623ba60a711c6ebed1220b7928f973a89d271bd8cd246e92ae5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700990388, "uuid": "3778a9f5-7b35-45cb-a4a3-1fa43ba9a1f7", "comment": "Malware payload", "value": "0cf716a2028e9b766008a555fc3cdfb2cd103f08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700990388, "uuid": "e68d31c7-234a-4762-935b-d5ce404e6565", "comment": "Malware payload", "value": "48db9bab292ca6e64eea3157e193ba24b5e1b7fb3f266d25e44eb8fcca7ba42b6ded8c40af214d15fa7d598e77253f84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700990388, "uuid": "1ba72ea3-9b55-4ee9-a7ac-5d776b54bfbd", "value": "T17836F190FB46C472C1015530A0B6EB688AA5FE56A7E6859F32503F3CFE75382396C35B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700990388, "uuid": "dfb24bb2-85a7-4b55-8ae3-f2868e8c7846", "value": "eba6ea3eb54d77d517181e99ff8c9533", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700990388, "uuid": "ee6a1ec4-2fa4-463e-8075-066dbe347c18", "value": "98304:XKFkdUsMlC5HujIUjstAKx1qcS82NTe407Vm:2kqsMlCtujIUjvSqZdTe407Vm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700990388, "uuid": "7d1ede17-fc1c-4c99-9049-89289ad76fd7", "value": 5259264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700990388, "uuid": "159f1201-7187-4d3a-a2d5-5578762c1eb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700990388, "uuid": "154dc719-e8c7-4e68-a7fa-150e987817e1", "value": "03eb47eecf445117704cea2e4f4fa0dd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "177370ab-8bf1-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1700957809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700957809, "uuid": "2ca18690-ed58-4eb6-b941-b9438a965e09", "comment": "Malware payload (RiseProStealer)", "value": "b5f964d3dbe27ea562d3a750af190bea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700957809, "uuid": "907d8120-9289-4d07-a54f-15e7fbd62da2", "comment": "Malware payload (RiseProStealer)", "value": "5a95175c3141c8f5891ce74366218d450a3180e6ca6636d940cd305594199ef7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700957809, "uuid": "f9c12329-1a7f-485c-bfdb-57ee3d5bbcd4", "comment": "Malware payload (RiseProStealer)", "value": "6c51176f2442631da81c9e95e6285db6fe852d9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700957809, "uuid": "d2c7d5f9-51d0-45f7-925a-4d5a8be2ddb0", "comment": "Malware payload (RiseProStealer)", "value": "ac3a2bc1dfae5fb081a1c2f2f961b23357a3fd18239861483934fc6e3b94e1280be97071c742e1552ba1e6c88a724250", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700957809, "uuid": "efb924cc-a7a5-454d-9904-b9b69fa7fad4", "value": "T1D4658C31FA08D4B6D09210B0916D6A7B91587A322BAF4CD7F3C05E6E41B52D2F235F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700957809, "uuid": "b1a2186d-6567-4f8d-a2f6-0b671ecde918", "value": "078471ac5a76189ffe465abe0c89c6b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700957809, "uuid": "192c658e-c7cc-4130-8f39-0b0ab768464d", "value": "24576:2opGDjnvrPpkjos0OtjcFc5kM49dj+IuxWQOIjuJuVvhbqL0HtFcgekRP9dT0WNI:OnvrPGT0Egyudc4tI3bqL0NFchaP9dTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700957809, "uuid": "4ea7a50e-333c-4f2e-9b60-44cd7908ea22", "value": 1539758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700957809, "uuid": "7c3c44c4-2e3e-4ded-ad0f-2643adaecb14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700957809, "uuid": "d4e7cf6f-32d5-4c20-b378-96d33395790d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b786744-8cb6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701042507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701042507, "uuid": "0d24e439-4a78-4b39-95ad-18d1cc845470", "comment": "Malware payload", "value": "2ef140966b38a9c3025a123423e36667", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701042507, "uuid": "19c0c4d8-990b-4452-90d3-2683c915cf24", "comment": "Malware payload", "value": "5b0d0d6d01b25c6c7af20da0a3c5256ffd61d439c19dd1a22b1b9b67882b3cd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701042507, "uuid": "89aef3ff-6699-41ee-a3a3-30613e45cac8", "comment": "Malware payload", "value": "411ef2d704a59446f52d36805945f13ea30105bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701042507, "uuid": "9467758b-103a-4452-b809-f9098313d3c3", "comment": "Malware payload", "value": "ce6a055368701d1382becddfded664439555854ebb59f6608fe040fa1900a4492c44146749576dc889e0f54a6861fcb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701042507, "uuid": "ccb97447-fa72-42a8-9292-f807d47c8b16", "value": "T125E7337CFD0A8287D9848577AA596FDC900023D3F304EFD70B36DB94E612B651A889BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701042507, "uuid": "155636d7-2ac2-41da-ad25-e38e1c1cf1dc", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701042507, "uuid": "e7b148d9-9353-40f2-bdbf-a73dae0617f2", "value": "786432:havhX/O6oxkolqMF/0OWCKHOgCcqcKLdpymtNMk7DcpZpiJRy2RIFjUZlQiRX3cY:Im6ekoEMF/cHPMNMLpZyIdiBcQ60EmJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701042507, "uuid": "31ccaceb-e758-4590-9cfb-9f05e768facf", "value": 64976628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701042507, "uuid": "c8621188-0b37-4e21-8b3b-485890cf24a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701042507, "uuid": "23c676d2-9f52-473f-b131-8cec7b828bfc", "value": "SecuriteInfo.com.Trojan-PSW.Win32.Stealer.bvmi.31667.26041", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46ce8fe3-8c7a-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1701016729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701016729, "uuid": "4cf20e83-efba-4e2d-9b0e-e92424f2725c", "comment": "Malware payload (Amadey)", "value": "a9224e1170ff8c84862e31f302ef9dc7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701016729, "uuid": "25d011a3-42c3-4f6b-a158-12094380f24c", "comment": "Malware payload (Amadey)", "value": "5b1a12ce5e8bfbe64500c70cdc1a9fc3d7356a5a3be540df14a648617cc1068b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701016729, "uuid": "c8e8fbd1-b48f-4e77-9ede-d3e7c6dc7e7c", "comment": "Malware payload (Amadey)", "value": "6f7d23e47a8af579a45f1e7753320695fc1ba981", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701016729, "uuid": "5a635316-9709-4b4f-a7a7-3f128e19ccc5", "comment": "Malware payload (Amadey)", "value": "80f36ba580fdc3de2d39ef8671156e996340cf62e797d6901234eb1c291163b5752704bb00066df95d07b221ecd5b525", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701016729, "uuid": "56c562b0-309b-40c0-92d6-ba021df4f7e2", "value": "T18464E0227BE1C072F26349344A7286714E3BBCA29B62B5CF3B94067A1E315D1CB79357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701016729, "uuid": "cd6b04a4-8dff-4d8c-b236-b5665508f546", "value": "225c0a302d7e57a1c8187a7075db5d12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701016729, "uuid": "4bdbc7db-0723-4b19-b53b-156505bd7701", "value": "6144:eaZ6wxUG7Ow8UDSer8ZNX8cmLu53ktAWlf5wfxvlu8F46wZC:/UG7Ow8UDSC8ZNMbLuZkieB246wZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701016729, "uuid": "99ed2991-5bc9-4e90-868f-6cd9567d4eac", "value": 313856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701016729, "uuid": "eb8034de-eb35-4e7f-9174-752323d8c5da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701016729, "uuid": "e267706b-4a5d-4c23-a2a7-079bc609354f", "value": "a9224e1170ff8c84862e31f302ef9dc7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0be16171-8c7c-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1701017489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017489, "uuid": "887cc452-db0f-4f3c-b2e3-c2427fbfd6d9", "comment": "Malware payload (Formbook)", "value": "752941a317d6e1ee5519de713e9b0b66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017489, "uuid": "2f1a38cf-8c47-47a7-ac2c-9e8b06686668", "comment": "Malware payload (Formbook)", "value": "5c0b363499da0abc5bfe5213d4ccff6ecf5f4b8d2ba2bc6b143f3a79c135e0ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017489, "uuid": "2ad5e8d6-d347-42e2-8bcd-9c298b152e60", "comment": "Malware payload (Formbook)", "value": "ce6c1df2044397a9432d647fb469c948d6e74927", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017489, "uuid": "e2b49fbc-54a1-489c-b197-2b14d7411063", "comment": "Malware payload (Formbook)", "value": "d4830ac186b406d7863a2d4e34f7116869927bc6c678e6cb0d06d6e62a0e81adba5159c16a59dc297a029d41afd954ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017489, "uuid": "232339f5-ec4e-4ea6-b5ce-b801eeaedb51", "value": "T142C4230744FCC7DBC914B7F554A91A5333F7A11F80C6D2ABAEC2213D5260B1A99A48EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017489, "uuid": "d9fd7d5c-ceb4-47e1-94b0-e1534dc1d753", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017489, "uuid": "8b801da5-559b-4adc-8fcb-4330477d663f", "value": "12288:my8ohI1b2VwfO35d8XacHbR+WN5xF9/ePqec7lC3P0fyr:mFoI1b22fOJdPcHbf5b9/sc7MBr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017489, "uuid": "5053ce73-02c7-4fa7-968b-90211d23d9cc", "value": 550912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017489, "uuid": "672e5df9-4e65-4b7f-ac0d-6ee3ab909df3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017489, "uuid": "92288ec7-0c07-4f0f-a2a3-8f5894c1e3a7", "value": "RE.Re,price lists pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2820e222-8bf3-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1700958696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700958696, "uuid": "bff271b7-c2b8-4d7f-961a-2cc86f66a285", "comment": "Malware payload (RiseProStealer)", "value": "5f5d597a9a104ef723905f44a459b879", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700958696, "uuid": "56501170-4935-47c4-8480-7c3f08afb4e7", "comment": "Malware payload (RiseProStealer)", "value": "5c510387cc9ff429d9a7500f7a352cea013915ad14508a4596e9eaa76777f659", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700958696, "uuid": "ef004fe1-6ee3-45b2-b04f-e0115251dbd9", "comment": "Malware payload (RiseProStealer)", "value": "ca1d67685d9cb5af675381a1495915df8e8846b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700958696, "uuid": "2d4f73c8-bf19-45e3-9979-d174b8ee8843", "comment": "Malware payload (RiseProStealer)", "value": "efadaf94bba61dc08676fb60a2d29ed8380bad95faf16775acfc895019db6488fad60ff376d0c8871a6f89947eacc1e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700958696, "uuid": "3f3223d2-0e1a-45c9-98e8-cfe9b0fcbd44", "value": "T100658C31FA08D4B6D09210B0916D6A7B91587A322BAF4CD7F3C05E6E41B52D2F235F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700958696, "uuid": "d40d65b7-c5bd-4411-81e3-ba168f50eb6f", "value": "078471ac5a76189ffe465abe0c89c6b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700958696, "uuid": "62982311-eb5a-4ef4-9295-d19adb9b34b0", "value": "24576:2opGDjnvrPpkjos0OtjcFc5kM49dj+IuxWQOIjuJuVvhbqL0HtFcgekRP9dT0WNI:OnvrPGT0Egyudc4tI3bqL0NFchaP9dTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700958696, "uuid": "b2102d82-9566-40bf-bd88-03c0c4796d25", "value": 1539720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700958696, "uuid": "9f0ee5a3-f66f-4f0f-b6e5-d4179227c386", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700958696, "uuid": "16ed77ac-7965-47b2-9cb9-c3ca17d3e3ef", "value": "SecuriteInfo.com.Trojan.MulDrop24.22194.30454.5756", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10095d49-8c8a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701023509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023509, "uuid": "d38480fb-7532-423e-8a38-a7bd655f06f2", "comment": "Malware payload", "value": "e0ceecef16a3c1daf08700eb8ddd2b70", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023509, "uuid": "66b1c5a0-6d07-4b20-85ae-fc4f1437314e", "comment": "Malware payload", "value": "5cfc5e78c5c34a2f299b2bf322afafd12a2b4d8fdfbe1e378373f0bd6f9ea944", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023509, "uuid": "6f91352d-eec3-43d9-a17a-087ced6c8118", "comment": "Malware payload", "value": "534ebc172270172df7055aa475563a6fb16fe872", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023509, "uuid": "2b8da2db-1d6d-4852-ba79-b5c5c35679f4", "comment": "Malware payload", "value": "9284b03e581b1eacc24670cbf946066aa4e35c9262e151c4e800c08a7ea95ce197884d0bcc352c4c96ab8d8255f24ea7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023509, "uuid": "a78401a6-be39-414a-b5be-9137d9e1f3d7", "value": "T156B14C1135EF6008B5773FE15FE4BAA68F9FFBB21A29D06E6004130B86A1E40CD55B72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023509, "uuid": "44a4f229-60d0-4bc9-b293-e6280862e858", "value": "96:KdJo7/leJDEd4/Kkkd4/KXdJo7/leJGd4/Kmd4/KI0DE2Td4/KNDE2f+/Xd7uHs3:KDe/lgD8IcDDe/lgS2fDE2hRDE2WFxJL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701023509, "uuid": "4c52b036-6f6f-439b-9657-01e07703a232", "value": 5422, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701023509, "uuid": "65fc06b7-2004-466a-bbe9-69254db3b100", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023509, "uuid": "65c4c050-555e-4cdc-b0c8-0e662e2fb521", "value": "Note IMPORTANTE .js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3756953-8c6f-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1701012214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701012214, "uuid": "9aa6a999-daf0-464a-bfc9-b45c86266131", "comment": "Malware payload (Mirai)", "value": "968456e0578438663e6c8cd906e73020", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701012214, "uuid": "61c2c4ec-ead6-4e9d-bd6b-5e95d27c40f6", "comment": "Malware payload (Mirai)", "value": "5e27794ec9c3fd238b43806c2e8a1dde1edc478a5f549b9383836e6fe3bbfafa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701012214, "uuid": "3758a520-8802-4e06-9c62-9a4f43db8716", "comment": "Malware payload (Mirai)", "value": "b3b75afad843a62c486af028ef414dab13938b32", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701012214, "uuid": "a149ab91-23ae-48ca-b5cd-d8dfc9b36846", "comment": "Malware payload (Mirai)", "value": "6a94b6f30c5bc5d86553c5ae2ce3d21e6de25bf134697da060ef0c1f4ca56c7e7f86b890d938e1bdea4d561424367aac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701012214, "uuid": "faeaf75c-2437-4390-a4c5-f0bf91ac7f88", "value": "T1AF630852B8C18E15C5D813BBFA2E018D33126768E2DFB3129D106F147BCA92F0E77A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701012214, "uuid": "de7af0d9-e34b-4898-bf67-27204b4bdf98", "value": "1536:atnER4jL83+4/ZZM0mA8w7lR5Tzq918y0nznIDi+XK1/m:F4jo+6ZZBLbR529ymXK1/m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701012214, "uuid": "e3fbd2a2-f5bb-496b-9537-7d53d4f93b56", "value": 70960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701012214, "uuid": "22f1f479-54b4-4332-98cf-9ba3c211c69c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701012214, "uuid": "15aee61f-7674-43b8-b90e-394a147878a6", "value": "968456e0578438663e6c8cd906e73020", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc7a5a81-8c89-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701023476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023476, "uuid": "759539c7-a1c0-43b6-81ab-3bcb7a109528", "comment": "Malware payload", "value": "99eb67b3e00b54df53c68e260a602c19", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023476, "uuid": "db75da20-99f1-4ddc-ba68-956e5832ac27", "comment": "Malware payload", "value": "5e67db46d47a8ade56e79e713a4193cdeadb426103570901c9ad10d9b625b727", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023476, "uuid": "a3b3751f-e66d-44d3-8959-605ad49e2088", "comment": "Malware payload", "value": "cd373a5641476fb94b3930a51cb24c91dbb5ba01", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023476, "uuid": "87ba422b-0702-4bae-a089-83408c401101", "comment": "Malware payload", "value": "65c2fd2dcea3f4a1d760a463f48f2fc862eb692deefab3b3a281592ffde3e457306c9c429f4e10f4e1eb0bead097f854", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023476, "uuid": "00566ab5-f4e8-4df2-a0ef-272ee2c05b34", "value": "T1F1A6F8F4B2517ED11FB4191DF28F40B23C37BC6AF07A5E8A32951A6CD5C4248E6E69B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023476, "uuid": "fdf2c4b4-2d03-4661-a6d3-61c2fae30c3c", "value": "49152:EmEdj9xT+7sAOeXxBG8eUqWHscGASDofYQ/KUbUL:Ic6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701023476, "uuid": "3f1411d1-232c-4d90-8ec0-d46342cce95f", "value": 10207350, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701023476, "uuid": "a08de004-bdd2-4718-bddd-b4a72b2e6ccd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023476, "uuid": "87fab315-d0eb-4dde-9fdf-3fa344feba39", "value": "208052251421932.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3022eb4e-8c7b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701017121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017121, "uuid": "b9370ba7-e7da-46a9-afcb-d1f8beab9576", "comment": "Malware payload", "value": "05192a65b0ff0c7d4aeccb20c079dfb7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017121, "uuid": "4e7994cc-8e55-4907-aba9-c1d5718409e9", "comment": "Malware payload", "value": "5e8baff04edb07f5378739ebf423bb8a9b83169f5bd2089267e50fb3eafd75a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017121, "uuid": "1f666f1d-5496-4608-ac58-b3dc46b922e7", "comment": "Malware payload", "value": "adb5b46b3080da24acd32f3cf1a2dd17bad1401e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017121, "uuid": "6238e079-8487-41c0-8e2e-7c02016d9b2b", "comment": "Malware payload", "value": "cce588430daffc182d9de67bc15e9fe7a6aa0713b04c70a109cad88dafe8bcd43b21f54d588b93b6a654bd82e8607c49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017121, "uuid": "8ae9f8df-4dc2-4937-bb10-9c1924c4b9d2", "value": "T16432EA6987AC4377EE2F1A3A9D6283C10EB2EA10D913EB5F748CA1461A673460613B25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017121, "uuid": "47e40ca8-d064-4e9d-8d86-383ab9a68f52", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017121, "uuid": "a4f5bf31-4077-4254-8a7d-078b9c8572c7", "value": "192:b62zNFYNZEVbKphewUFYy9N0oDMqUrTQNPH9DVTHuWNtha6:O2zNFwEtKaw8VN0Dq6TAVTHXND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017121, "uuid": "429cddf1-fd95-4ecc-911a-fdfb02775b13", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017121, "uuid": "5fc7c2ff-4af0-4ea1-8b86-222a26aaf47e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017121, "uuid": "acbbda8f-dc44-4324-a9ac-d78b84362ecd", "value": "05192a65b0ff0c7d4aeccb20c079dfb7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93f7fe4d-8c39-11ee-8907-42010a9c0042", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1700988941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700988941, "uuid": "fc2e28f5-5bed-4546-bcd4-bcdc49f21e94", "comment": "Malware payload (Adware.Neoreklami)", "value": "623d0c53320657a4da314dd01d1fec3b", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700988941, "uuid": "d5b6f7c3-3ffb-4e96-95f8-fe0b91d8e140", "comment": "Malware payload (Adware.Neoreklami)", "value": "5ebf1a56a0ee1082d1d4e2722064bc72438ba5cea7ebc733bc0aad6d1e8ea257", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700988941, "uuid": "c864c037-e6cf-4848-9744-8cf7c60b957b", "comment": "Malware payload (Adware.Neoreklami)", "value": "5bee13d94af380f796934de28b66c0d9cbdf6b4f", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700988941, "uuid": "1e9b139c-2221-4565-9b82-bcbec1d31b89", "comment": "Malware payload (Adware.Neoreklami)", "value": "68457790c0e1a228922c176fe4e6bbd600b7eb2af5426d4692517d3fc172dcc41d9728fd8cea833e5910cdb2d5926a17", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700988941, "uuid": "00cfe70d-d6cc-4604-a61e-3d668ca49edc", "value": "T14C7633623DE140FAC4D2043064502ADEE425E4B04F248EDB275D772E9FBE1AE547EE9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700988941, "uuid": "1e0bf744-102a-4e8b-8810-5876b6fb4b50", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700988941, "uuid": "f203a07a-8ca1-4916-a9fb-cc280ed98204", "value": "196608:91Oh1DzHUiZiT1m14DufybOWtRycXoj/VcU/4h9K:3OHHw1m14DufyCkRHX0VxW9K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700988941, "uuid": "a1ee9884-9895-487f-95ca-1cc0008beb03", "value": 7542818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700988941, "uuid": "dbdccfa8-49cd-4d10-9066-7918a3d2e33a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700988941, "uuid": "af386500-f552-4c28-956a-673a0c0b5c86", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1684fd1-8c85-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701021606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701021606, "uuid": "415fedc4-f4aa-46b6-8b47-2711aa0e6605", "comment": "Malware payload (AgentTesla)", "value": "afcf8f4da22cf241e13e3e04a3198a3c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701021606, "uuid": "f2b6b4d9-644d-4e09-88ff-0d65c6dfd98e", "comment": "Malware payload (AgentTesla)", "value": "5f509201afdde269f33488a0d456c5e829d4a2fa35ceaecbacaa2c2409048ef6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701021606, "uuid": "1dff739e-4369-4b42-a7c4-ba3222db61b4", "comment": "Malware payload (AgentTesla)", "value": "60d2a8c4cb4084f48aa2d38afab438af471fc562", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701021606, "uuid": "412d5f9f-5808-4e9c-969b-cd4074d01e3a", "comment": "Malware payload (AgentTesla)", "value": "b4bd0f38095eb327d067164f48b09c3d8e960f3295227a6e1217ced8e173011bcff7f86c1fa46a90d202fbaa21b04f1e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701021606, "uuid": "8d00df68-cf8d-4120-95a2-7e4e848125fb", "value": "T18984F11C3620C4F5F84583742B369F1B5AEE6C4366414D0737B1BBB89B356A3C90EAD6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701021606, "uuid": "545a0ada-3af6-4abb-b976-0ff3f93286c4", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701021606, "uuid": "6b8d22b2-1955-449d-94b8-c77ca417dd1e", "value": "6144:0T4DtTlmkDepzGbH5QbTCuPQalytjrfg6x4s9yav2CwX7j7ZL67ZLi:0TcFS4ZZ2edL/x9FhwX7ZKZm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701021606, "uuid": "ed253b99-f27e-41ed-8dda-bc0dce275f14", "value": 376224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701021606, "uuid": "0ecf7e7f-13cf-4a16-be54-d6523e255110", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701021606, "uuid": "6bed72db-9ff7-42a1-96f1-8500f65c519e", "value": "FACTURA N.\u00ba 230393.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "657eb21e-8c7c-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1701017640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017640, "uuid": "8be97470-99f6-46a8-a7a1-3825c7924f1f", "comment": "Malware payload (Formbook)", "value": "9c5cc586392b2b4ab395659480696eda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017640, "uuid": "20130dd5-4e07-46bb-8f97-c728c427f0f1", "comment": "Malware payload (Formbook)", "value": "605350df32f075d34dae4c671714c4a7c4666d50874feffab6c0e2535f020115", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017640, "uuid": "993bc9d5-f88e-4b8f-b354-d8f39909c57b", "comment": "Malware payload (Formbook)", "value": "8c95aa0bdc3c0d4c06359e608931f6dbd42828b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017640, "uuid": "98f625e2-5475-4aa6-8268-fedf9e4b79c0", "comment": "Malware payload (Formbook)", "value": "e0c5d06f7dd82930e275e9118a95551d144dd38bf1706f3330cd261f1c78eac627ab8f55902ce7b71e43b88e586d141e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017640, "uuid": "855ad07c-1f0c-4148-a045-e0d9d4dcd168", "value": "T158D4231155EC93E2C48E0FF569DF61A90279A38B5912FF9D0DCE02EB55727207B12E23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017640, "uuid": "59add391-a766-4c4b-8bf8-4822367ce2d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017640, "uuid": "601f7924-8b15-4052-a097-49833b0d4cee", "value": "12288:uhx6jhKgpINJG46y5CFlC7ccum7dhtSwCSVa4dIiNDIK4ENzgK:osdK3NJlNo6ccu6htSinPDoEN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017640, "uuid": "6c63d06f-faa2-428a-b1c3-e99172f27b37", "value": 652288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017640, "uuid": "ca9aadb3-63ec-4a1d-b129-bb44cd8cbb09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017640, "uuid": "2c9d1e40-9112-4495-91eb-0ca7b54a6ded", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fec312c-8c7d-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1701017926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017926, "uuid": "aea3ff61-f8ed-46be-aa93-9ba9709ff5ce", "comment": "Malware payload (GuLoader)", "value": "50f2af0863ba26174f4e918754255548", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017926, "uuid": "a4d470e7-8841-4d3e-9301-9dfbbae91d8b", "comment": "Malware payload (GuLoader)", "value": "6105c07aa9500683b2e15102919e3ca268875bb2f889feb0be9abe999724b383", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017926, "uuid": "5222aa9c-86ed-46ee-90e4-75bb3d576d21", "comment": "Malware payload (GuLoader)", "value": "000eb040b987ea77b454f894e88b5242bdb72085", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017926, "uuid": "fe65ffb3-1cd2-4f2a-b204-ddb8ed6ca69f", "comment": "Malware payload (GuLoader)", "value": "902960fb1fa19caf34ae40bb122bd1fc8159b53871eb8d5d976410af7dddb4ce87b0cafee9fd732e2f844bc236226b6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017926, "uuid": "1c323456-e67a-4144-ba3a-aa90f6fc998f", "value": "T14F8633317A65C811C888A5F4977EC3BA82E27D080B11211B7AFD7FBF78BC395E955218", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017926, "uuid": "c4ad44bb-88e7-4bf1-afc0-3a6a8b170c49", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017926, "uuid": "c22698e6-5ff1-4074-a9f8-0311d2e4db34", "value": "196608:X39l5n3J4intVYhC0D4Da5v7wdCZjc2cyTb5/M:X3Bn3JPtV9W/Zjc2cGRM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017926, "uuid": "ad271f32-6170-4ed9-b725-f1f7e4306f7a", "value": 8117278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017926, "uuid": "d45126c5-4226-42ec-9f67-485308ca6986", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017926, "uuid": "9226cec4-8265-4f55-be0a-54fdce3dbc0c", "value": "50f2af0863ba26174f4e918754255548.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63abf35a-8c7c-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1701017637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017637, "uuid": "8d40a03c-5d76-428f-be4f-13a9e13dfccb", "comment": "Malware payload (Formbook)", "value": "3169cbecdffcbc87e7cf8d7c90b2b706", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017637, "uuid": "0a652f95-39c9-41f9-84c7-d52c4e3d7670", "comment": "Malware payload (Formbook)", "value": "639d5d04a0ea4de3360bd342b8b821ad7f317d4520dd17da071fb24d316d13d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017637, "uuid": "c06faf96-0df7-44ff-b6c2-c46783575dd6", "comment": "Malware payload (Formbook)", "value": "d7462678f68b3460cc39c8338952dccdc8fc18a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017637, "uuid": "34e52101-8135-4651-8ae8-64534215c5f2", "comment": "Malware payload (Formbook)", "value": "3ac3a594b5b0f9a11ea94429a970f142e5bb89eaca6bd69baf055dc191aeba7b1e519413b8b261626186948c407abc9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017637, "uuid": "fedbd72b-0a94-4e14-a29f-5b6b6946bd8a", "value": "T1E3C4231B35AF97B7C0DC03F90DE7869243B56A97195FEF6C194D819A8C0BB20E67204B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017637, "uuid": "f565136e-af15-4686-8659-252c446794ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017637, "uuid": "9adeab73-c834-45cf-aea4-f1d3502bb536", "value": "12288:ZxPOXj9Rygkksj+oeAcvKpLKpLthOSlyVrwK4ENz4K:ZdOz+Z+FAwKwLEVMEN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017637, "uuid": "e3c17993-565c-4fef-af7a-7abdfacdedc2", "value": 590848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017637, "uuid": "dac46faa-2e61-4e4c-87e1-a9b4aa63d048", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017637, "uuid": "f805ecb9-b1c6-45b1-8795-7711c7d265d0", "value": "3169cbecdffcbc87e7cf8d7c90b2b706.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16d1fd56-8c9e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701032111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701032111, "uuid": "dee16356-a490-4676-8b00-d2a83caaec2b", "comment": "Malware payload", "value": "8b7ee4280107bf3cda8a7c38a589e437", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701032111, "uuid": "72587b76-9333-4495-b652-4e13d0189eaa", "comment": "Malware payload", "value": "63abfb8e4f59f7d5eb310cdb3455f13de2bd3152d845af4b10b0c81f6b6e8e1a", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701032111, "uuid": "8c7db9b1-37b4-414e-83c6-af7f15e07110", "comment": "Malware payload", "value": "9128e72ab8946fe3766a37c69bf0b961e900a93b", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701032111, "uuid": "0e257212-4b96-43c8-b29f-3a2cc590a36f", "comment": "Malware payload", "value": "00505b410e7017fa58748d3910cb2ae34d123afcefe89632629c3aaa006dee51749f8120071af7ca3c20bd7d078ea83e", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701032111, "uuid": "048b28cd-684d-407a-b67b-aac287afb56b", "value": "T1EFF733E0974F410AFDC50BBEEADA3A57C223778996E40829D4CF646F4A71E13C61B05B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701032111, "uuid": "9a959f8b-64fb-4544-a810-c785c2d5c8df", "value": "1572864:nXpHvAncxy99a+aBmyNGFNdsSITfZiv7PbdpWBrhB6/3:nlGcxy9kTMmGEAjDdpK6f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701032111, "uuid": "847546d7-fe6b-421e-836e-f5470c21f8a5", "value": 74206562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701032111, "uuid": "cc865949-8c2e-4259-95d3-7bb47fe73ddb", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701032111, "uuid": "79f92173-8e24-426d-a19a-42b8311b2707", "value": "Portal-Souls-1.0.5.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86155b0b-8c8b-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1701024137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701024137, "uuid": "7fe7d240-4b70-4a23-8afa-f011d326a3b3", "comment": "Malware payload (Amadey)", "value": "42adcf27247e2f9324ded079d3b52613", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701024137, "uuid": "d1b73444-619d-40cd-bd1f-7ba56d3df8ad", "comment": "Malware payload (Amadey)", "value": "650513f90b4b88bd0c4564016b87b00db1999c1f281cce6a6e8718bfaa5d8ab9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701024137, "uuid": "b02f2b70-2114-4f7c-9fe4-5d35fde4be3e", "comment": "Malware payload (Amadey)", "value": "51793943f7803bdbbb569448c83ca284dc7cb273", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701024137, "uuid": "4f4db6c8-c595-4222-b98c-dd45675de3f3", "comment": "Malware payload (Amadey)", "value": "127815174ce5e24c2a5f8792578fb67c251eb5365bd1f7238a5a5827ed4078b919fafbe809150ecc377b0e677d7e94a6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701024137, "uuid": "9e208310-4669-4a26-af07-4475a671990b", "value": "T1F84633CAAE52E614F48C707DD51EBE2E30B15E1B47F48B0599A8FEC7AD6395F0834902", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701024137, "uuid": "0446937c-160c-4aad-b0da-36bda784d669", "value": "2bdb246985c8a250c24a31e25f47c271", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701024137, "uuid": "513a9c72-ffea-4427-928d-886c964e78f9", "value": "98304:sIk4EA1UcVPv/GTBiktXL4f7sFjhB7PIf119llL2o+PifA73QHERfgu+rpzTPXp/:sjAaoLS67sFjh6d1Dco+N3ghrVXEq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701024137, "uuid": "b06c0754-3c24-4c81-bd31-0d7d50751cbe", "value": 5661016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701024137, "uuid": "c7f01e8a-ba7f-449d-88cd-4d52c7738486", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701024137, "uuid": "1c44aeea-f432-4003-80b8-26da23b16e1d", "value": "42adcf27247e2f9324ded079d3b52613.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0741e996-8bfc-11ee-8907-42010a9c0042", "comment": "Malware payload (DCRat)", "timestamp": 1700962506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700962506, "uuid": "10d2d2c5-440b-443c-83da-9611a6aa334e", "comment": "Malware payload (DCRat)", "value": "1fb41f04376baf7569bb5e7ce089c7a2", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700962506, "uuid": "95c0dc18-2307-450f-8e2f-4b78eccaf0eb", "comment": "Malware payload (DCRat)", "value": "66185ad00b183b834d08a03ad9f8d5716d8eff85bfa1c742c0f848a7bec0d134", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700962506, "uuid": "7c514c54-f8b1-493e-bafa-8db390fcf6f8", "comment": "Malware payload (DCRat)", "value": "3f614474797fd34e031e94d54e886eccc2081ab6", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700962506, "uuid": "04cd4d93-db0b-4f72-b1e8-11d43885e96b", "comment": "Malware payload (DCRat)", "value": "68e3d3e8083a86cddecf40c83718e853b9aadc8c322acf0bf7e0e19eda673deaa75fe3bb110d86472cc36df135d75430", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700962506, "uuid": "4d6e0edf-be55-49ec-b6f0-ddf7339c2f48", "value": "T1B3454A117A44CD12D269163BC5EF486447BCBD01AB62CB2B7EAF339DA5113A34E0D6CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700962506, "uuid": "7e34a0d1-e354-41ef-9217-753bf2be6d5d", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700962506, "uuid": "6d04be82-35dc-4a21-84ac-565b91db14b8", "value": "24576:U2G/nvxW3Ww0tNIccf3aa8KEHJ2J5vbOpotnPJ+4w:UbA30Oia8KEpSPI5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700962506, "uuid": "45c3e31d-0ddb-4425-b489-82219a2fd1c8", "value": 1248957, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700962506, "uuid": "701fc9dd-0108-4804-b9dc-d953dfc2e40d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700962506, "uuid": "f11fd874-39df-4931-a13a-e0e4b5b661b7", "value": "HEUR-Trojan-Spy.MSIL.Stealer.gen-66185ad00b18.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fe0feeb-8c78-11ee-8907-42010a9c0042", "comment": "Malware payload (Vidar)", "timestamp": 1701015832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701015832, "uuid": "5a6967b1-0a99-4638-b57b-7a6b78c85b18", "comment": "Malware payload (Vidar)", "value": "d3bec7236a76b93f14e77dc074ff6b54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701015832, "uuid": "0af0bc13-ccc2-40d9-ad74-e730057525eb", "comment": "Malware payload (Vidar)", "value": "661cd67cd8861ffb4403ef053ecf4842d89e9a25ca9fd98c749131d9d57b27ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701015832, "uuid": "629f3420-b451-48e7-ba39-808149046eb9", "comment": "Malware payload (Vidar)", "value": "6aaf256f0a6ecb5251367080d67b541484a7aa0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701015832, "uuid": "7a3831d6-5513-4a05-9d00-d76c8181b7f2", "comment": "Malware payload (Vidar)", "value": "c894fa31a2312bd692caa3e923e365eeb8574e00dc2e264c464c5bdbe4497d998d4da2de4b3c0416d805a5d2a396bfef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701015832, "uuid": "c59b1c26-a84c-4434-9694-0d1a81a0ad48", "value": "T1C8546DD392E16835E52346328E1AC2F4261EB860EF557BBB23775E2FC9B13A1C563311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701015832, "uuid": "97d57d41-cd3c-4d44-9103-3d9b2c76776f", "value": "38512f187ce560aad231123bf7f8c4c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701015832, "uuid": "3e046f73-7dc8-4ec2-a2cc-5f358411b5fa", "value": "3072:maN07a7/vcRnTad9jtOIbh7yAEtM6rVvUqJAffxuYGjA8jUpt3S:guz2nud9tOIbh7FqJAffx7Gj+t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701015832, "uuid": "ab413872-d493-40b2-b63d-ec938952f37f", "value": 281600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701015832, "uuid": "fdaf51a6-12dc-48b5-aa8c-3f8a72f45e66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701015832, "uuid": "20140b4e-61bf-4636-ae3b-cf0f3081e6ca", "value": "d3bec7236a76b93f14e77dc074ff6b54.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd6a2654-8c6f-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1701012231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701012231, "uuid": "7be1b634-e8df-47e5-a6f8-cdffc6f1c479", "comment": "Malware payload (Mirai)", "value": "7b92eb61c3bc53c743da8fd25d6f4731", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701012231, "uuid": "8128a683-e410-4ce8-b713-3539a0f428e3", "comment": "Malware payload (Mirai)", "value": "6632930c7ef7dda9063f0dc24e738d3cb764b851b003d702e6e0b7bf3d833347", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701012231, "uuid": "e81657fa-7f33-47df-b43b-573b4354cba2", "comment": "Malware payload (Mirai)", "value": "0e0f32accb5c57fb0e468487dfcef909ae3063e3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701012231, "uuid": "31948db4-d99d-4483-840e-f81efd42401e", "comment": "Malware payload (Mirai)", "value": "93c9602b2694761230c8d900980f03e15cc4861232b8b65fb3180c4564be0908817305031efaa0e32e70782890d09f5a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701012231, "uuid": "610b1c51-91e5-4431-935b-b93b7740e441", "value": "T13A431851B8D19A16C6D423BBFA6E40CD372563E8D1DF32178D222F1177CA82F0DA7A91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701012231, "uuid": "de6c452e-dea3-4cb1-a568-fcd530bc24fa", "value": "1536:ka8JYzfnBC+zLbXm/RjG35p9WhKvr6EAZNda:ka/TK/0pQhYTAZNda", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701012231, "uuid": "2fa4d92e-1db7-4769-96e5-d81573515605", "value": 59984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701012231, "uuid": "03b78316-8206-43d1-af0d-8feefe584187", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701012231, "uuid": "3a7509ba-75e4-4242-af28-b80b7fab1f6b", "value": "7b92eb61c3bc53c743da8fd25d6f4731", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2037bba0-8c89-11ee-8907-42010a9c0042", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1701023107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023107, "uuid": "83b52cef-f745-4bd1-a053-88bc86ff944a", "comment": "Malware payload (RaccoonStealer)", "value": "7a34b0a71978839c0f1b67ddecce33e1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023107, "uuid": "da17be65-a330-4060-a2eb-a618c382d5ec", "comment": "Malware payload (RaccoonStealer)", "value": "6676daa5ac462be5ab9db5b70a82e2fc6583b9ec2eaad6bc176ddb61ef08c5e5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023107, "uuid": "142f8a47-8ac4-419a-8f66-fde3606612e7", "comment": "Malware payload (RaccoonStealer)", "value": "efe3b29f5c015993a46ea3aac3e50c377e2c2e0a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023107, "uuid": "f13c069e-3f64-4012-b09a-0202dd1fac06", "comment": "Malware payload (RaccoonStealer)", "value": "938617bd42dbc4578734badefcd2dc792702f9a6b5baec9fed87fc5facb20957ac7ca6c753968e59b7939cf28fed266e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023107, "uuid": "c0938acb-1a18-4a5e-97b4-f942567523ec", "value": "T1588623A391541088EDEA8B3DC1377DA531F33F6A8AB098BDA495B5C127735E2C623D43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023107, "uuid": "4315ffb1-8b7c-4323-bc50-ed04e3a1517d", "value": "1620a4502dccef1905f8a7cf281e66b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023107, "uuid": "735d070a-b7fa-4f90-8563-2ab7a43f5d33", "value": "196608:PLejSGJHFn+3Yh8gZRZuuwRx5n6eRBjlH8G0xeOO0e8YP:yeGJMSZu9Rx56eRBZ8G2RO0X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701023107, "uuid": "7c2fcfe1-bd6a-4294-bce7-2f6e20c4d172", "value": 8531968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701023107, "uuid": "9e5cff58-b8ea-4fe4-a387-1ecbf10595f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023107, "uuid": "f79b73db-c619-4b68-b915-738bd3737f22", "value": "7a34b0a71978839c0f1b67ddecce33e1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93ee21ec-8c87-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701022442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022442, "uuid": "d3e39a73-9da7-4e4e-b558-a08b05cb191a", "comment": "Malware payload (AgentTesla)", "value": "d63a6fc2db7940e9b3eaab38ff49e90f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022442, "uuid": "a1957c49-ff4c-4cd2-ae76-fe360679d80e", "comment": "Malware payload (AgentTesla)", "value": "66e7817886bf009d9bfa2f6245d9754ee62dc2cec7d95dfa3a5efb4d553cf9fc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022442, "uuid": "6f1dba4b-8b6b-4cfc-b281-0e098eed7da8", "comment": "Malware payload (AgentTesla)", "value": "7056e1d0374a6b8f0907e5f24a72a808cd34c71e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022442, "uuid": "2f37e42e-639d-49a5-b3b3-7180e7b66386", "comment": "Malware payload (AgentTesla)", "value": "b47e51e398e680424e7583c4f84abfd4d04d5286bbc019d738836f941d0a2917290b0a2355aaf7e141ac59cdee493618", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022442, "uuid": "8b286347-63d7-45d0-81dc-10f9a7d8eab4", "value": "T1C4F4E043B22D4B1EEAB947F67130123047B46F5B6925E298BDC2ECDE5471F4C1A02AE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022442, "uuid": "f90e88fe-bc06-4b2d-95de-9cad894a666f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022442, "uuid": "e2e8cbbd-35d3-4ddd-91f7-358a259cd1cc", "value": "12288:adyYX9K2Gub1BY3io4rCcsa59JD/4hzOIO9jGJGwZjfssf37vT:ytQS1BY3io4uc5NDAhzOIOFGJGwhfxTT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701022442, "uuid": "c198b93f-e15d-4464-95d3-d075b28cc2fc", "value": 784896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701022442, "uuid": "d5b6e524-f035-482e-b120-d5f99cccf6ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022442, "uuid": "2dc2f992-e120-4bf0-af24-ee0d15a5fcbc", "value": "RFQ on SAK-TC233L-32F200N INFINEON PN PHARMA.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae23139c-8bff-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1700964074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700964074, "uuid": "a9e45a64-ca60-4de9-9669-65ace913d699", "comment": "Malware payload (RiseProStealer)", "value": "404dabc5398724e46e0bf2a4a1034fd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700964074, "uuid": "9ddfb91c-ad0f-4531-b974-182aed3a806a", "comment": "Malware payload (RiseProStealer)", "value": "67053e724d425fcf6d086c35bf29f257975d9ef5b1b021ca8018e82bfa1e9fb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700964074, "uuid": "47bb2290-fd30-44b1-8eac-84297d2a77a7", "comment": "Malware payload (RiseProStealer)", "value": "d60f0559f9041bbd93f1d426654f1cd20c0df40e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700964074, "uuid": "29d8cb63-c3c3-44d0-9575-3e0e45979224", "comment": "Malware payload (RiseProStealer)", "value": "3dd685fa626dfb8cfef65e3f9a6254fcdcbac2dc610bfc296749ec0a01202a6c26752e06a2ef9cfcbd250e7681b7bb02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700964074, "uuid": "0b0b4b6c-a081-4edc-9dfe-2507429e13b2", "value": "T124658C31FA08D4B6D09210B0916D6A7B91587A322BAF4CD7F3C05E6E41B52D2F235F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700964074, "uuid": "837cab7c-2b61-46ee-a574-73d79b4d7ce8", "value": "078471ac5a76189ffe465abe0c89c6b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700964074, "uuid": "00cdf7e9-7aa2-488e-bc26-a4c3612e8e72", "value": "24576:2opGDjnvrPpkjos0OtjcFc5kM49dj+IuxWQOIjuJuVvhbqL0HtFcgekRP9dT0WNI:OnvrPGT0Egyudc4tI3bqL0NFchaP9dTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700964074, "uuid": "bf919957-442d-424e-a80b-d29705ce0312", "value": 1539790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700964074, "uuid": "27f7238e-f7ed-436a-92cb-76ee2e640ca4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700964074, "uuid": "62094fe1-e3d6-4b82-ae1b-886950a68457", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61102d53-8c7c-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1701017632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017632, "uuid": "e96edf1d-97a9-4bd6-945f-99cab34c43ca", "comment": "Malware payload (SnakeKeylogger)", "value": "58a2caf18a10f91f5efaa737c810e20b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017632, "uuid": "ed3a9294-0274-462f-aec6-7ac072261de8", "comment": "Malware payload (SnakeKeylogger)", "value": "670c7cf4abc4d8822818bf65b023c90c7f88e546c4a503a2384f3a39df044d63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017632, "uuid": "0ae042ac-01e6-41e2-b842-f3d4e0a9ca7e", "comment": "Malware payload (SnakeKeylogger)", "value": "600f931a38f37302ad02fa233d25333067216615", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017632, "uuid": "082efbb6-7969-48d5-b18a-4aa7c88adabd", "comment": "Malware payload (SnakeKeylogger)", "value": "9e77fd9daeacbbdb0e0b067a39cfb3b8844e4e05865a25f8b871322945479c0ac6561f96dd24d338ccaaf1cf29243ee6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017632, "uuid": "eb32fbef-c05a-4153-ab71-3184c1e238d5", "value": "T1E7B4230073EE87F2C4AE87FA30BBC29743A595A2B560D77C5E5810DE8A79B116793313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017632, "uuid": "ec398707-76f3-4b00-a03f-39179daaf63a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017632, "uuid": "1e895e61-d0a2-4694-883e-f0103b490ed2", "value": "12288:QasjOg0SXb8na8rkcsCKndHbel3yQpwa92NcJpPed7K4ENzcdK:VAOg0SXbskcZKndIyQpRU6zEVEN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017632, "uuid": "fb058b7a-57d7-4213-a27a-8a40ac838495", "value": 532480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017632, "uuid": "5b782724-7775-4c45-98fb-b52bce7f508b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017632, "uuid": "d37e7c0a-f4b8-4881-bc7f-a895c53ba45e", "value": "Quotations.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d796d64c-8c01-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1700965003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700965003, "uuid": "e21345e3-43b5-49dd-a89b-bbf34f5c4962", "comment": "Malware payload (RiseProStealer)", "value": "50807c75b89fcaa5d0894414b797a22e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700965003, "uuid": "909066a3-02d5-4eff-9251-9cd6f16b8031", "comment": "Malware payload (RiseProStealer)", "value": "6ab16b9256d9dcb3d99fe8cd93493bc3236b80883019c6d3a14a270929490bff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700965003, "uuid": "c9029f10-b045-4746-b77e-5497f8b565f6", "comment": "Malware payload (RiseProStealer)", "value": "e7d78897826513e3b6c0ba458912f11c3a0a9c2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700965003, "uuid": "a1da10cc-adde-49d0-860d-b427dd7a6a4a", "comment": "Malware payload (RiseProStealer)", "value": "6ac02bc77f4342870f8561c27badc21c4101b8e22dbb3306a903b3c10aca1c365c6a240cad00a77b752c8155e134609d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700965003, "uuid": "e42d4b49-6e7e-4805-9ba0-8d7b18a40285", "value": "T1CF658C31FA08D4B6D09210B0916D6A7B91587A322BAF4CD7F3C05E6E41B52D2F235F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700965003, "uuid": "b285b7ce-912e-4eaf-8b3d-323c77db204f", "value": "078471ac5a76189ffe465abe0c89c6b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700965003, "uuid": "db28dfe4-e311-4e50-bf89-e9a5dbe5be4c", "value": "24576:2opGDjnvrPpkjos0OtjcFc5kM49dj+IuxWQOIjuJuVvhbqL0HtFcgekRP9dT0WNI:OnvrPGT0Egyudc4tI3bqL0NFchaP9dTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700965003, "uuid": "f126ef45-1a0e-4e5d-a091-78f07ba8f039", "value": 1539756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700965003, "uuid": "34f2ddba-b7c5-4703-9f09-6481212ed467", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700965003, "uuid": "acd92998-6aec-4e4e-a221-8cdb5cf0ee43", "value": "SecuriteInfo.com.Trojan.MulDrop24.22194.19927.25102", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "135828f9-8ca5-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1701035111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701035111, "uuid": "7c5afbc3-4dec-42fb-a7f1-768e6aaf7b0d", "comment": "Malware payload (RiseProStealer)", "value": "2beab69f2c8dd86bd23a2513953e4d18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701035111, "uuid": "2a08b078-a373-4bc6-9139-2dc97c49aedf", "comment": "Malware payload (RiseProStealer)", "value": "6dbbbff5537db28e763ea939f6d59863294fcc7eb9d9c6723986ad7b06f77170", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701035111, "uuid": "2ebb511a-2919-4c03-b105-ba90462a2f18", "comment": "Malware payload (RiseProStealer)", "value": "9335a3bf2064ac59c373eb2ac436c4574f7fdf19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701035111, "uuid": "74f63a8a-23bc-4ba9-bebc-bf5f8e52c1db", "comment": "Malware payload (RiseProStealer)", "value": "6f1dd981e08c0afa64836cde16dc9d5cdc198e59641892a28709fe47c05b86fc640f041ee7ecb8209681a91a529c7ede", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701035111, "uuid": "94f3037e-c397-47d4-b809-49841e8907f8", "value": "T1CE852342B6D59411F6F92FF405B747A343327DC2BAF0B26B23A6A8550E62324F572327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701035111, "uuid": "ad0e066b-96a5-42c1-a5ec-a783a4ef28e9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701035111, "uuid": "c0da001f-1666-4f01-ac6c-5abc1fa5a7ab", "value": "49152:k5pZEAUcoxuDrg9eACKHqC5i7hSi0PXh5:QpCAUcoYAb5Wgi0Pr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701035111, "uuid": "f3b9ed84-285c-40be-9547-f63a40e18475", "value": 1771008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701035111, "uuid": "56c03e94-3a38-4dc6-8b6a-d1d210932090", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701035111, "uuid": "11656d7d-9a87-4864-a787-a358f08d783a", "value": "2beab69f2c8dd86bd23a2513953e4d18.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f50f3b8-8c7b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701017173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017173, "uuid": "5f995aae-b740-44f8-be82-1d9d3d1e5b35", "comment": "Malware payload", "value": "1ea47040d84ba4859ac8b74b9b093704", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017173, "uuid": "1e43abf1-6281-4773-828d-9894e6fa23f7", "comment": "Malware payload", "value": "6e80e785c5b541432d1d48df09f152fdb8b68231fe4994486363bb9bf7399297", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017173, "uuid": "5575fa88-e9d9-4939-a680-d2f298215a87", "comment": "Malware payload", "value": "ceca8346497d40150baa748fed355b32f6687177", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017173, "uuid": "7e6c2177-aea6-46ee-bbaf-864e9c5cddb5", "comment": "Malware payload", "value": "3a738554d3915ad06a49dac1f1d73ed2947ade460ebedb153d36d902f504d659bf124150e1744be0029c83e00361ae8c", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017173, "uuid": "3bc1f0e8-5f3d-41dc-8425-2266c699a70e", "value": "T1B5867C17B384653EC15A0B3A4877B658A83FBE713A128D5B77F4188D4F359803E3A64B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017173, "uuid": "c5e6382d-cf00-471c-b7ea-92c3b2bd95f1", "value": "98304:bLgXyb48cJTaImS2diE7i8DAc39yOTHo6:bLO5JThE7PsWH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017173, "uuid": "6bc41c42-9525-4b5c-92aa-b88c686f2158", "value": 7857152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017173, "uuid": "16b11ba0-bc92-444c-9b32-3fe60c800171", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017173, "uuid": "2a7d749d-508a-4dc5-90c3-99c73b1125f7", "value": "FACT-NATURGY-A4-SIMPLEX-A9-TLLTK_NOPAGO20112023249525941229219492494924.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f4932fe-8c94-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1701027910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701027910, "uuid": "00e1f951-e12e-4a4f-ada9-3e9f343ccaa3", "comment": "Malware payload (RiseProStealer)", "value": "606341b7ff6919b71dd7150b5779baba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701027910, "uuid": "55c50be0-d2ca-4dd8-bd76-1c84abd537a8", "comment": "Malware payload (RiseProStealer)", "value": "6f1da627c7960d3e3d290c5e01cfe2427b5bc284920f8142726095df66910572", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701027910, "uuid": "825282ed-2354-45a0-aeed-29d44b81acac", "comment": "Malware payload (RiseProStealer)", "value": "977e941f0cd8937fca1fdcfc73b34397c78238f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701027910, "uuid": "776e9238-b94b-46fb-bc88-96b1096e94e1", "comment": "Malware payload (RiseProStealer)", "value": "9895aab8a3386e96709ec64338e37e84916ce31bafefaa08f19f429de2e24c7f23b61923eb5f9920224e377f684d2f25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701027910, "uuid": "2f2dd5e6-5407-4180-a974-e306cc61e641", "value": "T18C852302AAF58023D8B96FB05CF73753197B3CD7BEB083536225AD551D2276294B233A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701027910, "uuid": "d6192e80-554b-4494-b0d5-9343b079e52e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701027910, "uuid": "6200829c-91a5-4b4c-a3ad-f53c3e68e0e1", "value": "49152:LhTLO0JvPMmZW/JvXWUxy/TSPNdQ5wO/I:FTLdvPMmECTSNOA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701027910, "uuid": "1b89d922-533b-4b80-b463-ef4476ede267", "value": 1769472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701027910, "uuid": "d36c8fd3-a12e-4749-a523-98e30972f935", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701027910, "uuid": "e8af335d-0558-4c58-86b7-0de3a432c825", "value": "606341b7ff6919b71dd7150b5779baba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf1fb075-8c19-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700975297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700975297, "uuid": "3ecbd3fe-042c-48a8-80c2-828728f3bce1", "comment": "Malware payload (Mirai)", "value": "f1b4e1af6e522cff8e426fdb1835ca12", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700975297, "uuid": "c21d4b38-e239-4cc6-b4df-5849e3d7fce2", "comment": "Malware payload (Mirai)", "value": "71b7b4c83b36f0dd700e73ad931bd035fc849ab8bd7ebf50c249a98eca9be55a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700975297, "uuid": "8258ecb0-9d08-4b71-a88e-10a2cf57e401", "comment": "Malware payload (Mirai)", "value": "e8af0ef29b79594a8a9dd84ced9db47a54263bac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700975297, "uuid": "52e9719d-6ebb-44d5-86a4-523ab2d7ee09", "comment": "Malware payload (Mirai)", "value": "2ab630a325e4c418b7f18d90b776cc25dbfbcf3119188d47648ddeab22e4cce62a35a7984fe3b4f00280f031196c346e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700975297, "uuid": "6165fec7-fcf1-4623-adf5-da6375f9611e", "value": "T1A473299AF801DD7DF80AD77B44630A09B631A35516830F3B569AFD93BDF11AC0A52F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700975297, "uuid": "591046a6-bcc1-4194-9331-21d00fff9ab5", "value": "1536:pfRUb1FMSTbxTooT8boS2hgbB3wuRMZn85ZKL4t5uocJJZh6:pZUb8SfxToo/SxtAPt8TsocJJZh6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700975297, "uuid": "a324aef1-abfd-4869-92bd-b45d33923b8b", "value": 73808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700975297, "uuid": "a53a4db9-fc63-4135-a5bc-69641a029418", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700975297, "uuid": "086aa9a7-abe0-47ef-882b-89096898cad9", "value": "f1b4e1af6e522cff8e426fdb1835ca12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c35a869a-8c19-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700975277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700975277, "uuid": "e5d34f85-b9f0-4914-b4ce-b0b680e1cacd", "comment": "Malware payload (Mirai)", "value": "b7a9aadd68c50ae4ddfa08662852ce3b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700975277, "uuid": "e46c0078-8235-4c67-b4da-fd7c9182a85f", "comment": "Malware payload (Mirai)", "value": "7212b6c7c457cda648b3e628e3bf623226b16fc109f357e0421d77533cd26728", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700975277, "uuid": "60d4eeac-d115-4ba0-972b-0b9bca2e9071", "comment": "Malware payload (Mirai)", "value": "1a710b97b01d9734d36a38c85698c2190e2cb364", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700975277, "uuid": "6ebfb17f-f8d2-4213-8500-812e8453055c", "comment": "Malware payload (Mirai)", "value": "aba949072f8ebba1d6f3a3fda0711395e5ebc125a1289798fc0ac6161799d63fc8b08bd9d36091a4b9d12342866e35b3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700975277, "uuid": "40c8b61b-5b5f-4a7b-b7a3-b8981b547d12", "value": "T1ACE33B46B6404B17C4D6177AB6EF42453333AB68D3DB73069928BBB43F8679E0E23605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700975277, "uuid": "d2ba6856-7d11-4e80-97e5-8aec690b3376", "value": "3072:renQ44fxa9MDK2s5Ul1RC+fx3ij0EM/9J5vYzO:qnQNxa9MDKT5dIx3ij3M/9Jp2O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700975277, "uuid": "e66f9117-4458-4f84-aefa-ee0723675ac2", "value": 151279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700975277, "uuid": "d0085262-0635-4b1b-a40f-dd80690d2e68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700975277, "uuid": "1ba65f1b-977e-48c3-a91a-e1fc0b0e619a", "value": "b7a9aadd68c50ae4ddfa08662852ce3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a7c9bc4-8c8a-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701023634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023634, "uuid": "916fa451-7385-4450-812d-16c509d19ba2", "comment": "Malware payload (AgentTesla)", "value": "aced2c8014dbfe7a8dc34475f1c3ff50", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023634, "uuid": "55affe65-1769-43e1-907b-025b3b5e3a9f", "comment": "Malware payload (AgentTesla)", "value": "722b47ca4f0c2c337f7adf494536d7aa69d5e6bed3e9641b2017ff588be488cb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023634, "uuid": "f746c319-3ca1-4cc5-b06b-e924d31ee2dd", "comment": "Malware payload (AgentTesla)", "value": "cd4efe1e6ef15544eff65388bf78485114ce697a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023634, "uuid": "bcb500c1-9140-44e9-8b16-1318532ab018", "comment": "Malware payload (AgentTesla)", "value": "64643aa76af79577ea1fe24bf0d458678e7fb2d9eda2ce6193dc12fbfd7cd3dfd4f1dd8c6e437d94ad64740a4a75c9e8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023634, "uuid": "76532dc6-1d72-4894-973f-cf961477d79a", "value": "T19AE412662AAEFFD7E4AF03F90A35D40443F6ED295A50F704ACC231DB5178B619E22913", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023634, "uuid": "e1559ea2-b34c-4416-a241-f543eb115fe2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023634, "uuid": "0462a231-f9c8-4bd3-bf13-ccc20b7fc646", "value": "12288:r2E6jD//mXPp7ajrd2xJu9HhVli9AAh8tyQo5+Ph614eHENz:qtD/uXPAjrDHhQMo5WQDEN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701023634, "uuid": "761589b1-e2ae-46e4-b03b-05c2691505f9", "value": 696832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701023634, "uuid": "e4c0e2c9-edd3-48dd-a5df-d86e3374d079", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023634, "uuid": "ebb63766-9643-47d7-aad1-88aab56146b6", "value": "Ayl\u0131k \u00d6zet Raporu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c75ed1e2-8c72-11ee-8907-42010a9c0042", "comment": "Malware payload (njrat)", "timestamp": 1701013509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701013509, "uuid": "8b3510f6-c5f0-4890-8c85-1733e2167657", "comment": "Malware payload (njrat)", "value": "ad6a5dbadf6843f113872caf3fcd8b4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701013509, "uuid": "671956a6-8fb5-464a-a647-73b257703d0b", "comment": "Malware payload (njrat)", "value": "747cf93ddee9183764e543b2e1a39fe6c36f0d87c6b66f67786453db30262b53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701013509, "uuid": "4f39e049-e609-4e23-8529-3cd8443b5e5d", "comment": "Malware payload (njrat)", "value": "13547ec99e18219477b2c8d73e3c6f365e2d6a72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701013509, "uuid": "cc7ad648-f71a-4dd0-b85a-e6a59e445247", "comment": "Malware payload (njrat)", "value": "9a98382f44a9c2f25de79353ad7636d371bc1bf6b3ec38d1f5175ebc97f4c32dbf6ea6c033c89c50d1b7083f99719271", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701013509, "uuid": "535fd74d-1da1-494a-8ae2-6bd4b2c27983", "value": "T1B693D84977E96524E0BF56F79471F2404E34B44B1602E3DE48F219AA1A33AC44F89FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701013509, "uuid": "d406136b-f9a8-49ea-82e3-c0ff93ec7827", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701013509, "uuid": "16e9139b-bb07-4ee2-b3e8-9dcf434a2b36", "value": "1536:pUPTr1IDavlZhbSKa9YdjEwzGi1dDoDTgS:pUPSDavlZIXmqi1d2M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701013509, "uuid": "0142f128-4b7a-4888-ad3a-485dffbb1c50", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701013509, "uuid": "1f315bf7-c45f-4d61-8e79-6743197719d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701013509, "uuid": "31914e2c-a3b2-4fec-868a-71e03a8db1b1", "value": "ad6a5dbadf6843f113872caf3fcd8b4c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10ba6883-8c7b-11ee-8907-42010a9c0042", "comment": "Malware payload (BunnyLoader)", "timestamp": 1701017068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017068, "uuid": "9ddd8826-bdd1-4705-bb07-bf04dd795112", "comment": "Malware payload (BunnyLoader)", "value": "2f05a56a349dce85119e7fda9e8047ac", "object_relation": "md5", "Tag": [ { "name": "BunnyLoader", "colour": "#99D86A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017068, "uuid": "df118f70-d93e-49a2-881a-c47da0077642", "comment": "Malware payload (BunnyLoader)", "value": "74c56662da67972bf4554ff9b23afc5bdab477ba8d4929e1d7dbc608bdc96994", "object_relation": "sha256", "Tag": [ { "name": "BunnyLoader", "colour": "#99D86A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017068, "uuid": "079b3aeb-fc83-4518-99cd-699bb7b35425", "comment": "Malware payload (BunnyLoader)", "value": "2f5afa9af299cba599c57fd99319268db803b31b", "object_relation": "sha1", "Tag": [ { "name": "BunnyLoader", "colour": "#99D86A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017068, "uuid": "7abe5d29-f2e1-4df5-aff0-a535d117e66a", "comment": "Malware payload (BunnyLoader)", "value": "27e9e41127d7561c5fb3db4c13c03f1144b35be71ca51f83e21547e0877b0772819dd12771dd5e3f60143bea4390ab48", "object_relation": "sha3-384", "Tag": [ { "name": "BunnyLoader", "colour": "#99D86A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017068, "uuid": "542888c7-0ef5-4553-8eca-83e38a226bcd", "value": "T111A5230B679D8F12C6E98F3AB0C76B08DB71F900938BF74F248509D91D9A3D69B11A1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017068, "uuid": "1cab9171-fb2b-4be1-8101-3b3156e4591a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017068, "uuid": "22a02abe-83df-4be2-bff7-4f5fb0abb1bf", "value": "49152:13NvRA0BjE8tCpIQontgzhDeGN8HHA7twVJ6M7Qzio1/Hzwo7L:13Q0BnkpiCzhjNaHA7M7Qz/bh7L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017068, "uuid": "d8166053-ce87-4581-ab63-f08e269bb480", "value": 2133152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017068, "uuid": "39a27b58-6910-4db6-8fcf-704dc85e4457", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017068, "uuid": "2ff52962-1bdf-4369-91c3-ae950d89dc6e", "value": "2f05a56a349dce85119e7fda9e8047ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12dc07b8-8c3c-11ee-8907-42010a9c0042", "comment": "Malware payload (Vidar)", "timestamp": 1700990013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700990013, "uuid": "987b797e-896a-42db-b85d-47df15e251ae", "comment": "Malware payload (Vidar)", "value": "788ca5ac905268a5534c3aad4c20d710", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700990013, "uuid": "de694161-8c66-43f1-8283-3d0327094ff5", "comment": "Malware payload (Vidar)", "value": "7622fc8bbc24b2a897785d26cf343d51e1e89faf35783b658ff7b075d4686a81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700990013, "uuid": "2ccb1b52-2baf-4c18-a409-a2fbafe09646", "comment": "Malware payload (Vidar)", "value": "b06023f70dfa9e2e09267c6741a0fe6711d984b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700990013, "uuid": "682b876d-6887-4439-9f9b-7286cbedc11b", "comment": "Malware payload (Vidar)", "value": "861896bd6737512764129da72b0bc3e93a511c0726206fd6d383c4b658f2a98f330d25263d60cb17eca59f91e0bb749c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700990013, "uuid": "f4846b70-960b-483c-ab64-61a9251a382a", "value": "T17554D64392E13E44E9268B739F1FCAEC778DF6508F597BA922189E1F04B11B6C263711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700990013, "uuid": "73eb36f1-c4a0-4802-9906-0c3bf40bfc0f", "value": "32e191367f9932caeeb9bed9a82d73da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700990013, "uuid": "64720e47-b81c-4615-81f1-c41690184242", "value": "3072:T7iTepdVldLBUv/s217EfSXKAzV9E/7HMYUtWQ5mgDypp5kVyBk3eFx/RiPB:niipnld6p170+4MFtWqyn+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700990013, "uuid": "97390948-93b4-42b7-b61e-8f978bd08ae6", "value": 294912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700990013, "uuid": "6f7c431b-3143-441f-aad4-8da3ce435b09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700990013, "uuid": "5575e278-7165-4927-a385-b17a3f9876f4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "270d94a8-8bf7-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1700960412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700960412, "uuid": "539c9035-c85e-4334-b7f1-b6af40bf6483", "comment": "Malware payload (Stealc)", "value": "34fb465700868748a4a49d1063e3e8e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700960412, "uuid": "950411c9-0194-4dcf-a1a7-bf17f6a340a9", "comment": "Malware payload (Stealc)", "value": "7729e5b688bdac64950e3245bcc28e027c34a4528070cc014b8e3fc061ae56b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700960412, "uuid": "99e88b4c-0672-4ba3-ae9d-4f482f67736d", "comment": "Malware payload (Stealc)", "value": "62771ea2df6b9551010d51f4f931a5a055fe03da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700960412, "uuid": "8feee75e-887a-4cb7-987c-3a1ffa6b3e89", "comment": "Malware payload (Stealc)", "value": "f82e50eefc052a31019eb9c4da4a458d741ae8ceadd7a28770c2e08bc391ef8fe239bacce42e7c1b12084ddfb9c73f33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700960412, "uuid": "0c149cca-ec6e-434e-941d-70d8061cc06f", "value": "T1EE74A31392E13E44F9268B729F1F86ECF75DF6508E497BA912289E2B14B2172C373750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700960412, "uuid": "20e3bba1-9a5f-4399-aa26-59a2012b8878", "value": "4c459b08e177ae567cc13290dc63378b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700960412, "uuid": "e4e426a7-15fc-45c5-8bdf-e72b2462a356", "value": "3072:QI1d4WesJ0cFs/atixriVcD72lcdTXeC3jgtklNP5wfxGf5XyBk3eFx/RIAB:p/4Wej/atCh72Cd33aZGc5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700960412, "uuid": "730133b7-7b21-4602-bd61-7911d7835f80", "value": 342016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700960412, "uuid": "53c78823-999c-45e9-88d9-51b2b298d9bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700960412, "uuid": "adf3a3a7-f05f-4c96-95c1-addedfc21b50", "value": "34fb465700868748a4a49d1063e3e8e2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8cd18ab-8cac-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1701038422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701038422, "uuid": "9cc483c8-73e5-4dff-862d-cce545f71f4f", "comment": "Malware payload (Stealc)", "value": "caef6f271771ae3d1abe4fd9a9eda001", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701038422, "uuid": "71e806bd-096c-4bf1-9768-9f8d7879a829", "comment": "Malware payload (Stealc)", "value": "78a2bba2b5340b176b67cb9c6d9fd1c984a4bb4d0ee6a041256b4dc733acefb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701038422, "uuid": "a02dc896-0632-493b-a260-c790ed6cad0b", "comment": "Malware payload (Stealc)", "value": "7e65dfe3cc95f88d7deb7ab2ace1cb911ab33cb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701038422, "uuid": "e9124c89-89c5-4d2d-80e5-fb45298aa9e8", "comment": "Malware payload (Stealc)", "value": "d7b98dd84d45b1bf0893cbd86c7c9dbcb00ca2da070daaae9c1ee7856cc7efce06c15ae4c5c70b5532cbb8d5dc8e6689", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701038422, "uuid": "fc4ff9f4-7b5a-42a4-b5a3-a20e9809f0cf", "value": "T18154D50382F17D56EA364B729F2EC6EC772DF5908E49BB651218DE1F04B10B2D2A7721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701038422, "uuid": "8778a8fd-078b-46c8-a6bd-df3412f8390b", "value": "a8c9b214465db11dd2d44bc442cb8e42", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701038422, "uuid": "076c52fb-6825-4425-946a-3512771c578c", "value": "3072:ptDqZkZ2CfJ4Yp0Bb7RULMMCvgdBqCttMxrOUbR:3DJACR4DRRUwMCCBDttMvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701038422, "uuid": "d2eba197-f879-4f04-863f-90b2ea14ac8e", "value": 299008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701038422, "uuid": "e217ac5b-1bf2-492a-b76f-a3b04c1b1a3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701038422, "uuid": "b859156f-da6f-43cd-9c51-a21ed1f2d0b0", "value": "caef6f271771ae3d1abe4fd9a9eda001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a9966b1-8c7b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701017192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017192, "uuid": "189e74a7-5d05-4858-bc2a-b494f0527264", "comment": "Malware payload", "value": "a23db645b35ca1205d4cdf227a8a5868", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017192, "uuid": "6674ec69-2cf3-4778-88b4-b71a23b6f08c", "comment": "Malware payload", "value": "793ca9356bbe8faeaa6f8ea67111b4fa95db036107c958005d5ed0378418edcf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017192, "uuid": "2168ab39-ba0c-42a0-9e60-6e33e5642cc1", "comment": "Malware payload", "value": "95d23db4daeb35c2c05855dcaec711692a5dc0ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017192, "uuid": "c72ee8f4-2bc4-4df3-9f6e-7d48f9c588b3", "comment": "Malware payload", "value": "6791e998298e8868e5d476b58bcfc9f64e72104dc9ed1041d564fba7a0503fd2615dc9cb30afc3e8101c80d2264e2eb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017192, "uuid": "a9c09c40-3e5b-48fc-8a88-bc646e4845d3", "value": "T11917333071B184B3D6F5A43169BAC7B00839EBB72551BA9B33321EBAEDB875081717D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017192, "uuid": "d4109bb6-8520-40d9-8b61-f520cc7323b3", "value": "528bff25a7ae8920f85b5aa4b7c8d6f8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017192, "uuid": "0a4d58ee-d9bd-4725-982e-1a46f257c983", "value": "393216:wyabgyGmGbk4uWUWeIFiL//kkN2ODLz1Zi9tLwRLs2gqmZb:wyOHGmkyBWVFiL//tN/Lz1ZifiLlgZZb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017192, "uuid": "fe350192-852a-4167-99e8-5b15dea9a0b7", "value": 18573233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017192, "uuid": "a7a934f7-fb2c-4be4-9e53-a64c801b33f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017192, "uuid": "040177d1-ccc5-4761-89f8-938504143c47", "value": "a23db645b35ca1205d4cdf227a8a5868.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f93d710-8ca0-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1701033011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701033011, "uuid": "3325792b-76fb-42ed-9259-d290fb996a7e", "comment": "Malware payload (RedLineStealer)", "value": "d94fc8dcbc9e403657f9323967855f59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701033011, "uuid": "fb4c3cd7-c406-42d2-a4b5-363fe96e5f7e", "comment": "Malware payload (RedLineStealer)", "value": "7ca6811b3a9febcffeeee9d839ad6b8eb096688c666be805325d1acf663cc833", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701033011, "uuid": "3b749dae-6919-448a-b952-bc67725177cb", "comment": "Malware payload (RedLineStealer)", "value": "38300f1f5e15fe150a6668cf1ee74e0d21e87f05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701033011, "uuid": "45e9bcd8-c198-4c8f-ada1-a4466a837fe7", "comment": "Malware payload (RedLineStealer)", "value": "ddc42886e33ea10a9dae45c0029c1069b9d0b7a64257be84c56fbac711eeef03e3fd0fa45d75d96221607036386ef998", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701033011, "uuid": "42e2b1b8-aabe-4e5e-ae43-bbf5ad584a9f", "value": "T1F1852342A7D89061C6B86F7490F75653153ABCE3EEB8D31B270BD80B4892B447572B2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701033011, "uuid": "9241cbe6-7365-4669-99a8-2a5d4c8da1e9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701033011, "uuid": "181c438a-9e48-463e-b775-663178706d87", "value": "24576:MyJcSLlWITu5DSFNBzUgnFbaEaULSfE9SOb+fV6n8oKHjqlktLYPoPisFT4ll5lQ:7JTJW58NquF2TwSc9SHfV6ZaYP6Ql5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701033011, "uuid": "d219fb82-19b7-40a0-bd7d-fad0bfc68518", "value": 1771008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701033011, "uuid": "a808bf12-64da-4ddb-a793-fb46b8969e13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701033011, "uuid": "add6b617-0961-4c47-8e80-3ce050bbcc2b", "value": "d94fc8dcbc9e403657f9323967855f59.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51d1e069-8c6f-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1701012023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701012023, "uuid": "67c317df-d55b-4812-a503-3f5ce3626002", "comment": "Malware payload (RiseProStealer)", "value": "1927792efcdc255ed148d2d7835cf4bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701012023, "uuid": "a8d10717-01fa-4633-b2b1-5b1122e033b3", "comment": "Malware payload (RiseProStealer)", "value": "7cb16f0652aa546712f759faa5ba6f03c639ca54f395ca6e9d8036d3d2159f18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701012023, "uuid": "8e8bd79b-a7c2-4532-971c-e4507cd8a73d", "comment": "Malware payload (RiseProStealer)", "value": "8816ac451cef22fab17723c8e771251f62e64a06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701012023, "uuid": "361e69f1-2772-40a6-8c0c-89474717011a", "comment": "Malware payload (RiseProStealer)", "value": "6ca3d644713a97cb8c8aea9b992bf2f6b5ed247d6f3d7e758d24dfb3c2efde7c3365e9e6d41ae72cbc16cb0fe812317f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701012023, "uuid": "c7de659e-4e87-4f03-bbd1-340148cb3186", "value": "T17B352343B6C85135DDF52BB01DFA43830B36F9A168BC472F2661A5295872BC4EA32377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701012023, "uuid": "da72e59b-da2b-474e-ba85-18bb98496aee", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701012023, "uuid": "c257d070-36f7-4f4f-bfaf-c26cf65fc00d", "value": "24576:cyONlhS7dnP/dc1yY/NWbJgg2BBpUonc0oLxQZ7GfMK55kq6yli12icv:LONlhSZ6n/4Yplzr7GfMTq3I12x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701012023, "uuid": "22f00897-04d6-4ca9-94a6-21afc6dab7c6", "value": 1095680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701012023, "uuid": "a038058a-3660-471d-bd90-ff8438fba824", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701012023, "uuid": "568d5215-4b53-4112-879e-9358a3f776f8", "value": "1927792efcdc255ed148d2d7835cf4bc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59660cc5-8c7d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701018049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701018049, "uuid": "e82e3cad-3172-45da-ab03-761999bc6854", "comment": "Malware payload", "value": "60b60fab3866a4938391d961d9f56288", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701018049, "uuid": "9a4f6ec7-6f67-442a-b061-fff43b1e890b", "comment": "Malware payload", "value": "7cf847b4b8b09e5e4cc6aac45abcd37d1cc6880ec75cd0554c4f0f3b8b10ca42", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701018049, "uuid": "fbc410db-59d6-4c1b-9d3f-33079e83e113", "comment": "Malware payload", "value": "d3821c00efa5dc2ce0f123317d3a664589cdc5ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701018049, "uuid": "992fb965-ca53-481b-8b10-f4e9096d04d3", "comment": "Malware payload", "value": "111e204b700386d1590ab7c8275dd290a636469d4602f3306c4add57e19f56ea2aae88600dbe6d68276451a5b82c6b96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701018049, "uuid": "e52415d6-f609-42bc-8dd6-dd910a2aceef", "value": "T13C15F112B6C689B1E4632A320D399B20557B7C244A79884F639C7E1FBF733C15932B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701018049, "uuid": "bf0e1445-2dbc-42db-ba2f-783cd9f1be3e", "value": "aac51396886833dc961fcd7aab7711e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701018049, "uuid": "cfeb3afd-075e-4496-9ac4-756cd2cb313a", "value": "24576:lgZXoZUTVdt7KEA1FZsflCxjah+6Vr2x3aAq12JQf8H+:QAFclC4AxKAB+EH+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701018049, "uuid": "53fa5bfd-077a-4b57-9b1b-d35542174cab", "value": 938950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701018049, "uuid": "14613c61-a31d-4ea3-b39f-0837631251ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701018049, "uuid": "bbca2e9c-fde7-4ce9-abf8-9a2c6dc24c57", "value": "Factura_FVR23041255_Factura_FVR23041255pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "916dbdfe-8c8b-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701024156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701024156, "uuid": "e8988021-2f33-42ae-8149-802f65afef1d", "comment": "Malware payload (AgentTesla)", "value": "f1fc3e515c0469983a7870bff88128d3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701024156, "uuid": "c630005f-1e4c-462d-8869-3526efa386ff", "comment": "Malware payload (AgentTesla)", "value": "7e352106b797fd772547c6d0cdd113c888a9170cbf648b81fa136263e8e435d2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701024156, "uuid": "304f57fb-602c-483e-848e-78d3ae06b03e", "comment": "Malware payload (AgentTesla)", "value": "b2703c67e839ed93841c8ecd549fc66c2d245b70", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701024156, "uuid": "cab7a5ae-6e23-41fe-b2d0-5db67e3220ea", "comment": "Malware payload (AgentTesla)", "value": "bc544a1a9376e816c31a21aa567cf464c661d9a36ad0beae4efd671944e2c0c12e8a93e4c7ed163d5dc0004544b4a8aa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701024156, "uuid": "2a880454-e2c3-4720-a8df-1428ffa9bd59", "value": "T151E42226717C9FDAE0A693FA0EA1C00517F6EF2E2A78F9186C8531C7867DF115652C23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701024156, "uuid": "61a07614-57e5-493d-bf35-c2ed9c2182cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701024156, "uuid": "54a2d6ef-4437-4bed-a646-472c15193a16", "value": "12288:ME6jD/GR+exNWl3lZQRwCtFewVSquhl90O6U5yn6ISibaph9SENzP:MtD/Gckgl1ZQRwAKqK2OYn6IBuoENP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701024156, "uuid": "aa07500f-f19c-44c7-9975-38e3a66edf00", "value": 698368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701024156, "uuid": "4a5ffa71-a532-4c2f-a39c-805891f56dcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701024156, "uuid": "85101d48-53c0-4775-be29-887696ddeb57", "value": "f1fc3e515c0469983a7870bff88128d3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e5808da-8c88-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1701022808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022808, "uuid": "1a607e97-5ed5-4a99-8c81-3c04b94feacc", "comment": "Malware payload (RiseProStealer)", "value": "b67c21427052857dd4be9b37a3056cd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022808, "uuid": "c7ab3ef6-886f-4832-a778-3fb1dc7a7700", "comment": "Malware payload (RiseProStealer)", "value": "7ea7c4dc8cd7a346545d4a0c859c34fbb5f743b68f6aad320a67ed38cf853183", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022808, "uuid": "1bcd82b5-c0d1-4f8f-a311-8394e3057202", "comment": "Malware payload (RiseProStealer)", "value": "bcf32b05a1a76b954afcafc1aaee1e1ab82d409d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022808, "uuid": "1334645d-8e34-4067-b9ec-ad96edf87069", "comment": "Malware payload (RiseProStealer)", "value": "52637e8e3c52a50436ac54e29880c1ad9c4ef83aae21ad362ea88f6e47bff442bafbf0f3d06ca44c07e6a114f41a7113", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022808, "uuid": "f5ad820d-f650-498b-b966-530128c39a5e", "value": "T14045231ABAD84167DCB0A77086F30BA70375FCE15C75436A2294B51B0CF2EC9A53637A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022808, "uuid": "50f02d52-7903-4151-a3e0-a4b73eae43e7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022808, "uuid": "0fdcfbde-2fff-4136-a75f-dc178dfec315", "value": "24576:NysASg6SQf5tgP0gRYUQu3uFImkygA4Qg2Gny1VOQaxnHT:opSg6SmtgsgRYUQuHmkyWR2GnXnxH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701022808, "uuid": "73843036-87ce-466b-90e0-b8b3e54817d6", "value": 1218048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701022808, "uuid": "e02ac8f6-ab0c-4c94-8a4e-64d5619484ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022808, "uuid": "3ce37256-6414-477c-bddf-d7d4ba861ccf", "value": "b67c21427052857dd4be9b37a3056cd8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4023e0f-8c54-11ee-8907-42010a9c0042", "comment": "Malware payload (Gafgyt)", "timestamp": 1701000592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701000592, "uuid": "82c835d7-594c-4a48-bedd-f2ed2e11286a", "comment": "Malware payload (Gafgyt)", "value": "ecfa810656f16a12d61cc325cc5d5c3d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701000592, "uuid": "272a3ff0-b671-4749-a7a8-1c4047b869c8", "comment": "Malware payload (Gafgyt)", "value": "7f031d994305a52797ffd43e4ba96c48fb63a02eb1cdf92695f96e9b3ef5e1fb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701000592, "uuid": "768b2640-e99f-42d8-89b8-b5737d890b0e", "comment": "Malware payload (Gafgyt)", "value": "256f05ae58195612937cf34937289907400882ae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701000592, "uuid": "862b453b-401e-44bf-9048-45c302eef2a1", "comment": "Malware payload (Gafgyt)", "value": "6068c526330167731274f10edbe07fc25c06b6db0bcb42eeecd7c703d48bbd94867dde88502ffd919f5a1499e75387e2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701000592, "uuid": "ac2505bb-572f-4305-8b6d-54365f866f5e", "value": "T1B0930A67F900EEB2F40AA77604D74B157670FBB60E932322B3173965AE721C56827F84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701000592, "uuid": "d55cc6c7-d63e-4fbe-b17e-1e5ce5f27e6e", "value": "1536:HsGhn5Hk8NdlLOWsz9ThvP09leU90NGC2sy9LAJ3y9AbAE+f9SmC6V6qDj6ufSae:Hb5H3dFspd3nX2sy9LAJ3Ui+fcmC6V6l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701000592, "uuid": "6524a385-faab-4cf2-9b32-ad40fea8c9be", "value": 96546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701000592, "uuid": "674f9d1c-664d-4f3c-8b89-dceb0fb6af22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701000592, "uuid": "65207879-1b53-462c-a4a8-19b97fae289a", "value": "ecfa810656f16a12d61cc325cc5d5c3d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc331a0b-8c1a-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1700975802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700975802, "uuid": "78213af8-9eb1-4800-8baa-9e06c5fbe766", "comment": "Malware payload (RiseProStealer)", "value": "fbcc9a39073668929306c4081a8476e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700975802, "uuid": "d448767c-e19b-4931-9ab3-38f0e51bb299", "comment": "Malware payload (RiseProStealer)", "value": "7fd5e3fde1742b5d5c95b0a712d7b6e49bf4a77507f69bfada8c7e56c84a1ca8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700975802, "uuid": "3b65c601-cb15-4827-84de-6b8de65cff64", "comment": "Malware payload (RiseProStealer)", "value": "e19394ed3690b23f21eb073bc545993d69a60403", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700975802, "uuid": "60b67d26-1818-40bf-80c5-b7fd9a00e995", "comment": "Malware payload (RiseProStealer)", "value": "494cd3204e63a03fe629d01a90b7b092bbe274a54ec2464b47273b4a637c720e0eafebd4dce6f885a5e3c3a953c3037b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700975802, "uuid": "be669b1a-4556-4fc7-9da7-7181b3601872", "value": "T13C658C31FA08D4B6D09210B0916D6A7B91587A322BAF4CD7F3C05E6E41B52D2F235F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700975802, "uuid": "6d6b1111-0aa6-46dd-be33-cf7cba3bef7f", "value": "078471ac5a76189ffe465abe0c89c6b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700975802, "uuid": "22532dcc-007c-40ed-bbcd-48ac9467869a", "value": "24576:2opGDjnvrPpkjos0OtjcFc5kM49dj+IuxWQOIjuJuVvhbqL0HtFcgekRP9dT0WNI:OnvrPGT0Egyudc4tI3bqL0NFchaP9dTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700975802, "uuid": "1efc0494-2a93-4d28-ac5a-e406f0eeb412", "value": 1539809, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700975802, "uuid": "dcf58ef2-75bd-4094-8eae-c02634873a1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700975802, "uuid": "78dbe76a-392c-4cf1-9f45-9cca35fa2199", "value": "SecuriteInfo.com.Trojan.MulDrop24.22194.27442.3190", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8314c449-8c1a-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700975599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700975599, "uuid": "0e986373-74a2-43b1-9526-526c86676a5d", "comment": "Malware payload (Mirai)", "value": "2586350834c10c4a71002c83d2c66b11", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700975599, "uuid": "f77afba1-fdef-47d0-a452-750216fafbe1", "comment": "Malware payload (Mirai)", "value": "83bdce28fb9d0cd38272ffd8f04baf001508102cf8af7d4b3e2826fde3eea048", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700975599, "uuid": "ce7d1ee6-ec91-43e8-a817-04a9be5f2b70", "comment": "Malware payload (Mirai)", "value": "b36163dd5ae526aa3b1bcead9ccdeb10379f33b6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700975599, "uuid": "99909935-07d9-4760-a8b3-fcf289cb0e35", "comment": "Malware payload (Mirai)", "value": "1ee12f4dfb44897a88d3791737d67bb8eb35d1ef631521eac0adb79ef5576021ecc3bbadb518069f7f2d08d9f897fcec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700975599, "uuid": "a506d526-d3c7-4104-9615-7c9e85a24289", "value": "T125731842B8814633C7D213BAFA6E438D3B2573A9D1DB72178D216F1137868AF0D67B42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700975599, "uuid": "68991297-941d-416c-ab7d-a2c4de57a38c", "value": "1536:FBAoqR4m6cPsCCvVVlCL1iT2tIJ9/595XvX0ag78AZ5RVaxwjMladGYFUvj1nnum:rkwhXvlkxVaxwC6Gfj1nGnGn/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700975599, "uuid": "72ff8819-9be8-4400-ba7f-002e6f71d21a", "value": 75148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700975599, "uuid": "ae7c3d7a-54c3-4a27-8099-585e51490ca0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700975599, "uuid": "417ee6a5-8cfa-4ccd-bd13-d55eec30227e", "value": "2586350834c10c4a71002c83d2c66b11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2d4d74a-8c19-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700975303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700975303, "uuid": "0318a7ce-01b0-4ac7-b075-21fbf597a23b", "comment": "Malware payload (Mirai)", "value": "2d6614be2524ac820d4bf020f82379ea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700975303, "uuid": "d1f25961-af63-406c-adc3-67fc4cfed4dc", "comment": "Malware payload (Mirai)", "value": "8422e128226f04f95e62ca9d611a87c235cea91c71a7cd221ff4b9c2a5c292c3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700975303, "uuid": "dfb8c314-c153-410b-9b57-9ab4d72bf1fa", "comment": "Malware payload (Mirai)", "value": "1e347f31848c6f7e12bddd7d0811abba5c3efb54", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700975303, "uuid": "df3c2ec4-3d7c-4047-ae0d-60df1cb90edd", "comment": "Malware payload (Mirai)", "value": "6870a718209d484c728cb2223fd856c5d3a631bcf92c42ac8bfac4eadc0c9b7926d4f23ac74788b4d3b24e091184ee1e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700975303, "uuid": "75eb3c74-8370-47ae-b772-7cb58f87c102", "value": "T132732B86B8814B17D5D4127EF92E018D732327BCF2CFB2229D20AB1477CA96B0E77655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700975303, "uuid": "1e863466-0c6e-47ea-873d-952ffc8392bc", "value": "1536:HUnNL9u1FJsOJe1/DDrubfjlodpOanuRZQRM0iJCbzk51Y90QQx:k97DunlodpOanyCbzkD00QQx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700975303, "uuid": "112d88ff-e465-4f54-8673-db6da266f54b", "value": 80400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700975303, "uuid": "15c611f2-17a7-46a5-abfa-cd177fa0443c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700975303, "uuid": "f655497c-3584-41e5-bcfa-804f92aec72b", "value": "2d6614be2524ac820d4bf020f82379ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e551c44-8c7c-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1701017628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017628, "uuid": "47d5164e-12e6-4845-be37-248801a4e5d6", "comment": "Malware payload (Formbook)", "value": "6d0c4eb2d7c60e9e825dd4e5579e1e72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017628, "uuid": "dcf1c95d-9695-4ee3-916c-03dff3e1b31c", "comment": "Malware payload (Formbook)", "value": "8633eb2ea7decc6a280a1a7e51d46a95b45e18597abb5c611fdd93931cab4bd7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017628, "uuid": "86461352-4969-4515-a598-92ddc006e3f1", "comment": "Malware payload (Formbook)", "value": "d824360879830bc3e7efb04e81f0f92a9d618216", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017628, "uuid": "d05d2e14-5163-4442-97f6-a47851e5a0c5", "comment": "Malware payload (Formbook)", "value": "5bf8615b338d40f6fe37a937ba02be1c9428a5b8fcd84054cdb35d14c4ce81251a373da5a0e1c90749678fb5ddceee7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017628, "uuid": "b0802c31-5774-43f5-954c-d53de873a63d", "value": "T174C4231723BDCB6AC42D43F925E9A03787B291BBA154CB6D9D8C04D2CD72F10A756B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017628, "uuid": "c2b3d7bb-057d-46f7-84e2-e35b6e715082", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017628, "uuid": "abf2d0d2-b82e-47df-a5b7-13c4a7214e2f", "value": "12288:m/M6QRh+FbWgpkYByhpu5klZEPIK2y7JQ5GsZwB7K4ENzbK:cy/+57p5ByhEk/EwKrSBZWVEN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017628, "uuid": "bc609968-beef-49ff-b175-8640135454af", "value": 588800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017628, "uuid": "377b323e-0b6e-40bd-a7f7-a1c314e67b61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017628, "uuid": "a735ec69-46f9-48ba-bd38-acbd41ef41d1", "value": "RFQ 20024890A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e510c722-8c66-11ee-8907-42010a9c0042", "comment": "Malware payload (NanoCore)", "timestamp": 1701008405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701008405, "uuid": "93312fad-a92e-4cd6-ad8e-126509c8cd07", "comment": "Malware payload (NanoCore)", "value": "d58652b6bd76ac545da4b9dd4f70e032", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701008405, "uuid": "a4c753b5-2d70-4dab-9004-22ebfd817ff4", "comment": "Malware payload (NanoCore)", "value": "874f9ec9a67d5ecb2c131a9aa0c4738af6bc7be28dae7b47c797d8eecdd9961a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701008405, "uuid": "6978c711-c4ec-4cae-b08c-f8d6398a099a", "comment": "Malware payload (NanoCore)", "value": "3a8274e1137b855b756a638b383aa1fe5f06b12b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701008405, "uuid": "53e25407-a64b-4fa4-8bc8-884a39fbee97", "comment": "Malware payload (NanoCore)", "value": "c8effd815727ba09411ed78779d0818712be8526e979e84a89ada7966322dbd89f5d827e7798325b3833a0697e13b230", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701008405, "uuid": "2c7853b9-61ea-4fd5-afb1-0fff78502621", "value": "T1EC15E12962F44F89E8BB63F58968420517F5BE99503BF38D4DC1B0DB4E72B811A07B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701008405, "uuid": "7ca3e7bb-001f-41ef-858f-5532de50e56e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701008405, "uuid": "a36bcd96-b76d-4dac-a8f0-bee8dca8f38e", "value": "24576:NJtD/61ogATTzQ92eQCsYNkEIwcyENi0z:F6+gATT1CsYNkD9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701008405, "uuid": "8f06a8c7-0a45-405b-b570-766a3b818a7b", "value": 920576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701008405, "uuid": "bd0c5de7-c4ec-4cf8-9cd0-ab9af7e1c6f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701008405, "uuid": "10ee41c7-17ca-4dea-8b13-0bc7d36ad725", "value": "plugmanzx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb8528ed-8c2b-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1700983075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700983075, "uuid": "c64b17eb-cc70-40ec-a619-f5b618cd27d3", "comment": "Malware payload (RiseProStealer)", "value": "ad46675dd571f418cd6df93e0f262963", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700983075, "uuid": "1a4cd885-bc95-411c-9385-ee8f2cee7812", "comment": "Malware payload (RiseProStealer)", "value": "876e7953418ea3814c8c466cecc25d480acd71c71531ffe657da295d9c8d95e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700983075, "uuid": "1210cf02-400f-437b-bbfd-0fc44565ed58", "comment": "Malware payload (RiseProStealer)", "value": "4fcd5b340d9df92387a97214342b3d4132f3352a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700983075, "uuid": "ede418af-0e01-4a1c-8538-48ae2c872ce0", "comment": "Malware payload (RiseProStealer)", "value": "b86241cd11eb1d9b9c5ea57a6f2b5e2c57f5d5fb16eaf4b629ada92320e062f6add355895166ac4626054e75781f2440", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700983075, "uuid": "7915ccce-4d2c-48e5-8329-dfc7a1c84541", "value": "T107658C31FA08D4B6D09210B0916D6A7B91587A322BAF4CD7F3C05E6E41B52D2F235F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700983075, "uuid": "e72ba2c4-26cf-4a0c-bb7c-0bb141a486f8", "value": "078471ac5a76189ffe465abe0c89c6b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700983075, "uuid": "f53ec0e3-c763-46fc-9253-9ad7046cb4b1", "value": "24576:2opGDjnvrPpkjos0OtjcFc5kM49dj+IuxWQOIjuJuVvhbqL0HtFcgekRP9dT0WNI:OnvrPGT0Egyudc4tI3bqL0NFchaP9dTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700983075, "uuid": "2b655dd8-345c-4e37-8483-8238b316f45d", "value": 1539845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700983075, "uuid": "daf984ff-a05c-4dca-88ff-c40005c38eef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700983075, "uuid": "3f54a897-866f-4e82-a74f-f365be06e4f3", "value": "SecuriteInfo.com.Trojan.MulDrop24.22194.2424.25154", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e141e38-8c7c-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1701017493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017493, "uuid": "e14c98e3-6001-4ec0-b643-94613ed4ec38", "comment": "Malware payload (Formbook)", "value": "9b4e4041c2731241c61f5c01a8680372", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gunzipped", "colour": "#3986AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017493, "uuid": "3fe8e55c-b7cd-442b-b6ee-6cfa4a7741e5", "comment": "Malware payload (Formbook)", "value": "878c2055975e65a5cb716bcad258e77ce3c1706f2824616a2ed2bbb2344fbec5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gunzipped", "colour": "#3986AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017493, "uuid": "199b28fb-55bb-4be5-9ef4-2813fcc24a86", "comment": "Malware payload (Formbook)", "value": "ef93b2347909953af82d89642aa1962dabe50ada", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gunzipped", "colour": "#3986AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017493, "uuid": "aa46b47f-201e-412d-ad22-a399f488944c", "comment": "Malware payload (Formbook)", "value": "86cdb6fcba1c030c796e3debd356754e9608ac1e71109df2c1d190e3840241734a3243fdf8c8e591a21c0900105327de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gunzipped", "colour": "#3986AB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017493, "uuid": "c2a23118-838a-4be7-bf7f-1827518bf1d9", "value": "T1C1D42362116813B7C8D77FB108BD5397E3B625536886D1A24ED8B2FDAE41F8D8F06072", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017493, "uuid": "54bd2a84-8a78-4ab9-8b0d-ef86d51028b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017493, "uuid": "c71ebeb0-7062-4e2a-a631-71c577269fdd", "value": "12288:3y8oG24hTXrdwcruEDV6KwQzcCMWMK5KMOMDhsnUgCDV8qqOox3kUdZwD:3Fsu3JRx6KwQUlKUMzDhcUDiq65kUdZS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017493, "uuid": "750e4805-fdd6-4c14-8938-c7893fdf92dd", "value": 614912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017493, "uuid": "3448c8e5-06b7-4b45-aa8d-c8a2b2e4a8b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017493, "uuid": "253fccc8-ffe9-476c-ac6c-18095cb8e164", "value": "gunzipped", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3582d425-8c68-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1701008969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701008969, "uuid": "723d414b-d9cb-40d5-bc6e-b3a73a496a53", "comment": "Malware payload (Mirai)", "value": "7147f2fc5e1b6501a788e77720b02b9f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701008969, "uuid": "208b2df0-312d-4dd1-a885-fee75abd6c05", "comment": "Malware payload (Mirai)", "value": "88a38fee5d86bccd5774d892f10a20f6e072c177bfaa70e150aa68daf4af0e69", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701008969, "uuid": "cffa8ec4-d4e6-4ee2-8ac9-bbebbc14386c", "comment": "Malware payload (Mirai)", "value": "59f23d5f9dd0c4f926bb612b47ca968271567840", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701008969, "uuid": "9401a85e-f717-4802-9e4e-1df702369472", "comment": "Malware payload (Mirai)", "value": "55dc6f6389ed29fbd01fcae5b2c64f96fcf2b343d18a558383879bbf966d49c8fe003e748b730644200f4cb8b6ca2850", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701008969, "uuid": "5c3c2e4c-82e5-4fec-929b-9431c366b487", "value": "T13D334BC5AA93DCF4EC1506712177EB328B77F03A612ADAC7C3899523AC42B01E50729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701008969, "uuid": "f6730363-aa18-4947-9a7e-12a73c339922", "value": "1536:3hSgebzgP/AY+39afOsMJRdnhNsHSqMQxpwBNbr/s:xZebkP/Ad39UMJRlhNqSDQbIbDs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701008969, "uuid": "a4e305b1-babb-4112-84f2-a2fd83efb572", "value": 50608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701008969, "uuid": "31c36006-990d-4f5c-b298-d40a2e7038ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701008969, "uuid": "bfae375f-9c96-4918-bfe6-488bb0fb2315", "value": "7147f2fc5e1b6501a788e77720b02b9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cb73801-8c7b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701017222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017222, "uuid": "ac475675-c779-4dcc-a32a-662ed4645fdb", "comment": "Malware payload", "value": "280e205680319814ae0683dbc1909f54", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017222, "uuid": "5bc7d213-2ac7-47cc-885e-a134edb9d5f2", "comment": "Malware payload", "value": "895ac4212dece89bfc741a53aaa47a83c8a13ef307cad647901229729ac7e4c5", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017222, "uuid": "0a8a0f15-0007-4758-893f-f27c9f9b708e", "comment": "Malware payload", "value": "20cc76e07558f5cc44fb3f56c49926924a006270", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017222, "uuid": "f443e16f-8135-4e92-a6fb-85707fe9ebaf", "comment": "Malware payload", "value": "1185ca5bebac8c11996203fe9ec01482547cc63b3219a0b335e642e4f48312e7fa0adde8bd0188ad9a27354b88ff1354", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017222, "uuid": "6f304a61-ff68-431d-a14c-f5c26a320dab", "value": "T1FF86230171DACA3AC53F8574726DCF3A01B57BA10BB544DB13D41A6B0E7A5E202B3F6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017222, "uuid": "dbd5e951-9b1b-4827-bd1b-2278b105fc16", "value": "196608:eQ7HBzC6Vi9jNHkt0zva560rc9r6cH1Zc:eQgki95Hs0zvaQ0rIrPc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017222, "uuid": "3db06928-f663-4531-8fa6-c83906b6e406", "value": 8363520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017222, "uuid": "0f808f62-0491-44e9-ac34-71ebea48d2f0", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017222, "uuid": "11b6c2a1-e018-4357-be2f-c832dd05da5f", "value": "280e205680319814ae0683dbc1909f54.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be4ba445-8c7b-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1701017359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017359, "uuid": "6c7519fe-6352-446e-b3e5-6e3c0f63083a", "comment": "Malware payload (SnakeKeylogger)", "value": "a25ba7095b79a87bedb01b874045470a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017359, "uuid": "c712ee50-a8cb-4e03-b236-26b83a84dbfa", "comment": "Malware payload (SnakeKeylogger)", "value": "89c4d34808b79effab30b96880fabab56c4d53bfc77d51a1ee2f389340a5e4c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017359, "uuid": "166d9423-a84a-423e-88e9-eb11cc02f59b", "comment": "Malware payload (SnakeKeylogger)", "value": "4ccf21195e4242b9c35675ace7f27122eb88883f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017359, "uuid": "673f8ab2-0943-49d8-b28e-21e1a4cc62c9", "comment": "Malware payload (SnakeKeylogger)", "value": "761882a466a47741c16126100ca6b06b9b1fa33ce2860d9d22b896ec7691abf33528bad344d84e7861b381a218f7e286", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017359, "uuid": "78eb0a0f-efde-45e4-8b0a-138dc8855c05", "value": "T13E05163D1B9E1667BCB9D6A7EFD0822BF461AAE3F20D9D24D4D703559302902B0D427E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017359, "uuid": "66b57f53-58b3-4686-a7ed-2758f1417c80", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017359, "uuid": "4c53f0bc-5692-4f64-8d43-50afc9fd5b15", "value": "12288:OBa/mFiTEJ0+0OR8FCkotcyVItk4CZX0U6TWU5LDhi87dQuIAgNtNMZf5xnIKqS3:6IOXqr7dw1kEKq3ryoomBhS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017359, "uuid": "ef9647fb-adf1-4fa0-a167-0ea1f7ead1ad", "value": 845824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017359, "uuid": "51b96b2b-b400-4ed5-8fdb-109de496db94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017359, "uuid": "d13e6793-aeb5-4954-a483-360df34924a0", "value": "Musterino_96930826_Ekno_1_202311146214813_ekstre.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e26b1f2-8c7b-11ee-8907-42010a9c0042", "comment": "Malware payload (zgRAT)", "timestamp": 1701017117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017117, "uuid": "c86a7a05-61d7-43cf-bc22-174ea56b226a", "comment": "Malware payload (zgRAT)", "value": "9e0db60a48cfec5528004815a681a4b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017117, "uuid": "416db71a-585e-43f0-ab80-71719bf1a6e2", "comment": "Malware payload (zgRAT)", "value": "8aabc9b91a2bf3aa7e1f3243505fbc19b141a4cc1560fd6a0560ccb631e1866c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017117, "uuid": "b18e764f-0c6e-4716-b4a4-adcc9a66fba8", "comment": "Malware payload (zgRAT)", "value": "37d28abb8b9a5d4eaf129529bdef0a2d348fbd8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017117, "uuid": "fff5d631-f295-490d-8144-7d7e807a42a6", "comment": "Malware payload (zgRAT)", "value": "d3f5470e26656a12b9235fa625f94b149bc2d90ee0ba48cfe4d9a350465d70f88d037dbf13e8884df325a86f8e366b96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017117, "uuid": "7340be3c-ab9a-4235-8bdc-9ffc4b3a1557", "value": "T19ED423B8F9912C11FB739778E8FA527B7A89BB4C1004875F268992F3FB065210471FA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017117, "uuid": "b34d5509-eabd-49b1-9b1c-2a0f509fdcdd", "value": "12288:cQtect95N4STlcdfb43+NVW2N0Zqpqb93FtI+9nGq80KtKuggq16d+w:c67N4SG43+rkqAbxFtBg1RKfgw6k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017117, "uuid": "3fa65f48-ffe5-41fe-a1af-b2c9d50829ae", "value": 643072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017117, "uuid": "1754dc06-fc5d-482f-9545-4ba436cbda3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017117, "uuid": "4743f9bf-b9b6-49dc-882e-6dc82e771a87", "value": "9e0db60a48cfec5528004815a681a4b1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3476ae7b-8c78-11ee-8907-42010a9c0042", "comment": "Malware payload (Vidar)", "timestamp": 1701015839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701015839, "uuid": "3e0109ca-5a5a-402f-b8e1-822880fd9e84", "comment": "Malware payload (Vidar)", "value": "925b8b787cb3f7e8cce3bf392ab516e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701015839, "uuid": "aedf1a73-1405-4ece-adad-858d5ea644c6", "comment": "Malware payload (Vidar)", "value": "8b274137b01aa787637187c8feebf492950a5e652786475b7c344e73e24aa612", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701015839, "uuid": "ae8b9eed-f04e-409b-879d-264307105600", "comment": "Malware payload (Vidar)", "value": "bd70c883c9d332c01273de3ac4715bfb403bccb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701015839, "uuid": "5e9b1ad6-3f43-43b8-8b5f-3283c716df1e", "comment": "Malware payload (Vidar)", "value": "33eedff711487106d21a85d9778c7216b864b975794cce8acc208355970497ffae9d4c15ee142bbca0ddba671aa4013e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701015839, "uuid": "a2a5e20a-fa46-4359-b965-f28bdfca9059", "value": "T173546C1362F1AC61E5234673AE2EC6F4771EB8708F556B9B33196E2F08711A2C673316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701015839, "uuid": "77c060e0-d9f7-46b5-a528-c19ba9ae94a8", "value": "23014caea44efcaeb50f542fe1b4a832", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701015839, "uuid": "bf300e8b-d68b-4234-b894-45559ae33a56", "value": "3072:NX0Q0jaVCX2SrxZsGxIZq29lnCdKat+D5KEaZ+ULQIxl/vt1Zq7:5ozmSFZsMYQKat+4Q6lX0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701015839, "uuid": "5e197817-b561-451a-868e-a02e3ca04fee", "value": 289280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701015839, "uuid": "371f00bb-d43e-40bf-8a58-dcc0f8c93502", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701015839, "uuid": "14f2fb5e-df67-4650-91ca-15f13c6f273f", "value": "925b8b787cb3f7e8cce3bf392ab516e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16d584b3-8c8a-11ee-8907-42010a9c0042", "comment": "Malware payload (AZORult)", "timestamp": 1701023521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023521, "uuid": "55d733f7-5ffc-43de-85e9-ef63998e37c7", "comment": "Malware payload (AZORult)", "value": "cebf603dc3f2f0ec07df18818061213e", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023521, "uuid": "78f6a45a-46f8-40ad-b97c-89f82e6310cf", "comment": "Malware payload (AZORult)", "value": "8b7097b5d0ab2e5ee1735408a246a930f1fb3a1082f1c50f507bcb1dba732cf8", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023521, "uuid": "3f650e71-bd72-4e1a-9135-e7b07727fd10", "comment": "Malware payload (AZORult)", "value": "4dfda6a054c51155f99ef877e0a50196f10d7a67", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023521, "uuid": "6c8f3210-f64f-4e2b-a2ab-f0ee6dad9467", "comment": "Malware payload (AZORult)", "value": "5d8960dc4253cfced97eaaf6bfdaf68c3a2bb4a2afda6004d7e4f4ca528192fe1b2630e7b26593ae249bd0bd28c39ac6", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023521, "uuid": "164abeb6-40a6-4af1-8387-0a042f6c359a", "value": "T17A1512215E86C86BE22F497927F1FA31995F9C5809F38062C6FF9C57B274BC0796E120", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023521, "uuid": "3062b3d8-dbfa-4e36-b6ea-3a82edf82964", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023521, "uuid": "03f965ad-d0d2-4180-9b1d-28c83d94627a", "value": "24576:W2B5wZeEaYYuLqvQ5fgih3ihW9NVBDxyPvAYZu:hBGouuA/3ZOPv9u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701023521, "uuid": "768ab200-8aa1-46b0-9efc-eb6de5e6f582", "value": 935469, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701023521, "uuid": "686e76a6-8892-4933-bc62-a0ff487adc9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023521, "uuid": "e4e5a01c-5e6b-4a0a-aff0-97c168106535", "value": "Ziraat Bankasi Swift Mesaji.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ebd3d63-8c1a-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700975591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700975591, "uuid": "e722eb87-3c69-4c34-a3c1-48afc6fb775e", "comment": "Malware payload (Mirai)", "value": "cc122b0a8e46a4daab56694871a66ebd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700975591, "uuid": "bff766ea-f9c0-4151-9357-a6d2213bf484", "comment": "Malware payload (Mirai)", "value": "8bb4565d23253340408221f6636aec3fb652db969fa9df3045358d150dbca85d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700975591, "uuid": "3938c36b-9b4c-4114-a824-2dcd5c95e585", "comment": "Malware payload (Mirai)", "value": "b7c57834817deab94e6c4cd01e8038f232dd5064", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700975591, "uuid": "656547a9-6a1d-47cd-b9eb-aced9e538eb6", "comment": "Malware payload (Mirai)", "value": "128384615c11878014dad385b2b048f29d22589acd747d3e226bb1e7e489a2039aa3de30d9ca01b0c36d8a5285b386f1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700975591, "uuid": "c510986d-c329-4554-b0ea-d452dc6d8941", "value": "T15F433AC0BA43E8F5D8D646710273F7365632F03F1129F597C7A8A9F3FC41A499A26298", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700975591, "uuid": "5f995bf7-62dc-40c5-a61f-721e0d171583", "value": "1536:rXSNd2BmYBNZVZeMOx+EfxwuA6Itj8NWZ6bHySNJ8/3DP496rSKb:7zBXBNZVZeMOx+EfxNA6IwzbSWJ87Ueb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700975591, "uuid": "e384176f-2c88-4f3f-8aff-5ee91e48a0c4", "value": 58704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700975591, "uuid": "fbeeeb75-7e4e-4fca-b3b1-5243c35dcf94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700975591, "uuid": "16a3cf12-1470-4da1-8a9a-930ea85cc7aa", "value": "cc122b0a8e46a4daab56694871a66ebd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acf27bc5-8c89-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701023343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023343, "uuid": "3b1e4ff3-d14a-4345-b788-1dc9416a6e67", "comment": "Malware payload", "value": "72f8b25563df1f4b449202b21ce52c5e", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023343, "uuid": "59802ae9-22fb-491b-9e31-6971465bea49", "comment": "Malware payload", "value": "8c13b82c06e1ffe8dab873d07e57fe49aa0d803f7ed65a8ff0632102501b61c9", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023343, "uuid": "3f353123-81e0-4095-baf4-73e126ab8d62", "comment": "Malware payload", "value": "cb27b7e381e1d75ed8a5e0ed97da9f38a55a7b81", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023343, "uuid": "a886ef46-ba5e-465a-b2ef-af2a00c7e9f1", "comment": "Malware payload", "value": "adebf2dfda89e0eeaa49a17a4a750e57c9c374cb6473c8f302af633b4a3280d09fdb8d9426b861a6dcf78ea320e0c7e9", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023343, "uuid": "3457631d-e67e-4c37-8f76-c2ceed350d22", "value": "T14EE433BB48635AC7E4814825B1C026D88AFF65C87FDFC31CE6C1C46DB9896B097D9E60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023343, "uuid": "5eb26233-5d3d-4d25-a7d9-265efd5bfe01", "value": "12288:sTukqfeFL1WCkQmx3CjR8ey98fD9qkhTGVRvbaPchY2BDPZzHC/a4vocBS5V0mva:s1qGhOj3WRJbc0TwaPcm2BxH3VJrm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701023343, "uuid": "73e046ef-d6d1-4483-8639-fad28096f726", "value": 659284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701023343, "uuid": "c9a898f2-6a59-4961-9310-d483cf81f71a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023343, "uuid": "1d9d8635-28b0-445a-8a7e-429bb896496a", "value": "Ordem de Compra.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9132ee84-8c8f-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1701025873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701025873, "uuid": "4ba0b77b-77ca-4dd5-a224-cf004476396f", "comment": "Malware payload (RedLineStealer)", "value": "5d9ba3c945df70b752a763ca244387db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701025873, "uuid": "284f1adf-6e5a-4135-99da-8b0041bcd0bb", "comment": "Malware payload (RedLineStealer)", "value": "8c5d658cd2080db9670f73a6b3296f40af7cfa7f1d4cdda10c67e9a424be7cd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701025873, "uuid": "a391abf5-30ff-4fb8-b28c-627861964a4c", "comment": "Malware payload (RedLineStealer)", "value": "c2b435aacdc825ce4bd5a0a6afee564fc9837c98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701025873, "uuid": "71c99925-3a0a-4487-ace3-6966614c7416", "comment": "Malware payload (RedLineStealer)", "value": "30610c6c4f32f94f5286fe80bad21d594b0f3fa6588764b3757d63d25ab003e1563099aef19482022b0c856ed3a45a2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701025873, "uuid": "88f404d4-261a-4187-afc9-285f55355cde", "value": "T10DA46B243D825971D4227236CF5DE1E935BD7C5083B08C878B56BBAD8A901A3CE3DDDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701025873, "uuid": "93b7e64b-dcb7-447d-ae7a-c6b628ea6689", "value": "87d552636d31eb7a2797c4a63e862d4a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701025873, "uuid": "074d4a92-ec95-4435-bd1b-da4ddd8269a3", "value": "6144:AyU1zKCKVDp3Cbitu7gJzmgkYUDBg8ZHAOpQtFaErrXs5MZwUYm66G:AyU1K9pv6RZH8tFfrQ69V66G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701025873, "uuid": "bc67d418-5a2a-4009-ad39-36953196b89b", "value": 479008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701025873, "uuid": "e0392ddc-1ee7-4215-b791-38f01c92abbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701025873, "uuid": "a8350a9a-60f8-4502-97a8-ad9baf513726", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "510663f8-8c23-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1700979380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700979380, "uuid": "a1102f57-7c62-48d9-9a8a-ffe942834c5e", "comment": "Malware payload (RiseProStealer)", "value": "0848c5964e125e8bccd33d7817ee80fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700979380, "uuid": "60c5967a-7384-4e66-919b-9575e01c6297", "comment": "Malware payload (RiseProStealer)", "value": "8dbcc972d71496475748ad705460dc5310c47f5ee62a68902534c9b0fa61b62f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700979380, "uuid": "f31df0ea-73d5-4f2b-a098-bd244cc442e3", "comment": "Malware payload (RiseProStealer)", "value": "7b05266b3175c8330abb8f17cc9da06883972dab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700979380, "uuid": "f44d34a6-e1ca-42ab-b439-5aaff0130afc", "comment": "Malware payload (RiseProStealer)", "value": "28c07876e484fbd8e0091f29772b0a2dcb45fdb27c6328af53a1a10940722447f7afbfb97b4788499da81be0f41ecb79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700979380, "uuid": "f743b0cf-f5be-46f3-9bc6-d656983557db", "value": "T120658C31FA08D4B6D09210B0916D6A7B91587A322BAF4CD7F3C05E6E41B52D2F235F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700979380, "uuid": "8697f16b-2af7-41a6-8566-3e7e6f64ab71", "value": "078471ac5a76189ffe465abe0c89c6b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700979380, "uuid": "30fe20db-7f85-40bc-b4c7-ccd42c22f946", "value": "24576:2opGDjnvrPpkjos0OtjcFc5kM49dj+IuxWQOIjuJuVvhbqL0HtFcgekRP9dT0WNI:OnvrPGT0Egyudc4tI3bqL0NFchaP9dTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700979380, "uuid": "669d850c-7cbd-49d7-8005-083a3c7cf55b", "value": 1539828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700979380, "uuid": "970e3996-b131-4991-a1bb-371028188774", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700979380, "uuid": "4a2fe888-824f-4620-981c-526f89ea5f0b", "value": "SecuriteInfo.com.Trojan.MulDrop24.22194.3471.28788", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b988525f-8c89-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701023364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023364, "uuid": "a58d8874-af9a-4602-9599-72bc9723d991", "comment": "Malware payload", "value": "389a3577786da1471ae0b46afd189be0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023364, "uuid": "288a45d3-216b-49cf-a3d6-a340c098aab3", "comment": "Malware payload", "value": "8dd72fe5fc67bc1d048ff5060372d35ffdd33f4dec647983594f38e0a19aea61", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023364, "uuid": "171593e3-e7b2-4b1a-80ff-9a3855903eb9", "comment": "Malware payload", "value": "92c1871524d6d47b2b6ca41beb5aff40c3a4cf0e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023364, "uuid": "5dc07084-0579-4de9-83de-168ad36e4b98", "comment": "Malware payload", "value": "b5cace565a9ad9b652160d70459860b8dbfd678655c5a75f8730c5512e7cd620c76a8f3f4946861d3289c4f98f325f6e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023364, "uuid": "beeb26cc-47ed-4561-b776-96fd4f7150a2", "value": "T1CB4633464F83268BE7CB31B456466F6DFDB01E79859C8BCD25E4A2EAADF39305031203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023364, "uuid": "16816c72-cfc1-414b-82b5-393de6aed48e", "value": "edac19bae7a55f5a30336032d0b4ae67", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023364, "uuid": "ae4c7e6a-50ea-49dc-8145-2e52478152a5", "value": "98304:miwvm6NW/r9mtpkQnACgNgqVpbTYVgZoj47MZ5FV0ZIvY4mQj1zvJBZ1xWNjMqFM:mP+6NW/2pkUgNvpbXZ778hsIvY6j13Y8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701023364, "uuid": "dbc42ea8-2664-48bd-acfd-d14569b956a4", "value": 5625608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701023364, "uuid": "4986a0d9-640d-490f-a530-a47089c96879", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023364, "uuid": "c869f638-f185-4b7c-9cad-4ca1a81c9510", "value": "389a3577786da1471ae0b46afd189be0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0ae17e5-8c25-11ee-8907-42010a9c0042", "comment": "Malware payload (zgRAT)", "timestamp": 1700980507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700980507, "uuid": "fb3b16c6-6ab5-4c4c-8d7a-3520646bfd9a", "comment": "Malware payload (zgRAT)", "value": "dc195f2ddc9c30d28d5fb3a2649f560c", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700980507, "uuid": "e3d0b177-76c2-4155-9418-2725a20cc002", "comment": "Malware payload (zgRAT)", "value": "8e684d3f9529b34396c708fafca492a2333d50222042c3a5f8b7fb0573c96251", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700980507, "uuid": "cee7bc11-2726-406c-85f4-9c53abe5641f", "comment": "Malware payload (zgRAT)", "value": "2d5ec68d1d43e34d0864711983bc92f0e0cd67bd", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700980507, "uuid": "bbebc990-496e-4dbe-a875-369eab83cb11", "comment": "Malware payload (zgRAT)", "value": "3d774ccb2beb5c005864bfede4d0932ec1939e54f14e1af476d34be58f898befa8a4bcc416cd10a907dece749e8ef33d", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700980507, "uuid": "22c5a581-101b-409c-89a3-29069e905b81", "value": "T1A225A2440A9D4697F40E1678F02DD37A1BA1CD3962DAAB8769C1BDB3397D322FB36041", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700980507, "uuid": "5e4f5525-016c-4ae6-8760-7f9fb4589d62", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700980507, "uuid": "a84f08f3-fa3d-4ad9-a7a3-746d077d13cc", "value": "24576:+4LIn/I6LyM8Kgq0Wwmcyw5bJeVjTkLZcK:CQ2yM8Kgq0Wwmcyw5bJakLB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700980507, "uuid": "dc68bb24-e41c-4b97-8766-a08a5405dd90", "value": 1018352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700980507, "uuid": "26b52aae-a411-4441-b082-3d7635a8ea4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700980507, "uuid": "8c0f7c1a-78f7-4db8-beb3-e6c8abae9bd4", "value": "dc195f2ddc9c30d28d5fb3a2649f560c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9edbb5cf-8c8a-11ee-8907-42010a9c0042", "comment": "Malware payload (Vidar)", "timestamp": 1701023749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023749, "uuid": "5fd81011-af17-4a27-a844-d38af02677c5", "comment": "Malware payload (Vidar)", "value": "9be6ae4bcd41238b05d3d36a15cf3fd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023749, "uuid": "3f703a02-d64f-4035-93dd-920928da411e", "comment": "Malware payload (Vidar)", "value": "8e70da316bb9865e7edda277430df66cdf6da7b34a0e8607ca28192164c7b6a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023749, "uuid": "3ef2f42b-bcc4-432a-9001-61876d759b06", "comment": "Malware payload (Vidar)", "value": "f7b21d056c29b24cce88cecfdfb37605f7799433", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023749, "uuid": "981fc415-89ec-456f-b124-a79b73436254", "comment": "Malware payload (Vidar)", "value": "6b0e803ff80e12f111071e4683754cc5ff7dee9309c3b06637b91f770e9a6f811e5c4580f0101176f4797ee182c6a3b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023749, "uuid": "de408ab1-17ed-49cf-871c-08ce7f940348", "value": "T10354B44382E13D45E9368B329F1FC7EC7B0EF6518E59BBA912189E5B04B01BAC363715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023749, "uuid": "c57de5ae-7702-4fac-adfa-b5e21822296a", "value": "b79e8a13f3e64db949ba21efd0faecde", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023749, "uuid": "37c40153-54d2-4326-a25c-ed690fa81b64", "value": "3072:raN/7RKXnPryBj0pKVOkPue1jZ4DTLw/ueD2vsZVUozQj+bs:rM/dKXnP+p0pONueFWfLSF0oF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701023749, "uuid": "8ce6b47d-598a-4985-9d62-bd0a2ae586ab", "value": 297984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701023749, "uuid": "438a3ebb-6c33-4585-ba73-ed39d7ba89b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023749, "uuid": "70891ca7-5fab-481a-86e2-6f4867b2a2f8", "value": "9be6ae4bcd41238b05d3d36a15cf3fd8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54c1dbef-8c3a-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1700989265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700989265, "uuid": "ab718cd1-52c0-4c93-9517-599de8a31ed2", "comment": "Malware payload (Smoke Loader)", "value": "66a393c1df147bc022aabf233467b8db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700989265, "uuid": "c4eb60fc-5938-4d72-a5a4-5b9adb085131", "comment": "Malware payload (Smoke Loader)", "value": "8e867494a625d1da06926afc75ae619ae9594653f8b322361e3f89e23fbfe386", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700989265, "uuid": "731bb2de-dad2-484d-b3f4-13893f120a89", "comment": "Malware payload (Smoke Loader)", "value": "44c62eb9323123d19ae2f4076479bee2a8752caa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700989265, "uuid": "e11a94f4-7f26-45d4-a22c-d4bc0921113f", "comment": "Malware payload (Smoke Loader)", "value": "e4318fcdbf4a38d433738193773e34a13c4d483746702585484910361e656e7c9d8f1b0a47e511942124aa99c807a4bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700989265, "uuid": "c9874908-8fd4-4ad9-8ea4-838a1094aad0", "value": "T16254D40382E13D45EA364B739F1EC7EC7B0EF6518E497BA91218AE5F04B00BAD663715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700989265, "uuid": "55768fe5-c990-439e-a410-0efdca327581", "value": "0a0289a4f27045b7c64ea101e69f4d9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700989265, "uuid": "31919d66-8252-40a5-9930-0f817b6c8b2e", "value": "3072:BeTXkc9uefnKY/NFqCMxODMLqUh0KiuF5eUknojPQ5mUxUnyHSoQj+/:cLp9uefn5NUhxMEhQuF5eUNzXkP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700989265, "uuid": "a260508f-2bb5-4d33-9fbb-100745d55e76", "value": 296448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700989265, "uuid": "c4af028b-8cbc-411f-8120-7d71e53cd10a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700989265, "uuid": "c3f55c16-c56f-4246-98ed-b056fe2c1580", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a29adc67-8c7b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701017313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017313, "uuid": "3df0d9e0-6bdd-47f6-bbfa-429156871be0", "comment": "Malware payload", "value": "87141e74cd18647207cc879d2c1945d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017313, "uuid": "e9a13d6b-b3fa-4071-bf12-fd5f6d7a0b0a", "comment": "Malware payload", "value": "8f6c85652c1327827d5b818a2e581b3c239841ec683893f4c0584ebb574adc26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017313, "uuid": "d0cba6ce-6f9e-4173-9438-42400879311c", "comment": "Malware payload", "value": "f325f8dae8d77f35adf93a09beffaf1aa94fe456", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017313, "uuid": "92c0caa4-6274-45ed-8fd2-b2397848c08a", "comment": "Malware payload", "value": "39b56a4eb1cbc727331d8a4d63ae8e13881a393253a3d5534207c4540bb84092345513ae0b7e31162cad2b4b2668eef5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017313, "uuid": "f4a181bb-4f3e-4e42-bf2a-c43327c68b9c", "value": "T1A845B503BA978AA2C669773BC697440CA774D6816393EB0B3D8E336948C377B5D4170B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017313, "uuid": "6d38fa2a-b4a9-4d20-9065-17037937511e", "value": "24576:cfD8Y7EsxXVXfZjbzKc4eOimxp8lrbpw:cfDxEsxX8eOimxp8lrbp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017313, "uuid": "35f4faa1-bb89-4607-9bc2-b0f103629fde", "value": 1268224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017313, "uuid": "9cb39716-8aa9-4e86-a66c-e83a66bf0756", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017313, "uuid": "1cb9466e-2831-4890-a1be-319e12ecc958", "value": "Hemanqjlt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59c83fd4-8c88-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1701022774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022774, "uuid": "13cc3266-e574-46f3-90c6-448627ce3033", "comment": "Malware payload (GuLoader)", "value": "9282d8bcc4ea7580d5be8d94cae597e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022774, "uuid": "5157e328-49f9-4669-a080-f3bbf156cacf", "comment": "Malware payload (GuLoader)", "value": "904e693b2555b2c515c983440669d772e53dbf785755e16973ffa52b76ec701d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022774, "uuid": "b0c5a9d1-bac9-4397-a6ed-e6d7dd208648", "comment": "Malware payload (GuLoader)", "value": "e2a75d005bb91db9ad7a12e6a3610edf5ddd8708", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022774, "uuid": "2a9a1322-d6a0-4a27-8dc4-2c3d2710479c", "comment": "Malware payload (GuLoader)", "value": "eec2b8d88efc238892b656b45c58ffd3f6b9257a1ae23b9482f4b5da755a4d07789b0a1d719ff406f6f3943981f729e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022774, "uuid": "700e78d3-86d6-4afe-8ef1-a85a84afca37", "value": "T1978412426B48D86FE41589355F3B6DC35B527D7C6991724EA370FB0D383F282861A38B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022774, "uuid": "702253e3-487e-4d08-91ae-c84083395251", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022774, "uuid": "5a6b9ffa-81f6-4c64-bf09-0f43ba3e5b49", "value": "6144:bNDlOltlhf2SjJ+Sf1NAeEepWVwgQNSXXu3J3zRZm/SwspnEsP:but7ffHnAeuVw2u9zRZRP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701022774, "uuid": "7343843e-6499-444e-8c23-dd0a9f7559d2", "value": 385755, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701022774, "uuid": "7daa6398-58c5-48e8-a6b0-0a2a9a923c23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022774, "uuid": "7a774e9b-4520-41ec-a50c-91d75bdacb56", "value": "comprobante pago fras.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d138ce2-8c7c-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1701017626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017626, "uuid": "9853448c-6c1f-43aa-97a2-672c8d9a2d81", "comment": "Malware payload (Formbook)", "value": "842dbf4950551a266d2ae781a0af54ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017626, "uuid": "37aa0005-f500-41ff-844b-63e9f0b6b3a8", "comment": "Malware payload (Formbook)", "value": "905721c1b25229592e32539baf64ff1a2b60e0bd872c3d86e53d8d89d67d03bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017626, "uuid": "6d761ecb-0cd3-46be-b176-5c6c0e63552e", "comment": "Malware payload (Formbook)", "value": "b5016f862996878b5abf816aff4372420ecddca0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017626, "uuid": "d0d2582b-152c-42e0-b14f-a233e6f931d6", "comment": "Malware payload (Formbook)", "value": "ca40420a96d1df0befe1101c985502fec562af921a59451ed95121caa0229c2476eabc9055ceb2e24f8a9a88f6acdc2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017626, "uuid": "ac717101-311f-4d01-a3a8-0b932268c9c5", "value": "T153D4231632AE07A5D4DC07FE27B3C291037093DEB15BFF6849DC51DA9B68B04A96B243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017626, "uuid": "ffa7ad8a-7d89-4622-98a8-110b8e900a6f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017626, "uuid": "f0db469c-40e7-4811-9b13-e41f76267fac", "value": "12288:XasOHMvj6sF+kFpRJv2/WGyWofGPrvDiP8q5iVpKWODKxSAMIsr8ed3K4ENzZWK:X52sTjvSbGKvhYKh2KEA/sndxEN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017626, "uuid": "070982bd-4c9d-4d45-908f-21e7eeb6b484", "value": 640512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017626, "uuid": "69ad4d29-9409-4a90-bfbb-99c01963a14c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017626, "uuid": "91f832f1-b06e-42d5-b7e2-243aa5a5bd66", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb2849be-8c89-11ee-8907-42010a9c0042", "comment": "Malware payload (StrelaStealer)", "timestamp": 1701023474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023474, "uuid": "345319d5-d66c-44d8-9246-c0bda9c19ff5", "comment": "Malware payload (StrelaStealer)", "value": "97e9c1bf29e8bc389851538fd812ad26", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023474, "uuid": "b369bd91-a053-4188-9e8e-05bc7bbabf53", "comment": "Malware payload (StrelaStealer)", "value": "9059a44dc837a9ad492b17b7056d3ac02de681b8350796edeb08383f530c6b89", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023474, "uuid": "1f45470b-59de-4abb-9789-7bcb21e2e9b2", "comment": "Malware payload (StrelaStealer)", "value": "081e897c272754a36be4084e9a978bd44be0eb0a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023474, "uuid": "127cb744-63ce-48c9-ba25-9a3dbaa707f9", "comment": "Malware payload (StrelaStealer)", "value": "54c12600e451f65345e0f5c5676906c9961912947062abce26103c18acb1bacd66532e348ce6d26d503ff07e8af3d7d5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023474, "uuid": "047cd358-12af-4c7e-8a3c-aebf13b2aa50", "value": "T168B6E7F0B2517EE20FB4191DF38F41B63C27BC6AF07A5E8A22961E5DD5C4244DAE6870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023474, "uuid": "d6ab4b6a-07f6-492e-9bcf-95f6070fd6c1", "value": "49152:cSSd8aACYFriPV6Xgdy3N3uPyYsMQ/FUbUg:VcP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701023474, "uuid": "42d4d2d1-5746-4d6f-833e-193661685c88", "value": 10923667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701023474, "uuid": "30efc97b-cf21-4458-8ae2-72908df4c2b7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023474, "uuid": "02e769ea-abc9-45bc-ad95-485c3708976a", "value": "11766206557093.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bef87807-8c6f-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1701012206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701012206, "uuid": "c936a057-dd6c-45ed-ba4b-864a7aacf3da", "comment": "Malware payload (Mirai)", "value": "24bd19270da062f34775375484ba4ee9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701012206, "uuid": "609c7e2d-e696-4bae-a0d8-f6dd1410c881", "comment": "Malware payload (Mirai)", "value": "90cb0ba0df4ae39e04467077616baa9a8816e533b0623e972dda7a8dc315aca2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701012206, "uuid": "5cbfc64f-bb9b-489b-815a-2f5364a58034", "comment": "Malware payload (Mirai)", "value": "a583f3995e47d0e1ce3ac3c712c42325bcc8af93", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701012206, "uuid": "77bdb4f9-e7a8-4f47-a534-aa80acd6a718", "comment": "Malware payload (Mirai)", "value": "7e2a0fc4345aeab88cbaabc28bfb9f993720c45aa7caf771e44b72e02c8c9eef4691b941432111950fc4af160db2df42", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701012206, "uuid": "617b1af0-a87f-4d33-9af4-a8d1aa70730d", "value": "T1D773B309BFA50FB7EC9BCC374AA92712288D651A35A93F35BD34D418F25B21F15E3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701012206, "uuid": "97c2bca2-c3e0-4abd-8af1-fd4acf11e3d5", "value": "1536:aHJtIFGq1QM+uDEQhKvt191Yi8ZNFDGR:aHJtIMa+UEQPi8E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701012206, "uuid": "fd07ad12-3dd5-46d0-be87-ae0f2a841363", "value": 76904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701012206, "uuid": "edbc5ef5-e22e-40c9-903f-0fa251d3f36f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701012206, "uuid": "df813746-285a-4d23-bc54-af68b6663804", "value": "24bd19270da062f34775375484ba4ee9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2b46f52-8c7c-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1701017877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017877, "uuid": "7ddff3a7-767d-4b46-9daa-c788f875ad3f", "comment": "Malware payload (GuLoader)", "value": "415066b781fea8a841d8cf8f08f32448", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017877, "uuid": "892995cc-d8aa-42db-80d9-c22a7c4c8888", "comment": "Malware payload (GuLoader)", "value": "9128ffad6e906ed9c5ccc151e1b24c52013e8eef64a3990354e8fdd2ef9945c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017877, "uuid": "bc43ae67-258e-4e01-895d-97e517b44bf4", "comment": "Malware payload (GuLoader)", "value": "dbc65f2832cbe482b40dd4a2637460b2ceab2774", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017877, "uuid": "e99cc474-2d13-4cd6-9714-18527d1a913a", "comment": "Malware payload (GuLoader)", "value": "66b75e21e7e3fb848d8253888f87eef8c17b9f5d67d913b421cd723ae11baa6084c43a7a51121bbc34903961f833bd7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017877, "uuid": "636a3601-f5a3-4647-a117-e86f76727641", "value": "T153D4234311C1E1A7EC976A701EDFFB8682B567311418BB8F3B041E2A2DB32E86F15B55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017877, "uuid": "4a195f2d-8a9f-48c1-b686-6a37383a32f5", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017877, "uuid": "e6477d9e-5788-4e82-bdff-b88ca3f14edd", "value": "12288:2nII4xY1W6T3T2Hyj69rj2AMfiXDcdhCzNJIuqFv:2IuvwI69rj2HKIp7Fv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017877, "uuid": "95c1a4ce-1af1-4530-a733-88bdfb38064f", "value": 618474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017877, "uuid": "ba60e4c3-a1c3-4b8e-87a2-07f01a19285e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017877, "uuid": "faf2b4b5-e4ad-4ea5-98a2-a61920231fe7", "value": "415066b781fea8a841d8cf8f08f32448.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09602624-8c6f-11ee-8907-42010a9c0042", "comment": "Malware payload (Meterpreter)", "timestamp": 1701011902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701011902, "uuid": "2285036f-b2b2-4d8c-a172-4569608b9caf", "comment": "Malware payload (Meterpreter)", "value": "dbfe72085ba54253275429f078307fbd", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701011902, "uuid": "5917ea3a-bf28-470a-83cb-24a6fa616bdb", "comment": "Malware payload (Meterpreter)", "value": "91429407c3dcd1947735028b7b8632187edd45bbd0e19b7ae64a9a86574c3186", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701011902, "uuid": "a208aafd-36fa-4208-be48-26989a43d1cc", "comment": "Malware payload (Meterpreter)", "value": "1bedc6beaac9a9fbf27ef4605fcc4f4d1595e838", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701011902, "uuid": "8719fd67-c533-4a9a-89a0-f7c89b3f6ada", "comment": "Malware payload (Meterpreter)", "value": "1c878ebe631a172d850009242ed97fb51407dbe540ddb7e50f0c1c6f631740d15a4d36db97c5f4524bc338e5445a8bf4", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701011902, "uuid": "48bac290-6bb0-4884-952d-e89f2df2476e", "value": "T109E142133B184EB6E87C157D0AE2FDA765989A253B2B9266891803173922224B9B5D08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701011902, "uuid": "53f9e81f-d1e2-4761-a95c-d12873f5a699", "value": "b4c6fff030479aa3b12625be67bf4914", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701011902, "uuid": "ecacd380-f7bc-4d99-b5ed-64566159efae", "value": "24:eFGStrJ9u0/6LKnZdkBQAVbOx+gYKZqA7eNDMSCvOXpmB:is0uCkBQ1x+hmSD9C2kB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701011902, "uuid": "0fc83cbe-ac5c-4ad4-9241-8ff12165850a", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701011902, "uuid": "07e8b0bc-659e-4cc6-b4b6-707ae798ec22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701011902, "uuid": "464ead1d-5475-4b21-9bb7-c839613f8047", "value": "dbfe72085ba54253275429f078307fbd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17219ae5-8c7c-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1701017508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017508, "uuid": "3283eec5-8d86-4de4-ad43-b71a5893b6d3", "comment": "Malware payload (Formbook)", "value": "eddb45e0917911908d24f104fcf134dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017508, "uuid": "cbdada5f-aec5-4a8b-bef3-abb7123c7de2", "comment": "Malware payload (Formbook)", "value": "9206da924147e9cc204405a4fe9494c19fb50365c243188ee80ebeeae7d39351", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017508, "uuid": "37dae30f-9be9-4521-8190-7bd5c85f02d9", "comment": "Malware payload (Formbook)", "value": "09c5c74cdb780570b97d953b6c64aa519eb352be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017508, "uuid": "95364470-ba5e-4d0f-93a1-60d56921c9ec", "comment": "Malware payload (Formbook)", "value": "7606f6fdef4b37aa35c7d48d79d38cd6492c16ba28ce671cac1e29d9546ba314a0af437e9741217c24703c60ae94f458", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017508, "uuid": "bddf6c7f-2df1-4dbd-aa5e-02cba4306bb3", "value": "T12AC4234122D9230ACD4CAFB1A9A52553C731E36D4460FE769C8830E4335BF66AFD1EE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017508, "uuid": "73e42855-8a1a-4bf0-be51-51c6bcd78ee3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017508, "uuid": "edfdb88b-965d-465c-9d3a-846804bac7cb", "value": "12288:1y8o94Kms3Y4K/O0nCQJ47/znWk/eFecVPuLWnVerFVCKEH:1FCiALixnd2jW+ykVpV1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017508, "uuid": "b79a8819-37a4-44b5-9bf3-f124695a1a8b", "value": 550400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017508, "uuid": "fbe28634-f8c9-497f-ad25-2e69021710ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017508, "uuid": "5c1b6c1f-4231-4872-8c46-e2c27e478555", "value": "\u041f\u041e\u0414\u0422\u0412\u0415\u0420\u0416\u0414\u0415\u041d\u0418\u0415 \u041e\u041f\u041b\u0410\u0422\u042b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ddb0143-8c87-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1701022405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022405, "uuid": "5a678e11-39f1-4550-8741-3c0c386f85e4", "comment": "Malware payload (RemcosRAT)", "value": "8599a21e279d81d769229609621557aa", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022405, "uuid": "04cff73c-437d-4662-b58d-9d54080c5bd2", "comment": "Malware payload (RemcosRAT)", "value": "931c83f19a7fa31ec52a41d96a6a4138d932bbe7361ea070d31014826964c6de", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022405, "uuid": "e889054b-c35e-488f-9989-e57c6779350d", "comment": "Malware payload (RemcosRAT)", "value": "4de20211ec5b5b4a116a4c21d32213fc04344122", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022405, "uuid": "327fded9-9551-40a2-8c58-eece6729c2d9", "comment": "Malware payload (RemcosRAT)", "value": "1db84069e4bf517f01fc087400a8c02075cdbdfa363069ee31be4151e3b34ac566e7407a634cad0117c2f2fbca86dec5", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022405, "uuid": "fe94ec7f-b130-4089-8e08-324e211312de", "value": "T19C2523937B9C879ED26C8B72F4BD81724E98EF870510A841B7D1FE8D217665D3A072E0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022405, "uuid": "0b35e35c-46b4-43dd-b719-d4bb83b36403", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022405, "uuid": "251671b0-1cd5-4be0-b341-bbc1bb19eac1", "value": "24576:4dGRQ2shSzcfOPr2uP9R7rRceB3Ts4XQ3pdfSaFAn6GO:bsUgfOPy0R7FFD23FA6GO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701022405, "uuid": "fb92c1d2-f9b7-4feb-a4a5-7ef48df86124", "value": 1007080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701022405, "uuid": "a953c556-3d4b-4996-8f36-d57fdb53c97e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022405, "uuid": "6c04e07f-b3d9-481c-b2f3-bca7b62a48bc", "value": "DHL_Express_Courier_DHL_Waybill_Pickup_Confirmation_CBJ231025122556.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd602f18-8c2c-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700983481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700983481, "uuid": "2aa25af8-71d0-46c4-a73f-f836de4647a5", "comment": "Malware payload (AgentTesla)", "value": "22033619d1075b112f8b58d657f536f8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700983481, "uuid": "fdf9c10b-3c31-4458-ae46-8f604bbb37ed", "comment": "Malware payload (AgentTesla)", "value": "931f38d16e4369c01166d7dac9bbe0bc28af3228b6fca5d4f23e6f06f2f13333", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700983481, "uuid": "f18d4a35-0317-432b-84be-be971e07fd42", "comment": "Malware payload (AgentTesla)", "value": "05e5c0da4ee028bd41d0d07676ae1906a012126d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700983481, "uuid": "d95cfd74-55a3-4314-a6c6-1d1a7c5a831a", "comment": "Malware payload (AgentTesla)", "value": "bf014600dcb179072abbf9ee1d163fd1c35aa45c6d26bb702334c5fd162a3dc22491c86b1346b0f499757e973209b1ed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700983481, "uuid": "59cf8e1c-4b05-4aba-a5da-89001db4504d", "value": "T15115F12962B44F8AE8B753F58968420517F6BE9D512BF39D5DC0B0EB0E327811A07B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700983481, "uuid": "3e448861-0896-4b0f-922f-22e602b0ef68", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700983481, "uuid": "79d33ee7-e901-4482-be7c-ed431a9bacf1", "value": "24576:PLtD/6112Zyp+9Z5kx0Wq/vL4wZS82ENLf:96mZyID5kWWuvLXZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700983481, "uuid": "82ac2242-2443-4b0c-9682-d4268bbf35c8", "value": 957440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700983481, "uuid": "4d94b6da-4bf0-4b68-9456-a68dcf4d3720", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700983481, "uuid": "961e6ea4-c47e-4807-96f0-0e0639c503c2", "value": "22033619d1075b112f8b58d657f536f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e63cac92-8c7b-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1701017426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017426, "uuid": "e9f31ce1-603a-4c47-90a1-737cf606cfd1", "comment": "Malware payload (SnakeKeylogger)", "value": "634969e8d7e126dba7d9df1ba2495850", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017426, "uuid": "3fef5fbc-2dea-4d0d-9fa3-022e95357c90", "comment": "Malware payload (SnakeKeylogger)", "value": "9371ee974c4ebf35be61c05afbd3d3f73ac8d130346655b3374f7d9a779195d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017426, "uuid": "63d4aeee-356e-462b-a529-42462eeb8461", "comment": "Malware payload (SnakeKeylogger)", "value": "5678e50a87be9b0c46e52ef259e5624022b80757", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017426, "uuid": "9d1b4993-4f05-4acb-a723-399ea330fa0f", "comment": "Malware payload (SnakeKeylogger)", "value": "2ee243f06c5b78257619aa25de32fca81010249ca6fdfd65412c587071bdf9b27fcc767161d72c75624e588d6a8a946d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017426, "uuid": "a1441b5e-c6fd-4011-9759-5af05a480842", "value": "T10D835A48EB8D6A22C7EC0B7F94E77A500775EEB39307E70B65C8322519877DB6411A83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017426, "uuid": "0afbe4c3-15b7-49b9-b379-10bcf67b9a3d", "value": "1536:CaCQ1GTdMdAP82dlvrmUrKiKpp7lpQJ5m1zr3iRNhtCCKyqw:MtIhqlDm0HK7qm1vi/z3n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017426, "uuid": "3794fdbb-b608-47bc-bee5-5a87df23a359", "value": 88576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017426, "uuid": "8f2d416b-2f4c-42ff-aff3-be964895927c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017426, "uuid": "6783d801-589b-4ac1-8e1a-57b90dba2f97", "value": "Nedqm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a02a4fe6-8c8c-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1701024610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701024610, "uuid": "39ad4db6-9648-47c8-a658-c779f04fee2f", "comment": "Malware payload (RiseProStealer)", "value": "d01a6a68dc8f110c7372e8e8556830ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701024610, "uuid": "87a049f8-7324-4500-9d8c-5121d9f87a22", "comment": "Malware payload (RiseProStealer)", "value": "94da4bc8d4da9a69ed3ef46bf55b604a26d3ba5a82d992e7b3376fbe7ee2324e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701024610, "uuid": "9d9c3d02-afed-4fa8-ba8b-1cb7fc7d4882", "comment": "Malware payload (RiseProStealer)", "value": "166c0961befb3bad76d07dcde46df6c0fe57d991", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701024610, "uuid": "e126d195-2c5e-4bc0-a0c3-17e1712bc4e3", "comment": "Malware payload (RiseProStealer)", "value": "1b99172e211a9aa2bc43f451df83bf6bb75496122a34e6470afa2c83488b3abae805cb23bb7d2f5dba5150d07fe809d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701024610, "uuid": "16d851ce-e512-4d6a-9bce-e9caa023fb3e", "value": "T1B985232366E55027D4B42F3049F39B831E323CE2FAF0E226A790E55E4C1275469B772B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701024610, "uuid": "c74befb8-d163-4b42-9fcd-b1bc273c6a09", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701024610, "uuid": "1738d94b-f7d8-45be-949d-79ff81aae9ca", "value": "49152:nV1CTN8FwWWaH0EtasDpmdxGUHZ4X39Z+:fsNwwWb4Tp54XNs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701024610, "uuid": "e29a9064-5b28-4168-bd92-20ae1cd7cf3f", "value": 1769984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701024610, "uuid": "2373a600-a174-4fcf-91dd-61e4011d60e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701024610, "uuid": "d71965b7-7d0a-4935-8f70-bbbb92458b03", "value": "d01a6a68dc8f110c7372e8e8556830ee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f338359-8c88-11ee-8907-42010a9c0042", "comment": "Malware payload (XWorm)", "timestamp": 1701022890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022890, "uuid": "820ab9ae-719a-4698-aab0-e267a28ac1fe", "comment": "Malware payload (XWorm)", "value": "3dcafcf057793f2ae3e797fb37fdc58d", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022890, "uuid": "d0eb902f-0674-40f8-b8a7-e41c5160796c", "comment": "Malware payload (XWorm)", "value": "95756c300f007e1df2c52073978fe3d62979c1230b418fdf66fbae1801294c63", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022890, "uuid": "74c1cb8c-563e-4fbf-8187-7d9f2e95d0ac", "comment": "Malware payload (XWorm)", "value": "640ef1871bc8218667106caea23069193ad5dac3", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022890, "uuid": "6f338cec-73fb-46b4-bcfd-582dc6ae824f", "comment": "Malware payload (XWorm)", "value": "53eb08e36f2620adf2e5ccbc4a850aabf388ddbefa39b2e2354febf3b3e924945821ce765ffbe6f21e4e9926fbb62bb1", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022890, "uuid": "f5d4aa66-fbf1-4dad-affc-b6f75027c0d7", "value": "T133141C1036EF614C75B37F622FD9B9E94AAFFB711929609D1048034B4B63E81CEA1772", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022890, "uuid": "0431644a-456b-4454-bf23-d53462657028", "value": "3072:F6pa+oXs6s6s6s6s6sws6s6s6s6s6sps6s6s6s6s6sks6s6s6s6s6sBs6s6s6s6h:H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701022890, "uuid": "1c09feba-92e0-4081-8fdb-854615b3718c", "value": 203222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701022890, "uuid": "f48fddfe-a697-4e9f-9a09-02aebeba6ad2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022890, "uuid": "0ccc495c-c86a-4c5c-8924-d7d7a46bdd7b", "value": "Commercial Invoice & AWB.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10ec0b55-8c7c-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1701017498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017498, "uuid": "f2805445-19d8-4e6f-8a5a-f6341e10b020", "comment": "Malware payload (Formbook)", "value": "c93b8ad115f2693f3e5e33f505f44d06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017498, "uuid": "586c1842-2e00-42c0-ad51-16c32e0948ba", "comment": "Malware payload (Formbook)", "value": "95db9ea9df83185a3ab4cdcdac19f62ebf64daaf94ce2ba1f77677bcb361ba9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017498, "uuid": "546bb65f-48c9-4d2e-8c58-e58ffaef8a64", "comment": "Malware payload (Formbook)", "value": "9b9e46a0140773ebb1686bb5d4567a4a7895f2da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017498, "uuid": "98053db0-e514-49c4-9b78-9b1268aa8164", "comment": "Malware payload (Formbook)", "value": "e7bea98930c7017ff6228a79144ea570884916ed91b9e795440cbb6324a442ef19d704d05268ce2f6217bcdb3504372e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017498, "uuid": "8db83e8b-4d95-4734-9a2d-3a94eee9b004", "value": "T118D42361779596F7ED7E0EF412EA699A72BBF32B50D3C00809C416FE6276B084D38583", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017498, "uuid": "0dd9abdc-4eff-4b52-a536-22eb13dc1578", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017498, "uuid": "351cde6f-821d-433e-82cf-5622569a177e", "value": "12288:DXy8oCF8Jwc0mfNXgotB4mmTnufYT1c4gWLpYX1WRMZicwHvZqvDH5f:DXFO2c0SNd74mNwZYX1WWZibP4F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017498, "uuid": "b85e74d8-00ce-4551-9ac7-8a723e598531", "value": 614912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017498, "uuid": "2e49e920-7e7b-4d6b-9e9e-ee438186089a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017498, "uuid": "5115ff7f-7d49-4af2-ad31-1a404de609bc", "value": "Q7ZiqgD1IZjP7fs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4a306a4-8c3c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700990392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700990392, "uuid": "4b0afca1-6e3c-487a-8b66-76d23756d110", "comment": "Malware payload", "value": "a463d21ad724edb2113e773e524dd764", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700990392, "uuid": "e85630cc-cfec-4c9f-8ee7-f7ba6184ca38", "comment": "Malware payload", "value": "97f2a89e92a40f86cea0ad0246242bb2d275c187c413b04098e3d4b76171eef2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700990392, "uuid": "58e83bb5-d5e8-47ba-b1b5-3a9b7e8a1755", "comment": "Malware payload", "value": "23ac641ce8cc6cacee51208dd7cefd15287a1e3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700990392, "uuid": "f0d60f86-ef34-4a82-8620-b293db81d5b8", "comment": "Malware payload", "value": "35936ccbc8996b9ad47428d680cff998e9d6c236998492f1d9c155617a257be390a5b34fff6686632ac892ff705b80b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700990392, "uuid": "07e2643f-3203-4b0d-aa6d-b34bd1af15ca", "value": "T1A0C733A0F6CEC476C1175130A5B2E75886E4BE065BF6859F3250BFACAE7D382352C316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700990392, "uuid": "604ef2c4-c52d-4fdf-bfd8-bd370010ce68", "value": "eba6ea3eb54d77d517181e99ff8c9533", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700990392, "uuid": "1b88020e-581c-4a86-b5d6-b6d2948d9614", "value": "1572864:kbiSdJnpL0h9MgTBfyQmLykBwrSxOOGNHesx96:siSdJ2h9MWB1ierSCNHNx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700990392, "uuid": "a8a097c1-599e-4496-93e6-b98e50b17aa8", "value": 55609856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700990392, "uuid": "38815d68-4376-4ed6-a3dc-41dbd4c883e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700990392, "uuid": "933a22a4-d330-4366-b21f-b4e5bd6d2e4b", "value": "a463d21ad724edb2113e773e524dd764.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d5d5d39-8c6f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701011908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701011908, "uuid": "a5440e10-0532-4ccf-982b-543a746b0a35", "comment": "Malware payload", "value": "0170f9a9cf779fefa88e3a93dd551712", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701011908, "uuid": "12feb404-f301-4df5-995f-0a128ca65936", "comment": "Malware payload", "value": "980a9e9f44aca2a0503c0bdc356c97a8d72439332f0c592317454be367ff4f53", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701011908, "uuid": "9a8e0476-240e-4058-a344-5b0574c045b5", "comment": "Malware payload", "value": "70cdcb14c6916652bd5058917bf5e3ed77c63b29", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701011908, "uuid": "57f3a856-b656-44f0-b075-a1b6f37eabae", "comment": "Malware payload", "value": "0d4839cd7719f5f51a4a9c6e0b581d251b513012ce7b5a5428b788e0e9772909ef8f87761b2affe088a936722e7d8bb5", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701011908, "uuid": "f57aea11-1912-4471-b9d0-62c8b377b1d2", "value": "T125F68C47F85415A4C1E9C234C9664252BB727C4A0B20BBDB2B50B77D2FB3BD4AB7A350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701011908, "uuid": "b3364870-3561-4119-a584-e753b4c12bc0", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701011908, "uuid": "ad34e28c-82f5-4108-9571-53e816788472", "value": "196608:mdswEiI/C5CnZTH8KxV2AonzpHgYTW2fICxPiCGzio+f:idE96gTHlV2AmzPTW2fIwiio+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701011908, "uuid": "90c1e131-4459-4686-aded-013eddedea75", "value": 15451648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701011908, "uuid": "baa8759d-837a-4cef-bdc6-0c32ebe1c62b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701011908, "uuid": "055879c0-86c7-48f4-87a6-dd72ee3324f0", "value": "0170f9a9cf779fefa88e3a93dd551712", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b536386e-8c6f-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1701012190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701012190, "uuid": "e2ce141b-87bc-4bbd-a8c3-73ae2e226b2a", "comment": "Malware payload (Mirai)", "value": "ecae7204bbbeb3e39cf694bb32bd25a3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701012190, "uuid": "0cee0edb-ce63-48bf-8b66-51436e93cf42", "comment": "Malware payload (Mirai)", "value": "98e40b7275f2cb024e9c25c284856ec313a56b5ece226869b49c718135c32648", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701012190, "uuid": "62e2350e-2e0c-4a36-9a0e-d9b51f6642ca", "comment": "Malware payload (Mirai)", "value": "aa676873aa1687d1ba24a1c4c080614aa0d2d44c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701012190, "uuid": "1b3742b5-0915-4795-89ad-e00952d382f9", "comment": "Malware payload (Mirai)", "value": "077a11d9e451f7f299c9d68f7be980dd810ce6857f8b57782e1f4b43decbbe6d89af92857d73f5fbba4127c146403e5e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701012190, "uuid": "e7fd117f-51fc-4781-9502-71460de825e3", "value": "T17533D79178D15A2AC6E463BBF5AE408E3321B3E8D1DF7217CC241B047AD592F0DA3B56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701012190, "uuid": "5aeefdfe-4502-448a-842a-ed24629c36e1", "value": "1536:nOZJ16xQNsfidc25+t6WEIr+5+nuaUWhK9RX:nOZa+1G6WEIoaPh6R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701012190, "uuid": "6b247c63-9f0a-45b7-a272-7c865ce06b64", "value": 51168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701012190, "uuid": "9878fdb2-3e94-4fc7-8e03-9cc327ae8b0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701012190, "uuid": "c6750762-ef41-421a-9867-3e23e180ea93", "value": "ecae7204bbbeb3e39cf694bb32bd25a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "600128bb-8c7c-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701017630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017630, "uuid": "609ab4bb-2fcd-40bd-88a5-06044658c159", "comment": "Malware payload (AgentTesla)", "value": "bcae0e0dca60849e004a322a1b15b1d6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017630, "uuid": "c01cebb2-34c8-4aae-b894-8cec695098ea", "comment": "Malware payload (AgentTesla)", "value": "993eeee9034a444b7000ab0a34402139fb011e89c67b1e0c6758ab79367034f3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017630, "uuid": "a926fbfa-febf-4938-bd43-ec113c9fc766", "comment": "Malware payload (AgentTesla)", "value": "38967ff794685bf5aecb37b8da27d289989819f1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017630, "uuid": "166453ab-6edc-4e22-9007-a6874d1de82b", "comment": "Malware payload (AgentTesla)", "value": "9e42638cc607652c1871cdf2186cbcd2f7ebc118fff8275259c61bf1d666c5df843dbd6b00f43878c9f49e46a3ad621d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017630, "uuid": "71359ff0-d4c7-4c02-9c2c-4fbbcb08eddb", "value": "T1ACD4232E37774792C1F803F53AE712520BFBF2DB2558FE584E1C20CBDAA5B219662055", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017630, "uuid": "3f04d82d-de37-4d5f-bc38-838157a95533", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017630, "uuid": "0fb0e8da-e8b9-4eb6-847f-ba882827360b", "value": "12288:FN7V+zCyUSWDaaAs9SVXCHn40jdzgmpVv2O9/cFPhSGevL/GK4ENz2K:FN7VMMSWmXiSK1buJvej/GEN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017630, "uuid": "d37ad831-d2bf-4dcc-a4d2-245f2be15678", "value": 645120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017630, "uuid": "eed391ac-b810-462f-bf4d-7c564f50d066", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017630, "uuid": "b1427424-240d-4340-b800-0d89b9b61305", "value": "Pre-arr doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af1f4729-8c89-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1701023347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023347, "uuid": "54424e86-54f8-45da-aa8e-a48c820013cc", "comment": "Malware payload (RemcosRAT)", "value": "322985bff5b4980d441dd94e7d808ef9", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023347, "uuid": "c7507b0e-7e99-4f82-847a-2fabffe42ea9", "comment": "Malware payload (RemcosRAT)", "value": "99b39fdb3c9a16077c908bd0bda929cafaf93a2578d5cc43d7dc52c3de7ed50a", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023347, "uuid": "84f88813-551d-45a3-a532-80dff9d1b959", "comment": "Malware payload (RemcosRAT)", "value": "9f77114a2c8c80fa22e854460035a835c5fcb42d", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023347, "uuid": "8982ae31-0fba-4ac1-ac5b-d735117752c0", "comment": "Malware payload (RemcosRAT)", "value": "5af13ad946116ea6f8d73fcc8b1a7ffb55fc10d18f3d4d0a1d87e752e102d363a46afcd9589f9ab1f8525f6737985269", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023347, "uuid": "6b2cc3ea-9e8c-412b-b7d2-59e3515328bf", "value": "T197B49E01BAD2C072D57514300D36F776EABCBD202826497BB3DA1D5BFE31190B62A6B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023347, "uuid": "0e1a3885-9071-4829-8d5e-7302b4895e5f", "value": "8d5087ff5de35c3fbb9f212b47d63cad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023347, "uuid": "bd076311-d73b-4322-ba06-ccf95b889ad5", "value": "6144:i/7iPrcL3ArwhBq7Kjsn9iHGXg0lwGS9MNNhdFvPxps9gsAOZZuAXec7H7ov:i/uPq3AfK496Gw0lwGXN3pvs/ZuG8v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701023347, "uuid": "17ec66f1-8727-4f0a-88d3-5e96d82d66ce", "value": 494592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701023347, "uuid": "4d1a34cc-0ddd-456f-8ae4-393b0ff93459", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023347, "uuid": "dd3ae65f-c21a-4005-bc75-4ac8bcce6f41", "value": "17010233456ce7a0b734d15964a57a899974d4f058afc39859dc96351fd1223c8994ebbcc4936.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9817ea6-8c6f-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1701012224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701012224, "uuid": "b63b6900-9bd6-40e5-b0ae-e0cf8e4e7cbd", "comment": "Malware payload (Mirai)", "value": "becc38d7facdd10aed3ec532e5c693b1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701012224, "uuid": "d66c82da-0c1b-418f-a95a-5caf478e69e4", "comment": "Malware payload (Mirai)", "value": "99df351b7f1475a914c9007304dc7ab47d1fc453307ae2a76ef6ebb082acbbb8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701012224, "uuid": "8237c440-5045-4be5-9038-4e0200ea596d", "comment": "Malware payload (Mirai)", "value": "0483c2732bd8461947bb6e62b2673afe6a75bf01", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701012224, "uuid": "e1a48e6d-4a41-4322-928b-dfd506520205", "comment": "Malware payload (Mirai)", "value": "10c00d1f74534f9c26667d9c49a901c3f85bcdc1efe15b4e376dfa2838400bca9c401cd0ec007bb1f5da445e63a094fb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701012224, "uuid": "cfc504c2-13ed-426f-b7f2-fdf7849d4148", "value": "T117436B256A7A2E17C0E4B4BE22F74754B2E1665E25E8C61E7D330E4FFF21A50A0436F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701012224, "uuid": "f23cc3e7-899d-4f00-96c3-4ff0e98a1280", "value": "768:Cuopf8bQPAZqRU+fECeU6tq9bXV85PnXIsf0lkgUI7O+qoSJ/IT:CuOoQAqRU6ECeU6tSbXm5PX5IfZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701012224, "uuid": "9136da19-74a8-491f-8a12-2755fab86a70", "value": 59664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701012224, "uuid": "ea49f8da-cc37-425e-8f79-79949ac5ff09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701012224, "uuid": "4baa246e-ae7a-4043-a835-876c1d490d31", "value": "becc38d7facdd10aed3ec532e5c693b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82201c84-8c7b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701017258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017258, "uuid": "2ff983ad-cc6a-4f8c-b911-7a976ebdf127", "comment": "Malware payload", "value": "c23728a67a9120f8cc127ecec66967fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017258, "uuid": "2a588867-85d5-4704-8f88-3bc8aa91b901", "comment": "Malware payload", "value": "9a24326135e1943982a6b8cf70e4fbed8d5a5697dcbb87c8a03a025f82b97e45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017258, "uuid": "8adf2526-bcdd-4c4d-b1c1-ff55269709ab", "comment": "Malware payload", "value": "7779173c25ea1663473cc6f84496abc3e11da77f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017258, "uuid": "2898357c-0b45-4a33-be41-a3d589300dea", "comment": "Malware payload", "value": "f7dc300adad0ef0c96828dd39ba1c274f73d7701e2063c2ecef748a501f3b07f9c309ca22119decb6c7cccf885606efd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017258, "uuid": "7f996b2e-0a7e-4fb7-98b8-b13ce31b9453", "value": "T156A4AF07B79786B1D748173BC9DA04240771F181A27BEB0E7A8E23E68D437BA9D0D527", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017258, "uuid": "c68bb6c4-9b96-4f1b-90b9-abae8972d14a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017258, "uuid": "f3b19ce3-595b-4865-84bd-08655a24dbda", "value": "12288:oQAL72pjqx2npGCGuIaEhbYsXgenNzdpODWH2j:BAepjq2pGCGuIu3eNWWH2j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017258, "uuid": "1100d654-bf66-434f-ae06-6358d06c1722", "value": 479232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017258, "uuid": "c7b67b90-9c2a-4845-aeba-05035fdd25fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017258, "uuid": "c2bb9a05-e2a9-4fdb-aab6-9c553e3c96c3", "value": "c23728a67a9120f8cc127ecec66967fa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35eaa028-8c66-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1701008111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701008111, "uuid": "e496a986-0dc2-44ff-ae42-b91c3d2e42f2", "comment": "Malware payload (RedLineStealer)", "value": "4674764646aaff52a7ece3c9d5b28e87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701008111, "uuid": "5cb8b603-1281-4c0a-8dc0-a57635d54201", "comment": "Malware payload (RedLineStealer)", "value": "9a34d7026fa359ef241926403455d273e6cf3ce8d6ea8878547d71a82d4925b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701008111, "uuid": "f8861ee5-eebe-4cbb-a5db-46c327ac7dcc", "comment": "Malware payload (RedLineStealer)", "value": "ae06079e43c783fd9a2a190301635a9bc624a3d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701008111, "uuid": "a106137e-852b-466f-9130-a8b8768be4c0", "comment": "Malware payload (RedLineStealer)", "value": "8267b05f72c50ca8b45c4b3e542497edcbf2b1ad120b7883da64b11c681bf581e40cd12dcf1cf6c283d7614bf79e1a0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701008111, "uuid": "5cecc8a6-73a8-4cb6-91ab-3e421ff94283", "value": "T15504C658364BA9BEC96F487E9C600CD0777CACA31246A7079C8EF0E5793B7819B051F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701008111, "uuid": "e9bfa77c-d811-4608-9675-1ff11d370333", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701008111, "uuid": "49987037-3952-49a9-a7aa-9e8197bc12cb", "value": "3072:Mltwe744I0ieMK1OIdpJlocOHE0Sktv2yjJg8e8hl:Mlto4I0ieMKTfOHE0wyjG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701008111, "uuid": "3d12664b-09d0-40e1-80ec-dbb7dbc953a0", "value": 178176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701008111, "uuid": "6e7ce344-31d5-4e30-88fe-77432246621a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701008111, "uuid": "0c50eb87-6144-41a2-a143-a691f5e5e47d", "value": "9A34D7026FA359EF241926403455D273E6CF3CE8D6EA8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3660a1f-8c8a-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1701023756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023756, "uuid": "87893e65-a9a0-44b6-b31c-33d01068245b", "comment": "Malware payload (Stealc)", "value": "df00b4326c07994df3ca4996891fe69c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023756, "uuid": "a17b06a8-eefe-4c27-99ab-57907efa3437", "comment": "Malware payload (Stealc)", "value": "9d4b3b956471d7e851215b47b39e378f9ef22365de1ff9a12e4376994a4cbcc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023756, "uuid": "6f857e97-ddf6-440f-bb22-2c7ff1186060", "comment": "Malware payload (Stealc)", "value": "06726d3ebed2c868e7e7d9ab7a507115d1cd3298", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023756, "uuid": "af74a9c0-cc06-47ec-9956-8315c33892de", "comment": "Malware payload (Stealc)", "value": "5bfb0f1ae032af7c1cd7a52e028c1e9d3a6243435d3fb0aa5dcea4faf89799a76df18bfda1c1731f4a355c43628be93b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023756, "uuid": "a448ec97-e188-452a-ac8e-ffea6c9867a2", "value": "T12A54C30382E17D41E92A8F729F1FC7EC7B0EB6518E19BBA9121C9E1F04B507AC663715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023756, "uuid": "6d319904-f856-48f3-9203-209c37969919", "value": "b79e8a13f3e64db949ba21efd0faecde", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023756, "uuid": "a5b28fda-3285-4edb-8d06-0ae2860c6c67", "value": "3072:fKNXCN+vXiKmExH0+xHjP/PUctyiq5xA5vsZeU1VnprxQj+bs:f8Xi+vJmExHXRzUcttq5G691ppH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701023756, "uuid": "f2e5a826-1227-4b62-bcb0-8a71f5dd9b7b", "value": 299008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701023756, "uuid": "e1b09e66-7e19-465e-be5f-ca6ebbbc455b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023756, "uuid": "d9aae4e9-97b9-44c2-b698-65b731eaf4c8", "value": "df00b4326c07994df3ca4996891fe69c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2ab05e0-8c88-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701022896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022896, "uuid": "88c0b6a9-bf9b-4085-a127-b89d536b451d", "comment": "Malware payload", "value": "61cbdac94f8dc54e7fd3426549f12dc6", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022896, "uuid": "217dfd88-6e2a-43db-a8e0-de9be1805342", "comment": "Malware payload", "value": "9e0e46f4ca52b1af2a0f5fb9ca923cc44daa97418d20a9db49951921c2b682d8", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022896, "uuid": "3e7c0a2e-d6f8-43b3-976d-94dfdf2e1331", "comment": "Malware payload", "value": "c03cdcea89450655707f93571f3fdbd4cf40c0da", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022896, "uuid": "3b23fc4f-c683-455b-96b2-b57a2a4bb8b9", "comment": "Malware payload", "value": "5453f32cabe23794127eaf687365d7bb7f39a4202bc2b3989234a94e4a8452d8ea03b8d626cf1060921e41dad43a33b8", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022896, "uuid": "7ae73dae-cff5-4713-a903-0f442debd703", "value": "T105141C6436FFA00C71737F912FE9B5D65AAFF7716A2A509D200412078B63D80DDA2B72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022896, "uuid": "5258637d-bc28-470e-92fd-010f140b2207", "value": "3072:nypyZiOnyxyDytynyJyNyXy2yz7Road9G9ZfI14dz0BOWd+:S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701022896, "uuid": "5592bd47-03e0-4829-9949-8949b2a0f7a2", "value": 191002, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701022896, "uuid": "72ab0036-649a-4fa9-a99b-5cfeb6c3b842", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022896, "uuid": "880863fd-3e38-4b6d-a323-f99eda76cd21", "value": "image20112023.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6d2389a-8c89-11ee-8907-42010a9c0042", "comment": "Malware payload (zgRAT)", "timestamp": 1701023467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023467, "uuid": "0e178d0d-8654-4e21-a7d5-38da432755e9", "comment": "Malware payload (zgRAT)", "value": "3216b8ea388bef5a76755a9b791d7a04", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023467, "uuid": "4b41e1ce-c786-4728-9680-6eea9cb1f1a2", "comment": "Malware payload (zgRAT)", "value": "9ff962ea1abec6d716ab51c68b1b2ae818aba00bf2dbf7b4be53d77740cf0f54", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023467, "uuid": "d6cceda5-84d6-4280-b13e-fe4acdc00778", "comment": "Malware payload (zgRAT)", "value": "04524e9f9ba15e4c5b80a70bdf41068d9d11cd97", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023467, "uuid": "83674a99-ae55-42ae-bc10-7a8fb4d1de4c", "comment": "Malware payload (zgRAT)", "value": "6598966b55a69ce72446444e05eeeea6d02b365ca5ad37b22f5b5cadf59db94b9406620059ed22c03edb8851ed23daff", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023467, "uuid": "0c61edc5-a48a-4f52-a68a-0c9ba2763df3", "value": "T1C361D9C69EE4C179532983ABFFD291C1E0425C4C9E50094BE192FCF4B8B29759FE6670", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023467, "uuid": "eec3fb90-54ce-49b4-8a2f-08836d793110", "value": "96:vt7zhy+btmUqq1ZcDCV93VmWe5edCek1+v2yH:Fpy+bMHAmDe9sn5eQD+v2yH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701023467, "uuid": "5cb3a4af-620a-413f-8e60-a18b4ffd2e0b", "value": 3172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701023467, "uuid": "c54eb3f7-2148-4682-8804-906f675d54f4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023467, "uuid": "2fd24750-b67c-4e45-8abb-0f0dd695dc64", "value": "verify id#154565.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10a1d629-8cac-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1701038113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701038113, "uuid": "5b491086-5e47-44fb-ab5d-97e691b28064", "comment": "Malware payload (RedLineStealer)", "value": "a8268535f012dd25e7c65b25808dfcb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701038113, "uuid": "aed1c693-4f58-4f9b-b7c4-9f51dfc6296f", "comment": "Malware payload (RedLineStealer)", "value": "9ffbdda98cf31f4aa119e81af001fb59006c8296625700f488d864cee0e05ba7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701038113, "uuid": "f2feacdc-e8c2-4d62-a717-3d3286505d54", "comment": "Malware payload (RedLineStealer)", "value": "e10772ec2e0b8f41d00f5b599b465887fd0ba01f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701038113, "uuid": "a0c422f6-e7d8-48e2-9cbb-17a43c24aad3", "comment": "Malware payload (RedLineStealer)", "value": "6969335d5a1bfe3e516241995b5b59f025306665e0113cf09eeebc841c55e559dd54f05339d6312bcc1e4b4aba2392ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701038113, "uuid": "bb93006d-9a80-4da2-a5e6-7a4f491f461b", "value": "T1E8158D2178CC90F2DDE220B643ECFA3642ADD4B0072546DF76D95BEED6206C16F36686", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701038113, "uuid": "2df470f9-b76e-4cd0-98b9-f7affc6d8f01", "value": "9484afe6da674c93e28b2a435d059ca0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701038113, "uuid": "89c4aca7-5031-4bf3-972e-d533099ceeec", "value": "12288:JMRpruKN0YWKQDIMppZpcnfw53mw9FDrAQC80JUu1DMJIReK:JMRYKN0hKQDIM3Zu23mOfS8rI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701038113, "uuid": "74a5188a-ead8-48c1-b904-56968551dd23", "value": 954368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701038113, "uuid": "ca90a4d3-354e-418b-bccd-006303f1cd39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701038113, "uuid": "57eaa1e5-af38-4fff-9621-f86bf45f7628", "value": "A8268535F012DD25E7C65B25808DFCB9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44348cf7-8c14-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700972916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700972916, "uuid": "7e015343-468b-4ed3-8033-be99ec68060e", "comment": "Malware payload (Mirai)", "value": "08f82905077d4251e7d65b6f4530ea50", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700972916, "uuid": "41b146d1-93e5-4312-a492-a0e553d1fc49", "comment": "Malware payload (Mirai)", "value": "a1e49546c0f8cebcf639907fa9edfc50c86e2e7bbc1cef639b7427174cdd34a9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700972916, "uuid": "f6c42e53-c658-4b3a-b251-b098040f3584", "comment": "Malware payload (Mirai)", "value": "042cf59aae7d49ce71209621098e2fb365fe8974", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700972916, "uuid": "4e87e731-3bd1-4cfd-9486-4973b03bddae", "comment": "Malware payload (Mirai)", "value": "a75bd2c60edf5cfea353751d50ec5f50b9ed6fa99a9b097005b6f697d33a3115e50fd922174c55744dc1fa7b64215cf8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700972916, "uuid": "5632bdf7-94c5-41d2-89c1-29663379c891", "value": "T10D930905BB660FF7DC6BCD3B0AA4171635DC980A22E97B363634D828F51B25F09E3964", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700972916, "uuid": "754a5034-e5f2-4224-a2f3-53919fa359e8", "value": "1536:H9pR2jvKzviNt+96Z2MH2ZOMF3vERUjm:HzRwv7AkZ2S2yem", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700972916, "uuid": "57d4c1dc-be37-47ee-b562-8357317c5065", "value": 91980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700972916, "uuid": "db064d1f-fe5a-4fae-9cc9-0f1d8e1d3d03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700972916, "uuid": "fb742ffc-6018-4f6d-acb5-9e0c6c8f521d", "value": "08f82905077d4251e7d65b6f4530ea50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aa633d6-8c7c-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1701017487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017487, "uuid": "595eed3b-9ba1-4abf-8eae-c56ae74d1700", "comment": "Malware payload (RemcosRAT)", "value": "b65cc69f005ea9a571046be27b48edfb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017487, "uuid": "c5d7627c-1bab-4077-b950-51d9ddb99e4a", "comment": "Malware payload (RemcosRAT)", "value": "a1f95947c7d421aef77f87b95744c6a93c149e203af906b32b3e6002f3331cf3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017487, "uuid": "ebabd5d8-ac8c-49c5-b1b1-51d56a87e76d", "comment": "Malware payload (RemcosRAT)", "value": "4b3d1ce39b0328a76d52dbada6b554b4adfcdc10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017487, "uuid": "8d65bb6f-5951-473e-a893-556e90bef8ed", "comment": "Malware payload (RemcosRAT)", "value": "711a751cb2f1fcf5af26c770120d778ab757a8ff7cf721b32bd34bfcba6e9085a18affd4f446099a537d8d61a699c1fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017487, "uuid": "deb5d08c-b5bc-4afd-8f50-3630098f457c", "value": "T148052358283CBBABE548C778D16150C893F3F2FF5251EB5B20B1349E92B2793DA069D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017487, "uuid": "02e32cc9-775b-4f3f-b2ac-d8b9c2fe3b51", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017487, "uuid": "9800a915-6829-49cd-ab78-41c21a90d0af", "value": "24576:vFoI7QHt+80XIEh3OZ3IlqhMTgrvtTlrqs/m:9R7WAhOVAgrvtJ2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017487, "uuid": "013589b0-1ccb-444f-a566-d8d58cfb66f1", "value": 868352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017487, "uuid": "31cdf877-18ce-4e88-8a42-a20faee01357", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017487, "uuid": "56fb2753-e7f7-4218-b16f-8b30c99fef79", "value": "ORDER_RINNO ALUMINUM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a144d83e-8c7b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701017310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017310, "uuid": "b7375695-d53a-45aa-8cf2-85fbedebe937", "comment": "Malware payload", "value": "afa1a40a930bf77ab2ea3bda6b69362a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017310, "uuid": "2bc5bd18-c033-468f-87c1-df632942a16c", "comment": "Malware payload", "value": "a2b118ee4c6daafdcb5a7b981b3adf2533964e6fd813a22022c3f2b6bd6bd06c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017310, "uuid": "21d3be05-d6c9-4de7-ba86-1893ea96c0cc", "comment": "Malware payload", "value": "ea79d20dab856ce685824b1b4b5425eab9d3de5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017310, "uuid": "abdff8bf-0301-4077-a58e-8ad86dd70dfa", "comment": "Malware payload", "value": "9fa29e1b628f2608e907aac12983fdae8ab144d2b354f90b5d9804cac0fa76dfec29bec097032a79ce225f5c9d1db7f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017310, "uuid": "050b9b67-b9f8-472a-9503-cb6b7ca10737", "value": "T1ACA63C47ECE605A8C8B5D3B088624122B9307C5C0B6A73DB1B61BB642F377F49E76B45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017310, "uuid": "d8fab2b8-6cc3-42eb-811e-9561ff88b2b0", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017310, "uuid": "6b0c23ab-9cae-42ce-84ff-fdf5fbf0b21d", "value": "98304:XUQc8Y4ttH0KVy7yz9QJIJEGr3EM9v9PJnXfEHhr:/s4/H9ymhQJfJMJXsHhr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017310, "uuid": "4d9b3e3c-ba0b-44ce-a440-5e747762a82f", "value": 9752064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017310, "uuid": "8c4f9758-e487-4a55-9389-994948ca3df6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017310, "uuid": "61a5c2fc-ffa3-43a7-ab02-a54bc234dc06", "value": "afa1a40a930bf77ab2ea3bda6b69362a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e43dc96c-8c7b-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1701017423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017423, "uuid": "e93bdd15-3c94-420f-aabc-75510e7c156b", "comment": "Malware payload (SnakeKeylogger)", "value": "a2cdefaa9027ded0b82f1554c79b3781", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017423, "uuid": "88ba6a7d-5b1f-4b5b-ae24-9d22b2b7bea6", "comment": "Malware payload (SnakeKeylogger)", "value": "a341597a3593fea8c72ae01c56c656eb789ad7f9fc6ab9c4153433ab60066be5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017423, "uuid": "8a2fd022-64a1-4213-b1c4-956630ae1ce7", "comment": "Malware payload (SnakeKeylogger)", "value": "bc2b570e3097fff585f71cb806204b8b527af9da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017423, "uuid": "e013b9d2-10e6-4a1f-8e2e-4c577d211d7c", "comment": "Malware payload (SnakeKeylogger)", "value": "30f125f98a6bca06596e54134e90663e6cd45cdc234921726d3657b025c3ce8d8d5caa9b21e6f463324946a012f56d2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017423, "uuid": "716a5379-5ebd-4b8c-9ee4-f6a889f32f3e", "value": "T1DB358D05B2A68B44F57CC7F440526092A7B47C9FF25DCB8B8DC739DA39B0F911909A2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017423, "uuid": "abd2ce67-8aaa-4e0c-aa10-62523168d8f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017423, "uuid": "6f85626f-8513-44ba-811f-cf122536dd7d", "value": "12288:vHNjzMJr5EPvfCU1oAECJgsdlUgN9Ie4ryagV:PNjzMTW3CmEVsAg/Ie47gV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017423, "uuid": "6dba1895-fc9b-451a-8287-7cb8860953bc", "value": 1064960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017423, "uuid": "35bec8d5-7f2c-4d61-a861-f49985d501fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017423, "uuid": "3bb872db-b306-4b19-a81e-284c3ea56387", "value": "Remittance Documents Claim 1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5883e13-8c91-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1701026820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701026820, "uuid": "2ae7a5c5-44d1-468b-b9fa-b4dd47dd1c24", "comment": "Malware payload (RiseProStealer)", "value": "764fb09b4fb31924e3cd1d4074ab2cba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701026820, "uuid": "c3bcbbda-7f6e-487d-a4ba-24aa960dffe4", "comment": "Malware payload (RiseProStealer)", "value": "a41a9796143c1b66536d9b2966b0ad42a2fa1325b9177522d45685ded29fc25f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701026820, "uuid": "d7fdf115-4d77-4838-a1ea-9ff2215166ec", "comment": "Malware payload (RiseProStealer)", "value": "e70b07e83182f4931dc9d506aaf09aa981633fae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701026820, "uuid": "a8493a67-313e-47fc-ba01-4ac4566000dd", "comment": "Malware payload (RiseProStealer)", "value": "ab90b9c7108bca64c24ba11a8dd8359dc07c2d53c87ba02ad1e48e48628e8d9b76572d53674adc9fb9b2bde9d57a8ef6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701026820, "uuid": "fe9430a6-f932-4040-a958-2879fcb6ba88", "value": "T100658C31FA08D4B6D09210B0916D6A7B91587A322BAF4CD7F3C05E6E41B52D2F235F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701026820, "uuid": "fa83e57c-fabf-4d6a-a1ad-2a4e6d2fe61d", "value": "078471ac5a76189ffe465abe0c89c6b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701026820, "uuid": "2dc6aae7-e324-49a9-bc63-3967bec6984e", "value": "24576:2opGDjnvrPpkjos0OtjcFc5kM49dj+IuxWQOIjuJuVvhbqL0HtFcgekRP9dT0WNI:OnvrPGT0Egyudc4tI3bqL0NFchaP9dTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701026820, "uuid": "adf5b1c1-5cdd-4385-b260-7757dd54edeb", "value": 1540101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701026820, "uuid": "dfd52399-5c62-4c4d-882e-ab7e646038af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701026820, "uuid": "71422d2b-d5b8-4022-ad41-537852734ca3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92c2393c-8ca8-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1701036613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701036613, "uuid": "3624be08-3802-4b70-a33c-f51242b9b0fa", "comment": "Malware payload (RedLineStealer)", "value": "0c3317794f89bcf8c7edf34a6f677835", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701036613, "uuid": "760903f0-3833-4ea2-b4fe-279ed5f925f6", "comment": "Malware payload (RedLineStealer)", "value": "a587d0408130ab936e7084990a6af851172bf0c83e29a31501e0fa2163c49416", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701036613, "uuid": "f12d6c8d-66c9-4ff8-868c-caa54a74bf4d", "comment": "Malware payload (RedLineStealer)", "value": "fb2a18c402356e94db81dc9275c39c54217e6e01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701036613, "uuid": "d5fa1473-1ae3-40b4-b0c6-bc6b55926c90", "comment": "Malware payload (RedLineStealer)", "value": "6bbe7f8d4e6b073fa84a9d727376374437ca1f956c0a3b5fc3fe912570f487183bae57cbf2359a586dc64f7d44449404", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701036613, "uuid": "7e3935b1-7a54-4707-874e-8152c19d9929", "value": "T1DD8533229BC6D412F4B42B704CFF274307363981FEF4A21F2159994A3C225A466BA77F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701036613, "uuid": "c00125dd-b12a-463f-b229-663cb7b02b4d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701036613, "uuid": "212f6f9f-ec32-4c42-ae71-c85c096069ac", "value": "49152:1xUnEGlBfVnSsUaVJ86gdBIqyTgI+SuRbzqY9yhevj4Ri:i/fVLOIZE3dqY8hevjK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701036613, "uuid": "60c47190-2076-4b8e-bf46-ff6dae7fa842", "value": 1771008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701036613, "uuid": "73650de8-cac6-4739-bfb3-f8a97e9fe1ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701036613, "uuid": "53ee228c-359d-41c8-9e9b-693c8cba7c09", "value": "0c3317794f89bcf8c7edf34a6f677835.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f087f4e-8c8b-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1701023964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023964, "uuid": "67bdcad7-fe63-40af-8fc4-7434e062984a", "comment": "Malware payload (RedLineStealer)", "value": "4b8bfbb43c809443216a860d143bc23e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023964, "uuid": "e06ed143-5dfe-4e18-9a88-877f6ad06c4e", "comment": "Malware payload (RedLineStealer)", "value": "a60d986514630be39bd894ab0319a0ed1ace621183f7b3042b3013d4135fd953", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023964, "uuid": "fc134d8f-0d4d-44d1-be04-bd8d2bc23967", "comment": "Malware payload (RedLineStealer)", "value": "67e2e076c9b87fe488ff7d5c43363884207af032", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023964, "uuid": "f34fac19-5109-4f78-964a-ae5d3c73726c", "comment": "Malware payload (RedLineStealer)", "value": "038f548fd65dd6b3e77ba05e48b8b9184851d8845003aff0087ff47284063576927d91ab3338c118fa97cdb41fb8a71d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023964, "uuid": "ac8b7df8-afd9-4792-8c99-b56de8aa4e3c", "value": "T11E74B50392E13E44EA268B729F1FD7EC774DF6508E897BAB12199E2F14B1172C263750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023964, "uuid": "d0c8538e-7df4-46bf-bd75-8bcbe98abbf9", "value": "4c459b08e177ae567cc13290dc63378b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023964, "uuid": "e8d8eef8-6348-4f6d-a930-f0e95ea463a7", "value": "3072:7vkU4QeiJ0cCpeNEDZsCUnHftoBXLp9LeZOg6iP5wBf5XyBk3eFx/RIAB:774QehrDZ5UnHftoL9yGnBc5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701023964, "uuid": "3f1c44be-2269-472c-9b6d-5724dcbcfb25", "value": 342016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701023964, "uuid": "143902fc-3a8a-49b0-9d8b-6a47399ebccc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023964, "uuid": "7cbaa96f-e182-4805-bd3b-a9e55e06d397", "value": "4b8bfbb43c809443216a860d143bc23e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce09c8ef-8c3c-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1700990327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700990327, "uuid": "930a4c53-c1f2-4f3e-8cfa-84e59c8d9f44", "comment": "Malware payload (Smoke Loader)", "value": "868b8f185038654472a6579b9269df19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700990327, "uuid": "79308bfd-79b8-4f1f-a300-12bbf4d20ea3", "comment": "Malware payload (Smoke Loader)", "value": "a647595e7316d00d459c41191fc8169ce5a3cfa357d5a9651b6f870d6e06f175", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700990327, "uuid": "67a177cc-f6fc-4060-a6b3-0c8ac55381a7", "comment": "Malware payload (Smoke Loader)", "value": "1694bed39163d09ecfef89f2876cd3d2eb7608f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700990327, "uuid": "0cbe41d3-d530-4c4d-9e00-51bbdd70c6fb", "comment": "Malware payload (Smoke Loader)", "value": "292114d9e4d7bbe5f59a5a4963d9f9dc9367ef6a8155a6de294a1d73eab1c1365d08e768dcfb6c60b0107f3183699f63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700990327, "uuid": "a6867593-1a95-4b1d-a08d-b21559476016", "value": "T1AD54E50382E13D45E93A8B328F5FC7EC7B0DF6518E49BBA912189E6F04B107AC667715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700990327, "uuid": "79a8b36e-28f4-4a92-8004-dbce958d9b92", "value": "0a0289a4f27045b7c64ea101e69f4d9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700990327, "uuid": "7a476952-b6af-4908-a6a8-6683e69ae798", "value": "3072:DeOMh0OnJpjO/UySoUXw0sIYje/DLKcBeaQ5mUQU8rQj+/:aOc0OJhOcyEs2LK8Hw8t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700990327, "uuid": "69b51a5e-a373-4923-b963-f7dc0a5ed597", "value": 296448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700990327, "uuid": "32abdb69-c0e7-4ae1-b162-cf4c6b1a7fec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700990327, "uuid": "75d640ca-105f-40f9-9459-5dcc0c052af9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ff73c82-8c8a-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701023563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023563, "uuid": "607f5e28-296d-4240-ba52-0dd5597c90c7", "comment": "Malware payload (AgentTesla)", "value": "07c307fc7edf7ce2921621b086678462", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023563, "uuid": "8eb8969e-869e-4f8b-b437-57af5049d26e", "comment": "Malware payload (AgentTesla)", "value": "a6f200ee1842373c552e5538275866428d64db713c1da410156c958fac96b80b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023563, "uuid": "d9f61e2f-e055-4b7b-b99d-d124c0c775ce", "comment": "Malware payload (AgentTesla)", "value": "85db77fce4ce65a286b647de8c07a366cd6b8c6c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023563, "uuid": "d15068be-7e13-4b92-9d2d-55bedc9b46af", "comment": "Malware payload (AgentTesla)", "value": "11d91d01a634a4f84609491f016e8c4ab273780715074bba91e84d501079b1379e9427a88f52c6897e19441a97745464", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023563, "uuid": "1eccbfd0-d2a3-42e6-b10b-4bebccc1cf51", "value": "T1BA0569072344A05CE4A2883A55972EB49460FD0B59D6EB4D21D3FB3BB4E9192CECCF76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023563, "uuid": "243c05de-92a4-4a98-8176-2e97feee90f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023563, "uuid": "0b3fc707-f5dd-4ab8-9f5a-6e8c2dc72b8d", "value": "12288:Ud4ypJ7f+mDXttarruVBDUJvnVhlyGmWKCZNdQ1QLfD/6qaY5aKcq0hBGHWTKH8g:UdDrEhvOuL/6qP0gH80", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701023563, "uuid": "6f8a762c-c81e-4a57-b8cf-a37b4796e16a", "value": 830464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701023563, "uuid": "d943b917-09e9-4cbd-8e26-ba2b0cc4031c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023563, "uuid": "f39fee6c-ed84-452e-8c56-277c6fa8bab2", "value": "07c307fc7edf7ce2921621b086678462.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "628edc0a-8c88-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1701022789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022789, "uuid": "a8e6e19f-d7f5-4805-b1ae-2b0d839e8731", "comment": "Malware payload (GuLoader)", "value": "10b323a9892dc9c29f5d0ef9789e625a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022789, "uuid": "fa1742ea-874a-4048-a508-5d9ffcebebaf", "comment": "Malware payload (GuLoader)", "value": "a717fbd21060889df724d38a8e1b812c0d5a6c13d7f8e21c2466fe8194e8b550", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022789, "uuid": "56931155-c452-4ece-b3f9-97cffaabda22", "comment": "Malware payload (GuLoader)", "value": "6bb28d58a11ce9b6f4cb8c08e60fa51e67601add", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022789, "uuid": "a6af1a43-beda-45e4-b39c-b9ed5fec9aa5", "comment": "Malware payload (GuLoader)", "value": "d65db1f647c0fecfa43bcbefe71a22474f2b3844f49237cb39115c585ba1f70cab19a208690d0d0c54a9d2372f4b2595", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022789, "uuid": "2d47bf8f-27e8-484e-8b6f-a9a227ce78e2", "value": "T121F423153BBD8072E1D10B725DFD2DE75AB0B8553898244B43908E7DAD13282EA4F7BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022789, "uuid": "5a6476ed-c61d-4fee-a0f4-5c66d344788a", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022789, "uuid": "5da9ee63-48b8-43e7-b07f-c37256e3f5f5", "value": "12288:LzOgEfTixSK+Z9kbmK7YjrHW9rczJHvU5Ji/9Xc5uR4sdhSlkas+QkRc8zlv2Hx:PODgFq6YzoJ89XBR4Mog+Qkd56x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701022789, "uuid": "2d614515-82a9-4e87-8461-8aa167801392", "value": 752352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701022789, "uuid": "b25cad46-d82b-4aac-956d-721c52c96b5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022789, "uuid": "13c641dd-50fc-4748-8e33-36804a4ef585", "value": "Ekviperende.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "099cb6c9-8c7b-11ee-8907-42010a9c0042", "comment": "Malware payload (BunnyLoader)", "timestamp": 1701017056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017056, "uuid": "79121fa6-34bc-4abd-b367-c8d6bbe24f08", "comment": "Malware payload (BunnyLoader)", "value": "f00766545f4f322f4afba40ce9dc53fa", "object_relation": "md5", "Tag": [ { "name": "BunnyLoader", "colour": "#99D86A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017056, "uuid": "a50af870-8cf5-4c4d-ac5b-8a8bd4ff99e2", "comment": "Malware payload (BunnyLoader)", "value": "a7e0a91291a53f8ef4012e4c87f1fbadbd607affca8a36c6c3d78504b8d2d63d", "object_relation": "sha256", "Tag": [ { "name": "BunnyLoader", "colour": "#99D86A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017056, "uuid": "840307f8-33bd-4cbf-84cb-830100a29bd4", "comment": "Malware payload (BunnyLoader)", "value": "4709e0f976bf080122532fa6562474f44d06a470", "object_relation": "sha1", "Tag": [ { "name": "BunnyLoader", "colour": "#99D86A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017056, "uuid": "cb28b0db-3688-430b-9b1b-36729f4dc231", "comment": "Malware payload (BunnyLoader)", "value": "1687caece6b654e3b05a0dd40e38308bb4d163345100871cc82ed9717aa7aac2a5258ab2b04cf74442611fe7afc5a056", "object_relation": "sha3-384", "Tag": [ { "name": "BunnyLoader", "colour": "#99D86A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017056, "uuid": "2208a5b8-7bf6-4649-adf6-7dd41b032da7", "value": "T18406068223F94B79F6F74AB44AB96621493AFC76CB11D6FF1570800E08A4AD09971F37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017056, "uuid": "37ea56df-d23d-4401-b30c-beca5a55566b", "value": "8c258f040372dc83a7dc27d4d1112d61", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017056, "uuid": "5a7517c7-82af-45eb-b947-410512a09aa8", "value": "49152:uL0sMIUz+C10Z6a3vTHlqoHjML64q5mHkXHUIY:l0gSHUoHjMLBmMkM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017056, "uuid": "a395f0b9-00ec-4bfb-8b80-d725a85b0c3e", "value": 3832096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017056, "uuid": "65590404-b027-4136-8742-ed24a4361c27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017056, "uuid": "62172bf4-bafd-4e5d-8a76-a8048abc6278", "value": "f00766545f4f322f4afba40ce9dc53fa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07a9bafc-8c7c-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1701017482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017482, "uuid": "6856c06c-ad19-402c-a122-55c0d78c039e", "comment": "Malware payload (Formbook)", "value": "3ffe22a013e6fe337ae90a90315026e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017482, "uuid": "d566ad50-ecdd-48ee-a230-75d832ed3fab", "comment": "Malware payload (Formbook)", "value": "a859df4f48db18bd38614ea1e5bf5aa4f9d32f468ec5deaaff9a254cc7e871cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017482, "uuid": "bc8f0938-9a2d-49ee-9dc3-a7ffeba8f53a", "comment": "Malware payload (Formbook)", "value": "6db168910728d86e38b43ab25ec08658faee5d3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017482, "uuid": "9c2ba95f-250b-4778-9358-4eddc39bcf3c", "comment": "Malware payload (Formbook)", "value": "847e33e545847bf722e2fbdba9f1fcac4685a703f83dd8aa89ce8438a06447e8c46fb81e808ecaac467c239e79467a4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017482, "uuid": "510af3c2-0fcb-4ee9-9a40-5ed0adc404d6", "value": "T1A0D42311422493AFCCD83FFE943D991267F5E41D1EDBEB9B3D95B29822DA7F80400662", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017482, "uuid": "169a2833-6378-4093-89a7-218f7e890d67", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017482, "uuid": "b2bb026e-c8c3-4923-8c88-4111584dfa79", "value": "12288:0boy8oULAWeAK27oDdPC6gUprl63w+PB50IlqhGaxT9XwCd:7FdL+27oDZCOprGw+PUIWGgTL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017482, "uuid": "2da55554-767b-4b98-b00b-4fc41a16decb", "value": 619520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017482, "uuid": "ce2ab80c-24a9-49ab-8d80-6b979973978b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017482, "uuid": "a867c0f9-029f-4a92-ace6-b3d810e90382", "value": "Shipping-Doc-AbXKkQSCbHNKZjk-PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6680d8d-8c70-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1701012621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701012621, "uuid": "59eddd7d-41e7-4c6b-8409-af9faf637d19", "comment": "Malware payload (RedLineStealer)", "value": "a49f1c2617bbfc7d0f2e8ed093bad028", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701012621, "uuid": "7b5b701f-c0c6-470f-b0f9-5e02aa51d5b1", "comment": "Malware payload (RedLineStealer)", "value": "a8f8c8402aacaaa033d3fce1f44a717bdcab7e5375642d82907f17620ac7fbda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701012621, "uuid": "7be7b644-f63d-46b4-87d6-08c3b787a80e", "comment": "Malware payload (RedLineStealer)", "value": "d0080227d1b175f9e2d345da72441673288b6e8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701012621, "uuid": "9cd95456-974f-4d9c-b8c9-506c43a4ef90", "comment": "Malware payload (RedLineStealer)", "value": "806ab1d3ddc5ae06f885faa6ea976c8bff14829961b463eb5d02a3da7369084129568a7f9ad095f3b9f30afe23c83a44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701012621, "uuid": "001eb3b6-40cf-44f5-a512-5c5967077add", "value": "T135A53327BDE88223DD6553B154F359D306B9FC620CF816AE02E0E02A0A735EAF576357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701012621, "uuid": "66d15b6d-851e-4471-81bb-331b07064a0b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701012621, "uuid": "670ff81d-058a-474a-a7e6-55da103407ef", "value": "49152:EhPGdsr7He0g4Va6u2BPjsCG4AdY7ImhdZJ7CS++rpH:6GcaN5CG4bcadfCSLp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701012621, "uuid": "ad0858b9-cadf-4aad-921b-645c83240323", "value": 2213888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701012621, "uuid": "3d1be1cf-fa3a-4710-82dc-3de03d90d6c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701012621, "uuid": "31f0067a-5354-4770-9c42-77486a8031ba", "value": "a49f1c2617bbfc7d0f2e8ed093bad028.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68f00463-8c7b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701017216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017216, "uuid": "c5408c6f-58d6-4ceb-bcae-e0524e678ee9", "comment": "Malware payload", "value": "8f76873b1cbbad9c0817b0f5a7d00293", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017216, "uuid": "d9c8ab2e-07e3-4a3a-9871-53df760d8680", "comment": "Malware payload", "value": "a9bbd77643f15769f4b3fd73b6241af25d73bc4008e1f7768292da35e29e0986", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017216, "uuid": "a44bf2f9-81fa-4727-8fe0-69da0b15f34a", "comment": "Malware payload", "value": "13e2a13525378eb3b98b04b74da0eab3103f107f", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017216, "uuid": "99d5b7e5-c89c-47ac-b9c2-4ec53b1fb5e5", "comment": "Malware payload", "value": "0d33dbb841d52bc27341f4bafc1900de743aaad97fc1654b4cb339837e3fd62704fbde8d30927c104f5fa229f6fc8944", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017216, "uuid": "f5bb5aa9-48e5-4a13-b4ed-c74bc72f046c", "value": "T16A561201B1C5C53AC06F5434B6E9CB76106EBE6D677660DB13C02E2B6E7B4E109B2F1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017216, "uuid": "d762eea4-f72f-418c-9d4e-1f44d68d9bb3", "value": "98304:df15EiL+MIOBQLdOyzfQ2eX3Y1h4EVfdDQ9O0SVdhO2bGvBNrqBJ6QAZCs41YLqZ:dpfKXzfneX38DXDQ9eO2Svued4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017216, "uuid": "dbe1c976-c597-404e-a968-c6920314ecc4", "value": 6313984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017216, "uuid": "bbf1627f-153f-4f8c-84ef-f9de8e76ff34", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017216, "uuid": "4fc21246-21f9-4ab8-9e58-79ac020f74fb", "value": "8f76873b1cbbad9c0817b0f5a7d00293.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30a51903-8c1f-11ee-8907-42010a9c0042", "comment": "Malware payload (CMSBrute)", "timestamp": 1700977608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700977608, "uuid": "0b5b531d-0fc2-4772-841d-8c156524bf40", "comment": "Malware payload (CMSBrute)", "value": "fe049ddd0ffd2df34da564208aff9cec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CMSBrute", "colour": "#9A5433", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700977608, "uuid": "88a6fd1f-1956-459d-b7b8-b6165f4216d3", "comment": "Malware payload (CMSBrute)", "value": "aa16eed6abd2118df6b0670813ae3b9dab59b458bdc76222866c9a9fc0fa1409", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CMSBrute", "colour": "#9A5433", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700977608, "uuid": "0af901b7-09cb-4dd5-ab92-2cdd7f4753da", "comment": "Malware payload (CMSBrute)", "value": "1df42bae63a1698b6070b198f9dceb3ac2b1338e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CMSBrute", "colour": "#9A5433", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700977608, "uuid": "76eb92cc-13c9-4ae0-8b8e-97d8ddbdda7f", "comment": "Malware payload (CMSBrute)", "value": "3919ac19688a0ebaebc8b3dbeda0d349ad63860ac5322de458ce89feedfa16386d3b574c6da1c3fe18499c0c7a894744", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CMSBrute", "colour": "#9A5433", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700977608, "uuid": "22f24d7b-8623-413c-b764-f8043b2c3b0c", "value": "T14895232374E0FC75C4660331DD2CA7DC7BAD78A4AE2297873628BE4E29300B1E567765", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700977608, "uuid": "22bdb81b-b594-4f29-8b94-abeace2e51f5", "value": "26174cd618191e0f458fd2f9d0ece6c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700977608, "uuid": "6e8e3a73-468f-4525-b3da-0c0c551c2b58", "value": "49152:T9+v9qBhn3hRk9XkSxV4QFTNXopKJe8FtU+0:5wqBZTk9X7bFTSphIK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700977608, "uuid": "98b9957a-e136-484c-921e-621bc93f96ce", "value": 1973248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700977608, "uuid": "cb8bfdcc-e828-41a5-b93a-f9142a1aac83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700977608, "uuid": "e7266461-7e92-4893-8bf2-c32e8f19b39a", "value": "fe049ddd0ffd2df34da564208aff9cec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33f9896a-8c74-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1701014121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701014121, "uuid": "2e718f73-2070-4591-8544-7fd68350d7a0", "comment": "Malware payload (LummaStealer)", "value": "aa2dfea9923fe9c71b08f010c79c1183", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701014121, "uuid": "986ba9e6-582a-4a54-b59f-e6c0d7114fef", "comment": "Malware payload (LummaStealer)", "value": "aae25ab3e8475e344f059376788680c1b1a89bdceb57484f0cdd68d440e1ea53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701014121, "uuid": "0ea28749-bd6c-4745-b203-0daec96f83c5", "comment": "Malware payload (LummaStealer)", "value": "4563a860807a9179f7ffc51c77b2c79abe5b955b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701014121, "uuid": "5482903f-c5dc-40e2-bd1d-ff5d3176c2cc", "comment": "Malware payload (LummaStealer)", "value": "96bcc2410ef8222a8e3607e9e60cd18e2d28bd77130852f55c65ec3b4576a6282a3238d162a1d4a8a05ef218e18066b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701014121, "uuid": "20165c21-8b6e-47cd-8d8d-a7dbb2dfa009", "value": "T135850A1176F96B59F9F31BB95ABAA6110C3AFC69CF11C2DF1260548E0D21AD08970F3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701014121, "uuid": "9d67b15f-22b5-490d-9cbb-5f3bf4857e1c", "value": "c7fb2b0f7d1b9bb69de473555ebdc92c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701014121, "uuid": "d7988f67-075e-4cf6-8c93-48db37f08cf5", "value": "24576:CKQx/JIR6FC97GkbnwqA247eUN6a9DhvhXhuW:CKQx/FC97GkbnwP2w6a3vFhn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701014121, "uuid": "4ec0e745-b688-4f27-959c-c7d7c0907bcc", "value": 1794848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701014121, "uuid": "f093c2e8-d9ca-4a24-b58b-8d27f0c03daf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701014121, "uuid": "e2bbd182-bd80-4a8f-9b7c-731d5f04adfb", "value": "aa2dfea9923fe9c71b08f010c79c1183.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8b3e940-8c43-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1700993298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700993298, "uuid": "ccf6b613-2640-465a-b001-65231d2c62bf", "comment": "Malware payload (Smoke Loader)", "value": "7b2694fbd18027cab40a8abc91771870", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700993298, "uuid": "547f472e-1f73-4e4f-9761-8258d6555ded", "comment": "Malware payload (Smoke Loader)", "value": "aae3c6355f071ad180886c69ba02ed8eeb21c4a7731dfd06f8da3f02aa3c89d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700993298, "uuid": "36d8b896-e13b-40c0-88ed-20e66d1294ac", "comment": "Malware payload (Smoke Loader)", "value": "e8b39277a0c4bc60828ca09c98e94b5dfe805c73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700993298, "uuid": "1f49e150-0495-4785-9d17-53028792b7e8", "comment": "Malware payload (Smoke Loader)", "value": "0a1d79209e22a3f498cab628cd9a1d2289e769aad4186d605f81dab6f99c21ca78c944462a1a27de88d7fc75261fc30d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700993298, "uuid": "be234ef3-7e4a-469e-ae70-bbcb343a8e51", "value": "T14454C44382E13D41E9368B728F1EC7ECBB0DF6618F59BBA9121C9E5B04B107AC663715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700993298, "uuid": "a66d6e96-5d28-4d3b-94b9-3d0b4b912ae5", "value": "2982b8e2da4df297bf73bfc93d77b7d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700993298, "uuid": "a5080bb4-55b5-4b17-8058-4920678bf0bf", "value": "3072:aB66tgSde3MJHwDrDegBACPzWeFmH5m/2U9sCQj+b:69tJGp7BA3eFmIL9p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700993298, "uuid": "e9c0e908-dc46-4460-b217-35dcf04a0eaf", "value": 296448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700993298, "uuid": "bc69a8f9-7da8-4ab1-92bc-8132e234a7a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700993298, "uuid": "63d5a139-c22a-4ad1-b3a6-84dcee10f476", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "837f2dc9-8c3a-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1700989343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700989343, "uuid": "08c168f4-76c2-40cf-90dd-5ab6e03e1e23", "comment": "Malware payload (RiseProStealer)", "value": "c7fffbee15d5fb4fafd44c29466adeae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700989343, "uuid": "2becc564-1377-458c-acbe-02ec52bd147c", "comment": "Malware payload (RiseProStealer)", "value": "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700989343, "uuid": "58c441d4-9617-4c4e-aacb-2e7d24e92f4a", "comment": "Malware payload (RiseProStealer)", "value": "3bebc615f1d8777a7e64411d80adaa38b975df2b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700989343, "uuid": "436a973b-d581-4cd6-a3d2-39e6cbed699d", "comment": "Malware payload (RiseProStealer)", "value": "b6b948ff5b5a8117c2d33f262b3ef1d079ef56dd26150a49173bf89615d876704484ef938bfd3185ba7764318c187b6b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700989343, "uuid": "0e499a95-6fc7-4530-b908-1a8499732a18", "value": "T1CC953342A1DD8021E5BD2B7098F6266317763CE2FEB4924B171E992B5E13A40D4F273F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700989343, "uuid": "cb9e32b6-1d47-4fbf-914c-5f01841ccacd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700989343, "uuid": "b83c61e0-189e-4903-9d33-b7eb7758cc98", "value": "49152:0lX35jJPx/Geea4gCofpcglLRDzfnryHF2BM:w3fPx/D3cILRXPmHF2BM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700989343, "uuid": "57996a0a-9332-4737-9ad7-d38bbb8edf7c", "value": 2027520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700989343, "uuid": "0fee309c-5ccf-46ed-b804-562b5cacef61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700989343, "uuid": "14f959e9-b042-4598-b83a-9045cee41f57", "value": "c7fffbee15d5fb4fafd44c29466adeae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "770c9d00-8bef-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1700957110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700957110, "uuid": "eae5670e-dfac-47ab-86a3-f5c1a0f188f5", "comment": "Malware payload (Stealc)", "value": "1bdfbfdae4986adb79324930d7c9eaa3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700957110, "uuid": "258c69d4-994d-4ea9-92b6-c575d7f7a32e", "comment": "Malware payload (Stealc)", "value": "abdff7348eeb504f388224f2d33849eb2b8e661176a3e7c83d00a7aefe8a4cae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700957110, "uuid": "2ac92db4-96e0-4442-b720-100bff62ff16", "comment": "Malware payload (Stealc)", "value": "18476b581144f297d89b7ccabe69cae0b85081e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700957110, "uuid": "da58aace-56c9-45f5-8273-687538ebe9d3", "comment": "Malware payload (Stealc)", "value": "43632a43617ac8fbaf65bdfc6aac6e147500f41d1ee9440e2bf3c33e9ca6d04735b2fb3c925d70ef250e3e1aab7aaa77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700957110, "uuid": "124215a2-af6d-4a0b-9a0a-a5449dcad959", "value": "T10F54D65392E13E44E9268B728F1FC6EC778DF6508F5A7BA932189E1F04B11B6C263711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700957110, "uuid": "5f32dc1b-b0bd-4d8e-a95e-4605f742610e", "value": "32e191367f9932caeeb9bed9a82d73da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700957110, "uuid": "94ea0e95-d01f-4e9b-a445-64fac2cafd94", "value": "3072:98xu5M2SGMFDZW9SYqB75+lymT/GBVQ5mgYvX5kVyBk3eFx/RiPB:Wo5DMiglnM/w5vb+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700957110, "uuid": "560cbc3f-a055-4ddc-a536-998fb365e330", "value": 295424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700957110, "uuid": "b1747f89-fc9b-4cff-82e0-b1bc54e67347", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700957110, "uuid": "73b9cd20-910e-4697-a3c0-77f0c52bc02f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50e25a44-8c45-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1700993983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700993983, "uuid": "f6737de0-a432-4d66-9cf8-0dc92ee94a7f", "comment": "Malware payload (Smoke Loader)", "value": "9fcc32d760be13cd9dce1fe75eff3857", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700993983, "uuid": "7321230f-6188-44a9-9d54-9b7ea5d7c7ad", "comment": "Malware payload (Smoke Loader)", "value": "abe641bc75aeeafd830b88097ed26754af9dbac6034083fe24bd45a93f54b01c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700993983, "uuid": "c9881506-cc68-4186-bf20-24d7ac40c7ea", "comment": "Malware payload (Smoke Loader)", "value": "a731190bdeaa08149822e5d8f7bab89787b29cac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700993983, "uuid": "e35b5ef8-88a2-4910-98ab-c59b7d18cbee", "comment": "Malware payload (Smoke Loader)", "value": "1402dbd563d84afff70bcd6ebe11fad553ddb068ba2456c80df5c2a96a99861c4ef05485328c5632be62b19d67a20b1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700993983, "uuid": "81c7275b-1bb7-4fcf-bbb0-f6af151251fb", "value": "T1F254D50382E17D45F9368B729F2EC7ED7B2DF6518E49BBA912189E1F04B007AC263715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700993983, "uuid": "aa35bd56-1b9b-4adf-8985-4f0ca6b5ba19", "value": "2982b8e2da4df297bf73bfc93d77b7d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700993983, "uuid": "8f99615d-69ff-4790-a5db-0a5bfc74a5ab", "value": "3072:Ns7hOvqqvbXEXPwHgmsv/v1MkT/wEpV29AI3ti5m/IUYkeQj+b:qNO/74mG1Mk7w2V29DtYkQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700993983, "uuid": "fab611b5-321d-4c90-9953-ae695930908b", "value": 296448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700993983, "uuid": "def4a577-355d-418f-9205-1f124fd7a248", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700993983, "uuid": "8b93b829-269a-4297-a4bf-964c56379c74", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0f424b4-8c89-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701023350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023350, "uuid": "17b43d27-6bce-4e66-a4b6-e6478afde220", "comment": "Malware payload", "value": "24d588a1c195344294f51350b853d8aa", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023350, "uuid": "333613b4-24fb-47bf-a8b8-18b84fbdcbba", "comment": "Malware payload", "value": "ae280d0e2156248467f1bb96f3248fde6a8a24ff4c617c51f3e14eacb84ef015", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023350, "uuid": "664c1840-378e-49eb-92a5-8fa1e3a29c5d", "comment": "Malware payload", "value": "ed7421046c86823524e49bbb221e3132d35ca783", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023350, "uuid": "93374f38-7377-4f7f-8107-c77b7fa11744", "comment": "Malware payload", "value": "77454986ff7d8c5896042a00a6493ba69a0a265cafed26d08176d025bfe27ab576d755f874d4c7e85451ccc7edce3623", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023350, "uuid": "020fc3e4-279d-40a5-9bdb-826909e2aa38", "value": "T1CFE4238BA2D3E814C697DE34D92CAA590A71B4B072911D11BF7CF44D239FBB372294E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023350, "uuid": "8d0e0605-8bde-47f7-9bb0-7d2bdda8af07", "value": "12288:BT+oqO2lkeBqhP+aLrof672k/5+6iz0X7vDq287GSM6PJaYDdW87YQECQShyC7jx:BT+3OlThPb6k/bd7Dq287G+hc83ECxIY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701023350, "uuid": "446e1be1-68e1-424a-9631-3b9429e51d1d", "value": 722102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701023350, "uuid": "10f3645b-760b-45e7-9491-5acad9059dfa", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023350, "uuid": "3460dc19-fac7-4470-ab43-aa17c201b742", "value": "PEDIDO2411.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cf5f8a2-8c36-11ee-8907-42010a9c0042", "comment": "Malware payload (DBatLoader)", "timestamp": 1700987641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700987641, "uuid": "ea388968-a70e-46c7-a49d-1be4aa119199", "comment": "Malware payload (DBatLoader)", "value": "f536ccec11f1b6fb95137514ce0e1ed5", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700987641, "uuid": "2384808c-7e27-4e6f-992a-1dc6c23df9a1", "comment": "Malware payload (DBatLoader)", "value": "ae5345f8b351ea82e6d74797baf379bc605c69e079cc5628ab486bf8d4b76b18", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700987641, "uuid": "6fff32b9-3e39-4fad-9c65-d77bd0f8f6bd", "comment": "Malware payload (DBatLoader)", "value": "7dfd07532e6d80d2bea61196fc8dbd9bd1e9414d", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700987641, "uuid": "a4262352-7974-40a0-8ff0-a6362061e82d", "comment": "Malware payload (DBatLoader)", "value": "943fb709a2257f6778a68467352a8a940184e4d69920449800b98fa3d9b6ef4e94eabc2e57292cfdb7095b3135a53608", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700987641, "uuid": "fd1c513e-1aff-4c40-a4f3-f552b68271e7", "value": "T18595E112DE620077E06366B9992AA3519C3A7DA32F1075D66AF43D1C4E7EF843D1B233", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700987641, "uuid": "6be26520-31fc-415c-8916-4f915da0f7b9", "value": "5346a12dcb49c1d1cdae222f054ffa7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700987641, "uuid": "168f18fb-e3c7-45ae-9238-12441ed54675", "value": "49152:bee0SeGwcSGQPOvlzgzRlyYFT9xZdmPSw:blMGNQPywXFJQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700987641, "uuid": "92e2d11c-5071-4ec2-8eab-5f7878829729", "value": 1877504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700987641, "uuid": "200cbd43-89c1-46d4-a412-308fc6a3a8bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700987641, "uuid": "4befb793-4d41-4456-9fff-c340130f6f13", "value": "0097261726716.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85efa21e-8c36-11ee-8907-42010a9c0042", "comment": "Malware payload (DBatLoader)", "timestamp": 1700987629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700987629, "uuid": "4a10eb38-22b7-4818-924a-3757b2712830", "comment": "Malware payload (DBatLoader)", "value": "416cabd8d6419b8509ed3311426277a6", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700987629, "uuid": "a30b115f-acb7-45cd-a9c9-2e4141ae4613", "comment": "Malware payload (DBatLoader)", "value": "aea6835e1d8c9e5ba9c92e9e71d692c6777531fdfaaee0bbcd53d5e36eb2b8e7", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700987629, "uuid": "d3dd5cac-f4bb-44fe-baa8-364e142de616", "comment": "Malware payload (DBatLoader)", "value": "57b68abda0b9ecce8281cf109c3f631aa0799f6b", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700987629, "uuid": "c78ec765-59a5-4e02-9102-a76749ef4aa4", "comment": "Malware payload (DBatLoader)", "value": "332eeb3d98bbd979af238f0654363768017dc1f43f5ec6acdb8c7d810547017b03b1980584fa939ac866849140bfe1d4", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700987629, "uuid": "5614a646-da51-4031-827b-9033b87db39d", "value": "T1A995E062DA620033E013A7BE592AA3615C397D972F10B6D5A9F43C584E7AFC43E1B173", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700987629, "uuid": "f1b99e26-4f3b-4060-b160-0e680796ea77", "value": "5346a12dcb49c1d1cdae222f054ffa7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700987629, "uuid": "af3ce752-8a3b-4dda-ade3-9326d7cdbe5b", "value": "49152:bee0SeGwcSGQfOvlzgzRlyYFT9xZdmPSw:blMGNQfywXFJQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700987629, "uuid": "1601cd58-86d4-4832-91c9-7bd6d3390daf", "value": 1877504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700987629, "uuid": "5410349c-1231-4fdd-81ca-a148e3a35395", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700987629, "uuid": "8ef6040e-1934-4a79-8491-d3a49d7a1ed5", "value": "Summon_From_SARS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "359b7322-8bf3-11ee-8907-42010a9c0042", "comment": "Malware payload (44CaliberStealer)", "timestamp": 1700958718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700958718, "uuid": "dabac8f9-28f4-4644-be87-027f1fcc719b", "comment": "Malware payload (44CaliberStealer)", "value": "e335f71c0f053c393626691bd60a58a4", "object_relation": "md5", "Tag": [ { "name": "44CaliberStealer", "colour": "#9FA835", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GloomaneStealer", "colour": "#C29011", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700958718, "uuid": "b693d33c-6443-4028-986d-9a4ddf458058", "comment": "Malware payload (44CaliberStealer)", "value": "af0c48ca1ed3431b936d489bf1e8255a5d4182bd6164946bd6179ae3f212d0b1", "object_relation": "sha256", "Tag": [ { "name": "44CaliberStealer", "colour": "#9FA835", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GloomaneStealer", "colour": "#C29011", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700958718, "uuid": "5ca61cb8-bccc-43fe-9b79-9dc3a2eda013", "comment": "Malware payload (44CaliberStealer)", "value": "0cc99df70cca24c5f96edf36672ea297fe71043f", "object_relation": "sha1", "Tag": [ { "name": "44CaliberStealer", "colour": "#9FA835", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GloomaneStealer", "colour": "#C29011", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700958718, "uuid": "4db8d9b5-53fa-4f24-b276-580a65724df6", "comment": "Malware payload (44CaliberStealer)", "value": "fa91841a04f103f692fd56411af557cc51d9d47805abecd98eff245bf50b419056f081447d69ada3cabf458a7947266d", "object_relation": "sha3-384", "Tag": [ { "name": "44CaliberStealer", "colour": "#9FA835", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GloomaneStealer", "colour": "#C29011", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700958718, "uuid": "4f1fa182-0929-4e35-a50e-9b8609440de0", "value": "T1C0B63337B1E69D71C57304322FD4A1B43A38BD2657690CE74350B98F8CB8AD2BB2475A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700958718, "uuid": "cd5f9b82-3897-46ef-a39c-ab7ba470c961", "value": "319b1edcc4538be377f43066c635ffef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700958718, "uuid": "aa90f17e-3832-4aa0-8369-6b072698b0b9", "value": "196608:uchhf7FHaM6MkwG2ea8oQoidqpcO49UEahKBXSmLnS0rCqs2vm9EGgy:dvfBdPG2QzoY1OgUEPV7r9s2+9bgy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700958718, "uuid": "53ee937b-e956-4e1a-86e9-283b5876bbe7", "value": 10504001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700958718, "uuid": "f29e6035-9d33-4c52-adba-fa2bdd45dc2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700958718, "uuid": "26fd9337-146e-4f18-89c2-9c8334ac10b4", "value": "RP.sfx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4692937-8c41-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1700992512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700992512, "uuid": "5d301225-0499-45b0-9a91-19316ae9a0c6", "comment": "Malware payload (RedLineStealer)", "value": "ac077209bd27dd51673779026ebfe8b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700992512, "uuid": "c8a62657-c2a8-4d3c-a0ac-3b67953fb4ba", "comment": "Malware payload (RedLineStealer)", "value": "b1fab4e05f980678d6e3acba9910b8b07d422de7b80a5eded0dccf200310be01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700992512, "uuid": "ba463043-ded0-4b6b-b10f-00bb6b852988", "comment": "Malware payload (RedLineStealer)", "value": "ffe5a6347222376473381dc02fb18c784d331554", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700992512, "uuid": "ec333a62-3449-4acc-9be6-ec03ffb31f99", "comment": "Malware payload (RedLineStealer)", "value": "4471f5451b06c6218470a1cd167bd770e00d7105375290cd64dfcc1040f3aaaa9de2dd8c57460235efdc1c6044165205", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700992512, "uuid": "d29a9f0c-1af8-4d3d-9b44-b9d9e1d13787", "value": "T1E8952302B3ECA113D6F53F7088F21B4319367DD2FAA4A55F6345FC5A1E53A60A0B271A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700992512, "uuid": "daf42ac3-8e1a-4514-bcac-a2f786ba02aa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700992512, "uuid": "53791c6f-430f-4239-b964-809a4a2661e8", "value": "49152:qLxwJ50FPyyl56XJzQUpm2FHKHGZ2PNN4wEg5jhytKc/y15:Bgwyl56ZOHGZi4Vg5cth6j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700992512, "uuid": "1748db54-822d-4db4-81ba-7dff5c4a1bb5", "value": 2025472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700992512, "uuid": "702db8f4-2cc1-4e72-b1f9-4d7c5bda6ca9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700992512, "uuid": "042943a1-66a2-4cdc-a8ec-dfb3dd64219a", "value": "b1fab4e05f980678d6e3acba9910b8b07d422de7b80a5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "803872fc-8c3a-11ee-8907-42010a9c0042", "comment": "Malware payload (Arechclient2)", "timestamp": 1700989338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700989338, "uuid": "a5f00e67-d540-4f65-ae2d-755b5c84aa3b", "comment": "Malware payload (Arechclient2)", "value": "b94f666d3875b4d8ad535f1b3348118d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700989338, "uuid": "2a4eabd7-be14-469d-8aa3-a7fce1f96cc9", "comment": "Malware payload (Arechclient2)", "value": "b20090678b857d6b8638ed5db42de49a8be60f8169e6affb12e1a40b1d295f87", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700989338, "uuid": "2daf0b09-d036-45fb-9c8e-3533ad46962e", "comment": "Malware payload (Arechclient2)", "value": "720eb0ca23c35682d01020427c2e6976d0429f4b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700989338, "uuid": "00732574-7ff6-4118-9128-f01ee687d6eb", "comment": "Malware payload (Arechclient2)", "value": "5aa41b7964d834b6b2dcee07d0cf8df6e68ad4b67cb28d2fe974837be96cb6f99e8a5782a691015bdeb375f35ef5c25b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700989338, "uuid": "4c2da9b9-2248-4f40-9f47-ba3ce6321fab", "value": "T15B46BF5B7D760554E02C16B2D0EC669F8B9E5D324CB16B8B66FE3E7C2C37305984283A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700989338, "uuid": "5db88e95-5192-43c3-a71c-8c2d28cadcdb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700989338, "uuid": "bcdce06b-8ff0-4ca8-9369-a8674ac2579c", "value": "98304:xomeCBOW8DXAEarZPBnMZysirXNURXy/NiyW:xsCcW8DXA3rVCcrXNUoNiy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700989338, "uuid": "63624ac9-1220-4c38-83b6-5f550f6263ad", "value": 5577216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700989338, "uuid": "34a1278e-3d98-44e4-bc50-c897c6e99e9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700989338, "uuid": "770bb69c-379d-4796-8b8d-c04f91fa8e33", "value": "b94f666d3875b4d8ad535f1b3348118d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb2260d2-8c19-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700975263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700975263, "uuid": "ca3a449a-ae59-4e7e-88ce-01916dd50ef4", "comment": "Malware payload (Mirai)", "value": "7dc14de6084ccec5b03f3746b7b27ac1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700975263, "uuid": "064754b6-7853-4834-a10b-1d1c9f88cb21", "comment": "Malware payload (Mirai)", "value": "b438ad93cde05e47e01ee5e0f55c73aab265cda7f976b02314a743a3cb07849c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700975263, "uuid": "456afcf7-55b0-4e68-89f1-b241a406d22e", "comment": "Malware payload (Mirai)", "value": "c462121c8cc4ea99554e0ec24b7933f74ccdd055", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700975263, "uuid": "517485a4-1b08-4588-952d-9370a511f803", "comment": "Malware payload (Mirai)", "value": "20c5101a56a08d546ba6c6c1e6db775409e7f2b8f8ca295b9f81a005fe99b9ac5ab18871023c63a824d6928ee6d36b1c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700975263, "uuid": "81be331e-d26a-409b-9931-2a312dbab32a", "value": "T105537D37C82F5D94D404AAB8A0B58F742B93FC78C2132EBA199781E55047DBEF5053EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700975263, "uuid": "8f3e6ea0-91d2-4184-9cf0-fe57490ebfab", "value": "1536:ueI6gKt+kqz1OVLAlUl3tK/nr2lHymECMq8wQGGqZ:A6gKt+kqUVLcwk/alymE5wQGGqZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700975263, "uuid": "b3c9531a-4c61-464e-a060-967dfc21138a", "value": 62856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700975263, "uuid": "a2ead05a-f245-4e3a-b254-af58e31f1971", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700975263, "uuid": "4e0d3761-3629-4ba4-9150-b98250055e39", "value": "7dc14de6084ccec5b03f3746b7b27ac1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bace2fc-8c7b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701017301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017301, "uuid": "81572707-aaf8-4a2f-9942-c336d6ba11dc", "comment": "Malware payload", "value": "3c92db2f3ebf668029fdc4292993cbe1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017301, "uuid": "9ce3649e-3514-403e-bbf3-c8e058c6099f", "comment": "Malware payload", "value": "b486159228630e0fea177062ce127b00be242e7afe55d7a2fca2edcda81100f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017301, "uuid": "e0c9db90-d83e-4821-89fa-8affd712b281", "comment": "Malware payload", "value": "7f1c43a22291617078a99e9582c452a5251513f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017301, "uuid": "51789f8d-95f6-4927-a90f-89db9b207c85", "comment": "Malware payload", "value": "5ecb9b1fb9e6db212a9a84b41f6fe8df8ff11757bbed2b6cc9ac3ea0ded0793eb0525d5d4d7c73d36ef08371fa616870", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017301, "uuid": "b0a98cb1-c96d-40bc-a054-0436e67cf63c", "value": "T1D8C517157A5A5C6EC55AC4B083478BA21A3130CB1B36BAFF41C496343EAEBF46F2D354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017301, "uuid": "3db48e39-89cb-4c33-9bc5-50dc6dbdaaee", "value": "fd4d25833a183d8c1f425ffeadaf4180", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017301, "uuid": "f2472cde-84de-48e0-a5ba-4b796f55bd57", "value": "24576:0z/hHpKYWs3wSciyJAPLBr+ZsxU/PbvCpDROhGdw+WKT6w9cTBK7hpFYhHAfCQn2:0z/XKlewS6N/PbW8C+Mdp2E58lA4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017301, "uuid": "48674887-fae8-43b8-a1bb-2601598dc567", "value": 2714344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017301, "uuid": "9a9e1df1-1780-4e4e-bc9a-38997084f768", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017301, "uuid": "d69347ef-5dc4-44b7-9e42-2db0a3009457", "value": "3c92db2f3ebf668029fdc4292993cbe1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a12d81f5-8c67-11ee-8907-42010a9c0042", "comment": "Malware payload (Zyklon)", "timestamp": 1701008720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701008720, "uuid": "dc32faa6-bc0a-409d-8d04-6212ff21da4f", "comment": "Malware payload (Zyklon)", "value": "a8ee79ff487d9196d01d94f35a3bb420", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701008720, "uuid": "18d8f758-bd0f-4cf5-a86f-c46945c8588e", "comment": "Malware payload (Zyklon)", "value": "b4d51a794626e778a1c7364fd763f8136cfe93502fc04de96b76e4fe3af386ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701008720, "uuid": "bdb451ba-addf-4259-85e9-e14587a27617", "comment": "Malware payload (Zyklon)", "value": "19e2f9ef03baa9cdffc9f72aed2cb4bb7c13844a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701008720, "uuid": "6c7fd9e7-02c1-4bd4-8875-1e789b51c6c9", "comment": "Malware payload (Zyklon)", "value": "cf10ca03ea322ad73901c095cd33278afbaa348921c478ce4317f5b1627d3a361dbccef3709b9461a74ccc7de9354a3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701008720, "uuid": "751492c9-c247-45e9-81a9-63880c685ccf", "value": "T1EB06F10699664F37C2A87F74A4D7442E42A9E6663612FF173E0F30D2AD062349F171FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701008720, "uuid": "39541f10-3d3b-46ef-8b91-19ee9c5109af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701008720, "uuid": "7b08854b-0a54-4ac0-b10f-a092c3b538c6", "value": "98304:0Pe6m3FEPSC/9VC2OKPOizhto9Lf8vhmlZu:0Pe6KF4S8fC2vO4tIfQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701008720, "uuid": "7510a4a1-5398-4f65-ad93-f3bcaca195c6", "value": 3858944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701008720, "uuid": "4b380b10-92ba-4856-85ab-5dbbb265f640", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701008720, "uuid": "31a4e880-ab51-46f6-9f6d-cbfbf293259f", "value": "a8ee79ff487d9196d01d94f35a3bb420.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6237325c-8c8b-11ee-8907-42010a9c0042", "comment": "Malware payload (Havoc)", "timestamp": 1701024077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701024077, "uuid": "c4069da1-3975-45f3-beb5-f129bc07f3ae", "comment": "Malware payload (Havoc)", "value": "1a64418010134059ba9e84dc19451cdb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701024077, "uuid": "656b98f1-5c7e-498e-a9ff-7087edc0a75e", "comment": "Malware payload (Havoc)", "value": "b536fa701c63d883c8b561252e047bfc84e0e20164a8fd39368c1ff36ec4a957", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701024077, "uuid": "6049c0c3-8a4f-4382-86c1-b0ea2c8610e5", "comment": "Malware payload (Havoc)", "value": "2943188ee595673afb1aded627f9acbb07c2e05f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701024077, "uuid": "a2337c03-0514-4792-9f76-bff4ea583ee7", "comment": "Malware payload (Havoc)", "value": "c23bc3a7a45170b616c67394254106f4932a62f9a79aca8999bccaadb04597ebf57db693d9f2a3cfab83656f604bf2f9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701024077, "uuid": "4bf1075b-64cf-4db8-b790-1ac5eddd55c2", "value": "T1B853B816E29374FECCB7C17087AFA137F537B8491A742F4A1B74CB182F51A60256EA08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701024077, "uuid": "2339d073-ed46-49d6-913b-4cc3aeafc707", "value": "768:Tw4oLpFV7YbKcUnrx3EGyKX3kGwRLNIDR9jIxvp8YKKWLlAomotPE9EYOR0zzVqF:TwJ1F9jSu3kGkYKWpAomotgOCH5IZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701024077, "uuid": "d0c602c1-553a-4c64-ba1a-27f5eec756d7", "value": 64000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701024077, "uuid": "df814947-4dfe-4eeb-ada5-0a37c3b84e36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701024077, "uuid": "327eca8e-e3c0-450c-b4bb-25e0bb9e03a0", "value": "1a64418010134059ba9e84dc19451cdb.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5bf4cb8-8c85-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1701021613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701021613, "uuid": "4aae6798-649e-40d2-b08b-7cb88492175d", "comment": "Malware payload (GuLoader)", "value": "f500660b60725c739dcd5118d09a8253", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701021613, "uuid": "e97ab5e8-2aec-468a-a6c2-78bd9e7f91a2", "comment": "Malware payload (GuLoader)", "value": "b6c32db5e9a920c9675c3203d7b14ade688fe89bb495a045d2ee79f12dd35a31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701021613, "uuid": "fcb8270c-15b6-4648-a303-a8807e09c18b", "comment": "Malware payload (GuLoader)", "value": "5574e1318893c5b4c2184ea591a9098d5db556b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701021613, "uuid": "861b358f-fe22-4f5b-9c3a-a8b0a4817fbe", "comment": "Malware payload (GuLoader)", "value": "d214965fc8fe3bb16d026e17b4a7f57946e3716802788a6d33cc90894ac1e31cdb922eb57072b61faa1c4ff742171595", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701021613, "uuid": "50262bc0-b395-4cf1-9edf-4d65a49df4bb", "value": "T1A664F11D3660C4EAF88A83755B366B0B09EF680312420D1733B1A7B96B397D3CD5EAD5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701021613, "uuid": "a9c98bb7-4015-4719-a22d-fc52e47d8fc6", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701021613, "uuid": "3b2c22bb-e547-4cf6-b295-e41ea0cdfec6", "value": "6144:LT4DtTlmkDev3zsa8jacQT7U8xCTLywhcUFBUEBErgLgyL4uvI7Cx:LTcFSwZjtM7U8cLXFOEmE30uvZx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701021613, "uuid": "e62f5c71-a7d9-4d6b-b578-c35efaf105d2", "value": 335096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701021613, "uuid": "e52b36fc-5e40-479d-87d7-9c66f7c12c55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701021613, "uuid": "bd5c9448-b629-43ee-a0f9-7d01576436fb", "value": "ORS51123MQ90EI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "556e2b76-8c92-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1701027062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701027062, "uuid": "7d5d3b15-91e3-4140-8180-fd4e702433e5", "comment": "Malware payload (RedLineStealer)", "value": "45cee4ec3643349ffdf7395f7b4a5b3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701027062, "uuid": "539f56bc-a8bb-4581-98a1-566dfd82301f", "comment": "Malware payload (RedLineStealer)", "value": "b882d2fa75dd429d2366009bbe68c3bf3910cc54bce8a1b6e3ec56f8cae11775", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701027062, "uuid": "7a38630c-50d5-4487-8a79-a5280a2cb78e", "comment": "Malware payload (RedLineStealer)", "value": "26774d3f71bb03f94588b04e9bd8926fc87c6653", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701027062, "uuid": "f53fa9fc-7371-40fa-a3d6-7429074841be", "comment": "Malware payload (RedLineStealer)", "value": "3ead676e408f6ceb2c715b73afcfce2848c3098be0fedab43e9300304b1d5c9f9fa77a8844482e790f95b855a966577a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701027062, "uuid": "95eca732-28ed-4024-8ba7-58bcd2cd98b7", "value": "T1AF65F132F2F14637E1331A789D2B56BC592A7F212D3854862FD86D8C5F3A791342B293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701027062, "uuid": "1a67049d-b700-4f64-89cc-806324a53e7a", "value": "073577fa717a5d9f152374e9e2eb34c4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701027062, "uuid": "079ab992-6408-4b30-a185-9b7f080fff34", "value": "24576:n5hGigbZWG8Srp651ZFL3XVTLcx9+WrCkF2gNCs46sL3f:n0SYP+cRF2gNlsD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701027062, "uuid": "b022953e-3e1b-47a4-8c39-90f9233cd557", "value": 1457152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701027062, "uuid": "9c5a3f50-837d-48d5-9bab-324ecbe445be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701027062, "uuid": "3f827a08-9e4f-4971-9afa-fd33e6aecaba", "value": "modest-menu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c318168-8c8b-11ee-8907-42010a9c0042", "comment": "Malware payload (Arechclient2)", "timestamp": 1701024120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701024120, "uuid": "a18cfb6b-f850-41ec-8cee-fbd03a6c08dd", "comment": "Malware payload (Arechclient2)", "value": "36bd43b2792ce1ea475f91074eb2ef61", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701024120, "uuid": "8da0f5a1-727f-4503-b3af-4439d0f22422", "comment": "Malware payload (Arechclient2)", "value": "b8a0f9eb3dbf5e78c15777915fdb57b44748c1ece2d1c0e89cc2da8706ef7e16", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701024120, "uuid": "229ef12c-903e-4df1-bb2c-58dd526c88c7", "comment": "Malware payload (Arechclient2)", "value": "5cec1de19dc29bdc5b1e8b1b407df49bcf570fa2", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701024120, "uuid": "e5532b13-c98d-453e-b571-726b2c577c7e", "comment": "Malware payload (Arechclient2)", "value": "68d601638df3eee894acdba0e4a0dcae653477fa407c5fff7b8b76d8c78b6c1c10d97873ee741a6671b2b6a66393585c", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701024120, "uuid": "9c714e5f-6ca3-4e2e-8e64-18ca5089d650", "value": "T12E56AE493DBC0B50E02C1A728CED769B4BE95C1E78B1978BA3BE3D24CC36351597187A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701024120, "uuid": "010dd352-0e9f-48df-b77d-be1e3919c319", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701024120, "uuid": "1c8997a1-7053-49e0-ae48-506f4b24d51e", "value": "98304:HbJtyoEqHYztcfN3Ks24t5TPC3oRdZci:NVBHEtcfBKKDzZci", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701024120, "uuid": "4d366d9a-cfdd-4e6b-ae6f-6b90ca1fad28", "value": 6129664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701024120, "uuid": "0f11be31-58b8-48c0-9e03-d934e7202307", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701024120, "uuid": "84643ee8-4d3c-476c-8791-3d87574f34e2", "value": "36bd43b2792ce1ea475f91074eb2ef61.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a89933ef-8c6e-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1701011739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701011739, "uuid": "8ad77cd7-c541-497d-8491-47e1bc0c14fb", "comment": "Malware payload (LummaStealer)", "value": "cd1885231cfb3ba5df62d4854163a021", "object_relation": "md5", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-123", "colour": "#2ACF29", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701011739, "uuid": "2bf55dff-7bf6-450d-a0c3-cae59ead1b16", "comment": "Malware payload (LummaStealer)", "value": "b8c5d73c81fa2c8b48cccb02e99393a3f07fb20344d32afaef03c07d731ef9a7", "object_relation": "sha256", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-123", "colour": "#2ACF29", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701011739, "uuid": "05321612-f800-4cb3-b164-958a2386fbfa", "comment": "Malware payload (LummaStealer)", "value": "dfb3f8ce87fa65baff06b9b2ee78e9476569c77e", "object_relation": "sha1", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-123", "colour": "#2ACF29", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701011739, "uuid": "1e5e119b-7f65-4f98-99e2-7e3ba644e417", "comment": "Malware payload (LummaStealer)", "value": "af115e7ebc1787cac8477539b98484ad0c5298b8e4415dcd63928dfbf51325679990d588dda6789af6d45212e12d8a4e", "object_relation": "sha3-384", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-123", "colour": "#2ACF29", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701011739, "uuid": "d2f562fb-718e-4129-bff8-5e40dc791186", "value": "T1A315335B2B5AE5D6CD264BF68224843121B49EDB3459330C5F7FEC029D96C730B3B25A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701011739, "uuid": "4b1094fd-e56c-4fd6-aa0e-a939485ca0d8", "value": "24576:kRULXKhv/tCf5000wlSHE0sE6dCSQe1MXgSgn2WrcBx:keLX8tCff0wAH2E6dCX4mgNU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701011739, "uuid": "68392215-281e-4f36-861f-1ff26ef13813", "value": 907227, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701011739, "uuid": "17522cc9-c3a7-4625-bc5b-e11ca6314401", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701011739, "uuid": "e324ca7d-0f6f-4802-8fa0-b393b381e755", "value": "ZXCLOADER.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c2da9b5-8c84-11ee-8907-42010a9c0042", "comment": "Malware payload (CoinMiner)", "timestamp": 1701020926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701020926, "uuid": "61d1cb20-26a8-4300-acb6-79cfaf95f119", "comment": "Malware payload (CoinMiner)", "value": "16da48c2144fc7e3a9d7938816d1cb56", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701020926, "uuid": "a13989ae-3dc7-46ff-9b15-bec555a178bd", "comment": "Malware payload (CoinMiner)", "value": "b98c6b42626a0f6fb1a010abe70a32e9e5a71ac06a7905c14269f3471737c81f", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701020926, "uuid": "974efabc-1233-40ff-aaff-b619cf98f51c", "comment": "Malware payload (CoinMiner)", "value": "c3842182420aaa61e99561575e788d9188b75c12", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701020926, "uuid": "0f539a0a-df2d-4ab9-84a6-0441bb6c198d", "comment": "Malware payload (CoinMiner)", "value": "3c70d55c7c02ed00e77bd585e6f50a6ebdde809b690151d31aef2e664ab64d3c0490955c615e9dc8c57e2aa42280a68d", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701020926, "uuid": "79cbf09c-7701-40e6-ab86-35036894371e", "value": "T1CDF5332D205FAD27DB0D74BCE2462AD4612053F0ADFB9E7DA18EA8C18D3347B19F6458", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701020926, "uuid": "ba463178-1383-4c94-9c7a-dfe8a6946759", "value": "98304:JQXXV1Czo7h5mBxXoT/b+t/b1JbKtOrxzjHrdK8Dr:K1T8sb+t/bXbKtoxXVn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701020926, "uuid": "72ac677d-1c74-40e1-a465-d3b731952926", "value": 3413272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701020926, "uuid": "aa4d1778-ae09-4726-ad7f-77ec745beda0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701020926, "uuid": "a162d250-a0c9-43c0-b43f-848f9a688702", "value": "SecuriteInfo.com.PUA.Tool.Linux.BtcMine.9999.5965.11737", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f57c6385-8c3c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700990393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700990393, "uuid": "50618b08-41a6-4abc-9bb7-0333dea97f82", "comment": "Malware payload", "value": "7ffe1bbba11e6467b2a5a71c66515e9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700990393, "uuid": "5baba1b5-cb3a-4f49-962f-9d4f7f94922b", "comment": "Malware payload", "value": "bbed1847ad3f8247067a8b4d6c36b149445e526963c153cbf1e03dba455c7d3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700990393, "uuid": "d44118ce-e53f-4761-9c95-a5319a250677", "comment": "Malware payload", "value": "464e04728e65b06d2f39d851b8d99c1e1f670e8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700990393, "uuid": "9b993096-29a7-4403-bf13-4fc8c93e539a", "comment": "Malware payload", "value": "7021f567cfc71cbf1ea6e476e7116148f266ef2a1903727e8555c3c2e6db35cfc457849d1aefc04958334abed7b27f1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700990393, "uuid": "3d0d9a14-dcab-4513-8810-715291813809", "value": "T17ED5BE90FB46C472C1015530A0B6EB69C665BE56ABE686AF32503F3CFE75382385C35B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700990393, "uuid": "6ed9bb2c-4d5f-400a-95eb-d6fa7edffe11", "value": "eba6ea3eb54d77d517181e99ff8c9533", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700990393, "uuid": "9c8bb38f-4b1e-4aaf-b46f-71063c5c200d", "value": "24576:/t88uuR93NONX7SmiD+q/UT4GMTa/KgE9j2qwkc4TfgaQaYWX423IQ2Lc6ra70yW:haQO4TTa/KgEUq5ToSVItLc8awm7/m7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700990393, "uuid": "5947fc3a-96d5-482e-b52b-5e00aa960906", "value": 2986496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700990393, "uuid": "1705fd9d-8465-4604-9c22-a20f5072035c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700990393, "uuid": "ed88dee3-6c1f-4d2e-bad3-1efaa6a6a781", "value": "7ffe1bbba11e6467b2a5a71c66515e9a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c5aaef7-8c85-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1701021543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701021543, "uuid": "d2fea736-d99b-4aae-ad96-770bf7cc69a6", "comment": "Malware payload (RemcosRAT)", "value": "9257d0559280d38a0d848dd237101a6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701021543, "uuid": "b7551882-edcc-48ac-a61a-b76b7b0e8874", "comment": "Malware payload (RemcosRAT)", "value": "bd4d24cb135194ab4f43d8b8d93ea81b73dad049a686577eb385a00195e69dbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701021543, "uuid": "470223bd-5470-4d73-9f5e-6a922aa09c11", "comment": "Malware payload (RemcosRAT)", "value": "2cf0051b2a6ca85601edc9d51941c9baa3f5245d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701021543, "uuid": "e54447fe-91ec-47ab-98d1-9671af7a178f", "comment": "Malware payload (RemcosRAT)", "value": "3d1fbaf3fadf5d3b915e209e5950030369e5a8df26932d4d95f0136b0118a7664a2d656a8a73356d93f783b8d67265e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701021543, "uuid": "7dc44fd5-8e03-44e6-9ee6-f48430582f9a", "value": "T1B625010036B8AE27CBA502F8476261AC7BF53D2651A1DBF91F8270DEB4F0F745619A07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701021543, "uuid": "f281fc16-f7ad-447d-9f01-fe624147887a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701021543, "uuid": "5dd59d23-5532-4adb-a508-c7d07c42b455", "value": "24576:y7qjCdQf0EQZga+93tAI5oGZSiPxEASN:y73y0EQZn+93tAoZRp0N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701021543, "uuid": "b51ab590-8a09-4a8d-87d0-1c5891db170b", "value": 1057280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701021543, "uuid": "175fa79b-3d5a-4eaa-aba1-9958aa4841be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701021543, "uuid": "e15c4201-21ce-40b0-b412-eae7c498d9f3", "value": "Maersk BL 208268807.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "090f9a32-8c7c-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1701017485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017485, "uuid": "bdc3fa91-915f-42ee-92a6-4d2269e3237b", "comment": "Malware payload (Formbook)", "value": "afa8536f242b8c42045ee02d03bef4bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017485, "uuid": "f5176ed6-6107-4d31-aa22-e166e1b9ada0", "comment": "Malware payload (Formbook)", "value": "be50ecdddf0589ae6dd2b3d8c089ea1382a5ce29053693f12fea2c551c6b379e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017485, "uuid": "adc595b4-20ba-47d3-974b-0acab2184f53", "comment": "Malware payload (Formbook)", "value": "89c417ae45d98bdb9a770a2009002bff19c5d326", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017485, "uuid": "3ab6efa2-b6d8-40bf-a59c-07a254f288bf", "comment": "Malware payload (Formbook)", "value": "b03a0fb94d827414332bb987376421124bf481a5f1d0fdd924e56bbf3c540dc0b620d02fdf72590aba0e3b1ac0fa753b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017485, "uuid": "6b404b5f-7041-40cc-b284-02d71359ed19", "value": "T162C4234117FEE39EDD2FEEB0825803560B79729860E6FD5D96D370B70A32F108691E26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017485, "uuid": "a7693057-2b6e-43df-af38-7ca62fc842c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017485, "uuid": "f24a627f-dd10-4604-924c-7993e5294da9", "value": "12288:ty8o1EOh1zEPE8l3O5R2f2ptzyzIStHBBij0Y:tFKEO1Au5RdtuzJh00Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017485, "uuid": "ce3c66b1-2be7-4f22-8c82-029e4ed0252d", "value": 550912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017485, "uuid": "5d0b12c8-d230-4714-8fc3-a490a77a9bba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017485, "uuid": "6edc6b07-d187-4964-8a59-9c92e697f309", "value": "afa8536f242b8c42045ee02d03bef4bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f117015-8c7b-11ee-8907-42010a9c0042", "comment": "Malware payload (Vidar)", "timestamp": 1701017307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017307, "uuid": "81d32bc8-e0c1-4815-aff4-4c4434e4fcdd", "comment": "Malware payload (Vidar)", "value": "2771e660879c3f1778dcd6eee859a6cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017307, "uuid": "463e96d6-7961-4b6e-802e-75f8f35327d2", "comment": "Malware payload (Vidar)", "value": "be6ccb52a142256dab2a53a95c87ebe958182924ca28829725beb4104e8b0b6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017307, "uuid": "b3501589-ea5d-49cd-94af-c7574add54bf", "comment": "Malware payload (Vidar)", "value": "6edc195a9dafb4229fa0c0f87edb2559ffdfc0e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017307, "uuid": "a2f76e4f-bf5d-4fea-aba6-5dd769201f8d", "comment": "Malware payload (Vidar)", "value": "bd51ea87f1ed7320af22cf4111f56ba0ddd66cf71bc9a39ce1196aa5cea4d21699953daf1eacbaaa42235789ee2543bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017307, "uuid": "c1c174da-cf17-45df-af8d-625c627be817", "value": "T151F22A237DA6C0F5CA1A1730DC3A6B6EC2BB7D661B32172777A07F691970591BC0484E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017307, "uuid": "445b6dfc-eafb-40a3-aae9-6d753301474a", "value": "9cbc271e34e96d3433f0062f5d29a4a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017307, "uuid": "1b59149e-3aca-44c4-8807-47bb13887a88", "value": "768:IfZzOgC/sqW30OmxEGJt10VxODw8H2HhDBqII8QOeO:2Bq9Oo7Jt10VxODwxDRQy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017307, "uuid": "5164dad4-1b8b-4098-bbb5-023780ace01e", "value": 35840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017307, "uuid": "99d1b89e-1881-4529-86c0-523241edc606", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017307, "uuid": "25126abe-3bae-4665-bb31-71e50e15bf72", "value": "2771e660879c3f1778dcd6eee859a6cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca9c38a8-8c12-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1700972283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700972283, "uuid": "97048678-df16-4d0d-91fe-dcd39d416c81", "comment": "Malware payload (RiseProStealer)", "value": "789fcea44ad14d205ae8bd5cb4771165", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700972283, "uuid": "9096ce50-6c51-45ae-a6b7-3114b7da28be", "comment": "Malware payload (RiseProStealer)", "value": "bfc639641083133c764bc592c9ca35e68fdfd25efbe2b9c8861424d06935c420", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700972283, "uuid": "769fb58f-00e1-4cc7-a470-5da783a4f230", "comment": "Malware payload (RiseProStealer)", "value": "16fd7e1179843bd519419a957dbc51ccf9dde2b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700972283, "uuid": "0c460b18-abef-41a3-b337-2888d2e3f985", "comment": "Malware payload (RiseProStealer)", "value": "cd784535c249995f3d537c5d705f52798ceb900da796f680ec4183937ce836f433c0d23100c596cd551dbb5eeb6cdb69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700972283, "uuid": "27e55b36-d49f-4039-91bd-a53374cc3ab8", "value": "T1E1658C31FA08D4B6D09210B0916D6A7B91587A322BAF4CD7F3C05E6E41B52D2F235F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700972283, "uuid": "b63f1a55-38ef-45b9-b290-5ce7c5cef360", "value": "078471ac5a76189ffe465abe0c89c6b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700972283, "uuid": "cd1f2961-e456-4136-9387-6640f43fe3f3", "value": "24576:2opGDjnvrPpkjos0OtjcFc5kM49dj+IuxWQOIjuJuVvhbqL0HtFcgekRP9dT0WNI:OnvrPGT0Egyudc4tI3bqL0NFchaP9dTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700972283, "uuid": "9539ef84-6bc2-4b21-a111-e1b021e23651", "value": 1539791, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700972283, "uuid": "95090d8e-766a-49ca-a67b-cbe71fe7c084", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700972283, "uuid": "a18192a7-e39d-49f2-b1c5-b8bb3a9f53c4", "value": "SecuriteInfo.com.Trojan.MulDrop24.22194.30727.8207", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "894b7910-8c93-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701027578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701027578, "uuid": "a6756531-fbf2-4486-8b9c-566e4841bda1", "comment": "Malware payload", "value": "a68b6f25de9068abe950f07cf1830c8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701027578, "uuid": "acc633ae-2a70-4d26-b81e-e8ffc386c8fe", "comment": "Malware payload", "value": "c11ccf6b28e360183fcbba9909fd17227787a64c5a841730cf2036a59f2816d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701027578, "uuid": "3b5af234-c8f8-4d27-9640-fd403bc225fa", "comment": "Malware payload", "value": "fcc15b83117a4d139bc7f28d50b6bc0dc2b61fd3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701027578, "uuid": "ed7939dd-eddd-46a2-bb8e-83d433309f15", "comment": "Malware payload", "value": "2fc0c8812df159d20397211daa55d1cf320b01be0d2a49b829b545db0682c1691d318b59f50f9953286ecfafd5fe8c4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701027578, "uuid": "51fb9a3b-c624-4b0a-99a4-ccbcfb062a2f", "value": "T17054E60392E13D41EA364B728F2FC7EC7B0DF6518E59BBA912589E1F04B00BAD663711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701027578, "uuid": "37bd49b5-bf3a-46e9-b264-0c7bc61f66e4", "value": "1c1cf4a921a5454d88be29284face39b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701027578, "uuid": "444e81eb-b2a9-480b-b23d-7e80c7497075", "value": "3072:fftM4J2ooluvoUnfSUfkV09x6H6Iqd2X4cWYd4UjWZzQj+Is:f1M45VvoUn7I09ULqdC4cvFiZF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701027578, "uuid": "3b1727a0-86bf-4c52-8c61-6846b240b0ae", "value": 299520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701027578, "uuid": "5ef3908b-b986-428c-a6f1-755cfd0f9ce8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701027578, "uuid": "9f35f242-5341-4a1b-9fc3-1ba8f5204ed4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47c23ef8-8ca2-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1701033911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701033911, "uuid": "7ed32a40-6adc-4dfe-8379-30f1ea27bcc6", "comment": "Malware payload (LummaStealer)", "value": "b83877f76dfaea75355ccc2ccae94201", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701033911, "uuid": "cd767bb9-17dd-4801-8a4c-f58840039a75", "comment": "Malware payload (LummaStealer)", "value": "c2af3e3e623297ec90c6c5afea6b0ee2107697e9c0bdd370f5ecd615c68b4115", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701033911, "uuid": "87706935-c532-4d85-8b6a-d47e634c4d73", "comment": "Malware payload (LummaStealer)", "value": "3067c934fd623e01537299735ab56e4831cbd224", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701033911, "uuid": "7b89c3d9-da6b-469e-b5a6-25160243d6bb", "comment": "Malware payload (LummaStealer)", "value": "dcabb045b10c64c02e7f11e756d8116949a4398101adb40a875db5621e932c0b88671aba12bc4bc1445dc0965dc00a7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701033911, "uuid": "03656eb0-564f-40d5-a96a-498dbbcd6bec", "value": "T1E4853382B3ED8062D5F92F7444F66BA31A347DD5E960E7222315E54D6CA3E24F07232B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701033911, "uuid": "51002dd1-b83b-428d-b92c-32ed8c421376", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701033911, "uuid": "a95a6273-8732-44b1-95dc-3c37a3826646", "value": "49152:TUcqeGrQsSKZRPeiu9RIRODqE4KjjguSPbi4N:zKrCKZJhhE4KvUDN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701033911, "uuid": "44d35fe8-2520-4034-bc01-8ed971f17035", "value": 1771008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701033911, "uuid": "e72f2948-1921-422a-8853-ecb3f272e93e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701033911, "uuid": "05db6409-cd7a-4afb-bab4-8b6ccf696e8f", "value": "b83877f76dfaea75355ccc2ccae94201.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77edc03c-8c1b-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1700976009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700976009, "uuid": "6eeb8d96-cfa3-4e3d-82ca-e42c0c0134f0", "comment": "Malware payload (LummaStealer)", "value": "173d9aaaa9a62a689354ab9fc47c051e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700976009, "uuid": "4217070a-9490-4275-a108-eb6c68f01c54", "comment": "Malware payload (LummaStealer)", "value": "c2c2d2f8153ffade74c03bee326711a603e1dd8de071b5b0ab63e40fd1d40a2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700976009, "uuid": "ffbea4d6-b013-49a2-a3b5-3019e3536243", "comment": "Malware payload (LummaStealer)", "value": "5adc6972ca669eba979982b88db216b4d11a264b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700976009, "uuid": "f7b75aa9-0de4-4177-8e27-fc636b64019b", "comment": "Malware payload (LummaStealer)", "value": "27cd2d576754ca067150208af7126f43db6f728da7d4b3342f00fc4661ea13e7e372884a4e25badf1c285ae573e35f29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700976009, "uuid": "78559ecd-cc38-48a1-81c3-2b9af04279dc", "value": "T111E629C7F85140E8C0A9D37486665263BA713C995B3027E72B10FEB82F36BD4AEB5354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700976009, "uuid": "8ede9101-61a5-418e-99dc-323ed33e2394", "value": "b2e121c8fb86c781c89c83ffff7fe337", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700976009, "uuid": "3379d58e-922e-4fab-8853-5cba24e19dfa", "value": "98304:8qNld11RlyRzM7hNNxFk9kBCxBA7llFlaDyjClzmEmoGBc0jxozQ:8/J27F4A7eDykmoGqhzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700976009, "uuid": "2fe45a63-e389-43c7-bc39-e95a7d92a8f3", "value": 15030784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700976009, "uuid": "47ee1ac3-5781-49a4-842a-84f1080277e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700976009, "uuid": "b4c357cf-6722-4f93-b1db-7425f5e090b8", "value": "173d9aaaa9a62a689354ab9fc47c051e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7db83412-8c7b-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1701017251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017251, "uuid": "ccbac23b-7589-427f-b731-0ea731d12778", "comment": "Malware payload (SnakeKeylogger)", "value": "fc35e8f4e686768edb5ae42d7f1eddda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017251, "uuid": "9c565b4d-107b-471b-a828-37c0405eb4ce", "comment": "Malware payload (SnakeKeylogger)", "value": "c31c83c9e23f1b9a0d3713b99447efad083e2043bb0ba78e9edf2bf5a4fc3290", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017251, "uuid": "74bb7212-8faa-4ca8-a0ef-4cfc4abb941d", "comment": "Malware payload (SnakeKeylogger)", "value": "f402d39a62d3ef28a685d728216b863844187e74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017251, "uuid": "40904ef3-7b93-42df-80d5-41c2abcdb6a3", "comment": "Malware payload (SnakeKeylogger)", "value": "771613213150879ae1603b9be9a5a75e883a6fcc3f4fc4a0f70bea403b3a8cfe91f8438134bed41182ca5f113e21e68a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017251, "uuid": "b464922a-7fac-4f4d-9f2d-b9b75d913b1c", "value": "T100358D04B2A68B44F57CC3F840526092A7B47C9FF25DCB8B8DC779DA39B0F911519A2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017251, "uuid": "7cc02a84-e5df-479c-a205-516b462f9f56", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017251, "uuid": "ffc98514-f3d8-405d-b906-a084680517b1", "value": "12288:O2PSzMJr5dqNVhQSGqMysoE3oYz+SRU0rH6PF+5JQyagV:NPSzMT0Nzs2t0H9OgV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017251, "uuid": "f3063599-977e-4c4c-82d5-e8fe44242e84", "value": 1065472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017251, "uuid": "9728f55b-c5c4-495e-bdb6-aa5eb111006e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017251, "uuid": "159d29c0-367b-4867-8e0d-62870ff0900a", "value": "Product List 62994721598.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ee48029-8c7d-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701018058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701018058, "uuid": "56ea6a1a-b5d1-48c9-bdea-685f74449ae5", "comment": "Malware payload (AgentTesla)", "value": "dccb7779a1ced7b8c1b0274c527daeb6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701018058, "uuid": "b94ae8af-1e2e-4754-a7cd-68db9788bc5d", "comment": "Malware payload (AgentTesla)", "value": "c42c37c46206d1beab2ca15b75af8b1f8b9c0ace15155f8ce934749ca05ea250", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701018058, "uuid": "62d81f3f-de6c-42cc-b882-75b585856bae", "comment": "Malware payload (AgentTesla)", "value": "cc4c4fe4e133e654f06a3587cb0f39e32f7cd8ab", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701018058, "uuid": "42a1e9c2-e3a9-4600-8dab-13d9019eaa9c", "comment": "Malware payload (AgentTesla)", "value": "294bf6578bf67fcf521a367cb1a0365d7752849bdadd0a821c527539c3e376cb56a1459e08d824ddc8cd7de4ffd322f6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701018058, "uuid": "b1460f6b-6c1c-465c-bfbe-8f61f4cc35ce", "value": "T13CD402D27116DDF7C8060AF14925E66102F61E1E94E5D10F38FA7E2F76F23622852ACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701018058, "uuid": "9d6f95cf-ebb1-4e58-a519-73c18aab951a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701018058, "uuid": "3feae1d5-ea3e-4338-bdda-640358e22c26", "value": "12288:jzY4JyS7t9CqZsFVhDvzuJSgfvZGnNoKeProTGYB4llcOI+1BDEAmD:mG1mhjzuJ9pONLePrHlmaD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701018058, "uuid": "67ae70f4-0b42-466b-a4f2-cf3df466700c", "value": 649216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701018058, "uuid": "a71a8f9b-4efe-4aa1-a623-80d4ba897ba2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701018058, "uuid": "57463b36-94c5-45ce-90f3-fba2d994b844", "value": "cheque-000000005903.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bada0ce-8c7d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701018053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701018053, "uuid": "847ce615-d619-4353-8aa8-27772a3876df", "comment": "Malware payload", "value": "d37b85b09086c80a3ee953249d2f2127", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701018053, "uuid": "e46e4082-becf-490d-9b95-b6fb08478541", "comment": "Malware payload", "value": "c451fb32dd30ad7610e5f569d46468c8bc8c2f19520488c49eb4dec30b6477e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701018053, "uuid": "8f662448-ec74-43c8-adf7-9f211828f297", "comment": "Malware payload", "value": "b6436755f2793a563663064d407734038de90a5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701018053, "uuid": "684fce33-f786-43c5-9647-f75d360d218f", "comment": "Malware payload", "value": "01097c5e40dc20da44d7137c3452fcab6d05503ed4d14e49f371fe7ecdf911dc7ab5822ec976d4f0cb48f28cbc22b78f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701018053, "uuid": "15c14475-f620-40d1-ad1e-ebdbbca33b5a", "value": "T1D015F112B6C689B1E4632A320D399B20557B7C244A79884F639C7E1FBF733C15932B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701018053, "uuid": "5254fa0a-f09b-4d99-a0e9-35d9f3904f53", "value": "aac51396886833dc961fcd7aab7711e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701018053, "uuid": "475a6d03-3cd8-47c2-b853-616289a15837", "value": "24576:lgZXoZUTVdt7KEA1MZsflCxjah+6Vr2x3aAq12JQf8v9:QAMclC4AxKAB+Ev9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701018053, "uuid": "2789a481-4754-4aad-97d1-fcb85aab094e", "value": 938974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701018053, "uuid": "05490e86-e07c-41b1-9502-68f8dc4cff07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701018053, "uuid": "956a1b77-a53e-4afd-894f-b93adf5ba0b0", "value": "Certificazione Partecipazione Corso AML IT15318pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f512652f-8cb0-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1701040214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701040214, "uuid": "105ad9c4-141d-4053-9371-7671e09fb369", "comment": "Malware payload (RiseProStealer)", "value": "be7080d7608a51d7f8c73130ee210870", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701040214, "uuid": "2d006aad-97b0-4609-b292-c6559f1e2830", "comment": "Malware payload (RiseProStealer)", "value": "c4609cbf2f91d3b700f7faa1079ff450dbf8f6647a7f186578e2feabe3c3e4c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701040214, "uuid": "0c00b445-27e4-401f-b1d1-8636cb4e0f98", "comment": "Malware payload (RiseProStealer)", "value": "1effe43037d5fc581a76dadede36f6ac388bed85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701040214, "uuid": "7a869d45-eb9f-4a58-80be-97ba52c43f32", "comment": "Malware payload (RiseProStealer)", "value": "0d625c9cc5e90ece977394d41ead4db1f43ee8041e64e121def4f3f6c6eb730149e332ad70a237867dd09d98b598ef76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701040214, "uuid": "ba30b2e0-28bf-417a-8c34-205beaa59fc5", "value": "T1D6852303A6F84021E9B52F3044F712971B75BCE6FDF4862B639E5E462D22798E1B0727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701040214, "uuid": "68e5c2f7-3c8d-4bf0-8842-93f666ff3083", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701040214, "uuid": "6efe5526-5bb3-423f-aad9-fb889e44db76", "value": "49152:OSW6LoKOcx8e+rUa+l6uXb2LxERIrwqWeqhWEbL+z:LWxcxXnXXeqnP+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701040214, "uuid": "7a0beea9-befc-4d49-83c1-8d9576e2fdd1", "value": 1766912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701040214, "uuid": "54e8d3b2-0314-4d5e-b37f-b33f302144e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701040214, "uuid": "a30d63ba-4df6-4e71-b126-b69d968f91f9", "value": "be7080d7608a51d7f8c73130ee210870.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad8ff1db-8c88-11ee-8907-42010a9c0042", "comment": "Malware payload (StrelaStealer)", "timestamp": 1701022915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022915, "uuid": "082b5414-94fc-4faa-8ba1-ba5138e98957", "comment": "Malware payload (StrelaStealer)", "value": "3bfc100a1d2b407375d9d95dd47dc71f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022915, "uuid": "cf9c53ab-60f9-4fb9-ade4-741fb17b435b", "comment": "Malware payload (StrelaStealer)", "value": "c5e02893f3684d719644f37d8240e45f52ee79e452f45f2d8e31e4afe426cf94", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022915, "uuid": "a239ed5c-8412-47ef-9921-67f4d698e33d", "comment": "Malware payload (StrelaStealer)", "value": "ba92e800ec742f31ba113d2a59cbb7b72022ff05", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022915, "uuid": "366fc350-c095-46c4-80b1-ac0a9ce73614", "comment": "Malware payload (StrelaStealer)", "value": "9bf3f5d8a8e2e09941e081daa6d9782dfa985cb728782126111a2f71f810df140c2c306eacf6c711535713c67ecc436d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022915, "uuid": "631d951c-f0d7-4fc0-95ad-24f12d94f1de", "value": "T1DE650AF4B251BFE50F74590DB38F80B22C6AFC57F1BE5E8622952A0E95C4244D9E6CB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022915, "uuid": "be719962-8839-4618-b763-a64856d67801", "value": "12288:3DlUUcdtPY2lKbo9KRoMRDmYnwmAMfh07n2OwmBPLMW1fTnBAuxLJ6W0IQkS+XsY:WZYkmpWNV1fjS8VbQhqAm1LUjMpPpT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701022915, "uuid": "e7fb388a-cdce-492e-9eee-44256b9c2f13", "value": 1466686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701022915, "uuid": "14bb9941-9597-4334-b118-0dd4acfca6e4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022915, "uuid": "ad29b7d3-1e1b-4fcc-ac14-4bbfa518de41", "value": "doc29869316239014.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee3d0053-8c89-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1701023453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023453, "uuid": "4137149d-f98e-42d2-a38d-34f037902a2f", "comment": "Malware payload (Formbook)", "value": "2b43d2febed4af51b4e38c089766b7e2", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023453, "uuid": "3c7e284d-4f71-4185-ae9e-3cc4d73a8923", "comment": "Malware payload (Formbook)", "value": "c6278fa04be065c8a37b80f35ebbafef00de918be694488ac9fc429016486cc1", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023453, "uuid": "882496da-1e0a-44a1-8b76-7d991d94d85d", "comment": "Malware payload (Formbook)", "value": "9fb11d53e5631a39c942c6eff29300d70812a4b6", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023453, "uuid": "f081e674-b03d-42b1-96aa-45fe0a9749a4", "comment": "Malware payload (Formbook)", "value": "58a1e6f920e3a896bb40d431d34603eebc2bd0377b6285bb62632b971990bfced76a3660902960e16916bdfdcdf02b54", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023453, "uuid": "d7d07d50-28ed-4418-8fa4-013ac95604c4", "value": "T14A459CE827BC4B1BD7CD16F5A021178D47B0C535B6C7B79A748ABCB52E923124EC2E42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023453, "uuid": "51f8f537-78d0-4e9c-b3af-ecc34fc3bf3d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023453, "uuid": "7ecb279e-cdcd-4ef9-9b79-62431ba56dc2", "value": "24576:EDhOwEjuBDQDodIrohw74kPVQu6Uk7Dc1Ee0sthjIAMqaxRv4FgMey7K:e8YDQDodIrohw74kPVDqE0s3rMq+vygc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701023453, "uuid": "9080c2b2-3e65-4551-9200-b381265cf74f", "value": 1198592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701023453, "uuid": "b5bc75bb-ae8c-483a-887f-91755dc9e6db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023453, "uuid": "d6646511-f7cb-4016-b7f4-67ebf792c0a6", "value": "DHL AWB & Shipping Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7dbdce0-8c8e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701025562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701025562, "uuid": "b125bda2-028f-46bf-9bbb-ac014507e44b", "comment": "Malware payload", "value": "03e2eb8b402e6ab17ee91208aa91d20f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701025562, "uuid": "15114c73-f0b7-4ebc-a821-8f42665b96e6", "comment": "Malware payload", "value": "c678a2ebcd489ac928eb3d28c9e96e56dbf332511235783497630a78a27c2051", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701025562, "uuid": "52c68f32-dbad-4576-9fb2-813a57546b74", "comment": "Malware payload", "value": "e97d7f61414ffa048a1a389c6a1de6807ebc85e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701025562, "uuid": "4c851a58-2b38-4c86-b77e-143dc7756e08", "comment": "Malware payload", "value": "5c46d5488d5f2daa9bc8e9ab963fc1973738f7d92d80d1a88a1438f5d64f635899bb4a85983e060612e82c5b955d69f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701025562, "uuid": "593d9fbf-8260-47e3-ac2b-f2c07e24ea75", "value": "T176063363B090190CDBA193B158F9A10C403A616764D03D2A4E9F298EF7B7FAEDF7415B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701025562, "uuid": "42016b40-0cd4-446b-af40-e8d25f69abbe", "value": "83a16448cb90e20899e2697682f235ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701025562, "uuid": "28c7e97b-801b-479e-8cf9-ed730ac13698", "value": "98304:QF1EUzg3Rhcpr/uZnpjROh8ochgwoeFcn/Qyl:8bz8UpiZvXhgeFO4yl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701025562, "uuid": "e0e972a1-319e-4cda-b8d4-1871e8f39325", "value": 3728904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701025562, "uuid": "44c563b8-9ea4-41b3-b67a-c6da9150090a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701025562, "uuid": "b7c0a1dc-ad31-4350-b9c7-f28a375a7816", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a204764-8ca2-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1701033807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701033807, "uuid": "f579bad1-44d3-4e7b-acb2-d74fe4cf028c", "comment": "Malware payload (RedLineStealer)", "value": "a2504fdee11217ac13b7cb81739eca7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701033807, "uuid": "18363a6e-d457-412d-9ab3-bd6bfe3b60c5", "comment": "Malware payload (RedLineStealer)", "value": "c7ea2248544df93fd2e80967891293e26b594f3ad5f09f54b830c0e5d3c93f8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701033807, "uuid": "a41e8bfb-5386-41c4-8fa3-c053384cf0ec", "comment": "Malware payload (RedLineStealer)", "value": "9ff301cdee5718fe5e8f255db35f221bdeb13323", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701033807, "uuid": "6b93496e-f509-4e8e-b4a6-61ccd70dc9c6", "comment": "Malware payload (RedLineStealer)", "value": "c0c080d3c45d7b63f90dddd8ed33210fbda74e0ac43e8398789ee7684fca9a0b6c137bf6da947c6e7a2ae941967aa1d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701033807, "uuid": "5932bd4b-0389-4ce9-9e85-9058a6130cf0", "value": "T12CD48C4727424965C63E123F7CEE86E40127E0214F2C849B5BD48F6FCED6AA489FD71A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701033807, "uuid": "7657ab66-43c9-4ba6-9e6b-19ac7afbb396", "value": "87d552636d31eb7a2797c4a63e862d4a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701033807, "uuid": "58c25446-0db5-4370-b3af-a41d6f1c4ce2", "value": "6144:PyU1zKCKVDp3Cbitu7gJzmgkYUDBg8ZHAOJFO+unwOlkYv454zahw40U+j5akaV2:PyU1K9pv6RZH8y5gahHuaVIEipKb66G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701033807, "uuid": "7c0721d5-0b74-4ef6-9748-bdaa6ca16237", "value": 605472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701033807, "uuid": "701e14a5-7bb2-412c-b584-cc3490a88eb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701033807, "uuid": "96102304-5f67-48c3-bef2-eae300c3ebbd", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12674e87-8c7c-11ee-8907-42010a9c0042", "comment": "Malware payload (NanoCore)", "timestamp": 1701017500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017500, "uuid": "e196257d-ac36-4609-9dda-812d152a1877", "comment": "Malware payload (NanoCore)", "value": "47afecdd07e1ffca80a41fe42bf1508c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017500, "uuid": "e03e93ce-49d6-4a17-a488-3bb0959952ba", "comment": "Malware payload (NanoCore)", "value": "c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017500, "uuid": "a9376c3d-34f8-4ba7-b216-5a08ad34642d", "comment": "Malware payload (NanoCore)", "value": "36dcb0ee19e521611be48d5cf27ed0ffe2ec5fd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017500, "uuid": "91a65853-3a93-4293-9f21-37eb4226ee43", "comment": "Malware payload (NanoCore)", "value": "21d235fd280237a34d9a61c37c70ebfec2a172d5e198ff05d947d41bccf77cb122ade87a60231d856b85f638a208cf02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017500, "uuid": "17666d45-58a8-4a1a-b568-1a5efe9cf1db", "value": "T1BFC42364174C069FC1BDACFE91269626A3F6E53A7056E3C31C70603EBAAB7D10E501E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017500, "uuid": "775f7757-3b31-4fe1-ab99-79dc25646178", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017500, "uuid": "071c3419-4d6f-4a8f-a2f1-d23d076b201c", "value": "12288:wZUy8ofQbBX0BUjhkDURK6Dnf7H2EyFwRwJiHvl20BaFOkWQ:RFNbSuPKaf7HVR/Hvl20BnQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017500, "uuid": "2d4a1cd0-ab71-45fd-9fc2-006ba193393b", "value": 585216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017500, "uuid": "027149e5-b7d9-4cfe-ad8e-43885b278e6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017500, "uuid": "b2074dd6-7ea9-4eb0-9474-1272dbcfcbf1", "value": "47afecdd07e1ffca80a41fe42bf1508c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad4614f4-8c46-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700994567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700994567, "uuid": "86113e79-5b7d-404c-85b1-dc0abf013f1b", "comment": "Malware payload", "value": "f483617fe273e34f1e32cde08f35398b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IDAT loader", "colour": "#23D030", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700994567, "uuid": "091c03ae-b956-42b3-b60e-f4e3dfa8fd18", "comment": "Malware payload", "value": "c921a68903bf79736891199f1246e1c92665d9ab221d92db3e6b51e4e948dff0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IDAT loader", "colour": "#23D030", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700994567, "uuid": "3490fa0a-0204-45ca-bed0-bfda29160896", "comment": "Malware payload", "value": "1876df80d214159d3becd4e88bf1b978d8b6f0b0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IDAT loader", "colour": "#23D030", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700994567, "uuid": "72490e34-a994-4c5b-aeaf-9e9402a92f5e", "comment": "Malware payload", "value": "f8e415895a48529d4fb7d7b007896778085caa05fc286683dd9cca72ef0a4f88b2f32da0e12ec5abd578f9d5eba119c5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IDAT loader", "colour": "#23D030", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700994567, "uuid": "089a433c-bb38-4b14-9fb9-af4a828ae5e7", "value": "T1D8759792EE4A75C8D2E700F1450DF3679DFAF2BD1FEC0AD970861618E3652D2D812BA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700994567, "uuid": "d26d912f-a036-4ea3-af19-650743f8ed88", "value": "12288:m7K8QYXYBvXDGPDYOYx6JvrxzRjcZYyhr7yz:GoBGfYAJ8ZJ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700994567, "uuid": "b0934228-af41-409c-9c4f-9823a344c4b1", "value": 1552398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700994567, "uuid": "ae8a80e1-9f63-43f5-8153-307317abdad8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700994567, "uuid": "40a0b90c-b450-42b0-bb42-ac6c86068619", "value": "8ca876292f872241a4fdf512d3d8a69f3a94c0b987760c90be81ed197f9ac82a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07cd68f3-8c84-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701020918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701020918, "uuid": "e1dee69e-8b05-4490-b7f4-702873b6665e", "comment": "Malware payload", "value": "0866e3ce03a706e56e09e9d98879e385", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701020918, "uuid": "c186ba6f-67ac-41a8-9d4e-425379e8e680", "comment": "Malware payload", "value": "ca8a715d59cf0d8e30158a751bb3a6e4545d0456a38f398e97d0d3a25b089138", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701020918, "uuid": "2aecd578-0158-4f71-8a64-68785bc00c46", "comment": "Malware payload", "value": "e1a40487f0d17257456b157c3d1ad1afef6aee88", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701020918, "uuid": "dd96df36-2b60-402e-98fe-ec9d890eeb04", "comment": "Malware payload", "value": "cdac7e7ddbd895235b2a66f18c35edafe9536053df25d4ab2016801bc01dd1f2fd1dc0218216cbc5e6246e487a3c4907", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701020918, "uuid": "fb5487cd-9a6a-41bb-85de-2146abafb038", "value": "T137D533B2D27112DFE1C0555AAF84AE64E2E6942077A3ACC41EC3CB686B380F1E9F4654", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701020918, "uuid": "dad23bc8-c517-4fb1-b18a-4edc0a75c36b", "value": "49152:g0Af8geN+ic4YRY7t280bvK7FLRbe75Kp7iSChuz4oTKuUEqk+PHVFjyvZu:g0Af8g2rCG+vmtb+5NSCwT95Ayhu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701020918, "uuid": "b24683ad-49bc-4e45-8eed-405582caff88", "value": 2965624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701020918, "uuid": "c124e55e-2c0b-464e-8139-633057dfb8d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701020918, "uuid": "a0d07032-247e-4e07-b4a2-8ac927b7ce90", "value": "SecuriteInfo.com.ELF.Merlin-C.17284.15348", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e660eb60-8c3a-11ee-8907-42010a9c0042", "comment": "Malware payload (RecordBreaker)", "timestamp": 1700989509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700989509, "uuid": "ad00e9be-e824-4e50-9172-fe1a8bb1ae99", "comment": "Malware payload (RecordBreaker)", "value": "f990201eadb1c0eab5b192e224b8ba1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700989509, "uuid": "bf9fdaf6-91fd-4f6c-b854-cf0d8ffe34c2", "comment": "Malware payload (RecordBreaker)", "value": "caea4462ef597dcaaff2856f52b7ec416965fd92d421a105ca97ef82376cd195", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700989509, "uuid": "818da22e-214f-4734-bb6f-b4d4ea017aca", "comment": "Malware payload (RecordBreaker)", "value": "c134f7c7d3c00e072249d8a6d2e550980022f9e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700989509, "uuid": "9ada8ec0-9078-45a3-b447-01aaaebc6950", "comment": "Malware payload (RecordBreaker)", "value": "400fd0beb27fe633b9b47fe058ce3a882ab9b08c1bf99af1b2c462a832426abe865a60ac0132e7f9b5ae3f139d61a9bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700989509, "uuid": "54ef3c0e-a893-495c-9e40-4b1b2f713462", "value": "T13454D50382E13D41EA268B738F1FC7EC7B0DF6618E59BBA912199E5F04B107AD663711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700989509, "uuid": "5a5230f5-9be8-4cce-a078-0a252c4ce3df", "value": "0a0289a4f27045b7c64ea101e69f4d9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700989509, "uuid": "4ab0fa93-0356-4a54-9e1a-d58c89b5018d", "value": "3072:FekmIh+soDFqegD3gI2bqy5n8jaLaeGQl+tax0Q6VkV8Q5mUZUWRQj+/:wk7h+soBAgIQqun8jaLa7Ql+QCjlfg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700989509, "uuid": "14fd2e32-8b2a-4a24-b559-0f9d23932f50", "value": 297472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700989509, "uuid": "32d518dd-4772-4103-8ea3-93e3a4f576d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700989509, "uuid": "33478f6d-a0c5-406a-b069-43d92db4b864", "value": "f990201eadb1c0eab5b192e224b8ba1b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c853b8c6-8c8a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701023818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023818, "uuid": "119bc5ca-3ca3-4497-b632-2c56a5027508", "comment": "Malware payload", "value": "86c7ef3594c5a364eff860ece3663454", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023818, "uuid": "b78c889f-449d-4ec7-bbc3-ac388a8052a7", "comment": "Malware payload", "value": "cb27c4175bae821069aab849b191acda179f2e91b5f5f5847a510bc15d5bd850", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023818, "uuid": "a8e675fc-345c-43c8-91ed-d3879c24820e", "comment": "Malware payload", "value": "eeab6d63eabf9fdc302a5ad8cc7c15f06b5352f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023818, "uuid": "84534d87-a676-4792-b954-54c97b0ed0e9", "comment": "Malware payload", "value": "e2fb78d226b94e1afed120e08041f1ae5ec9966ce8e40206ff880c0621326f863b97c09b1a698748d8558a6f444a16c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023818, "uuid": "bc01421b-14d5-49eb-856e-c450827cc625", "value": "T1D7D5338B52809131D413EAF82BB1F7285AA77ED119614C6A7DFF1DDE0EAF551002CB2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023818, "uuid": "fc3314f8-115f-460c-85ef-82340a7e328b", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023818, "uuid": "603741ce-3e3c-4e80-bedc-0e2434ce9d49", "value": "49152:H21yF0cd1E2n6faeHD6tn+VloJh5JtUt30blsBDI2t4OojvCH9zEAnR0R+S0WD5A:W60cd1Pnknl8X6BzKJgEAnR0R+0TlE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701023818, "uuid": "ef263bfb-49c1-4351-bb3a-365d8e03233a", "value": 2869227, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701023818, "uuid": "ee39b1c4-24b3-4d81-b43b-b2d8cd5ab123", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023818, "uuid": "ec661646-e88e-48b1-98ad-3bc71ef28186", "value": "86c7ef3594c5a364eff860ece3663454.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56e22963-8bf1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700957915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700957915, "uuid": "108cd086-9e06-4e7b-a4b9-0799f1bd0bb0", "comment": "Malware payload", "value": "5ea4106aca2999f55271a47b3c87beda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700957915, "uuid": "6dea9842-4da3-4227-b4fe-5ba7b1e07a0d", "comment": "Malware payload", "value": "cbedbc9097662e4a04c9615bffc112b8a558ad9463a407c6e4b53be2a1af499f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700957915, "uuid": "134655c7-ada5-40b0-9e1e-1b3b0836ed7a", "comment": "Malware payload", "value": "48b6a7bcd5bb3470b6ee5bd22568fd5dada31464", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700957915, "uuid": "8c92fb55-101a-4e74-8eab-20294fea9152", "comment": "Malware payload", "value": "2ad4d0c083aa9ab71f8b92eca5ee3046a4c1117bfe80828ae5a85835c62c2e21a6deb5be410b48dfe5acd47a44492465", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700957915, "uuid": "f206efb3-1436-45f9-8421-1942fbef9bc7", "value": "T1D2B6331EE1D574E5C9BC9BBCF8311D0F0D30ABA16D6DA7896E493D90388B18E433752A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700957915, "uuid": "0c13f4c0-23ef-4414-930b-17b3f350e40f", "value": "17fa5dacb8d855eaad59f9a0ea4af349", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700957915, "uuid": "b5119534-679f-4117-ab0f-3a672d3cea61", "value": "196608:jePqVM9OSMKvxjnUPM44Tff5GXtLobwC6GRMS9:jLBoVnn4wpGdpW9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700957915, "uuid": "e1884a5b-54df-4757-9bd8-85d74fc7d686", "value": 10460321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700957915, "uuid": "8c4264c1-c4c1-466a-b891-8c9a4ea6421f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700957915, "uuid": "14778876-9400-43ba-8893-a39fa35d238b", "value": "y8V3Yf9cXw8HXP3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd4096c8-8c46-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1700994621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700994621, "uuid": "51dd72db-a2f7-4f44-9411-ea374629704f", "comment": "Malware payload (Smoke Loader)", "value": "6fd0dff62b1a248bbdd415806fdd2eb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700994621, "uuid": "e96fd033-abd9-41c9-9569-96119c4d4a53", "comment": "Malware payload (Smoke Loader)", "value": "cc1ab7eef4eb1f7568b6d3fe705eef6da66e8f0fd907405b15501338322f5aee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700994621, "uuid": "4637b9b8-187b-449e-aef2-907894d078a3", "comment": "Malware payload (Smoke Loader)", "value": "654443671e3c2a1a56a965f6ce78deb4e317bb31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700994621, "uuid": "79709596-8d57-49aa-86dd-3554c41da631", "comment": "Malware payload (Smoke Loader)", "value": "a33af45414c1cfa01a75086081ee5ee98dfdcf56833cf00310fac99dd524495c433ff6fe10dd1763f2ac5e5124847f76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700994621, "uuid": "48707894-b43d-443f-b6a9-3d1b983aea84", "value": "T14A54C613A2E13E44E9268B72DF1F86EC774EF6508E597BAD22189E1F04B11B2D273750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700994621, "uuid": "8b54f68b-4941-4935-955c-509490ac6fc8", "value": "32e191367f9932caeeb9bed9a82d73da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700994621, "uuid": "3947f03a-352d-4c01-837e-d7f924dbe2e0", "value": "3072:KRVDAqcjOtz7HJ27F0hjWkWLOqkJvxGQ4GQ5mgjle70M5kVyBk3eFx/RiPB:KJA4tPJ27FUvgO3vxffKlI+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700994621, "uuid": "2089300b-ec0c-47b1-bfd9-75e95637ecc7", "value": 295424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700994621, "uuid": "162b96b1-2c08-4686-80f5-9de4fee74a54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700994621, "uuid": "9ed50bac-195e-4a5a-b1f9-d249f0c01ebc", "value": "6fd0dff62b1a248bbdd415806fdd2eb0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f3279dc-8c7b-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1701017092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017092, "uuid": "ddcf4845-9e70-4ab6-b4ab-d6cd7c6bc0b0", "comment": "Malware payload (RedLineStealer)", "value": "1cab040f3338ef8554774dd9ebb69a13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017092, "uuid": "6873e87a-ad19-4504-abf0-af96639ba248", "comment": "Malware payload (RedLineStealer)", "value": "cc71be0316018fe23fb2293e3a6555abc61273b80b30e761c7cdf7e3942ef965", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017092, "uuid": "395a07b5-4472-42a2-b124-43a028cd80f7", "comment": "Malware payload (RedLineStealer)", "value": "6e330651bdec6f144f686f1b42c7da08d692a9f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017092, "uuid": "f4c6a3b3-f5f4-4131-bc9e-98d34c83e002", "comment": "Malware payload (RedLineStealer)", "value": "262cc36ee26692b0593913141bbcf7801df05020870bcd88d1e6414dfa63200c6f4dc49de2889a0211ac7b021d8614b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017092, "uuid": "e04e7af9-ed6b-42ac-b3af-b3bea45691b8", "value": "T1D4458D317481417BFDB220FB86DCBB26422D917047796DCB06D84BFED6306E26B31A5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017092, "uuid": "0fafb15a-2cd2-47b9-ae7a-d8eac2382535", "value": "bbe2990d8b692a2bc3e523d54929d6fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017092, "uuid": "85ffde96-f3e7-4778-9451-3190336006a9", "value": "12288:bZ9HouF4ZYWzHZbeeGXr3l37E9MqZZZM91QCZYuOLa3eWTOIbfZnzcpE11qqeXk9:kuF4ZYWzHZCLuJZZZM91FBFTO8beXk9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017092, "uuid": "a4d18be5-7b96-4e49-bffa-6920b91b3042", "value": 1188128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017092, "uuid": "e269ba92-aa7a-4429-ab43-ca18c9ed069d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017092, "uuid": "feeeb789-4a43-415f-842e-cb60eaa8f971", "value": "1cab040f3338ef8554774dd9ebb69a13.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a87db147-8c8a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701023765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023765, "uuid": "954d4c27-dafe-47f1-adff-af8efaaa136b", "comment": "Malware payload", "value": "d529365f44b69989bf9225c832bfcaca", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023765, "uuid": "c95b60de-282f-4136-bafc-993bf932e417", "comment": "Malware payload", "value": "ccb5d3fa9b8a1c04dd56955ba34ecbfd48c4acc5b24f5e09c59608ee1f544fb3", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023765, "uuid": "768b9a11-ff01-4c35-8383-0562af10301f", "comment": "Malware payload", "value": "53d2ac0b644b072cff12fa191f3d5a7591e9bc7a", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023765, "uuid": "f9ad2a1c-bf84-4168-be68-7af3eff32c03", "comment": "Malware payload", "value": "5c75cf686dbe016b09d9083b28ee3ad09e580c203fd82be7c442c60050b36501e74394766bdb4776e33ea9ae43f709d3", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023765, "uuid": "b5f0bc4a-ca3d-4a77-b082-e1bbf6124199", "value": "T10FF0A4439706633BD43541858BF86CADDC5004C334DCEE54BAA04CABA799D23EFC2839", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023765, "uuid": "110b6fd5-7ece-41fb-a4c7-d567ff8528e0", "value": "12:9vWdWvWdWvWdWvWdWvWdWvWdWvWdWvWdWvWdWvWdWvWdWvWdWvWd+4mFgvBoh7jy:9AWAWAWAWAWAWAWAWAWAWAWAWA+4J2J6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701023765, "uuid": "50b9f553-f0cd-4e68-a876-10f71b8ae6aa", "value": 569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701023765, "uuid": "70e8547a-344c-48ac-8688-8321775029b7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023765, "uuid": "f3caa6b2-cf6f-43fb-926b-fa0baaf75f0a", "value": "d529365f44b69989bf9225c832bfcaca.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e52b5c6-8c88-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701022782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022782, "uuid": "88631451-62b0-4baf-8542-97fd240e8b9d", "comment": "Malware payload (AgentTesla)", "value": "eae60bd3a83c9b7ba1b0374322f9542c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022782, "uuid": "b4dee1d9-5850-4e03-b4e8-725c9d5567a9", "comment": "Malware payload (AgentTesla)", "value": "ccffe92de8a5228075844dd6d0e73c0ff3616031eadf71b1a0cbe2958019b8b9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022782, "uuid": "c2b31851-807e-470a-a5b9-d729fa19bff5", "comment": "Malware payload (AgentTesla)", "value": "6c4142808b8d5a80d300a8305f99f40f4029a8b6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022782, "uuid": "93fcd927-2182-4c2e-92be-645680d5eaea", "comment": "Malware payload (AgentTesla)", "value": "e54f122284f0ccf9159e06598586d15a69d3f56e856131c411a273ba10f1f23f668417f237a89873471b0675c8179a4d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022782, "uuid": "d8b04a28-cfab-4547-9812-a8afb018ee26", "value": "T17B8402823341D0AED16642321B76ADE34BA57C3D4E55724AA2B0F75E787F642CB0E31B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022782, "uuid": "626ce81e-fc79-4b7d-82ee-ab872259700a", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022782, "uuid": "90e52c1d-e89e-4341-a86d-1a3346c64815", "value": "6144:bNDlOltlhlf+trzIibqQhPYJmi2q7skQS7+t2BXGfvWMe7SoVzQ:but7VubqQ1dYLp7+eGGMeXzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701022782, "uuid": "e4228e61-1423-4b74-af62-0bcdc5dcd49e", "value": 394368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701022782, "uuid": "3031940e-157c-4849-9171-21214db946af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022782, "uuid": "a5475da4-d8bc-4c9e-bbbe-e2c3d4d0e666", "value": "Korporalernes.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9e423bc-8c12-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1700972281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700972281, "uuid": "fd7cf2eb-43d2-419c-8cfa-9e380d69655d", "comment": "Malware payload (RiseProStealer)", "value": "95e02100902ab4c879216d517fdd9713", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700972281, "uuid": "304304fc-5ad0-4e57-977a-ab32b84da1e7", "comment": "Malware payload (RiseProStealer)", "value": "cd4ad20afc68c022bb6734bd05d8154c4d2862847da828a3e23bbd174ec7d730", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700972281, "uuid": "5be2d6cf-b822-4e1a-a000-17f8bc18265e", "comment": "Malware payload (RiseProStealer)", "value": "6703df867b2f36583c91b8a325d8f75f2e830429", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700972281, "uuid": "391acf23-69c7-401e-8820-46fa7719a20e", "comment": "Malware payload (RiseProStealer)", "value": "9f094c43cbe2079e0189fe6fe63a3a9c2bcedd13d64a2fa60a8b701ab02528592580217e13236629dfd632cfa49db5e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700972281, "uuid": "04f4d18e-79a8-485b-9ebb-6bf3dc679f78", "value": "T1F9658C31FA08D4B6D09210B0916D6A7B91587A322BAF4CD7F3C05E6E41B52D2F235F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700972281, "uuid": "b1592ade-85f5-4a4a-81e0-f6ede22caffa", "value": "078471ac5a76189ffe465abe0c89c6b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700972281, "uuid": "b84ab818-a1fa-456f-a551-aafb865fc036", "value": "24576:2opGDjnvrPpkjos0OtjcFc5kM49dj+IuxWQOIjuJuVvhbqL0HtFcgekRP9dT0WNI:OnvrPGT0Egyudc4tI3bqL0NFchaP9dTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700972281, "uuid": "2922139c-82a3-4ed4-ba68-38ea47fc6511", "value": 1539776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700972281, "uuid": "c7578209-7845-4440-92f3-9e94d1856459", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700972281, "uuid": "ee4b5de2-bbf9-478f-bb64-e99e3f4ffc6b", "value": "SecuriteInfo.com.Trojan.MulDrop24.22194.29424.4170", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e284bcff-8c82-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1701020426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701020426, "uuid": "0e813549-e4fe-487c-bb11-06a261bc8c93", "comment": "Malware payload (RedLineStealer)", "value": "1f0288dd8ef42bb8ed68d8ba290ceb48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701020426, "uuid": "42fea94f-aaee-45f2-9963-4ac418d99543", "comment": "Malware payload (RedLineStealer)", "value": "ce849b518aa9975806d7bac2d39e7bc9ee8e39ac8d5180dfa302c0491030a49d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701020426, "uuid": "bea86297-926a-420d-9e9b-4491d5d34598", "comment": "Malware payload (RedLineStealer)", "value": "03dfe797f67eb10dad5162683fbc6a2834ec2335", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701020426, "uuid": "8dada7d4-c56a-4238-af05-3a038cfaa50f", "comment": "Malware payload (RedLineStealer)", "value": "f9e429ce26865d35969bd131012b579921aac0c6ecc7df1fe007ad02d5db81085b3f75c9fd8f5ea842b52c1b30d23423", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701020426, "uuid": "51089010-f2d7-4c0d-ba20-f4d35c58ce25", "value": "T15185334225E89033E9B41FB858F65B6319327CA5FEF0D21B235E9C4B1C52648D5B2B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701020426, "uuid": "b5d2bef0-f16b-4962-8920-20805fb5e17e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701020426, "uuid": "ab0dd564-b400-4f59-91d8-b59117705af9", "value": "49152:gZSf8Sa+p+fRuf6nKUXsqvzBuN7YvaZLhrIQ3TZc:WS0Q+fAc8N7EyLhhdc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701020426, "uuid": "54f319ab-8703-43ed-a4a4-0d48dd15eacf", "value": 1770496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701020426, "uuid": "77f61e8b-46fc-4511-95b6-24a79996930f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701020426, "uuid": "597aa947-42ce-469b-9657-9022857581c8", "value": "ce849b518aa9975806d7bac2d39e7bc9ee8e39ac8d518.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0b48f2b-8cb3-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1701041415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701041415, "uuid": "e86aea97-1afc-4c34-8829-aea7e00738af", "comment": "Malware payload (RiseProStealer)", "value": "867243ef63d6f23644c8cbd25dea8db1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701041415, "uuid": "9d13d4f3-0751-4348-b056-8d7a4abf4c9b", "comment": "Malware payload (RiseProStealer)", "value": "ce96a3e09c94bf8715b57584d9ceecdb641b80fe360e2757b01a201749753d7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701041415, "uuid": "f5f159b7-630f-4c05-bcac-ec3aedae52e6", "comment": "Malware payload (RiseProStealer)", "value": "615cd8e15788ba1490afbb62ed34a96ba2259257", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701041415, "uuid": "6ce5359a-a637-4020-86aa-1cf0460e9999", "comment": "Malware payload (RiseProStealer)", "value": "2fd6bdbd651fd5b7b0ea3b252c4ec61815ee87f88392cc6e7bf173300a703b09fc41ae43d644a362cdb2067c69073275", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701041415, "uuid": "4226fd65-2dc2-4f22-97eb-93b998f8c104", "value": "T159852383A7D98153C6782BB048FB4693193E7C94FEF073562365B4092D21690E9BB73E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701041415, "uuid": "781f6107-b7cd-4e9a-a29a-102f02808813", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701041415, "uuid": "7e452bea-6ea9-4ebd-9c40-e7c643de5a44", "value": "24576:lyCOnNfc/Bgpny++cNBpOOgSfajzY4hopJeRIouYcGBkfWin9t6e8jrXVsoKk:ACQtEiyJKN1aIAEwRbuYdkfWZe8nu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701041415, "uuid": "6b5b5809-8c20-4f15-952d-0d90036745ca", "value": 1769472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701041415, "uuid": "0c788424-817e-40a9-910c-1b90c79aa9a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701041415, "uuid": "fb845bed-9d41-42e7-81c7-f0ce38078a52", "value": "867243ef63d6f23644c8cbd25dea8db1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9de3d7c7-8c8b-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1701024177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701024177, "uuid": "75aaf628-6897-4399-8988-e1fd2ad75315", "comment": "Malware payload (Smoke Loader)", "value": "c2295057ff24327e4bf59414ebfa604e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701024177, "uuid": "85bf0573-54e2-4222-a892-9c780af5dafc", "comment": "Malware payload (Smoke Loader)", "value": "d008c142c0ba6ed73c2f3e14f73e54eb09c382e6d2acdc1a4bee8625059bd8ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701024177, "uuid": "e9f5b2e0-633f-4a4c-ae06-77ec95ab210e", "comment": "Malware payload (Smoke Loader)", "value": "36c78f503f5fbe73115af9162c7afa2a7d2c29fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701024177, "uuid": "4e950b2a-b148-46f0-97db-71ccea5f4a51", "comment": "Malware payload (Smoke Loader)", "value": "38ed12a001c05d0bde08655e48d8535684eeb60a94c7e3fee038415ede03fefcf6b75190720ce332e030d11f15e0efef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701024177, "uuid": "82ba8478-1ad5-40f4-86be-d04b710b32b0", "value": "T13554D40382E13D45E93A9B729F1FC7EC7B0EF6518E09BBA912189E5F04B107AD663711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701024177, "uuid": "fe86aaf1-95e7-4e2e-9d15-5bfef4e3a2e0", "value": "1c1cf4a921a5454d88be29284face39b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701024177, "uuid": "0737da5f-1895-4def-aa6c-e20065bcacdc", "value": "3072:PtlCjGk2NuenKdVJ2gmB7YdIUROQj+Is:llCcHQ1Rg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701024177, "uuid": "4fe604d7-dbfd-438f-8d92-fe3088e5b59b", "value": 298496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701024177, "uuid": "0fb5a1f4-2883-4606-8fd7-b7789266c904", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701024177, "uuid": "10d4dd67-1006-4fca-b02a-f9e930849ae9", "value": "c2295057ff24327e4bf59414ebfa604e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70eae4a0-8c8b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701024101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701024101, "uuid": "cdc8abff-ff06-4722-90ac-6d661c1c159d", "comment": "Malware payload", "value": "7f6a6b2dbcc7e7d0ec091e1c2ea40328", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701024101, "uuid": "103150d3-55dc-431f-b659-c97405f47d25", "comment": "Malware payload", "value": "d09e258c89940c457fc1bdd91afc87c6da6eee848c3452df004015c4cb637040", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701024101, "uuid": "57522c73-338c-4961-b1c4-b93e032f6bc6", "comment": "Malware payload", "value": "adcf2df75e330419a0b3d96abf935d7d82b3abab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701024101, "uuid": "7185aba8-c6fd-4f89-8c2b-e2649dd8c433", "comment": "Malware payload", "value": "728fec022005dc0dbe01dfe020caa3987eb9672be3bd98173404cbb95cde799be0a0c1776114d3a4a86a39d97f69634d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701024101, "uuid": "d5bc456a-1e7e-47dd-ac2b-abaf3107f772", "value": "T1D6A3BF1476E0C467D8620A305E76D6FE6AE5BC12DCA48B0B33D07F5FBA32542DA0D752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701024101, "uuid": "ba48ec08-0cac-4fa0-bd7a-6119f3ace4a0", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701024101, "uuid": "4cb3e111-be74-45dd-9f89-03e622fd22f8", "value": "1536:3msAYBdTU9fEAIS2PEtukbnWtbZXyaVWAxZ7yWzv08SNahFH:2fY/TU9fE9PEtukbnWtlyQT/7yIhF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701024101, "uuid": "312516ac-5457-4f30-bc91-f5f36f5bc2e3", "value": 101064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701024101, "uuid": "2686fcda-00f5-44a0-ad3e-58fc79a6e1d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701024101, "uuid": "80554a20-5c8e-4b12-a264-f7f610e362ce", "value": "7f6a6b2dbcc7e7d0ec091e1c2ea40328.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5cb05ae-8c8a-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1701023760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023760, "uuid": "5e0572e3-3055-49bc-a038-9561fbc585f6", "comment": "Malware payload (Stealc)", "value": "f96465cfc3f1d8eddd03d1c7ddc0a277", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023760, "uuid": "9868ea6b-4677-4b83-9b3d-9cadca99178b", "comment": "Malware payload (Stealc)", "value": "d0b64df818cec79d629e729f725cbf4ed071da6fe4b3b040240b2e044868896c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023760, "uuid": "023f2e81-2250-444c-a275-66c0cf0bed5a", "comment": "Malware payload (Stealc)", "value": "292ef94578e048e855527f0357725dd6ee21551d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023760, "uuid": "698f4696-2f9a-4aea-b266-18fe9dde53be", "comment": "Malware payload (Stealc)", "value": "0b35dda460acc7c744547e2762f1bf47dd3181c1b8a90f434e58969526f90f811f1588d74df2787669f5f35b1674e043", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023760, "uuid": "67189e5d-5ca2-4dfb-8016-8656e8ab169f", "value": "T12C54D60382E13D41E9268B729F2FC7EC7B1DF6618F59BBA912189E5F04B007AC663715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023760, "uuid": "78a10551-f9c6-4bb2-8cb1-a7678811e35d", "value": "b79e8a13f3e64db949ba21efd0faecde", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023760, "uuid": "5f7193e2-4649-43b7-a158-4ab0f2b46b30", "value": "3072:4NFCfQ5mXRMmmmG7fR+J+cF7/IjOjhrgdvvsZYUypba0Qj+bs:aFAQ5mBqmGLRit75jxgaTKba2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701023760, "uuid": "ff60f748-5173-4342-813f-22712d87c715", "value": 298496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701023760, "uuid": "068a42f4-10f6-4d2d-b66d-4045414eba13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023760, "uuid": "5af5773a-481a-4f6a-9087-c46cdf8ceecf", "value": "f96465cfc3f1d8eddd03d1c7ddc0a277.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb600949-8c19-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700975290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700975290, "uuid": "eee85d20-83c0-423d-9429-28b1b000c65c", "comment": "Malware payload (Mirai)", "value": "82daa3e0e15329452f80bf3f59617d44", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700975290, "uuid": "dbf90208-90e5-4ef8-9eab-47d676379b72", "comment": "Malware payload (Mirai)", "value": "d0ba79ca0f6d62340a575b54ba14df2dbbf296e4de9376aca7f6db58ca05836c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700975290, "uuid": "f097a1e7-b482-4d97-84ec-ddc06956ff90", "comment": "Malware payload (Mirai)", "value": "8b31364789c3069678e4a9e1f941fa60ea30a52f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700975290, "uuid": "e14381ab-39a8-4db9-b6f0-34118ab266ab", "comment": "Malware payload (Mirai)", "value": "24fe1326ca3f1b364bac5e5722c3648ac0fcb1632a446b6953eb84733c27eb93f34c6c16128cb4aa1566a1a0bb124d7f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700975290, "uuid": "7ec5d78a-cd38-42da-993d-1efb769f048b", "value": "T15583B76B1E228FACF759C23147B78E26579C23C73AE1C641E16CD6016E6034E645FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700975290, "uuid": "e7332794-5c25-43e4-bd85-77c0212142ae", "value": "1536:IdTilr0PkIz4OIFch9k54icX/NTseHJeMbLTvh:kWWPmTctX/BseHZLTvh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700975290, "uuid": "d4c4a1a4-5eec-40f9-8511-c50a3a00e111", "value": 88412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700975290, "uuid": "3af3b6c0-0c42-4639-8dcc-b517a59e40f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700975290, "uuid": "d0770cf0-bed1-49c9-94e9-e0f0012fcd1d", "value": "82daa3e0e15329452f80bf3f59617d44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90f3a20e-8c40-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1700991943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700991943, "uuid": "284aadd1-8958-405a-84b5-09ef2361c6c8", "comment": "Malware payload (RiseProStealer)", "value": "76e628a0fe544c4d30d915aea46d5fe3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700991943, "uuid": "4c893ff4-c2a7-408a-9542-8c3c89965225", "comment": "Malware payload (RiseProStealer)", "value": "d11147f3e5a94754d73dabb4007a05d0b0ff304971b2bd43829b48c73ff0ba47", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700991943, "uuid": "f61d2353-f71e-4d59-99d3-1b139de9e133", "comment": "Malware payload (RiseProStealer)", "value": "f09617876a1849056d075c444a998de140265403", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700991943, "uuid": "097dee0d-a783-46cb-8118-8f949eb00964", "comment": "Malware payload (RiseProStealer)", "value": "aac3d9b72d8a163ea035de98eb31260ff11d7fe1e96e8ca68ef4bc25366f02470bfb081d9585b75563ec5b4c2ba03063", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700991943, "uuid": "cc0cc37c-e2e2-4f87-99ac-812eada43e88", "value": "T13195235267EA8446E4791F704CA317A70A357CE2F7B0A757335ED50A6D22BA0D0B232B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700991943, "uuid": "9feb70fe-c752-4d2e-8b8f-e795a0b4467e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700991943, "uuid": "79d09a88-301c-4dbe-93ef-64f72ea2cdd4", "value": "49152:4tqPR2fQQjZqwSm6B/JMAo4TPItyHeKEUS4XUSie7q:5PUfQQjZqwSNpnHeKEUS4kSi5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700991943, "uuid": "5ee44c00-5cb1-405a-b248-74f22b270a98", "value": 2026496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700991943, "uuid": "be964538-6267-4d84-ac4d-c9f8230aa83c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700991943, "uuid": "1b878f9d-9a2d-4acd-a393-d3174c2d9956", "value": "76e628a0fe544c4d30d915aea46d5fe3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b96c5a18-8c6f-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1701012197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701012197, "uuid": "87c9a4a8-e36f-4a00-9932-9f2787dad272", "comment": "Malware payload (Mirai)", "value": "3c3285585fa5b3bce0f4fe6153264ce0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701012197, "uuid": "a57b65bd-d2a2-4234-a49f-246d29df9574", "comment": "Malware payload (Mirai)", "value": "d1fb2afd46e3c931f505f751898322b73e025df945915b676fa9503cd091dfd5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701012197, "uuid": "22178ebb-9228-4ebc-9507-267e9f2e7556", "comment": "Malware payload (Mirai)", "value": "5a0190b124f5ef2a006d069a5c5154c1112333b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701012197, "uuid": "f6b627cf-8b2f-4d50-9c16-425e07907df6", "comment": "Malware payload (Mirai)", "value": "a4c88cf441999a6aaeec53a98ff72dc576e5a709615b614b29e58806ae012ad5bc7bdbe5d28bfd4e0bb24d93c593620d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701012197, "uuid": "fbf81340-8ddb-4eff-a57c-c3b73dcea8ad", "value": "T1E573A70E6E259FBCFB9C823587B78F21965833D626E1C644D15CEA011EB034E741FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701012197, "uuid": "4255fcbd-c4b0-4084-9089-0a75314590ba", "value": "1536:zoVvPLWTs7ys6XcniEyNMx3sDmTRdVSabdza3TTLbwXmP5r:zo5WTm6XouMx3sDmTvVSabQ3TTLbwXml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701012197, "uuid": "b07c9f83-70f4-4f2a-84d0-c087e78ded01", "value": 75976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701012197, "uuid": "eca31e99-b904-4711-a1a8-592ce56ec550", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701012197, "uuid": "a9ae179b-9676-4e8d-aedd-b670ce7acaab", "value": "3c3285585fa5b3bce0f4fe6153264ce0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53528975-8c90-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701026199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701026199, "uuid": "4f7ae3e7-f03f-4754-81d5-6f7d15addf1e", "comment": "Malware payload", "value": "45ed129e813a0cdf66fc32f4c2fd44fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701026199, "uuid": "ba75f491-c8ab-472b-8931-d5eaf32d1920", "comment": "Malware payload", "value": "d31fde4191e4a075ab9bf9d6c7fac997b463192e37ec19d135f618ee7cf33d97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701026199, "uuid": "a72e4f17-f541-4191-8747-7aebc3312978", "comment": "Malware payload", "value": "c1faa3c16482d73c4d316a4799c143659183aed4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701026199, "uuid": "1f89db95-189c-4607-a4d1-21414ea7aea2", "comment": "Malware payload", "value": "b520723d0ecdaaf03bbb8ad0a4850a06ccb49a21e1cbdf56014ecd370d77e90ce139f8cbd4bcfe585537b2c3f2dcd215", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701026199, "uuid": "44c30ab2-765b-4df1-a6fb-f4567020989f", "value": "T1AB54D61386E13D44E9268B739F1FC7EC7B0DF6518E19BBA912189E5F04B00BAC663725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701026199, "uuid": "9cfbf0d2-c0e6-4c35-938d-955abb55c6b3", "value": "1c1cf4a921a5454d88be29284face39b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701026199, "uuid": "1528361e-7751-40ae-bc98-1ba03ead1731", "value": "3072:T1tz+Us2RQT3y/gG8fqh1L5mMxFNJt5VSwaZ0LVYdXUn8Qj+Is:nz/fRQT3GifgKItOlZlku", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701026199, "uuid": "7760b703-45b6-4306-ac20-3a4836915f19", "value": 299008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701026199, "uuid": "d567c825-a4e0-4eae-a363-9145eb5810f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701026199, "uuid": "02021fe8-3d82-442f-b6f6-cee7cc8a5587", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44c37644-8c7a-11ee-8907-42010a9c0042", "comment": "Malware payload (PhemedroneStealer)", "timestamp": 1701016726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701016726, "uuid": "21da0db8-a292-4d7d-8353-d0a0573c652d", "comment": "Malware payload (PhemedroneStealer)", "value": "8bc10ffcee089200f8a0c9012f1e8e79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhemedroneStealer", "colour": "#645F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701016726, "uuid": "d397b3be-8b84-409c-b254-92d2453c4de6", "comment": "Malware payload (PhemedroneStealer)", "value": "d3f32d7dea3e4d41eed1238a269075c4030ddff3843cb286b1860a6de6ad000e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhemedroneStealer", "colour": "#645F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701016726, "uuid": "c2a2b521-6de9-48b9-a4f5-6ff6b17978f6", "comment": "Malware payload (PhemedroneStealer)", "value": "c3c29a18803173d8c283feb9a64af5d1d4877635", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhemedroneStealer", "colour": "#645F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701016726, "uuid": "2adf2c33-e75e-410b-8f75-96fb3777ccee", "comment": "Malware payload (PhemedroneStealer)", "value": "0dcd18138dabfb15384b9a869746bf3537ac3b4d768f8f7d6c55327df45b79ead182bcdddfa331536d4df199e69701e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhemedroneStealer", "colour": "#645F55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701016726, "uuid": "8048b873-596c-4dae-9ba9-c27be27f1f33", "value": "T1D7936C41F3E142F7EAF2053100A6762FD73663389724A8DBC74C2E529913AD5A63D3E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701016726, "uuid": "1a3cdd0f-72bd-4456-bb5a-1dc0de875b99", "value": "2c5f2513605e48f2d8ea5440a870cb9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701016726, "uuid": "63dae662-1f46-4d65-afd6-8a04819a0c96", "value": "1536:D7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIfPwEO+:f7DhdC6kzWypvaQ0FxyNTBfPP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701016726, "uuid": "0fbee2c3-eee0-40f2-96c3-d143cacab255", "value": 91136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701016726, "uuid": "7e95e336-d19b-4229-8b97-2ccd9d781065", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701016726, "uuid": "5072ac8a-1477-4241-a935-22c2a50763cb", "value": "8bc10ffcee089200f8a0c9012f1e8e79.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33f6eaf5-8c8a-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1701023570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023570, "uuid": "fc79f7dd-94f2-4899-916e-2fce70f96b57", "comment": "Malware payload (Formbook)", "value": "a91a8edf24d47caa5467f0edc250d0ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023570, "uuid": "77a272b1-605e-4c57-9d36-824ce6956e70", "comment": "Malware payload (Formbook)", "value": "d45e79dad9202c1ff02f089203e68b1b28e96c02437323a59a21dc1249b1750e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023570, "uuid": "d662b330-3a96-485c-a4a7-778b9b258b9a", "comment": "Malware payload (Formbook)", "value": "98041ec6166c2966f676cbc8a1f1d42fec947c00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023570, "uuid": "9a6ea928-a554-43c4-b34f-f9c2cc7be662", "comment": "Malware payload (Formbook)", "value": "359f25e72322079b28b74efba4d626a67fc3eb20623ed1da634a3b3073a4cba02606b91613b467472343b96be627c354", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023570, "uuid": "daf69a3d-226c-4712-ac55-76623906687b", "value": "T1B2D4110032F86353E47693F551A2019177F97AA977B8FA4D0D9168CB0AF1F0E8727A4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023570, "uuid": "199dca81-1b5c-4dff-83f5-28e6d455be91", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023570, "uuid": "c0579c91-7fe4-412b-9269-1dafbde0bea6", "value": "12288:x4Vv6NZVslFs1JABNmJ4lnZxGA7sRLwQz8XdgTDdik5dCNd:6CvVsoABNmWnmA7sRLwjeTxrUd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701023570, "uuid": "ab957582-e2fd-4ad6-b744-5f24c58aa8a2", "value": 622592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701023570, "uuid": "1cc5dfda-f488-4d6f-b40e-518f81b0ee6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023570, "uuid": "275a6e34-1124-46f2-a110-7aff0353017f", "value": "doc 202307 009200100 0001 99911.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0345b2a-8c46-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1700994626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700994626, "uuid": "7262bd34-d097-4b1c-865f-bbd69416a23e", "comment": "Malware payload (Smoke Loader)", "value": "e46a2677fe5342b0876181cb1ee3bbed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700994626, "uuid": "46486969-787e-48ab-8d8a-620e810a9100", "comment": "Malware payload (Smoke Loader)", "value": "d548abf6933d51e8542495a3c7b764316175638a9bd953870459cacc03f17fb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700994626, "uuid": "4ece20e4-78af-4911-81e9-47a77ceeb709", "comment": "Malware payload (Smoke Loader)", "value": "7e7afea9d5d259a1477b6ebe7bcd7416b315dcc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700994626, "uuid": "874df771-3a04-4850-b3b1-3364ed74ece1", "comment": "Malware payload (Smoke Loader)", "value": "d207e0fb357616482ba6888fba0a28995fbd1a92537fc80b320c4dbf70662dd5058386f4319e80243371c246d642d165", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700994626, "uuid": "7b751f27-1ffc-4579-8ef3-81727649beab", "value": "T1EF54E71392E13E44E9268B729F1FC6EC778DF6509F597BA922189F1F04B11B2D263B10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700994626, "uuid": "f9e178fc-5b0d-4f51-b311-b6ee582d2fe6", "value": "32e191367f9932caeeb9bed9a82d73da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700994626, "uuid": "cce788e5-e354-416b-9f00-e1959f3d99dd", "value": "3072:+JLu5oIAjWbfxosyNJmYopJD9BOvXZx8pzoQ5mgBay05kVyBk3eFx/RiPB:2a5/uWbZ0mYk99Ev0zc4aB+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700994626, "uuid": "8fcbd328-7eaa-4f27-8a4d-3606a5d7c36d", "value": 295424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700994626, "uuid": "067aef61-3740-451f-b01e-c744c878b667", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700994626, "uuid": "42f978f6-382b-49e8-91b3-a6ba121428f6", "value": "e46a2677fe5342b0876181cb1ee3bbed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55760114-8c7d-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701018042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701018042, "uuid": "b2b3ad61-ef6d-4a80-949b-c9facabcf596", "comment": "Malware payload (AgentTesla)", "value": "9bd78fe505ac23241b36e3561eb5e579", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701018042, "uuid": "358ee912-ac1c-4f13-a859-ad5d4556d64b", "comment": "Malware payload (AgentTesla)", "value": "d6e0b3d79114481b9a9857e79907df7b2db60cdec113367e9826300d3d63b943", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701018042, "uuid": "2232ac60-b918-4558-8773-21385aeac88b", "comment": "Malware payload (AgentTesla)", "value": "3cda789cca02ae3dc09490d8f71538bee9bc698e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701018042, "uuid": "7937b083-0dc0-4b54-830d-9bc7bb793654", "comment": "Malware payload (AgentTesla)", "value": "1e442ddd582f1710dca3df4666437466557464a0bcf8799a68ca10811e0521609465d895efdd3af59f06d854e2a1f285", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701018042, "uuid": "2f50ca73-2190-498d-827a-ae5d0f4c3886", "value": "T1C8E412A0722A8D85D4194FB21C374E50067B5E0E59A9F80D34FE3E2F77B374129A2E5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701018042, "uuid": "006cb15e-6af6-4d80-ac70-63f42616f5de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701018042, "uuid": "7a04247b-9eaa-4114-a801-1b6d6607302d", "value": "12288:O8zS55mFzNsfc0NEOXv69f5qKO6wy7nU/UQ0MQvjA/FHW4kmm18EAmD:Of55qRs0o7oa6HnU5u0DZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701018042, "uuid": "8c1dfea9-cb5a-4bfe-9b68-eb68f979e404", "value": 685056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701018042, "uuid": "074e2be4-15ef-4149-97aa-aa0bce9aae80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701018042, "uuid": "9855c1a1-424a-4aae-9268-9f1977f750ed", "value": "AWB DRAFT SHIPPING DOCUMENT_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deb6241a-8ca7-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1701036311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701036311, "uuid": "37a20233-68be-451f-aa7e-4e230fb8c24c", "comment": "Malware payload (RedLineStealer)", "value": "07202cc7ab051d5bc6b61ac06e9aa76f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701036311, "uuid": "4366c319-9cd6-4486-a3a2-05727a6d9d78", "comment": "Malware payload (RedLineStealer)", "value": "d77e8fb5ba7a82bddd984983702943ed713fb7ca6f09dc24ab4af882a6501024", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701036311, "uuid": "d1708bc2-9cb0-47df-951d-72252c750e66", "comment": "Malware payload (RedLineStealer)", "value": "a358900ebd8d59505374a250083f7a35594dc6fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701036311, "uuid": "0abf292d-3822-4fb8-91a1-232150a6b789", "comment": "Malware payload (RedLineStealer)", "value": "ded6983153ca1b2876a947fc8e62de38c01d5c5159d4dc8ea99f230f5cd27306fcf028138451ec8a33d9e15f2a035cb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701036311, "uuid": "d03b6762-938c-434d-9d18-d73db55a448f", "value": "T15B8523527ADA9423F9B83F304CF507571A36B991FBF0835B07566C065B23294A9B233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701036311, "uuid": "4135b2ce-91d8-457e-a8d5-968bd90a074b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701036311, "uuid": "5e2ba32d-8390-4896-9445-130c0b7f25a2", "value": "49152:8YnO2jehtZtpasdh1wQQZ6MvbN1nYJ4as:VO2jeLtdQIMpBE4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701036311, "uuid": "bb3b98ac-b854-4a33-94a4-540da6d32d59", "value": 1770496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701036311, "uuid": "9fe740df-5fd6-4b5c-a092-4f6f34ad697e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701036311, "uuid": "53269554-4f02-4cf7-8319-e8418651c979", "value": "07202cc7ab051d5bc6b61ac06e9aa76f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c163e843-8c7b-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1701017364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017364, "uuid": "8f70305a-59b5-466e-a188-3ef9efcdedc3", "comment": "Malware payload (SnakeKeylogger)", "value": "9176d70680c26f6ecdcaa34176e156cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017364, "uuid": "19592d36-5a94-4c10-b218-fc8a8ed221c7", "comment": "Malware payload (SnakeKeylogger)", "value": "d80adfb429565563472cc6e9d4fef4b8435c2804ad977c4f4d5452cf5462cb59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017364, "uuid": "5f503988-37df-4e4b-ba50-095e02aa65c6", "comment": "Malware payload (SnakeKeylogger)", "value": "921afd31d5f7acaf2308325346a705d2ca11d18e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017364, "uuid": "3c1b1569-85ff-48c6-a940-97406a34318c", "comment": "Malware payload (SnakeKeylogger)", "value": "00e1f57d493d186dddfa0d47167c307753c57bc8b89bb7b9e44e42d8806934365db4314fa55ef905cccc826e7119418f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017364, "uuid": "1daa6f70-102f-44ca-b327-8f6efec2267f", "value": "T12FA4231411A8CF7EFCED0B73A861071B2F3BB50618CBD6355E8061CD1A51B6E89856FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017364, "uuid": "80bc3f53-16d9-473c-a0e3-65e470a3b824", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017364, "uuid": "43dab510-b9bd-489a-9e9d-b755c90afd7f", "value": "12288:/y8opMEnPv0OxHxsk22oAKXTYLzLFjLm5AbAJzh/j67FEoc05n1F:/FUv/xsk2pcLvFjLmxjEEn0F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017364, "uuid": "709c11ba-2ad5-40b5-aff6-0f1ed2844f08", "value": 486912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017364, "uuid": "b77724b3-d8e7-43b1-945b-fe187a3a710a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017364, "uuid": "2cec2efb-1c26-4d50-941e-68dbd0e9f9be", "value": "Contract.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad6cb678-8bfa-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1700961926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700961926, "uuid": "fb43cb9e-0be8-48d2-bd7a-5b56e5e421af", "comment": "Malware payload (RiseProStealer)", "value": "e80751717cca8236214c5032c6083f73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700961926, "uuid": "c4329ee8-1c93-48a6-9345-c392ebdf0503", "comment": "Malware payload (RiseProStealer)", "value": "d8d624051c7bc4021ca762c5c495afb41f8dc89d0ac010de46c1d15cfcc3fe39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700961926, "uuid": "5864b65f-60ea-4f3a-aba9-9bc9e0678086", "comment": "Malware payload (RiseProStealer)", "value": "ceb55c4cc4d63c54c40e7ae33d667769b4f36302", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700961926, "uuid": "675537cd-f04a-4ab5-86bc-3d1d2292728e", "comment": "Malware payload (RiseProStealer)", "value": "1f56b210facadff5501fa6c7cbf7be7c77ba19d77b9b33a007f7bd48f837262abbbedfba89e7155938d24a79ada13fcd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700961926, "uuid": "b6e39888-bb06-435c-bea5-e594c8057296", "value": "T11C658C31FA08D4B6D09210B0916D6A7B91587A322BAF4CD7F3C05E6E41B52D2F235F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700961926, "uuid": "6226eb71-45ef-46d9-9606-6996ed2946a9", "value": "078471ac5a76189ffe465abe0c89c6b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700961926, "uuid": "b50f6058-a378-4bd4-988f-014ac8dd831d", "value": "24576:2opGDjnvrPpkjos0OtjcFc5kM49dj+IuxWQOIjuJuVvhbqL0HtFcgekRP9dT0WNI:OnvrPGT0Egyudc4tI3bqL0NFchaP9dTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700961926, "uuid": "372d1001-d82a-4761-ab54-33a813898687", "value": 1539738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700961926, "uuid": "4979c744-fd2c-40cd-87e1-2d347c9ed287", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700961926, "uuid": "1bfa98ce-d341-4586-b124-66a94c0b57a1", "value": "SecuriteInfo.com.Trojan.MulDrop24.22194.16521.8367", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d598ee2-8c88-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1701022887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022887, "uuid": "a4383dea-464d-4872-af6a-864ccadec887", "comment": "Malware payload (RemcosRAT)", "value": "8901b2d7b0b566d5f5b44c0e952ac535", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022887, "uuid": "1cf114c2-e1d5-49f1-895d-6bb4999ca130", "comment": "Malware payload (RemcosRAT)", "value": "db4f57bfb4b4130e7d017e417b6c84f770d54e80d03bf24c0c8f4d3fbdafe357", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022887, "uuid": "fc57cc5f-b2b0-452b-aa81-26b38e0c14e5", "comment": "Malware payload (RemcosRAT)", "value": "d1de36c95e003d9350a535e33361386ad98cf48c", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022887, "uuid": "48f7b2a6-7124-42b7-adc1-3c0be6689079", "comment": "Malware payload (RemcosRAT)", "value": "03957f0c05819e94d86b9311aa1daf0a72ec4790187e835874b7d7d46973d44a370186d1d25512325389b89d09c90c18", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022887, "uuid": "7e26aa15-0aa1-47ff-ba7d-d7faa1647822", "value": "T11F140A2039FF504C72737F956FE5B9A54EAFF672266E60AD1014030B4E63A80DE61B72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022887, "uuid": "03cd2f03-9e0f-48b2-a915-e559c5fba36f", "value": "6144:fvvvvvevvvvvsvvvvvqvvvvvDvvvvvOvvvvvavvvvvevvvvvOvvvvvfvvvvvl:fvvvvvevvvvvsvvvvvqvvvvvDvvvvvOc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701022887, "uuid": "f8aaaccf-461a-4451-8a89-b3c3eafc518e", "value": 203102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701022887, "uuid": "0b382bcf-e057-4855-aa59-f3483fb0d6e4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022887, "uuid": "22e9b216-50c9-4902-8da7-58bcedb0e539", "value": "Bill of Lading & Packinglist.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "641ea35c-8c7f-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1701018926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701018926, "uuid": "1d0075b5-ca6d-4da8-b94a-47175f050098", "comment": "Malware payload (RiseProStealer)", "value": "2c9b25035ad1bb9cd204a08b5a35e68c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701018926, "uuid": "f454a1ab-1c2c-4100-abb7-48de19933ebd", "comment": "Malware payload (RiseProStealer)", "value": "db652b5b0fd8ddbe02597797ee78c8a05275a00bf1905ad10e584252bba13c02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701018926, "uuid": "5bcb790c-38d9-420c-8eda-c7b05b2347da", "comment": "Malware payload (RiseProStealer)", "value": "e43b339cdad722928ec19680f66b9fb6e9141d61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701018926, "uuid": "6c595359-d1b0-4d1d-9c1f-62a35f661bb5", "comment": "Malware payload (RiseProStealer)", "value": "38600d19dc64565f0b2e5c1aa4fc9d90827510cac8d404f178ec9a9ccd91dc590e7fcc681f5b1643251c20480022bc29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701018926, "uuid": "9873a8eb-61c6-45b6-a845-7330d76c2720", "value": "T19695334AE9E80436E9B377B058F906970B74BC91EE2CD7726B01069A1CF31C5627972F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701018926, "uuid": "6ae004f0-c749-4c5e-9da7-8b5e8f627c16", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701018926, "uuid": "a2ecbf3d-db36-45d2-aa8a-9879349993b2", "value": "49152:Rz2/hJzR9qRey7IqV6ru1CtoDHiRUXjGahie7:U/3zR9CV911CiDCRUTR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701018926, "uuid": "66b4b6a9-9cce-4d4a-a4cb-43ad73f8ebd4", "value": 2025472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701018926, "uuid": "089d63d0-e40d-4a79-92f0-c8f9aa9e1ebc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701018926, "uuid": "7fd8aecc-7859-4f50-9187-24c9e8ada0c8", "value": "db652b5b0fd8ddbe02597797ee78c8a05275a00bf1905.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aaab03f-8c88-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701022775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022775, "uuid": "1200565f-b20a-45c7-a932-86e83129126a", "comment": "Malware payload (AgentTesla)", "value": "e40b02f52316d85f32ed05c34f100a9a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022775, "uuid": "9301d248-e0a4-41d4-929e-27c0f5544fda", "comment": "Malware payload (AgentTesla)", "value": "dd8aae27e7726cc2fa28a115919e94014d94b8300018c97fc06448f8fea2796c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022775, "uuid": "6aeeef20-11b7-4fb8-b2b8-e8bc5f37cca5", "comment": "Malware payload (AgentTesla)", "value": "9d90e3bc34698ea7cd32a1e01fa5bc36e83a62d3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022775, "uuid": "7d3cf7aa-01a7-4921-8d56-2ef24d77b345", "comment": "Malware payload (AgentTesla)", "value": "d975264f3badd6c2d4fbe2bbb41a07c77138768b8651f673cbdaf2911976bfc8004dd0d2f7e2784680a8c5caee9c6875", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022775, "uuid": "dcdd4eef-2081-4a50-808b-ee1d23668828", "value": "T1157401423B90E05EE66147B21F3B1DD267A23D3D6562B21B7370F30D783E5A1960EB4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022775, "uuid": "2376bca0-3940-4c1f-b826-73a2be231773", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022775, "uuid": "89f12e1c-50f2-4142-a07b-13e6fff312dd", "value": "6144:bNDlOltlhX8OMB7p7sKBWgVEfaq3Az8wG8dZIu8I0bCy1Fx0iOk9+RLWps:but7JMT7s4WgEfav8wG8XfD0ey1F6bky", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701022775, "uuid": "cf463932-92be-4d43-920d-a155d7d2e836", "value": 366063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701022775, "uuid": "54173362-951a-4572-91dd-822b7454cbe2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022775, "uuid": "20ba9dc4-b78c-46eb-b755-20835cd61b1c", "value": "junta justificante.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6256b8a1-8c7c-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1701017634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017634, "uuid": "14a122eb-4dee-4b4c-9457-9ff8e6814a0a", "comment": "Malware payload (SnakeKeylogger)", "value": "791b1eedf60deb460c18adf14264f32e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017634, "uuid": "8b8dabae-8642-411b-b500-5bc74d69f98a", "comment": "Malware payload (SnakeKeylogger)", "value": "e01abaa9e6305466b3a738296e3d2509519e181911d1ace2f2392e913b8418d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017634, "uuid": "cc3be10a-1bc8-4f8f-81b8-52637b629140", "comment": "Malware payload (SnakeKeylogger)", "value": "46d899ffb3cfbeff5287b5513846000788c06ef4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017634, "uuid": "8640e1b2-5f47-459a-838d-98cb49cd47e6", "comment": "Malware payload (SnakeKeylogger)", "value": "9e3d6f8218332c0629050078102268c387c24d80e6f49546697519cfd781757da4ada6609d73e6ae6fbf5feb1e111a9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017634, "uuid": "0f7c1192-d252-45b5-8998-3ea1dc2e25c7", "value": "T10EB4230373C04F23D2EF437A21BB219117B892F9D925FE6C1AAA21F78D25B289D55703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017634, "uuid": "2f958e58-fa11-4a22-87fc-343749de9a4e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017634, "uuid": "bbc5b358-674a-4c50-8dd5-38fcbaee4a6a", "value": "12288:O/f40KiK9YmcZXy3zuyb9gxjDc4l8kK4ENzuC4K:i4CKYFkX9tEEN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017634, "uuid": "e40481af-d2a6-4420-aafa-b7ec12f78fde", "value": 534016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017634, "uuid": "c59d6d15-ab91-4635-89d8-990d27ebda87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017634, "uuid": "a45a3988-47df-4a0c-a2b9-87ec9d4e766b", "value": "PO 13045.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b37a643-8c37-11ee-8907-42010a9c0042", "comment": "Malware payload (DCRat)", "timestamp": 1700988014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700988014, "uuid": "4f3c52a1-cba4-4c2a-9a2d-aaafc7b61918", "comment": "Malware payload (DCRat)", "value": "0d5c7b052f8b34dabfe6abf1e009024a", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700988014, "uuid": "652e10a2-316d-43e4-9424-205f78e66ba7", "comment": "Malware payload (DCRat)", "value": "e03038827ba08d9b531f67f1face2f3bd11b9b962913107536b36fa3efa57493", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700988014, "uuid": "0682d2fd-f010-4227-81ba-8c728eae5766", "comment": "Malware payload (DCRat)", "value": "e2cef2325722c66ee6104bc46630181136d17b19", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700988014, "uuid": "bbe07858-41af-42ca-a8db-958337e3f0d8", "comment": "Malware payload (DCRat)", "value": "8c08351d7c6f14954d60875ba9084b15a396926f97f40456678d69beabb202c793b8550dcbf7c973ec98cc11f1b55da1", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700988014, "uuid": "ebe54900-4a25-4046-9749-7a38a8473b20", "value": "T150759E16A5D24E32C2741B3192A7017E9390D7623622EB0B355F64D3AD4BBF48F736A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700988014, "uuid": "47fbc63b-cc38-44a0-96ba-ee217f9fce0b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700988014, "uuid": "94cde020-64f1-4b77-8185-ccad51096abd", "value": "24576:qSmED50/pi/cgvhhAjgjQDLQZgmwS310dlCByMbLDV/g1BVeOXeoEIZQ+L:qSwgZhM2QPKPdUWd/QvReAQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700988014, "uuid": "05cc796b-b4d9-4c1e-8112-b508c9333d84", "value": 1644032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700988014, "uuid": "5dec5538-8b57-4895-b59d-10ec6b0c7071", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700988014, "uuid": "51d8c7d7-ca0d-4879-8ec7-0151cbba2efa", "value": "0d5c7b052f8b34dabfe6abf1e009024a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a81115a-8c7b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701017084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017084, "uuid": "8fd2c504-e77b-4019-a1a4-0fbf64246799", "comment": "Malware payload", "value": "a7513c16a99ba5a5df3a4e9a5bd813a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017084, "uuid": "8e4c14c5-d79f-4d49-8238-e1fbb5f83e84", "comment": "Malware payload", "value": "e069f512b83888542932c4b7fb8d4030cbafdbbe57639991093fa3390000bb73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017084, "uuid": "682031ee-1bca-4b5c-aff8-f0407c84e655", "comment": "Malware payload", "value": "f91e68569f3247b7b4b8873cf312ea778bf2dc0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017084, "uuid": "6c71c514-9e3e-4f5a-ab7d-b22beedd65b2", "comment": "Malware payload", "value": "bad602b58d38588eeb66417ca3378328e8a2485d1d8328ee8276969415879d962f556be6ba72b3eeb189abcf491cb484", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017084, "uuid": "2d759ebb-12d6-4c6c-94ea-2e7865d3794c", "value": "T1AE8622117580D1B2EEE3F0BB4BDCFA26579DD160072494DF16C81AEEE6306C27A316E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017084, "uuid": "ac1af4e7-2d76-4bb1-bab6-60f62b47a550", "value": "bbe2990d8b692a2bc3e523d54929d6fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017084, "uuid": "e8d5bb8f-5e2b-412b-acff-ebe06953fdf8", "value": "196608:4x54Zkolh3fud93YJ7qZgegZWEFkDQFyTJyD:4x54l+YJ7qS8DfTkD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017084, "uuid": "eaddf3d4-81f0-486d-8d6e-aa44633f753f", "value": 8005920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017084, "uuid": "38d630b5-6c74-4aeb-ad80-a7753619953a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017084, "uuid": "b34171a1-e176-4172-af6a-a8a17153eab0", "value": "a7513c16a99ba5a5df3a4e9a5bd813a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7b9a10d-8c85-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1701021616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701021616, "uuid": "2fe4a084-b2f3-4ad7-b793-0e0d0c41b0a0", "comment": "Malware payload (GuLoader)", "value": "e553f97ee06fb23d3d19d63c9c1d034b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701021616, "uuid": "cde76676-05bc-45fc-8f4c-8bf866dc34b2", "comment": "Malware payload (GuLoader)", "value": "e0fb6016daf6a37abe27dcdcab73cea16e85ef7fef8cd5e441a85a3abac68259", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701021616, "uuid": "b4b4576a-c666-4817-a76e-c877280259ae", "comment": "Malware payload (GuLoader)", "value": "1424025c94fd9a2c19b919e5bc83656650ff4cc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701021616, "uuid": "463219e5-9fbd-478a-b8a5-e70500c7a167", "comment": "Malware payload (GuLoader)", "value": "efada9fd9bb2d5ab3e3ba6073200a09254b86971bccb6cfe3d8b1e3906d489b4aca6648bdd7fa3d24fa72947ae0b3dab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701021616, "uuid": "8b9004e0-2587-4941-a9d8-6fa4a91177d4", "value": "T17EB4121E7DD1C0DDF5898771A766CB0B56DA7C032246220B7FB2ABB94B24793D80E4C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701021616, "uuid": "7bc2191d-f8d3-44c5-912b-7d1dca6fca0c", "value": "7fd61eafe142870d6d0380163804a642", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701021616, "uuid": "baa7657c-c70e-4333-bb8c-ae3ba1bb0744", "value": "12288:iaC7FnGkuvCTSzdolTvkw9hH19aYZv/SPqpivm/:E7RGpvCTSzdoB1hZvkqpx/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701021616, "uuid": "62dd029a-e4cb-400d-ac1b-af8fd62a52ed", "value": 509128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701021616, "uuid": "95ef2378-0723-4c9d-99f2-6c0f6a3d2bfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701021616, "uuid": "c58413fd-798b-4926-acbc-709fd1b4459d", "value": "25-23PJSM-653.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cee7509-8c7c-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1701017518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017518, "uuid": "4b620a2d-a4cd-48d0-8210-0cc238b4d6e0", "comment": "Malware payload (SnakeKeylogger)", "value": "5859deb7a9114c494516b03411c9165d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017518, "uuid": "e9ff83ed-4925-406a-bdc8-5ca26e000af6", "comment": "Malware payload (SnakeKeylogger)", "value": "e210886b7dd377ce7c5e9642bf043bf17c8943adabf2a940ec6844f286587629", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017518, "uuid": "e7f45e6c-fd5b-4934-9726-645035ad4bd4", "comment": "Malware payload (SnakeKeylogger)", "value": "a1c5aec26f47eb5d76d9d80048c5fed2ad75ff2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017518, "uuid": "da502559-64f8-4114-bbe8-07d557b608a4", "comment": "Malware payload (SnakeKeylogger)", "value": "6aed22533f02a5c71c27ee3d2488b76b731bc1e4ab5946e641d42065d7ecccbfbd2557ac425cc725e4516815141af545", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017518, "uuid": "237baf11-86c2-4a3f-a454-2d33db5ccdf1", "value": "T152358D04B2A68B84F17CC3F840526092A7B47C9FF25DCB8B8DC779DA3971F911519A2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017518, "uuid": "93411f98-34c8-42a4-9d6a-5b0f8dc8b7fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017518, "uuid": "64e515cf-8a70-401b-9e50-41cca016f431", "value": "12288:sQ4fzMJr5vyagVsQVo2T4iOAS3De5EbqDIe0OLKcWYEb:T4fzMT3gVs8o8OAAe0OlC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017518, "uuid": "ed5e842d-71dd-40c8-9b6f-b120ad676683", "value": 1064960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017518, "uuid": "28e96b34-296d-431d-a125-01388c6d98ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017518, "uuid": "8d86ca32-bd7c-423b-b0ab-410b1d1bd854", "value": "Product List.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "245f71a5-8c7b-11ee-8907-42010a9c0042", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1701017101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017101, "uuid": "4e91bf82-b640-4c44-81ea-82aa1ad6cda0", "comment": "Malware payload (Rhadamanthys)", "value": "eec338fddd2d5fba1395358179c31f43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017101, "uuid": "0316ab56-d3c4-45e4-8341-720e17a6391c", "comment": "Malware payload (Rhadamanthys)", "value": "e22dc4909170a6ab08366719767378332be2f0ee62a43a8e6883c37ac720aa6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017101, "uuid": "29317b63-a881-4a27-a618-f9c77ee93853", "comment": "Malware payload (Rhadamanthys)", "value": "e9344af6c7353a7aeae032c5469dda7a5a865d3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017101, "uuid": "e4f147ca-3c3a-45d1-bc19-ed5867c8edad", "comment": "Malware payload (Rhadamanthys)", "value": "63b3ddfac33d1680eeba633024b7c7ecf0c2954b58f261e669431739582894ee5265c509ead83eddf0c76f0109197409", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017101, "uuid": "36bb2edd-f073-4f2d-a3c7-8a4d315a97ea", "value": "T1A5C55C16B7B801A8E1F3C27CD9A6465AEA7178454B30E7DF12A0465E1F33FE19D39322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017101, "uuid": "8b28b7a8-7a45-461e-bf44-dae4e7724aa2", "value": "5f091eecefc1b49cd7a2a9cf6847cbb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017101, "uuid": "61dce954-6084-464e-9fda-624c31cc206c", "value": "49152:OGPXINuiBg8FsUMLMX/mH/xnJhMrqF3Ie73PpEfCTV:OVuirsUMMi/jC2ei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017101, "uuid": "28939017-b5c8-449a-974c-93579453d692", "value": 2515968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017101, "uuid": "1e520037-092f-4949-b497-d312e6816d6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017101, "uuid": "b183d6d2-9ce3-47cb-a18e-12a269a970ca", "value": "eec338fddd2d5fba1395358179c31f43.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e49e41ab-8c89-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1701023436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023436, "uuid": "e555cfcc-dccc-4e55-91f8-067ed4f0f678", "comment": "Malware payload (Formbook)", "value": "00e2bb2624c734506abe9d2c5bd89ade", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023436, "uuid": "1b3d5cfc-af6b-4a02-805d-d4ece22039f0", "comment": "Malware payload (Formbook)", "value": "e3446e1f5a6de1c690cc7cb5cce30547173164c67d9a4ebb6570545c69b34933", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023436, "uuid": "ca97c6a5-e7e0-4061-834d-e8504141e053", "comment": "Malware payload (Formbook)", "value": "fe9ce13b890558a8c85c88cddafdc07fc943012b", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023436, "uuid": "b087d785-c6bf-4b75-b1d8-dddcc98bf30e", "comment": "Malware payload (Formbook)", "value": "b3b86f36722fa233cd0b2aad4cacbc405f3b897a736c2597a181c0f759e7f500d060ad8aa86df6d1a60c207720c5722e", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023436, "uuid": "d9423484-ff9e-4095-956b-18de53710d63", "value": "T1B225E12952B44F9AE8BB93F58568420507F6BEA9403BF39D5DC170DB4E32B814A07B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023436, "uuid": "946e3e73-cf6a-40ff-bf2e-b6c440c7bac1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023436, "uuid": "7bb50c06-a7d3-440f-98e6-dce37b88e7a0", "value": "24576:SFtD/619Y/FCmKv9XHzrxHoojg6RDJ23wHENt:q6b6FC31HxFcWUr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701023436, "uuid": "ab31017f-5e3d-4a35-a590-035e1ceb447d", "value": 963584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701023436, "uuid": "378f55db-37b7-4860-8339-d58c6da4d185", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023436, "uuid": "33ca4f39-8f96-4e28-ae01-8d00be2830b0", "value": "Dhl Consignment details_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc28dd73-8c9d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701032012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701032012, "uuid": "6e5e7aea-9799-4a22-9678-dcbc697b90e7", "comment": "Malware payload", "value": "7e7d876d47dd7a8eec697d8568663a06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701032012, "uuid": "ef0ff3ec-a904-4498-b888-7fd060b411ec", "comment": "Malware payload", "value": "e375f26b657d9850d7f94a69883c99942d3c32d21a85435f825fe90016da884c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701032012, "uuid": "e442d131-4a1d-48aa-95e4-23321e0787ca", "comment": "Malware payload", "value": "2e7ab02e99391fb4597a1a7e82bfa3104f004b2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701032012, "uuid": "789c4087-69ba-4a83-8f16-69cffb9e3311", "comment": "Malware payload", "value": "bdc8eb5b4460fb512416ca4bce229572c052d0a7da8a3504fabc9b113a6018c7ad13df4ff87e95247b5210391ab01ec3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701032012, "uuid": "b97e4a91-12e7-459e-9ead-5ae782ac4e7c", "value": "T13EF733E0974F410AFDC50BBEEADA3A57C223778996E40829D4CF646F4A71E13C61B05B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701032012, "uuid": "25aff74d-6620-43c5-9c53-ad6a32f02627", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701032012, "uuid": "9124b8c4-1697-49f5-82a0-5e970c34d341", "value": "1572864:GXpHvAncxy99a+aBmyNGFNdsSITfZiv7PbdpWBrhB6/l:GlGcxy9kTMmGEAjDdpK6t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701032012, "uuid": "4a9ebc0a-a831-46f3-9d58-b76e0d5d8bf4", "value": 74206372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701032012, "uuid": "fb95d55b-6a49-41bd-b582-342af8b1c0ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701032012, "uuid": "a5c9b00d-ec3f-48bc-a9d2-04ee61bbc041", "value": "Portal-Souls-1.0.5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72fdadb6-8c7b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701017233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017233, "uuid": "e1d9e444-05af-4a4c-bf8b-18942471fbea", "comment": "Malware payload", "value": "6c3dc29e2e491beed780cf04fd770560", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017233, "uuid": "7f222b5d-da1c-41e6-b9bf-0ba326c4a4d4", "comment": "Malware payload", "value": "e426d8096da87dc44e070d7934b8eb7cd996a8a19491f57234c8a77fa26f5471", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017233, "uuid": "18cb2c27-8b13-4c26-ae4c-bf6a47c405b3", "comment": "Malware payload", "value": "5babfacb2fd257326c6ebd2ff02019f9dbb480d8", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017233, "uuid": "56f3b9fa-d665-4038-9c86-8994186527ad", "comment": "Malware payload", "value": "4e637e3ea6f0c6cf3f4d08c437b6a9dca91591eaff91057fae9637049609c215bc024f76d4b046e1508ed5900d929150", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017233, "uuid": "0f8b318a-76a5-4dff-ac59-8c4731f775fa", "value": "T1C5E5E01275C2C532D1BE06701A29EB7A417EBA200FB099DB63DC5F2E1E725C15632FA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017233, "uuid": "9d15fb52-c090-4bac-b376-6762cfca0e09", "value": "49152:ft8YP5T68otYLN4iFvr/7RaKAcXGQt56YK1JeXl2at7eCArKOd1QjdKgmrL9EAx6:aY6YLAXeajG4QjdKgEClbZp82", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017233, "uuid": "8888e2b0-057a-4340-818c-af7407a43adc", "value": 3157504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017233, "uuid": "ffd30d1c-0c3d-43b7-b584-c08748125721", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017233, "uuid": "d377c5e8-f593-488b-a7ac-6badfec9cd41", "value": "AI_ChainedPackageFile.WCSetup_AppWC.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cff433d-8c8a-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701023531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023531, "uuid": "9627ac44-bf33-408b-8b47-5084af50acfd", "comment": "Malware payload (AgentTesla)", "value": "83065805a50a8e2d3a74d0f3f630dbf2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023531, "uuid": "9e7db1fe-a5af-4189-af92-bebca1d3967a", "comment": "Malware payload (AgentTesla)", "value": "e52c2bbc31d96a46c4e735a71ed57b3d6b7a644c9132eddfb1cdc3c996570c98", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023531, "uuid": "52829a44-99ee-40ce-b437-f1d54b531341", "comment": "Malware payload (AgentTesla)", "value": "3eec23d4fc9ff7aa03dc5e32bab97f9ffe4b7323", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023531, "uuid": "a674f896-f06c-4f96-995d-fdf42894d14a", "comment": "Malware payload (AgentTesla)", "value": "cfc7271d9b8bb2f25df0fee6099447116368608efc82911fd1568edf7b1861efc399648e7a4523c19733adb3e6d66183", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023531, "uuid": "c8826825-7cab-4887-9e6d-1b1d15259ebc", "value": "T1AEE401463384D966D2C85AB07A2181B851F6FC268CD5E5DAB6D0FBDE417AE00C7CE3B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023531, "uuid": "36008060-89f2-43ea-9526-c251faee20d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023531, "uuid": "8cbefc42-e873-40ae-8131-f93a0d462a9b", "value": "12288:fy8ovLjI4BW2zjUOwzI1bf8g4iYj+QTDYRjnXMErN+hnU9bFmPP0HfAOhE82k/Pj:fFQvIS1pYiYK0OcEr6U9bMk/AOhsoxsi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701023531, "uuid": "f9359b46-498c-435e-aeb5-fc1afc97111e", "value": 714240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701023531, "uuid": "36c9c7e5-1d7a-4a59-a2c3-8e210c97ab11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023531, "uuid": "812d07f1-32cb-4305-975d-da8cbefea357", "value": "PO202033467382TKZ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cffbd80-8c7c-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1701017491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017491, "uuid": "c6709b3c-6500-4cb9-bf9f-e913141bb4bf", "comment": "Malware payload (Formbook)", "value": "8b7c38c4a7ecab9ec748fc749c416ba8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017491, "uuid": "04c63a8f-be49-4df5-956a-fc0be0bd8808", "comment": "Malware payload (Formbook)", "value": "e530118a9d0b15b581bb36ac809c0d6c3e7d1fb0e845fd85de134d4bc8a52898", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017491, "uuid": "c3d417d3-3fcd-4868-bb0c-1263a917318d", "comment": "Malware payload (Formbook)", "value": "7ce9ce4b9b008b43ce07c1932696fbcfebd6b726", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017491, "uuid": "cbb3b477-3d50-470b-b4b7-c24494179924", "comment": "Malware payload (Formbook)", "value": "cac2e2781739ed3867103087d9b8656a2f5c0684cfb906c775b965c282a0861b31619551f05749190f40437f3889835e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017491, "uuid": "b0c59f4e-e1a1-4da2-bbd2-d234e4d0443f", "value": "T140D4231633F0D395D80E0FB31E97ACB7437E811AA6A1F94ED9CDA19D0663B498811E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017491, "uuid": "c2e7b44a-18e1-4ede-b62d-1599c382e4a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017491, "uuid": "d7440239-ce40-42bd-b09d-38eb0c17b1a9", "value": "12288:4y8oWVdl+qTdX0Slz1BOBD+S2TRnZIlzLrY9P6XIYsNkwPR3:4F7r+KNnfBOBD+BThGzLrkVkqB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017491, "uuid": "dbee38eb-260d-44ca-b7fa-2ce1e1623793", "value": 615424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017491, "uuid": "8b29ce57-907f-4ba7-ab9b-37384cc9050a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017491, "uuid": "2506951a-05ea-4f19-b4fa-099134969f4f", "value": "Payment AdviceProforma Invoice No.02172.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "422fb9c5-8c37-11ee-8907-42010a9c0042", "comment": "Malware payload (DBatLoader)", "timestamp": 1700987945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700987945, "uuid": "54ddde2d-ab13-42f1-a500-8bff1bb21ba8", "comment": "Malware payload (DBatLoader)", "value": "4fa301c6f5c6013be9d3b136ef6fbb96", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700987945, "uuid": "e5001eb6-2918-4735-8d7f-50995b37fe05", "comment": "Malware payload (DBatLoader)", "value": "e5590f3ca36c707f3cec8c6fdfecfa949233708dae9b8d11f020906b8058bffa", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700987945, "uuid": "75b96c2a-5334-4601-aa96-2b61fb41a68b", "comment": "Malware payload (DBatLoader)", "value": "1e1e6227b2bc7426b168a492c4b8d202478be1a4", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700987945, "uuid": "5f62fbdb-8b6f-44f1-9ea9-e3fe7f980aa3", "comment": "Malware payload (DBatLoader)", "value": "08e4e26d9d3bd2ee4cddbc01d7d9168863516ba93f1541e64729f6168db1ef10a544881b759eade29dd16d8e445ab6bc", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700987945, "uuid": "ca904c21-4c41-4d5f-868c-1a1c7285dcc1", "value": "T15785E1719FA0C172DC772ABA7C1B8295C92A3E546E5928762FF931CD4B797813831383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700987945, "uuid": "22b1e2c4-9242-48eb-8111-5c58a5df107d", "value": "64246ffa312721d4dcd10d9cecd821df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700987945, "uuid": "f6cd6c94-8f48-4654-8422-b8c8e3babc3a", "value": "49152:bZAtX8IxTqh0eJa3DZEe9sRuCVCW4lMyqChsQ:bZmXX8Za31CuCc5MXC+Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700987945, "uuid": "ab7cc5b5-3012-48ab-a7ad-5740fbcd2267", "value": 1740800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700987945, "uuid": "cbe9c6a0-96ff-43a9-a792-fa305a8f379e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700987945, "uuid": "6327b98b-0084-4f6c-8d6d-a850df99cf25", "value": "4fa301c6f5c6013be9d3b136ef6fbb96.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34248bed-8c66-11ee-8907-42010a9c0042", "comment": "Malware payload (NanoCore)", "timestamp": 1701008108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701008108, "uuid": "68d37618-11cd-4bbd-ad98-91049bb147ec", "comment": "Malware payload (NanoCore)", "value": "5255b3dd53921bebbbf3464f36d9a34d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Exploit.MSOffice", "colour": "#7F0B27", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701008108, "uuid": "61b373fd-f317-4801-8040-1ecb74ea614d", "comment": "Malware payload (NanoCore)", "value": "e58d43d6c26604984dce363a2ffe11c9162e58666f02041df046663554dee403", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Exploit.MSOffice", "colour": "#7F0B27", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701008108, "uuid": "ffffea20-a77f-4266-919f-d5adbb86afb5", "comment": "Malware payload (NanoCore)", "value": "8733b861014f74afbec927bca7a1c2f57cf7989b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Exploit.MSOffice", "colour": "#7F0B27", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701008108, "uuid": "d0fa5e5b-a796-4cc7-ae8c-6079cd43c605", "comment": "Malware payload (NanoCore)", "value": "97c65160f36fa2df8e841cab2a2effceeb68c3054fb2a69425b48122c83bc40fbc4d319500b62d11160aa79be73411b2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Exploit.MSOffice", "colour": "#7F0B27", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701008108, "uuid": "faf64f9c-904a-4449-a024-e315947d607a", "value": "T1A083CD6CD78F01A98F6253369B2B0E8441BCBA6EF34052B5305C937533E9D3DA2256BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701008108, "uuid": "1bc9ae6e-8f4b-4212-b2ff-c84169198a70", "value": "768:aKwAbZSibMX9gRWjkJkdhJTSSxHaGaWYtdIKvX:aKwAlR5iZSKKh6kX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701008108, "uuid": "dd42c542-c348-4aba-893d-5e0dea323b7e", "value": 87371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701008108, "uuid": "37325c1f-b98d-4a75-8422-bde2dac9eca9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701008108, "uuid": "c15d7f0d-1fbd-4740-9f88-dc076f39fda5", "value": "SD237687289.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00d18b9d-8c7d-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1701017900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017900, "uuid": "9a9aef49-da84-46a7-b06b-09c2ec818a01", "comment": "Malware payload (GuLoader)", "value": "4418f199f91334813accf8fcad230ca1", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017900, "uuid": "b4831b3b-d76d-47df-89f7-43a451ee9a80", "comment": "Malware payload (GuLoader)", "value": "e6c904ecec51e2ab5b79e333b7ed9aed2fcfc23d8802ab3d554cc34f4bb24e34", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017900, "uuid": "2c4ad683-82fd-42a6-9f53-0a70576700f7", "comment": "Malware payload (GuLoader)", "value": "39e1a8ee477a93b1ad48b7f286d1775b09b021b4", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017900, "uuid": "d7e36493-c269-4f72-98dc-e09088b9e243", "comment": "Malware payload (GuLoader)", "value": "7dcefe8782b8a8b91603096d2906e390102627e68a1c7a7205ab35c9e31ebddc00b513bc4f68a8828b0287719085ed33", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017900, "uuid": "aee5faf1-bdd5-4398-b7ba-4fc6b62729ce", "value": "T1CF8422973FC080B3D6E249709AF5FEF6A9B4E3145821D0473F941F627E36A404A167EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017900, "uuid": "add2fdbc-28b7-44fe-8383-3fb2e16dde28", "value": "4f67aeda01a0484282e8c59006b0b352", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017900, "uuid": "8bc204a0-b1c3-47b6-bcbb-94306407ffa1", "value": "6144:q1onyPNGWymnAMk203YUh9vIxBCVUklaQ9C/JRo4R8PFzUrZiYXDHIk:WoyPAW5bPEhRIXK19C/JIFUrfDH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017900, "uuid": "62ecfbde-b7c8-48b2-93c9-70595f6730b5", "value": 385016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017900, "uuid": "c5d46538-cd2c-49a9-9274-6f68c2fd1326", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017900, "uuid": "fb9cc1a0-5b1c-422d-aa8a-889cdc5831bc", "value": "Rescheduled DHL Express Courier Pickup CBJ231025122556.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1878329d-8c8a-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1701023523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023523, "uuid": "b66cf7f5-d988-4eb0-8878-88c695860b3a", "comment": "Malware payload (Formbook)", "value": "2ff1e370de7553385686210bc30cadf5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023523, "uuid": "88e7dd40-3a12-4008-9c16-fc0f06e55252", "comment": "Malware payload (Formbook)", "value": "e72b90cdd75e9fcc56f6a017cb0b496ad0292bf4eb58d5f82ea51f98d7472e13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023523, "uuid": "400d633b-b2bf-4b09-a55e-079aa2c76c51", "comment": "Malware payload (Formbook)", "value": "13baac3e90f2ec4591a464a5e82478638432b6d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701023523, "uuid": "a438fb2a-a853-41e2-9657-1eb5236edc7e", "comment": "Malware payload (Formbook)", "value": "284cf10a6fc318d9867409e3af22eed18e5166762a6335239b76c329803d29af3d7c4f8be8475d91c77e25c7ea340a6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023523, "uuid": "7e43fab1-c2ed-4c56-927e-5707c8f04795", "value": "T1CAE42226615AAFC7C8FA13F20A58D00553B1FE295974FA142DD332E74BB87F0A9B4853", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023523, "uuid": "faa54cfa-4cfa-4334-8f04-d2b86a0956a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023523, "uuid": "31174532-e2e7-4fb3-b13d-18f7a02be050", "value": "12288:pE6jD/TFk700lGLMIZxpgchdNq1KHdWRIkT3w66Mp/N5AaYXENz:ptD/uwxVZzgodg1Ko3np/HTmEN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701023523, "uuid": "a3c083cb-da32-4e88-9fc9-bac1b8af817e", "value": 669184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701023523, "uuid": "8edd88fa-7bf9-42ab-bdd0-52e038b4cba4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701023523, "uuid": "bf94ebeb-28a7-43e8-b56e-fb350ab3ab29", "value": "Ziraat Bankasi Swift Mesaji_EFT-17363849,PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c178249a-8c88-11ee-8907-42010a9c0042", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1701022948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022948, "uuid": "7ff54d69-91da-4318-916c-83831a5056fc", "comment": "Malware payload (Socks5Systemz)", "value": "89b6d7bd20e98839bac4e05e7037f094", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022948, "uuid": "d0af222d-a9ff-4c74-b019-1bda9af663d9", "comment": "Malware payload (Socks5Systemz)", "value": "e7aeeb75ea8842f2529e6c8b59d975cc004737f4e663ec75ee715a50cb03afa6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022948, "uuid": "363a437d-6f50-41ce-a382-63309bab9253", "comment": "Malware payload (Socks5Systemz)", "value": "877b6ea0f13dc5f5517d9071f200bf035f806e28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701022948, "uuid": "e8bc8c24-6581-4aeb-ba38-c5b201732e39", "comment": "Malware payload (Socks5Systemz)", "value": "7c8c6fdfe34626676ad876c94e7a5c5600552e14d6520fe8b058b0acca03508851e3c44e986b983a235fa7310775e4f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022948, "uuid": "c51268ec-f609-4a7c-9617-1c6eeab8df59", "value": "T13826339CE57520F4DA25DF7A5E24840213A7727167F9608833CDAD6DEF08DDA1388B3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022948, "uuid": "369fb6e2-69a4-4c7e-8112-c5f3a0171e5e", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022948, "uuid": "ac635b2c-3bd7-43f0-8a83-d9e5a2490991", "value": "98304:exHuoJAeZBGyf5ezguZGJx7eShXOHQbAMkTB5WElE:gBGOIyfMkJlhzmLu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701022948, "uuid": "637948bb-c05c-452c-8a11-cb84dcff0f56", "value": 4808857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701022948, "uuid": "5c76d7c3-90ae-406a-bcc0-415af69fb403", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701022948, "uuid": "4db191f9-9296-4e5f-b394-b210daadf913", "value": "89b6d7bd20e98839bac4e05e7037f094.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d1e8476-8bf2-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1700958301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700958301, "uuid": "9c502fa5-c3a0-449b-b631-f6805aaf43c5", "comment": "Malware payload (Smoke Loader)", "value": "bae4a44dbc07d23ef15e8ae149e3e061", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700958301, "uuid": "a9514563-9b7e-40e5-848f-f6cbafb33e60", "comment": "Malware payload (Smoke Loader)", "value": "e8294c5431401445f5feff3a660f67a803295d2ce86fbd7696c3d95782a6d8d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700958301, "uuid": "41008a52-8748-4f4a-bf36-9f497f1b7566", "comment": "Malware payload (Smoke Loader)", "value": "52abe81dd98b75eecf80df7ffd7c67e09219d9ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700958301, "uuid": "73752fa6-1a2e-4676-8acc-b1af551c0828", "comment": "Malware payload (Smoke Loader)", "value": "cf688614d89fd69f5f23b46d269fea961805bf744a28200736817d0f259c4a19c3788961eeab42f3e68a9f01c5e882cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700958301, "uuid": "45833897-a8ba-45d7-97ef-268464ebbba3", "value": "T17154E75392F13E44E9268B729F1FC6EC778DF6508F597BA922189E1F04B12B2D263710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700958301, "uuid": "0d985a55-0b76-49ad-b798-c2dbcf56aa8a", "value": "32e191367f9932caeeb9bed9a82d73da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700958301, "uuid": "ace15c4f-f4ca-4309-91f2-60ee9b9fa00e", "value": "3072:c2ljgDLZu8wepLa75M5XnEUqeS8nuvJV3UQQq4AQ5mgBID5kVyBk3eFx/RiPB:f5gDI4Lx5XEUlxnuvJVkQQq4UEI/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700958301, "uuid": "37e0cdf4-ab2a-4c7a-b27d-c2e3894052a5", "value": 295424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700958301, "uuid": "0973c779-9175-4053-b5fc-426c79c1e259", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700958301, "uuid": "635d290a-1b73-4150-839a-afbec938123d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "339fe40b-8c37-11ee-8907-42010a9c0042", "comment": "Malware payload (DBatLoader)", "timestamp": 1700987921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700987921, "uuid": "4bb27097-5608-486e-bb26-317cfe1cbf29", "comment": "Malware payload (DBatLoader)", "value": "ae014e9d876464412d3180a8235dbdef", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700987921, "uuid": "6da440b2-5901-457a-b3e5-28aba81614a8", "comment": "Malware payload (DBatLoader)", "value": "ea5cca67b84c377c1c50e3e978fa2bcf6d178e8ce9cb23971c3304359b23e435", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700987921, "uuid": "69f78c00-0cbb-47fb-9550-e8775d846c47", "comment": "Malware payload (DBatLoader)", "value": "bdd571e383b4915f3d68c9747740f209e1c31c94", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700987921, "uuid": "84db2268-d552-4f3e-b6a9-00a293f3c6d1", "comment": "Malware payload (DBatLoader)", "value": "c618a0abbed86f27ac7ecdc2f6687e34330de516214ce4363107eee88e8df5746255d9dec184905e32766be4a5c1d78d", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700987921, "uuid": "4f6e76d8-a98d-40a9-8a0c-fdd926ed768e", "value": "T17785F171DB60C671DCB736BF6C1B8185C82A7E602E4928772FE8358D4E7A7817835287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700987921, "uuid": "75394958-73e9-4a28-a937-d79d32942f3f", "value": "64246ffa312721d4dcd10d9cecd821df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700987921, "uuid": "7e1c02f4-9e47-4ddb-8996-c560b028af17", "value": "49152:bZAtX8IxTqh0eJa3DZEe9sRuCVCW4TMyqChsQ:bZmXX8Za31CuCcXMXC+Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700987921, "uuid": "87fe2587-d505-4287-b617-ef1a53d091ad", "value": 1740800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700987921, "uuid": "1ec98046-a6dd-468d-a24c-1f92ea97b2e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700987921, "uuid": "bf53ea2b-c6e9-4980-80a0-ed1e863d7edc", "value": "PI and payment confirmed pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c631b9a-8c7d-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1701017920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017920, "uuid": "c819a5a7-962d-41e2-a3d8-dc668c2db703", "comment": "Malware payload (RemcosRAT)", "value": "fe206035ed01d81e70839c6e173b9b75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017920, "uuid": "5c33d8cf-97a7-4ca7-a5ce-709a2b44ce20", "comment": "Malware payload (RemcosRAT)", "value": "eb2b838b16132790a2e2ad046f2176548a10d073c0dbb5f3c3658873b378fb7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017920, "uuid": "6bf6a576-de67-4bae-99a7-1093197cf9ab", "comment": "Malware payload (RemcosRAT)", "value": "418d9bad7cdd3024154d6e7939a03f8ec7a86ba9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017920, "uuid": "edc71c01-b2be-4004-b952-7b045252f4ce", "comment": "Malware payload (RemcosRAT)", "value": "21e93e3166f42ed26068c3233bdeab3058f0991c016e5d2341d6aa840a5aeb8744cf7495846fdabdbc2dcbce52974973", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017920, "uuid": "8f47f69a-9484-423f-ae04-f48b688a358a", "value": "T1B7251242B207DFD8E81A47F00C7A465001BA5FAE98D8D90D35ED3E6B7B7632235A2C57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017920, "uuid": "513062e5-66b3-495d-b6b6-ed2b4d9fe04e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017920, "uuid": "8bcfda56-2b27-4b80-915a-0c9a67b49315", "value": "24576:GXB0eT0Ukfiro5hFYjqK3i8sxCpfpe+0pENd:GRhk6rLuKi8sc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017920, "uuid": "f0c75e47-04e1-44a5-bd26-6f8877e2d668", "value": 967680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017920, "uuid": "d7ed16f1-ba64-4e2a-ad31-af4ebfbd304c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017920, "uuid": "c794f5e9-1a26-40b3-9f63-6ea2b353319f", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf88a5e1-8c19-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700975271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700975271, "uuid": "eaf3d5db-1785-48b9-90b9-f95a6c695932", "comment": "Malware payload (Mirai)", "value": "dfe4e71d1db6cf22663be012b11c7717", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700975271, "uuid": "6cd8e887-10af-4fb7-a0c7-7b2b791eb4b2", "comment": "Malware payload (Mirai)", "value": "ec63da0f43b98c5bdd435b851a842cb3ffe6ce0ed8f4bcfaf883efbdf7169326", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700975271, "uuid": "b3613972-12c9-437a-8605-7fbf185721a4", "comment": "Malware payload (Mirai)", "value": "0ede93bd8b3fbbdcb92538b32c35066bf936317b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700975271, "uuid": "378881be-3e0e-4996-8064-7ccf2a993b27", "comment": "Malware payload (Mirai)", "value": "6be61d8b906a5501e15f83dec2bbc9b0f0984cd3a3c316c7f057b3ed585aa4a9dc767868d035b26b954c2d16924c09c3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700975271, "uuid": "b327c8ac-68ed-4e3b-aa13-19d3da02257d", "value": "T124634B033B1C0E57D5A32974293F53D5C3FAEA9122E4BA88654FEB568A34D360583ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700975271, "uuid": "ff272f9c-dee1-497b-b593-e557f85fe93b", "value": "768:9O7Monh+3WKv64pho6N3CXv0Sah/7egiZ9ULCgSDsAEkfIZuHdICvwFTQtUYRwt1:9i9h+rjKXcSaIgkUmvEkEu9IwiQ2Y6t1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700975271, "uuid": "981c8dbc-4334-455d-86d4-3c02b8e1ecd1", "value": 67608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700975271, "uuid": "ae89229a-054a-4539-9c64-cff1333b9aed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700975271, "uuid": "08541597-e125-44a2-8cf6-983cef40a4d2", "value": "dfe4e71d1db6cf22663be012b11c7717", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "188ac83b-8c3f-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1700991311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700991311, "uuid": "ed78e819-9ad0-40a1-9e8c-5cf28c1999ff", "comment": "Malware payload (RedLineStealer)", "value": "0f66c11b84b409c0b2ea602dc96585f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700991311, "uuid": "4c411fd3-1b22-4591-82d1-06bfdddae9df", "comment": "Malware payload (RedLineStealer)", "value": "ed9c56af756bffebc97edfe6ae977c42e77f5bdaeededc4a9b46186578ecdc34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700991311, "uuid": "471e3f69-d878-403f-a929-bb9f0d155504", "comment": "Malware payload (RedLineStealer)", "value": "d96d7df17a0738060d4ddb10d50d60de5db79e02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700991311, "uuid": "06dff90b-5cb2-4f07-ae6e-df0ff14c533c", "comment": "Malware payload (RedLineStealer)", "value": "aa391143f34f06034a568bd6f96df22ffcc1b46f661f9643dad1a6b64bce1672d27a208e5c4868411520cb01bfb6903e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700991311, "uuid": "84a61c2c-c0e2-4ab3-a530-a83e27ef774b", "value": "T1AC252217DBFC257BCEB263300DFA129729367C908979429F7284696D1D22780E97237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700991311, "uuid": "d640ac47-41b0-4c6b-88e0-fe47de035d01", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700991311, "uuid": "f5db1969-52aa-4e4d-abcc-96a23c8327fa", "value": "24576:AyGNQR5BuiZHHXPWFVS252rjBGS8Y5v69Nw2:HUm0iNXPCV6ISy9Nw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700991311, "uuid": "d2da4f26-4a05-4992-8519-4d647e353d80", "value": 975872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700991311, "uuid": "4572f42b-2f85-44a1-bd92-6882b4f112e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700991311, "uuid": "a1bfde3d-d261-4b1b-b5a7-f70ba022ca70", "value": "0f66c11b84b409c0b2ea602dc96585f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "207888c7-8cb5-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1701042005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701042005, "uuid": "727ecfb7-8d6e-4e4f-b2e9-3f3fc7b1be3c", "comment": "Malware payload (RedLineStealer)", "value": "ba34eaf106dc2500ffdb21846e48a14e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701042005, "uuid": "b02d673b-be10-45f0-b2d8-1d7309e431fd", "comment": "Malware payload (RedLineStealer)", "value": "ef8411db0399eaf1712a3b1956b569a5a9c9468e395bc2e11801076c88882729", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701042005, "uuid": "3eae21ad-bd18-46f7-84d5-9eeeb9ff128b", "comment": "Malware payload (RedLineStealer)", "value": "0ac71049e75c040b791cb7d13d2dc2843f01849f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701042005, "uuid": "d009cf5b-edf9-4db4-b18c-c34adb8eb164", "comment": "Malware payload (RedLineStealer)", "value": "23370b15af594c624fb0e6a7fadd5e3933a7327286007a9f1e7ee5d5fda319a02338c0f30e949501c9630cad37c44353", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701042005, "uuid": "aa7ded37-c28e-47f7-9ab3-7156d0b2a1c7", "value": "T17BE4F112BAC184B2C6B165341EF7B631593C7C310B7A8EDF9B940A1E6E314C1DA36B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701042005, "uuid": "21efc05e-9c41-4f2c-b0e3-db0e0b5a7af7", "value": "ab9ff6e4872ea2766a5f5c6af5649e9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701042005, "uuid": "2c6f288f-c5a2-454d-b8fe-08fb1d33a6bf", "value": "12288:K6ErxJMTtEultk8MB/fRRC7hcEPv9Tqa8daABY0NCEDHXe1PHWknWb:KJr8tE+284RRMiFDYLEDHo/Wki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701042005, "uuid": "df0cebb0-0359-46d2-be38-295683252123", "value": 722018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701042005, "uuid": "4b471dc3-9804-49e0-9b61-7362f732d7ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701042005, "uuid": "7a71402e-9954-44ff-a9c6-f25328f61512", "value": "ba34eaf106dc2500ffdb21846e48a14e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0732ee3-8c7b-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1701017336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017336, "uuid": "6af2c13a-fd95-4a61-b538-178242d5c350", "comment": "Malware payload (SnakeKeylogger)", "value": "15263e7a37292fe57209c7f3c1573d55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017336, "uuid": "480594b1-4920-4b5b-880c-74a884a36347", "comment": "Malware payload (SnakeKeylogger)", "value": "f0a380fdc3f7682a1496a867b4506c2c6258db3a13c876625032483e4d872f1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017336, "uuid": "daf2ee7f-9c77-442c-8067-e1437f1600e4", "comment": "Malware payload (SnakeKeylogger)", "value": "f66db7efb5fa5fbdf4d0ed2397d9064f5de20e62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017336, "uuid": "c4567cac-ce50-4a0a-88a6-490634fa8e8e", "comment": "Malware payload (SnakeKeylogger)", "value": "394a8d7c291064247f67312ca164bc3fa85400ac23de906a1210fde02a0cae67b6849ced6ea688931961b52f195045ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017336, "uuid": "a6848b84-20ed-4849-bee3-15a18bb4db40", "value": "T139B4125032975B36D2BA4BF95D72510C0BF4BA3A6872E38ADDC525DA3197F008305FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017336, "uuid": "05822562-7b07-4ab5-a2a6-7c3ae1180053", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017336, "uuid": "e4cf4d1c-93d5-4358-8e3c-fc57947cc7b1", "value": "12288:GuPiP54ahSfBTMIRGRt4W75UrruAgERNG4IpC2:RM4B4HyWI6tERJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017336, "uuid": "59b5e73e-0c41-43a6-8491-73215873e1ca", "value": 521216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017336, "uuid": "2dbcf674-1dba-4731-a122-3aafbc62f62c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017336, "uuid": "e31201cb-fa9c-4a52-ab27-2825887d3666", "value": "TF-24098-001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed6a2d61-8c74-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1701014432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701014432, "uuid": "8b7478b2-95df-4b66-a260-8d82bdfe96e6", "comment": "Malware payload (RiseProStealer)", "value": "a4a639bd504bb10dac51578349a8e262", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701014432, "uuid": "f041d91a-6a65-4b68-9bb2-7bab6efccd84", "comment": "Malware payload (RiseProStealer)", "value": "f18a0df016222da923bf1a86b8d25740a68304a7b91b39eef728e3cce55f4db3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701014432, "uuid": "2cef507e-63a2-4667-a79b-18c5b0ff9b88", "comment": "Malware payload (RiseProStealer)", "value": "dac63d484d7eebaf2039ff799bfd2a7656b3ca21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701014432, "uuid": "8cd7e244-b664-49b2-884d-7e5d3a8d38b5", "comment": "Malware payload (RiseProStealer)", "value": "a99aa5edeac8c590f670cf974bd1b21db717c1df5c4b3e161e776479ea1b2fd1afd96a040dc74421edc8bc6c1cb02bd7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701014432, "uuid": "3036a580-4fa5-49e0-8565-de3b183d7b29", "value": "T145A5333955D4F033FCF4A77590F30AE316BA3D5A453286321B61A35709A7B86B43239B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701014432, "uuid": "8b3ca15b-3922-4f37-ad63-f48562dd6c38", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701014432, "uuid": "5ef7fa97-efe2-4529-bed9-3874bad7ccc5", "value": "49152:9RzDc2vUdyrfvGkJngQAP4upABN3uKsWO2pEtHmgDbH7vlSp:HNNfvHWb4N+yO2S/H7vo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701014432, "uuid": "8b19f57c-e357-413f-96ba-e2509604bb19", "value": 2216960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701014432, "uuid": "2eac9639-6ffc-43b7-99e8-13519eac69fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701014432, "uuid": "8f2d2aaa-87bf-4b7a-96c0-890fd7d50237", "value": "a4a639bd504bb10dac51578349a8e262.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a445b7bc-8c8b-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1701024187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701024187, "uuid": "8c9f5080-97b8-4be6-be72-3a15927f63cb", "comment": "Malware payload (RiseProStealer)", "value": "2f362a236d5065b71f19bec48d4aaa4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701024187, "uuid": "5bd86f98-496f-4eef-87da-1e592e5d14bb", "comment": "Malware payload (RiseProStealer)", "value": "f1f7945d3877cdddee7c137203b2308951aa4c50a687309b13742c08da03c2fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701024187, "uuid": "c48d31a9-4f16-4b34-93f8-c75ea0605726", "comment": "Malware payload (RiseProStealer)", "value": "499870d7195a0c6efeee5732df383a3808e055fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701024187, "uuid": "84709590-5469-4216-ad38-2ec763118736", "comment": "Malware payload (RiseProStealer)", "value": "bc26ceed60c6788f3aa68a4bba58b698904e6978dd2cc2c21eb2b2e056d59874a2096024df878a4af8f70c2b1231a535", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701024187, "uuid": "91756f30-32a9-4524-9064-d75f8a2d215d", "value": "T1CB658C31FA08D4B6D09210B0916D6A7B91587A322BAF4CD7F3C05E6E41B52D2F235F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701024187, "uuid": "824bf525-1383-4a61-861c-94544e18d8f3", "value": "078471ac5a76189ffe465abe0c89c6b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701024187, "uuid": "d9b8b374-f227-42f1-8c9f-b85bac36f2f7", "value": "24576:2opGDjnvrPpkjos0OtjcFc5kM49dj+IuxWQOIjuJuVvhbqL0HtFcgekRP9dT0WNI:OnvrPGT0Egyudc4tI3bqL0NFchaP9dTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701024187, "uuid": "cf83107c-9f5e-4985-8c48-b9907116a0d5", "value": 1540083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701024187, "uuid": "631cb4c3-21eb-4b57-844b-b851a5720b9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701024187, "uuid": "5b4e4279-90d7-48a3-8fee-3ab6ba175145", "value": "2f362a236d5065b71f19bec48d4aaa4e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "651d6c16-8c70-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1701012485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701012485, "uuid": "cec418a4-22dc-44fe-95a5-4d44a62d11cc", "comment": "Malware payload (LummaStealer)", "value": "8f39c05f0b707361ea8bd098b290275e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701012485, "uuid": "4678aff8-6662-4e7b-bb4b-63795662bd1a", "comment": "Malware payload (LummaStealer)", "value": "f2dab1d38398546e059eaeb657dbea85c6370011b6bb6964e71124424a0fe79e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701012485, "uuid": "fd4ad660-8a41-45cf-a16e-3f765708e01d", "comment": "Malware payload (LummaStealer)", "value": "1f165f1bf3f85e3b0b07314996533605aed836bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701012485, "uuid": "4c4c0e3f-9d6d-4c22-8161-52aaec20a639", "comment": "Malware payload (LummaStealer)", "value": "89b05c07f72adef3679a88059f977006f9afa93b10beb39194e24158eb6523115201309f3d0a44353c3bc44304baadc8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701012485, "uuid": "b290b515-970e-4cda-aecb-642c2e1070c1", "value": "T1BBD4BEAA357E042FE3FB067551A9C67A8A720F131D67732FD67E29830790297E8C8D11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701012485, "uuid": "9d2a1204-5e73-4416-969f-9510eb38d4f7", "value": "d46ada1df6dbcaf417425c9854741617", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701012485, "uuid": "c5ef312f-132b-476f-9f1c-7f0d5ef84087", "value": "12288:C701QC2L4q6NtIaFfqebmPwxUg9F+n67K1:CwT6UIOie1j9E67K1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701012485, "uuid": "7a35b6ce-0fd3-4249-916e-a2aa105576b7", "value": 606996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701012485, "uuid": "c9e7f34c-38d3-4dd7-a62b-c2dc9484306f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701012485, "uuid": "ef47b9cf-6dcc-4514-9bca-01d2b4de37cb", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06f6fc84-8c84-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701020917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701020917, "uuid": "d1abcc1d-1d84-49f3-87d0-9f1fa280d872", "comment": "Malware payload", "value": "89ae36448f1922870f1a09c29f17c775", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701020917, "uuid": "e46d0655-269f-48a3-88a4-39414716a082", "comment": "Malware payload", "value": "f34bd1d485de437fe18360d1e850c3fd64415e49d691e610711d8d232071a0b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701020917, "uuid": "c3422448-5cd9-4b15-ac9c-155a7bef5b86", "comment": "Malware payload", "value": "3b1329e81739b1ea6acbb4ec4dff11f02ff42570", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701020917, "uuid": "b8eb9e42-fd20-4b67-948c-2cd06913e197", "comment": "Malware payload", "value": "bf76ae23de34f06562ee0493a3554d4d48bfaaeb75b033d8da5f41d23ce83282e161cd48f7d23fac5188917a82c8cde8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701020917, "uuid": "7476e5f4-64e5-4fdc-8a8f-a8da5b603d2f", "value": "T1FC5633F8933B45B331F687B83622468693E63724D1CE4132AF7D969F5A3FA740990027", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701020917, "uuid": "d2de63df-c8a6-4a29-9200-8ad131e14e52", "value": "98304:/2SwmX4Dc0nAPQmJpd+3MmbLmNzlosf+A+KX9KfbFc7pXIIXXRPjwU12yY7vubtH:/2rmXH0nrmcqNn+A+KXozFc7DdfY78n9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701020917, "uuid": "969f0854-9c72-46a9-a88e-a6f2942ba0fd", "value": 6217056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701020917, "uuid": "2d04b4a0-305c-469e-8e9f-d660c6393bf7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701020917, "uuid": "480e8c26-5bc3-4743-bbc5-57f2831ec566", "value": "SecuriteInfo.com.Linux.Packed.1241.31665.27695", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "350ab7dd-8c37-11ee-8907-42010a9c0042", "comment": "Malware payload (DBatLoader)", "timestamp": 1700987923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700987923, "uuid": "083d8799-4757-43fe-81f6-35cb907d3265", "comment": "Malware payload (DBatLoader)", "value": "7053f043f7bb5bc1318ab14247e872cf", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700987923, "uuid": "62512688-68e6-4ef4-adb9-2d08bf785ef9", "comment": "Malware payload (DBatLoader)", "value": "f52a87f82d672530fb56cb062565ecc0881bd59c71e333895b38c65a9ded043d", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700987923, "uuid": "366c4996-8962-4b1b-b9aa-69bbdd392834", "comment": "Malware payload (DBatLoader)", "value": "1fee47da16c2fe67aba3b683b660bc0359234683", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700987923, "uuid": "c85bf168-b8fb-4a41-ba54-a24cb8066d09", "comment": "Malware payload (DBatLoader)", "value": "da43773f6c662f5ac0aa32d8884c7c0f8c1850f04a1907440b92b72b38f1e1565f8e7cdb8dbae7f5fc5e4643a6be96f9", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700987923, "uuid": "bc882daf-b2f4-4b49-83de-a2afde2b5adf", "value": "T12685E171ABA1C271DC633BBF6C1B8285D8193D50AE5A2C762FE831CD4E797903935287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700987923, "uuid": "5dd910a4-7641-4401-9fba-423b40be05a0", "value": "64246ffa312721d4dcd10d9cecd821df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700987923, "uuid": "2e791e12-6da3-4206-9504-bc50a2147952", "value": "49152:bZAtX8IxTqh0eJa3DZEe9sRuCVCW4VMyqChsQ:bZmXX8Za31CuCcBMXC+Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700987923, "uuid": "3eea985c-48fd-4d7e-b69d-42f56bee7561", "value": 1740800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700987923, "uuid": "8837912c-281e-4394-b0f0-42b668731d38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700987923, "uuid": "69ddf69f-1751-4105-b728-179458ca9d10", "value": "Invoice And Payment Confirmationh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc99232e-8c33-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700986459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700986459, "uuid": "d52bcf9a-3e8f-4e28-ab83-97912421bb3e", "comment": "Malware payload (Formbook)", "value": "cf52e32f7257ad06e9436c2090585f55", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700986459, "uuid": "e436d445-c7f1-4cad-85cb-749df8609b67", "comment": "Malware payload (Formbook)", "value": "f727949e07d541b18cebe8cd2b7bb9d6411de4dc70da6c0d50e192443f7348f0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700986459, "uuid": "2521993a-c4ed-4956-b28f-6aaa848b2a58", "comment": "Malware payload (Formbook)", "value": "343b96d6585f54649029929f433e15f7e8f170cb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700986459, "uuid": "ad2bd97f-5053-463a-8dff-aacfa167b7a9", "comment": "Malware payload (Formbook)", "value": "3f3a717bea66f6dc4b85429960cd426cf0758bb859a8815fb37bd6fc91e3c41869f9d7178ebc57d5f4dbddaae59da7eb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700986459, "uuid": "ad877544-63d9-497b-9c38-30657b34fd68", "value": "T15EA42211BA81D837F19702711E63DDB8C2B17F445D29A90BB3E4BF9F35360CA8965386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700986459, "uuid": "0c5d86b3-3bf8-4743-9b64-757cd1c5400d", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700986459, "uuid": "65f82665-1825-4680-bb51-244df546e741", "value": "12288:HMQ9NbCGz1EAj3xAQId/jvIAl1nUiAbqTtzcN1GrkwX:sK0y1EAlAQE/jvI21nkstzcN1GowX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700986459, "uuid": "9ac777b3-4c80-4911-8bcc-ae6b11cf78db", "value": 467872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700986459, "uuid": "bfe8345d-ed50-4221-aea2-af998170aa7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700986459, "uuid": "acdb1e9a-7a56-4522-a12a-a719995200c5", "value": "cf52e32f7257ad06e9436c2090585f55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e77cdb4f-8c7b-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1701017428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017428, "uuid": "c15d183e-9749-420d-9923-554fa1435d29", "comment": "Malware payload (SnakeKeylogger)", "value": "df9cc5e53cba3ae39407b8869a81e206", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017428, "uuid": "5e048222-8a07-48d5-98de-93b7c21dffd6", "comment": "Malware payload (SnakeKeylogger)", "value": "f8af447d9c19f47df305a44bc8556a1d0f651c22d911f320a53c2a36556988ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017428, "uuid": "f9a14d90-8590-4755-ab1a-7937c1b3a517", "comment": "Malware payload (SnakeKeylogger)", "value": "b429c5b311055c819506c4c5e4df1c6cc288b008", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701017428, "uuid": "993e739c-e245-4b87-a640-7d80d8ee2314", "comment": "Malware payload (SnakeKeylogger)", "value": "21c03f94d139fa2127b91d675999e3e3c0d81f17001213423c726f30a5d6d1e1dcdc210bb330221e14bd6db0da1cd5da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017428, "uuid": "df06ae1f-52f2-4a3e-a5a5-a1913e71b8b9", "value": "T182F46AEC361075DFCA5BCD76CA982C64EA6064BB530BD243A01705ADAA0DAD7EF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017428, "uuid": "23e0c5ce-39c4-40d8-894c-f89ff95a7c1e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017428, "uuid": "2eb0a51f-2e02-431f-be17-c874a6956928", "value": "12288:HGzkoVGyAbFjc+DUL5iEni6aHr7IoFWNjD76r/ECn394LIVeGy90a9vkL9FTJM+J:QxEyAjceUL5k6IPvSuLEy3SLF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701017428, "uuid": "fb5c0a7f-0420-4dba-844c-4f9ee039ab92", "value": 724480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701017428, "uuid": "341f5718-64a5-4012-9661-8f0d40427f46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701017428, "uuid": "a9bccb95-5729-4e06-b3e5-21faa226d4eb", "value": "Gun Ici Cek Statu Listesi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40ad85ef-8bf2-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700958307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700958307, "uuid": "8f1731ba-47e8-49f1-af13-bb0c06709632", "comment": "Malware payload", "value": "f3f9eb8c2050414cbec862125fa4e0d7", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700958307, "uuid": "0504a19a-759f-4923-b629-4080ab26180d", "comment": "Malware payload", "value": "f95b42089a9feafae415e6dc848ae0916252c92f02915f26864ea10d6ab6030f", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700958307, "uuid": "aca6fdce-9379-4b31-8fd2-c8bb8d27b02c", "comment": "Malware payload", "value": "d71945d599b73b7a89295817d89c80141883973f", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700958307, "uuid": "73bbaf39-2aeb-4a83-8855-fcb648a87afd", "comment": "Malware payload", "value": "3bd661f9fd2d4b2f4a77a97cd56d60de67b7e306be38e5263a9954b45a228d703a4eb4410f3d3b1edee3a93e3e98d249", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700958307, "uuid": "86a7fd78-e747-41e1-8394-41e27b5c3970", "value": "T181E5EF29F86532B0F88DC5B406B01EE403F96CB1122B9BC43235719F976BEAD9A74D35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700958307, "uuid": "4cec065e-c97f-4ef8-99e8-27d3258074ab", "value": "49152:ALSEJH/T8j2EpWh3tA7fqUOZZFJuIpEZaU2qqLtvyCEP:yJH78j2rqmUOZZ3uIpMaULC9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700958307, "uuid": "7beac6ae-8398-4e53-ba61-ec9f02b94634", "value": 3171026, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700958307, "uuid": "a2d26c4e-bc7a-468e-a718-94095aa2d07c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700958307, "uuid": "01fd2be7-6e0d-43bd-be63-01a964e8f0a0", "value": "Information for personal.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "584526b1-8c7d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701018047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701018047, "uuid": "ac202927-fc47-4641-b3b0-c6574ae992bc", "comment": "Malware payload", "value": "47add7b37faf9e1bd6c843beafd83be7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701018047, "uuid": "06b5ea8b-97ee-4e86-9952-2fa991d2daa4", "comment": "Malware payload", "value": "fa24ed7496834aae986ae5e13d0161383fc064a0d0a042432069c168b41a868b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701018047, "uuid": "9ca65983-1645-49c9-a79a-9420d8bc5e4f", "comment": "Malware payload", "value": "60afc00716e5701380671fb61121dd53c7715d0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701018047, "uuid": "c87fcebe-e04c-4855-9e45-6261fd09d47d", "comment": "Malware payload", "value": "aa2f6993f98a67a3769c5cee57ac620a6ffcc9c5bcfd924614c8f956470f4a3889083b03c6fc54bdd730a773551f9cf9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701018047, "uuid": "ec4d29e4-16bf-4804-a0a8-4899ecadbb41", "value": "T18015F112B6C689B1E4632A320D399B20557B7C244A79884F639C7E1FBF733C15932B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701018047, "uuid": "41921c67-0c26-4afd-bd65-3b0e45126d3e", "value": "aac51396886833dc961fcd7aab7711e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701018047, "uuid": "31d5f19e-98ac-42dc-9417-5ea498271a2d", "value": "24576:lgZXoZUTVdt7KEA1oZsflCxjah+6Vr2x3aAq12JQf85y:QAoclC4AxKAB+E5y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701018047, "uuid": "8eadef5d-9192-4bb2-b5da-c972421c6ba1", "value": 939010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701018047, "uuid": "ecac39fd-1df3-4d72-80b9-b7966f68d72d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701018047, "uuid": "1347c912-206f-43d8-a1cd-3aeb9d901c3e", "value": "Commissions_open_20231004_Commissions_open_20231004pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccdf8979-8c94-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701028121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701028121, "uuid": "72394b17-0593-43f3-8f4e-47500f9f5dcc", "comment": "Malware payload", "value": "c83fe58088ef5f05342367e71eb28873", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701028121, "uuid": "a4ef8a4e-1a06-46f9-90fd-31eef2c839b7", "comment": "Malware payload", "value": "fa5710fea9ff93e8d446803066d2cf74088f67db96336c000fbff597982eb128", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701028121, "uuid": "e876f11f-88ba-44ed-9178-4f438a495e91", "comment": "Malware payload", "value": "8af8c027cb0f56b6775115383f4d5bdf010a6352", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701028121, "uuid": "90f98650-b34b-4274-939c-932245e5d50e", "comment": "Malware payload", "value": "33f0308a1cc4e18483ed35b98041ef1d412149bca8d11bc58cb11de9922da0ba406f0fd25762788c05c5be646bf34b16", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701028121, "uuid": "ca3e5d35-384c-41c9-97c6-820955ee0475", "value": "T12105F26272E35538F4A71A34289D2F464178BE3357DDCC29BB9C0F8DDB2128899A7317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701028121, "uuid": "66540c50-e9cf-4269-9d6b-6c2b551c18d6", "value": "a36cacabacb45240e82865262b4c0145", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701028121, "uuid": "d51f03d6-cf5c-4ea6-a53f-6eac679f8b3e", "value": "24576:/tR2jQOoVmT/QrwFbxE6Elpq5nOkcJofEXmi:1TMT/jb+Bl05nBcJocXmi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701028121, "uuid": "cfaf1d72-01c4-44ec-9b00-76dce1902b83", "value": 814592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701028121, "uuid": "2d529335-9774-47c9-874d-98f5309a6147", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701028121, "uuid": "5659dcc1-5115-42e0-b98f-b60cfc590474", "value": "Plumulaceous.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78b692a4-8c8b-11ee-8907-42010a9c0042", "comment": "Malware payload (AsyncRAT)", "timestamp": 1701024114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701024114, "uuid": "cd9955c3-514b-4ead-9d03-bb0053048c61", "comment": "Malware payload (AsyncRAT)", "value": "1ade097499dd5fb334ffe69d06d00b31", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701024114, "uuid": "cfe09560-cb59-40aa-bbe4-1263c3856ea4", "comment": "Malware payload (AsyncRAT)", "value": "fa5a74ef1355ddd1d5984b84d52d7aa0727e11e40a89ca3a2bbf4594eea57730", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701024114, "uuid": "4aa0a351-1c2f-4129-bce8-daf6339d3914", "comment": "Malware payload (AsyncRAT)", "value": "ab5e0d3a2e0a71b2afe9a04bd24835a8f5874079", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701024114, "uuid": "a9937df7-073f-4192-a245-165ead166c4c", "comment": "Malware payload (AsyncRAT)", "value": "9f97ddc532a32be6522b2daaaf77cf093d9570a612871baa8c84e72c79e81e7bc03d8cc936b2f8df7bedd55addae61cf", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701024114, "uuid": "33025a93-dc50-43d9-ae0b-d81fdd140163", "value": "T141F3BF083BD95459E07EEFB05DB57246877AEFA21912C25E34E16ABF2B03D44CD00BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701024114, "uuid": "d3be0f36-36b2-4bff-b438-2d67d93ba746", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701024114, "uuid": "adbf0449-6202-4960-a88d-7a728c057cfd", "value": "3072:6vpWpop9+bNFwwO52HJe5BV0bUniyimyx:IVpkbEaJe5v0bURy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701024114, "uuid": "6aba55c6-632d-4f86-909f-2213f8e23fe3", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701024114, "uuid": "14f2613b-db13-4afc-8350-d6572446a273", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701024114, "uuid": "31cd21d0-6653-4eaf-af37-d5b551f5c3f4", "value": "1ade097499dd5fb334ffe69d06d00b31.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "544c83f6-8c7d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701018040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701018040, "uuid": "6763d175-3743-4279-9e09-ac5d3297da6f", "comment": "Malware payload", "value": "ec9265661da500af848e36043d6817d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701018040, "uuid": "c0655daf-b4fe-4d1f-9dbb-840f123f8281", "comment": "Malware payload", "value": "faf43b8f6dcda1a10cbd06920a86d186725997d962978960a4b88b7ffc4ff5bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701018040, "uuid": "e73dd27a-72a2-4e14-96e1-2afd99ce584e", "comment": "Malware payload", "value": "3ec77d0cdaee10efb0508ae1978b305421f8a2e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701018040, "uuid": "c19d9546-1f13-44b5-b45f-c9ba440c7d1c", "comment": "Malware payload", "value": "39139259092806381d77c8d7f51ba1be298d2bbb63da8db6cf8fb09aa4f1c8c6b3b1792b27fb4693a3e9eec49c12d8bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701018040, "uuid": "5c5c864f-607b-460b-801a-db114ee6cc9c", "value": "T1A915F112B6C689B1E4632A320D399B20557B7C244A79884F639C7E1FBF733C15932B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701018040, "uuid": "0980878e-9a85-4dc5-bbbc-5a3ba54d0886", "value": "aac51396886833dc961fcd7aab7711e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701018040, "uuid": "b82acbe4-17e7-44ba-81a1-77bea8c3d452", "value": "24576:lgZXoZUTVdt7KEA1OZsflCxjah+6Vr2x3aAq12JQf8OR:QAOclC4AxKAB+EOR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701018040, "uuid": "161b0395-eb6d-4eb5-8d78-16cc01fb48a1", "value": 939007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701018040, "uuid": "68dd8a5f-cb58-4fa5-a57b-fa89381045a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701018040, "uuid": "d00523db-d5a5-41c0-8ce7-e5e015c0bc44", "value": "Commissions_BEL6_20231004_Commissions_BEL6_20231004pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faf5c580-8c76-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1701015313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701015313, "uuid": "76ea6c54-37bc-437d-bbcf-f747cf22924c", "comment": "Malware payload (Stealc)", "value": "7c4697660b6661822a0182424f634a09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701015313, "uuid": "bdbd01d6-8d57-463d-b201-0fce4ddf0e02", "comment": "Malware payload (Stealc)", "value": "fb44a1de2ed99dea54419c93b263fac098cfc68215b08455ac0a9a5ff575ecd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701015313, "uuid": "613fa720-7861-4879-b37f-6aa5956a95d0", "comment": "Malware payload (Stealc)", "value": "ab9f9830687e34c211363d30884fbe9646830be4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701015313, "uuid": "f097e636-e449-4d25-8fbc-9dddfa538e74", "comment": "Malware payload (Stealc)", "value": "4f8d4b4dbb05975dab8800b4ef9a11ceec0b4f8bfe29029e5663fc2a630bfbd3e93725ea78f4da8d8ab0befdcc7599c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701015313, "uuid": "f48e1285-55d7-400a-82bc-9be9bc853695", "value": "T13D54C60382E13D41E9369B329F1FC7EC7B0DF6518E59BBA922189E5F04B10BAC663715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701015313, "uuid": "9647aa5c-c02b-4700-87d9-e2fbb6b86f43", "value": "b79e8a13f3e64db949ba21efd0faecde", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701015313, "uuid": "842bec48-126c-42a4-b85e-640fee46910b", "value": "3072:gNrQKleA0tN+lcHDOaNt9wvIJVIlOxvsZDU1rNhQj+bs:SrjleANaD7t9/PID+1t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701015313, "uuid": "49030018-92bc-4f23-8c5c-38f498b0b43e", "value": 298496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701015313, "uuid": "e36b3551-7dbe-4c74-a445-16b528ae5e9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701015313, "uuid": "f733d024-e257-42c2-b957-8a5387c9079a", "value": "7c4697660b6661822a0182424f634a09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85b528b1-8c6c-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1701010822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701010822, "uuid": "54d1cdf2-146f-4bdd-be57-75346ec9ac6a", "comment": "Malware payload (LummaStealer)", "value": "6cca1050da6a9751f1c290575200d6e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701010822, "uuid": "c6e116ce-74fc-48f7-ad43-a2ce68b65353", "comment": "Malware payload (LummaStealer)", "value": "fb715d832dc2ccdd174f5ce2c826609ce79e3091b73d85747a1d42ac6a80169c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701010822, "uuid": "f35964c9-0486-4947-b4f5-a6afa2e57243", "comment": "Malware payload (LummaStealer)", "value": "618046976c3b76664daa14840c3a4d6d355c3ccb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701010822, "uuid": "73636e3b-d14a-437c-b5ef-9794153c7195", "comment": "Malware payload (LummaStealer)", "value": "a6cf4a0130ef45b52a3ba051d20c47c1d291bb720e3ae5abea9a504109a144b68a93b095660c290860123d68375b2d6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701010822, "uuid": "53b9e872-9154-4f23-b7e1-b0b226bb151b", "value": "T1399523517BDAC437E9B43F345CF7168315397EE29EF4A51B23B7AC882961240A03276E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701010822, "uuid": "f54efc89-afbe-4871-bc27-b071b1551688", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701010822, "uuid": "78fa068c-ebd5-4fa0-8513-b1a9c6893a03", "value": "49152:9HvPeQFKepsgnB1NhRVCbYY3ALI7r3DKfHWOdoimt8u:tvFtpsyCk29Odolt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701010822, "uuid": "90a79104-c9df-4c4e-8410-bb04d9a7f3cc", "value": 2027008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701010822, "uuid": "a021f37d-8622-455a-a102-b08833499fe6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701010822, "uuid": "bf967f20-6f6e-4579-9faa-799f8a1c521f", "value": "6cca1050da6a9751f1c290575200d6e3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "923ea13f-8c1d-11ee-8907-42010a9c0042", "comment": "Malware payload (DCRat)", "timestamp": 1700976913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700976913, "uuid": "449133f7-edb9-4c8a-b04d-07678e7f1e9a", "comment": "Malware payload (DCRat)", "value": "b843b704dd6690f5cc7a8a400674b054", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700976913, "uuid": "90a37a3a-3b6d-422a-ba12-fe4a84015885", "comment": "Malware payload (DCRat)", "value": "fc07e1f14fe415abbf50144169406b444d1a70a06332892004d29e286da08f37", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700976913, "uuid": "ecf6a952-9bc6-4d00-b3ca-3576ddf30ae7", "comment": "Malware payload (DCRat)", "value": "fec8571d6b9e1ae91e4cb0ff7d1a6477ff0888a9", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700976913, "uuid": "6a69f96f-28d9-401a-b279-a89e4421b9b9", "comment": "Malware payload (DCRat)", "value": "aae9f8618835276c9791ca098c31c3750414074ef54e8a99fd02b40fe865076b28baecbb3baa71f58df849b20776e7f2", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700976913, "uuid": "382aa5d6-2373-49a2-a4a8-1e135af9c7f2", "value": "T14416F107A5A34E33C2B93F3584D7041E53B0DA667A53FF1B3A1E65B5AC066718B122B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700976913, "uuid": "1afeb0b7-c3bf-4efb-84a5-82d7c0698efb", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700976913, "uuid": "41e03bda-42f8-405e-be0c-057eb1cfbc9a", "value": "98304:ySA5A5qQ2o3QCHp2IzQCI2qQv3zjb7iK3OPBOMVw/WBmCL:Vv5WUQC4IzQL21zjb7X3uQMVYzO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700976913, "uuid": "83310f16-b5e2-4538-9a61-2e429a9e6fe0", "value": 4075162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700976913, "uuid": "4929e546-d272-40c9-928a-c0f17f84488b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700976913, "uuid": "64d4f9ce-d3a3-4987-aa92-1a9c2dfee6e1", "value": "b843b704dd6690f5cc7a8a400674b054.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b695d35-8c34-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1700986565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700986565, "uuid": "27737fde-0a42-45b4-aa93-fbbc8481d682", "comment": "Malware payload (RiseProStealer)", "value": "90d61751f23585ed23627f3e7bb8d285", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700986565, "uuid": "a628d968-1cb7-4057-82c9-5555a0c5252d", "comment": "Malware payload (RiseProStealer)", "value": "fc2182c50aa3488f9832bfdf4e5889dc9e55415223d3b51a1bf42a3307cc8360", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700986565, "uuid": "2162f0f5-2841-45ea-b2ef-8fa06a763cb9", "comment": "Malware payload (RiseProStealer)", "value": "1a01491e66039e8bc35307efdea39655fb056a41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700986565, "uuid": "3ff3a165-b8a9-47ce-afde-ce516e3145b2", "comment": "Malware payload (RiseProStealer)", "value": "544f8af3f030c5ef5df5aa43884f4669fa6b13d04ad89bdff5d08684ab43f066abe38c93254ea47ca100e82bd29d0eac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700986565, "uuid": "44b7b09b-f986-433c-948d-f8b951dc4d66", "value": "T1F7658C31FA08D4B6D09210B0916D6A7B91587A322BAF4CD7F3C05E6E41B52D2F235F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700986565, "uuid": "87d2d57b-6603-49c4-b4aa-bba16471327b", "value": "078471ac5a76189ffe465abe0c89c6b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700986565, "uuid": "6ae2f3ea-3df3-489f-9e79-22eca02202f6", "value": "24576:2opGDjnvrPpkjos0OtjcFc5kM49dj+IuxWQOIjuJuVvhbqL0HtFcgekRP9dT0WNI:OnvrPGT0Egyudc4tI3bqL0NFchaP9dTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700986565, "uuid": "0a81e07c-bfd7-4af1-9be5-d08dbf7e1f76", "value": 1539863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700986565, "uuid": "9bde1b84-ffa6-414a-8bfb-0614c5ac9a4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700986565, "uuid": "bbc63e48-7e22-497c-943f-b81ae5eeabce", "value": "SecuriteInfo.com.Trojan.MulDrop24.22194.32699.20752", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "508f98f9-8c6f-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1701012021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701012021, "uuid": "dceb3556-889d-4f25-b5bb-931e9008b493", "comment": "Malware payload (RedLineStealer)", "value": "a3c720e7252f66e20afb5be9cdbe99f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701012021, "uuid": "c9a2ffed-c958-4a4e-ac40-5ff1ffce7311", "comment": "Malware payload (RedLineStealer)", "value": "fcbdd18744a3ce7a6a12212158755361ac8c1468eb0f19fc6f666ee057c84462", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701012021, "uuid": "dc92fd61-bae5-48f7-8842-5ea6ce187d2a", "comment": "Malware payload (RedLineStealer)", "value": "d3af2e85ecb4e77dbce1514e810a3bdaff63c663", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701012021, "uuid": "84b9290d-fffd-4233-acfb-692f4ba5557a", "comment": "Malware payload (RedLineStealer)", "value": "9361ae804a65aade7e6e2cc12b7442a2754fc49026ba9c058dad48b01cb3b2f9938c20d38acdb8dea919922f753370ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701012021, "uuid": "2a0371f8-1886-4850-970c-1346497570e1", "value": "T1FC03D08344796A18CA15BE36011188E2F6D5B394F6582101F7CC9CFBBF2E784E75BA09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701012021, "uuid": "029adfe6-5183-494f-b56b-f904df73b86a", "value": "768:f8FhylJE+hwr5hN7F0I0bQyvUgq65DQVi:f8qlJEQwrDNuIyvD5sV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701012021, "uuid": "d3347c92-519d-470d-99f9-dc041c2ca4b6", "value": 38094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701012021, "uuid": "a783af95-fab6-4df4-8d37-be9968b0eab5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701012021, "uuid": "dcb2c0e6-993c-48c8-8d24-dbb28a33424f", "value": "a3c720e7252f66e20afb5be9cdbe99f0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c43e839-8c74-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1701014108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701014108, "uuid": "f8133c79-7723-40f4-954e-7f33f38742b3", "comment": "Malware payload (LummaStealer)", "value": "af70eec37ef796df4212aa5fed8c0b6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701014108, "uuid": "221d28b9-1c74-4828-9d50-a787863cfe07", "comment": "Malware payload (LummaStealer)", "value": "fd0b2a3feaeeb4a337a83b1576f59582d0e626c40a85c414f36e229fa647a7c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701014108, "uuid": "e9fba78d-c618-4bc1-b49a-1ade904a3ad7", "comment": "Malware payload (LummaStealer)", "value": "81f86d974208d70e7470b1383dbdb678665bf5ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701014108, "uuid": "7f6d3907-75ca-48b0-84d3-42448c66c01c", "comment": "Malware payload (LummaStealer)", "value": "ccec355b7d9d2a5627066d28f2a8eb84d1b506d77da0806653cdbfd180386a4333d576a7aa18be32cfa4f42106da824c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701014108, "uuid": "b43d688a-5fa9-469f-b103-a814873889dd", "value": "T198452327BFEC9231E8B4ABF454F716E31379BC52493D036A1790A9151DB2B49BC3432A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701014108, "uuid": "1cb2c3c8-62f1-43a7-898a-4ebe58f0f7c6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701014108, "uuid": "30ef7769-f518-468f-aa28-49cf56787276", "value": "24576:iy22PxKKp9xm0gVEUQuYu+eObnQH0NPAK+2FrC9oa0:Jn5KG9xngVEUQu9ySnEm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701014108, "uuid": "98988200-5063-4ceb-b9c0-02ebbaa42379", "value": 1218048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701014108, "uuid": "8131583d-ac29-4681-abc1-4bc987ea417d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701014108, "uuid": "bf3e734a-1d74-4a3d-8e89-4c5a1b82828f", "value": "af70eec37ef796df4212aa5fed8c0b6d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7798ad73-8c44-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1700993618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700993618, "uuid": "f495d737-f893-435c-a12a-531b626a8e9f", "comment": "Malware payload (RiseProStealer)", "value": "75f4c532bda99ffc59552f777b1ee559", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700993618, "uuid": "4718f889-5b54-4a80-85bb-95689e4205a7", "comment": "Malware payload (RiseProStealer)", "value": "fdc0f4a19971e3a7ea01e098037be838d61a35b0ca5c4f59161d84bca61f783f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700993618, "uuid": "c67bdf4d-7cb6-4923-8799-f88eed8b132b", "comment": "Malware payload (RiseProStealer)", "value": "b9b64219a84b7af435c2a1012f013769d7644a0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700993618, "uuid": "d0bfef09-8b3c-46bf-8cd1-4feb62e8f09e", "comment": "Malware payload (RiseProStealer)", "value": "3ee0a35469da4165a99ce357b58a918f9d02dc0ff5d173d10b368c148be27446ebde78d8b9862beff4a4c898d1260918", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700993618, "uuid": "3b0e4c1a-40b9-45fc-aa3b-391556c8a2e3", "value": "T149658C31FA08D4B6D09210B0916D6A7B91587A322BAF4CD7F3C05E6E41B52D2F235F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700993618, "uuid": "7737bf29-f2d8-477f-94fa-f68e2eeb53d3", "value": "078471ac5a76189ffe465abe0c89c6b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700993618, "uuid": "90760f95-03ad-4892-af49-740b079f4d36", "value": "24576:2opGDjnvrPpkjos0OtjcFc5kM49dj+IuxWQOIjuJuVvhbqL0HtFcgekRP9dT0WNI:OnvrPGT0Egyudc4tI3bqL0NFchaP9dTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700993618, "uuid": "c9828287-4b4f-4d20-82ab-bb02d4dc72ee", "value": 1539935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700993618, "uuid": "7d3b00fa-7b84-45cb-9133-3399f933b256", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700993618, "uuid": "3ab92764-1bbc-4fd5-86c0-d33536e942d9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d12e4a52-8c6f-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1701012237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701012237, "uuid": "f43db4db-976c-48cb-981c-124887762573", "comment": "Malware payload (Mirai)", "value": "8626f942cf302261f6ea13c498c0f01a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701012237, "uuid": "2abbfbaa-5cb4-4fb5-9bd7-1eb12d56561e", "comment": "Malware payload (Mirai)", "value": "fea3794170b2fc52d04ba31190436754f395e582f661c52998563c045564b668", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701012237, "uuid": "2eae7f59-fb25-42ea-a1d4-cea2ca42bc19", "comment": "Malware payload (Mirai)", "value": "38f7093af422b4c33f42d5138b50c07edc7920c0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701012237, "uuid": "d460c99d-dc95-47e9-9ea8-03d212f095e5", "comment": "Malware payload (Mirai)", "value": "95a6edfd19f08a83749eb9989bb8d4a8d205647ee779cedbc32e2813b6097019e6c0ce4dd97a8084d1e38efc11d46568", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701012237, "uuid": "ee35ede7-e071-48e1-ac97-f6a464ccf737", "value": "T100432B96B801AD7CF94FE6BE94234D0DF621335051930B2BA7A7FDD36D321A86E12D42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701012237, "uuid": "3f309725-3d5f-470d-81cf-32b4e7d5b0dc", "value": "1536:0FMAMFlwZA9UwTvlc3O2yIE8WhijBq8pnzO:3TFlwZSUwTSjfqD8pzO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701012237, "uuid": "f63a1b58-cd2b-4e7e-a5db-228336ad0b58", "value": 57088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701012237, "uuid": "7bbe4d69-9224-46c9-8135-16ffbd8f0d8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701012237, "uuid": "9e36a619-6dae-4a0b-aecf-9756da581859", "value": "8626f942cf302261f6ea13c498c0f01a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10555a22-8c4f-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1700998169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700998169, "uuid": "45683936-b548-4c61-9648-d8ad67c0c2fa", "comment": "Malware payload (Amadey)", "value": "f4ba796f39305262e65d0ebd9d0ee33e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700998169, "uuid": "9c810df9-4d26-446a-bd0a-8b522570d81e", "comment": "Malware payload (Amadey)", "value": "ffad1db3679cbb413b1b72a358c986f37327530dddaf91f8feefaff59099b225", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700998169, "uuid": "c2c34403-6eb5-4141-b430-0fd174227b06", "comment": "Malware payload (Amadey)", "value": "8b425d5af330f85ffd1f0cd3695046a44309fea6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700998169, "uuid": "f5705831-ec56-4db1-b142-a768aaaa9750", "comment": "Malware payload (Amadey)", "value": "efb292c8f281ffefb5c418f5b7694aee0beba08346b756da3195a50f6657624eb79bb4dafc06a99aae9768080b8e0f32", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700998169, "uuid": "9edbd7d9-adc4-477e-a84f-ebf6229a781c", "value": "T1F2F5E1556D068F93C9AD48FDB43F98C8419B6E04A889B0F2F53C72D25E6074BA37B18D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700998169, "uuid": "6d13a36f-6cf8-419f-aa12-b50faa72b5dd", "value": "4fc7d580c9c9e24e3cf5a2b5a1a4d764", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700998169, "uuid": "0f98db96-d41b-47b1-83ff-e8a299ca35fb", "value": "49152:OlK6hZB6fbUdfVXiZgX/uvuV6YM2bt831GstdvlbROZuaK60ZsOz/C:GK6hQUNMZgPehs1sP7OZqZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700998169, "uuid": "2479a811-0948-4bab-bb78-04383d84dfb3", "value": 3340816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700998169, "uuid": "c32f527f-52ee-427a-b196-e54d0e356a95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700998169, "uuid": "1f455f15-3348-4620-bae5-d61b6089a59b", "value": "SecuriteInfo.com.Win32.BotX-gen.3017.24951", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be12f46e-8cac-11ee-8907-42010a9c0042", "comment": "Malware payload (AZORult)", "timestamp": 1701038404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701038404, "uuid": "42834cd9-080b-44ff-8f34-b8277d860dd4", "comment": "Malware payload (AZORult)", "value": "e7d8ea8f7edeab9c00e6916db9cddf6d", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701038404, "uuid": "03225f8b-3ec5-430c-8582-7e743035d8d6", "comment": "Malware payload (AZORult)", "value": "ffe63aecb926ed305039dda5b7102cdfa7bb826126dc0b178e700d7782441579", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701038404, "uuid": "1bcfa55b-23ad-4a06-94ec-e878dab2d4f5", "comment": "Malware payload (AZORult)", "value": "5f6900b970ae01fe9cacd3c054bb6fac4ccd113c", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701038404, "uuid": "f3829f35-fb52-4539-8460-68f75b48c40d", "comment": "Malware payload (AZORult)", "value": "f9735ab23432504c8caa4253b508ab3bff86b207a07d1b0193f839a9b3a6dba11624b738ba397254ac1664d6ba224ab1", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701038404, "uuid": "29b46478-7e03-403b-a6f1-5074ddff8bd0", "value": "T1ECF4E0AE2B50D913DFC005B4C891F3BD8B616D546995860BB6F23DEF79E4B89AC042F0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701038404, "uuid": "53dd72df-624f-437d-904b-af7efb6dc85a", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701038404, "uuid": "c794c6f1-fdd6-4d92-bab4-d3c904dd281c", "value": "12288:GcqMWxQR0RULXAhXmv58VA4mM5ryp+DDokyE779mrgBvrw:Gn+RMSAhXoG1cp+DDkE779mIE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701038404, "uuid": "cbda168b-ca8e-4524-be37-2006c009b649", "value": 740086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701038404, "uuid": "ed32d4c8-fb3b-40eb-b60d-7d5c4478eefb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701038404, "uuid": "3b201166-738e-4376-88d8-32632a128edc", "value": "Document-HT1P9915900.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }