{ "Event": { "published": true, "date": "2024-01-13", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2024-01-13", "timestamp": 1705190581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "b469c9ca-97bc-4aba-b460-bb6b7786c3f4", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2065f7b-b1d5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705124186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705124186, "uuid": "ad0208d0-b077-429f-9a60-52e11b360281", "comment": "Malware payload", "value": "459d63c87281a7c35bd3fb015d41c155", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705124186, "uuid": "9a4a5e42-adaf-4a49-b303-670306ef0f1c", "comment": "Malware payload", "value": "0215fb5ca62cce5debc7bb6720ef089b075aa4167632ae21f9a1df42636b880c", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705124186, "uuid": "bcf23905-3e40-430e-ad2f-e27da07d44d1", "comment": "Malware payload", "value": "14d20f30b220aa969573953606ddcd3392d3bfe2", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705124186, "uuid": "ae4faadd-2734-48ad-9538-caeeb81554f3", "comment": "Malware payload", "value": "70eef951a6ced694d698bc5b99de634a424e2cc5bf407325c5a3d0ca18df193b709880b3b4544cc106b61fc72a8791c6", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705124186, "uuid": "c3697b63-52cf-4b52-919c-2ff573679052", "value": "T1FEA1471236FB50087273BE5517E67ABA4B6BBBA1613DA45C108C060A0FD3D84CD977BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705124186, "uuid": "68a58006-d8c5-4370-8740-e79e6a1df37b", "value": "96:SDv8vBDqazRdWDkXrV+DVfFf8f7RIT9r17T9rN9rz9rdf9rB:0uxda5tUD+T9x7T9R9f95f9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705124186, "uuid": "f2d3c49a-7d2e-44e3-9b78-e533d54272ac", "value": 4962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705124186, "uuid": "784233de-6b0f-41e9-9c90-19dd2e3a2813", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705124186, "uuid": "48301992-0992-41c1-954d-8c823ce50d0a", "value": "facturas y datos bancarios.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90e07462-b207-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705145606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145606, "uuid": "4ec1f1cf-15db-4222-a49f-16971212c908", "comment": "Malware payload", "value": "30e063d32b50ce8aa1da33dad0b2072b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145606, "uuid": "b5402466-7228-4dc4-a848-81040258ba1c", "comment": "Malware payload", "value": "034fa9c7e83d9c8f87cbaabae09c409e30ef2698d6490c1059b47ca74967f459", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145606, "uuid": "845dffee-c2bf-4de9-9354-ad77fec28aa5", "comment": "Malware payload", "value": "3ec60db5e79a0a131cfe2849fef540271eb9832e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145606, "uuid": "a2dff839-5fa2-46c8-ae95-68d2d16f0fef", "comment": "Malware payload", "value": "68774e2882517468fa3749227e3f84484abfd88cb6a8d0845b9e32eef3a8d99a5e4c767e1fddcc0ee44cddf43957a313", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145606, "uuid": "fb459bc6-7065-4841-ad2e-d28633b2054e", "value": "T1A7457C22F79145D5D20611722FA3133D3B7EABB60A20DBE32B54EE695E32772AD33141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145606, "uuid": "dd8fa188-fc08-4343-8487-6578f5dbe11e", "value": "12288:X9H09kiOzvQIciSsV2zuYOEm2ividCVx6A0:X109knEidV2zuYOh2iacVoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705145606, "uuid": "3d0d9d47-39d7-4f95-a883-3752f8991460", "value": 1220608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705145606, "uuid": "976c75f3-09e3-4c7c-9064-059660020eb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145606, "uuid": "2860e710-9c91-46a8-a56c-5af840731eca", "value": "SecuriteInfo.com.Win32.Trojan.PSE.1TYMTF4.18479.8903", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2f6f550-b26e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705189901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705189901, "uuid": "561c9d06-6bd4-4a04-b651-d9c3cef207f3", "comment": "Malware payload", "value": "8b1f4b4bc2b50adbc705f0d6208c9bbf", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705189901, "uuid": "320a34c7-b69a-40b7-b63f-fee95373f830", "comment": "Malware payload", "value": "091be24ecf44b4a67293a2ee7c3999ad7ff3cc93eb6cbc578fcf0dad2da303c2", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705189901, "uuid": "635ac26b-a5a1-462b-97b9-5c682dc6b98e", "comment": "Malware payload", "value": "3c528e8e2a20653a0bcf5166ea534b7be3bc585a", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705189901, "uuid": "c986c92a-1338-4571-82ce-6cababd94d60", "comment": "Malware payload", "value": "4d7a8ce56d56a08a5437a5a18cc48d2b0b4b23034e4a10a159b53acd29639584cb799c7b8415c6f8c8e4a8de66a72a27", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705189901, "uuid": "7e2c313f-1c15-44c0-aae8-240114b7ef84", "value": "T1D7455C33B246663ED09A0BB9C9B7B320B93B766165168C5B97F54C48CF2D0802E3F657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705189901, "uuid": "4ec4ee35-0996-42ca-9ff0-fd339a9410c9", "value": "159121034c81853a28e8aaf12b6a2e16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705189901, "uuid": "50bfa841-92cf-4659-8ae3-ebcabd8d86c3", "value": "24576:c4sN7NFRVtX4Af6+UPZiBKLJrFrQdtlmvh:iTRXXd6gMJ5e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705189901, "uuid": "3ecd0263-cded-4c88-b750-dc0bdab0486a", "value": 1193472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705189901, "uuid": "9b3d90e8-e6b5-47d6-8621-6066b400273d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705189901, "uuid": "c1b5d47a-3ed1-47ab-aac5-a21649831740", "value": "IpOverUsbDiscovery.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df5a924c-b1ae-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1705107512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705107512, "uuid": "0bca9cfb-63fc-4672-a48f-f7a2990ab7cf", "comment": "Malware payload (CoinMiner)", "value": "7760638f7e80b5cfc98bd5b01bb234e5", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705107512, "uuid": "d0891e41-5f0a-4be6-8051-39babe274dc1", "comment": "Malware payload (CoinMiner)", "value": "0b66aa2b41ed7e2d6b9705da29b251b2fe93e5891fb026961f9a5c573ec14a28", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705107512, "uuid": "0eb60c23-96a6-4e73-99fe-8f0044280fd5", "comment": "Malware payload (CoinMiner)", "value": "86ce6ad2c9bfa7d8522a0ff628fd9702bc2df8c4", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705107512, "uuid": "f4941493-cc4f-4b39-a4eb-e6744a7a2030", "comment": "Malware payload (CoinMiner)", "value": "9f8c1f6dd6bf47c1ba503a434c7f7ac3b7928d5e9c10639797f5139ae13c89eec116ea7c719999f726f30edcad824b76", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705107512, "uuid": "1d95ee9f-3760-48a4-8436-480a1d093dfa", "value": "T189563384A4AFA10F8879CD7CBC135B65C511F27299E89217DCCF2ACC3E3E74E1859668", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705107512, "uuid": "4e8d500b-3b1e-4950-8222-10d27fd85960", "value": "98304:CmEyr0aQwcIEbpjc7N9ECns7Am7Un+mJf2QwMss+QAGiOSFQ8O48sqSnjLliqOT/:Cm0aQMEdmz47AZnXBwMBQHLF78sHjLcR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705107512, "uuid": "8d913ff2-63d2-46db-827d-2ebd795e6f98", "value": 5962682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705107512, "uuid": "6092df03-d08c-42c8-ac8b-cd1f06704eba", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705107512, "uuid": "5cebc00d-ba0e-4295-aaf2-4acdb8b81b69", "value": "runing.tar.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aef6724c-b1f1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705136207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705136207, "uuid": "54e5d4b5-4fb2-4d4e-9af4-4aa6ec54dafd", "comment": "Malware payload (AgentTesla)", "value": "cb0717d65a69b927a6a64d3d6f07f67c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705136207, "uuid": "f4e6914c-6d22-4027-9f1c-ef20b558bd45", "comment": "Malware payload (AgentTesla)", "value": "0bdd6fa1489c0ed18e9aa11d09e6994a48c953d907a862eba9bad0a6f824b07f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705136207, "uuid": "e26bd410-0dc2-4aa5-8d68-eefac37396f4", "comment": "Malware payload (AgentTesla)", "value": "0a683ecda9e0b1d1984b6a1c76b6b9263d46c1c8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705136207, "uuid": "2e07c57b-e194-4ad4-af92-d87882ed1d11", "comment": "Malware payload (AgentTesla)", "value": "a86ec6fa7b1cbd23552f8e20f950336927655560111aec86064b2beeb5acd2257095b732bbbc077a2f4074068be5e16e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705136207, "uuid": "9a908f89-1629-4dfd-902d-3affce9aebe0", "value": "T169A4E06BB7C84F11C56C65BC94E36A2553E2F5DB36B3D78A3E0052DA0C613E4CDE9A80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705136207, "uuid": "62461526-352a-42ea-a63e-984842313c2c", "value": "12288:lueAlvS+8Qyh6HQUavuhrnSaCuUncPxsmopSUz0W:lueAlv8Hh6uWp/Cu+cPXopSUzt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705136207, "uuid": "adff0f2e-dbc6-4dbf-957e-e17ce2ee3b92", "value": 464128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705136207, "uuid": "a9bf417f-0571-4191-a155-d47b099b2f65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705136207, "uuid": "bd161d07-51f5-47f1-b633-48d884e94514", "value": "2301051321091.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efb3dc2b-b1d6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1705124719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705124719, "uuid": "74da6ed5-3364-4bdc-af25-4db4b71b2f08", "comment": "Malware payload (DCRat)", "value": "63ff8dffd93f2b0e977da65ad70600fb", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705124719, "uuid": "e0c61c0b-5470-443e-8a42-b04b5f5f7c4c", "comment": "Malware payload (DCRat)", "value": "0c1c671209be073feab00d096d81dc0db17e93b45d46a27c4a44a1bd2bb3d445", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705124719, "uuid": "74f41b92-cac0-4c14-9278-df17f2f8cbcf", "comment": "Malware payload (DCRat)", "value": "4af3f5579e6035087f809e47b25ecd33101bc451", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705124719, "uuid": "f27a1e7e-9166-4df3-9a45-c94bd0877a29", "comment": "Malware payload (DCRat)", "value": "e2d4338c74e0bba3d7912ca098dd415cf9eb03bb61ab4dc932cce5e4e4bf818e9510efa0bfe4eee5837b7a32efc34d86", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705124719, "uuid": "c89ef382-7215-49d2-887c-e8fcd87950af", "value": "T1A8C57D2439FB502AB173EFA58BE4749ADA6FF6B33B07585E205103864713A81DDC163E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705124719, "uuid": "559f1fcf-b3f5-4b3e-b735-e5a9ad4078ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705124719, "uuid": "b57e1011-a2c9-4d60-bd2d-6b2a883f1c99", "value": "24576:45KJz8NbqphCw7sULqPyZwSxIshHN/ZYQLpB4qLNYDyiAqHU4vm89hUn8qljlG0Y:UKJ0qpXlwSxfGQLPVv4U4vl9Kv155", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705124719, "uuid": "0f82e0c6-bf9f-460d-b10d-9379ca358a2d", "value": 2628608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705124719, "uuid": "7c923592-c0cd-4273-837c-f0f999099624", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705124719, "uuid": "1904a964-f625-410b-89ce-7c80104a1063", "value": "63FF8DFFD93F2B0E977DA65AD70600FB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c8f708e-b1be-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1705114218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705114218, "uuid": "43a55ebc-4650-421a-9fa8-ffa6fcc87dc5", "comment": "Malware payload (RedLineStealer)", "value": "0f91831a8d0b82c13b3c7ecff30df92a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705114218, "uuid": "4d7538fa-971c-4c49-9c60-2133a15c7721", "comment": "Malware payload (RedLineStealer)", "value": "0c8c53eaf564684ae4bdb152e3ba7adc9bc3790c4e55504a37168f70507b8932", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705114218, "uuid": "e15d8c70-c80c-44a3-b6d5-d5e83c2285b5", "comment": "Malware payload (RedLineStealer)", "value": "7d14c7b7b21046ecb741dafe50f5507a14e7f193", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705114218, "uuid": "eca9d95b-8d23-4034-9548-163586be11d7", "comment": "Malware payload (RedLineStealer)", "value": "e2a81f1afe37c32655aafd07888f1cccddaf13c443c0ed290f5cf5ad8900a3fa312b387791067aa568ba05b15a67af8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705114218, "uuid": "0930dc44-4873-4f99-bbb1-634b2ba7ca61", "value": "T17B645C18B7E8C922F27E47B5D1F1D2B19774EC13A552E34B5ED42CA73D22740EA012BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705114218, "uuid": "98981a31-6310-4ba6-9ec4-ff713fa89b0f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705114218, "uuid": "d24aec4c-18ed-4df8-989c-36a2829e9dce", "value": "3072:M2iLprYKQmI/ZLkmQFNfXiZxxQhSeDnsy1X9nkGmxrRSAykPMRqT6Dv/YyeqiOLR:R+mQkbxAMxrYA9PMRqT6D4gL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705114218, "uuid": "8add0caf-950c-477d-b07f-d70d19f46ff6", "value": 307200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705114218, "uuid": "7ea075d1-a92a-4631-9fb1-0d12901472c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705114218, "uuid": "16652139-8f2a-4eac-a544-ef970dca3c41", "value": "0f91831a8d0b82c13b3c7ecff30df92a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b7729de-b24f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1705176386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705176386, "uuid": "f34f861c-6d10-4b6e-a9ec-a5f2b1dce99d", "comment": "Malware payload (RiseProStealer)", "value": "31daab982bcc81097e0a3698cf06fdb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705176386, "uuid": "7a68f656-00ed-41de-96f6-14a21e160982", "comment": "Malware payload (RiseProStealer)", "value": "0e3ac7bea2766001aad0154d0a9a59846ef6238654ed4c685f8342ddb6b12f8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705176386, "uuid": "d4a00940-3acb-40f6-a6ca-70d757ef73ff", "comment": "Malware payload (RiseProStealer)", "value": "9ab4a484120889c90cd655727fb4319367daf8ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705176386, "uuid": "7e0c55a1-8a9e-432f-9863-0694eed52f16", "comment": "Malware payload (RiseProStealer)", "value": "4a74fc88158d7e09705af0d2d98cf97aa52d5932d94131bf5ab788d7dc71a0029b8df361d87f77cfde8285a3a6086793", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705176386, "uuid": "a92dd2ff-d9dd-4fde-88bc-2461e00f4a9c", "value": "T1D12633886EC158C9C25996707913FF3CB4BF3EB91254CA5A789C1BC2EBF6BD04472489", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705176386, "uuid": "fd5dfd81-9299-4efa-8f2a-856c2f46d6b7", "value": "aaf32b017ad9e013ba3051fb314bf830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705176386, "uuid": "4a057f1e-1035-45d4-8174-77ce61e6ef90", "value": "98304:FDVbI6wODuem8KzhRomPjtpH0S/4+KjpOZP7Gf8o:FDhw1D8KzhOIjJKlSPa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705176386, "uuid": "e68598dc-a985-40d8-8126-6bb890645cab", "value": 4603560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705176386, "uuid": "18f5d5f0-6c4b-418a-b44a-34bb8b01fc38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705176386, "uuid": "88bbc3c1-6990-4264-a32a-f5d6f82029b4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c3f8650-b219-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705153275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705153275, "uuid": "6d68f66d-abe1-49b0-a8e2-977709e7ca34", "comment": "Malware payload", "value": "5bdedf806e54c19d7a43cb6b07ecfa8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705153275, "uuid": "a5ea526a-5e04-4e9a-87f2-0331abf516bd", "comment": "Malware payload", "value": "0fcdc79a162043d182a461fb538be45fd27b6d7b9bda489bedc1d51730adc0c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705153275, "uuid": "df087642-7646-4f54-baad-3217c432c410", "comment": "Malware payload", "value": "30e1cf7f24850a229077e30e8222cc789523c59b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705153275, "uuid": "ce39e9f0-eae7-4743-9cde-488b8e6a6c62", "comment": "Malware payload", "value": "5b72efb54ada0a53de36b43143a3b844de89a9038233fee7478a072bdfff359a572049ae6778f34337f1ea5f4bc3a3dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705153275, "uuid": "641396c3-0307-4c14-8ecb-6e279231e749", "value": "T17A562A43F8A691E8C4EED2798636D262BA603C85873433E76F50E7751B32FD0A979314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705153275, "uuid": "87f49240-0544-4970-8203-638b39e7a878", "value": "49152:varY/qsJigYn4SBjLUlUjfiqbaLOD2Jp8WHLN1EYc5aXSiwuYn9Q778z/mfUVNNO:xqsJ7LOoo5a07+1XzOqseEgnto2Lz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705153275, "uuid": "3138c16d-b063-4f84-8d9d-0e534501dd2b", "value": 6063104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705153275, "uuid": "51fd678e-3b46-4a52-a7de-a24931001fa2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705153275, "uuid": "5d84569f-13a6-4212-9a4d-73e105da41d0", "value": "SecuriteInfo.com.Exploit.ShellCode.26.7885.7243", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82642aab-b207-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705145581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145581, "uuid": "cf39778d-4d36-4dae-b4ed-b36f4f981c72", "comment": "Malware payload", "value": "abcc8aef9cccb320ad828440e48ffdf4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145581, "uuid": "e8345a43-3409-4a63-af49-51907792e54c", "comment": "Malware payload", "value": "14a994b375ddfad950c74a9728c4a07583acbd056fb4178f7154d57a8f9a18ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145581, "uuid": "98733cee-c9ee-4b5f-93ae-a5c623de8ec2", "comment": "Malware payload", "value": "680a1c09859c99847e144923169e66e95c126d31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145581, "uuid": "ff515267-c00e-4325-a245-8e81b5ad284e", "comment": "Malware payload", "value": "2cd9f8e5c1cc4f616508d7a62ec11fbf0130e7b8ef5cfa319875f605cddb5db7c0289113f442ca685ccd13a8f6f78d24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145581, "uuid": "3ce21eac-e339-4010-b614-38bed58be57a", "value": "T1AA759E01FAC389FBCA85053004B76736BA7297462B18CB97B31DFE257F23141A96B2D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145581, "uuid": "59c112fb-fff9-469c-aa21-6cd53298116f", "value": "a311bc6f9cbf8d650fa7fa6c7bb6c3a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145581, "uuid": "8994b9a8-0542-4ad0-9eab-6c29a7ce65b2", "value": "24576:17KmBR+4sPjfE6QGSNkvJDu61RzVuE6fcuG43JslsB5cJLZtrSacXLXxgwNIWd7c:VKmBSrmrNs3/zlsB5cxZmlFIu7c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705145581, "uuid": "e1394446-d264-4655-a29f-75d1f3d54a9d", "value": 1671168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705145581, "uuid": "4b25b00d-f2fe-4159-b1cc-219262b39a3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145581, "uuid": "ac26faf6-342a-47bc-b43b-23be37132649", "value": "SecuriteInfo.com.Trojan.Click2.43482.16086.31631", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "945c381d-b23d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705168804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705168804, "uuid": "c848d8d2-3987-456f-b134-554b169f4da4", "comment": "Malware payload (Mirai)", "value": "9b5ead0a2d03e9e0795b30976015b004", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705168804, "uuid": "8e14b60f-55bd-4614-985f-945c71ddf25b", "comment": "Malware payload (Mirai)", "value": "18e36cc7549371e0d0ba2702beb8ca8ebcc087c1a2042c4dc176150fa9bcfac4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705168804, "uuid": "307eaefd-98fa-430f-82a5-01381f41b80d", "comment": "Malware payload (Mirai)", "value": "6daca46b55d142be50c653d9fed4a292fc6ed315", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705168804, "uuid": "d4c4e0b9-14b1-4e54-b7a3-1a2df96f6a5d", "comment": "Malware payload (Mirai)", "value": "9ee2d8da9958f98d6bcada5121c951d805e3ec9c7b7805b69debadaff0f9c208a40a999e745dfabdf95f2f1f31c79453", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705168804, "uuid": "8d0d467e-41c7-40d5-9a16-082234cb8658", "value": "T10BE31945FC408B23C6D212BBFB5E428D3B2A5798D2EE72039D256F64378B95B0E37542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705168804, "uuid": "7a145ea1-735e-4899-992e-def9f942fcad", "value": "3072:uEs+y+rdlS+71FD34hj4zPVMy//61TNV6GM:uEpr/74h+PVM31pV69", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705168804, "uuid": "354fe170-8385-4778-86ba-a605c56f2c09", "value": 146176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705168804, "uuid": "415923d9-2da4-458b-a9a4-53682f90abca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705168804, "uuid": "1f3bb498-76e1-4054-a404-07f710e5e246", "value": "skyljne.arm5-20240113-1759", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca09bea7-b238-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705166747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705166747, "uuid": "21b010d8-e846-45d0-ab17-ad2df5fccdd0", "comment": "Malware payload", "value": "5d1e7b6de2842f103436463d0ae23ebe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705166747, "uuid": "c1c7dc95-95f2-45da-88fb-2bcb7bab421e", "comment": "Malware payload", "value": "191707605942e547a36afc53f094f9b1269f34b6bcec4dbfb22ee68924bb85ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705166747, "uuid": "989484c2-524c-4645-b3b1-ed3249917a58", "comment": "Malware payload", "value": "e902bc42fe22fa6795d192f38ef1fe9f17005399", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705166747, "uuid": "3f910182-11dd-4d30-b807-d1ebdafdc0f3", "comment": "Malware payload", "value": "4726ed51419aed8b62585facf97b3f139e3ccbfe6f434a2a94cb1d6ec24ac402a4d54d07cb4a03d9aa53c9b3f4bde8b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705166747, "uuid": "460df376-e18f-4914-9258-a550764aae86", "value": "T1785623232B102699E7736AF2415558B3BEBFD3D8E0891EF5E4C6C8ECD6564AB0C7C019", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705166747, "uuid": "5c301954-fc31-42e5-afc6-2046b5eee035", "value": "12288:tTmwrO3YbX/9BKgzWfs1SWaw9wziDfGS:5xzzWf4aw9wziDfj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705166747, "uuid": "06192054-e130-413d-890b-157aa9b05782", "value": 6055424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705166747, "uuid": "5afd32fe-e998-4979-96e0-a87363ad6b16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705166747, "uuid": "a05640c6-1336-4e45-9b10-a137b17f35fd", "value": "SecuriteInfo.com.Win64.Evo-gen.26111.28650", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a45f3927-b1ae-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1705107413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705107413, "uuid": "60e6a77c-2daf-4f68-aa23-c3bf9b41b987", "comment": "Malware payload (CoinMiner)", "value": "65686cf97fabbdbd672f001ce5501dc0", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705107413, "uuid": "dfcad8a9-98db-474d-879a-4bb0cddf13b3", "comment": "Malware payload (CoinMiner)", "value": "19b2c0bd5172f568f1fa33678867bf7aacf9f40764fcfe823eaffa0bb82a4a49", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705107413, "uuid": "5f92eb1b-d667-4b47-86cc-122ba561cfda", "comment": "Malware payload (CoinMiner)", "value": "bd514cd70b2fbaf767ed84d5ed01ebe2c007d876", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705107413, "uuid": "bcfc8149-71da-4703-b658-3d30225a4fa3", "comment": "Malware payload (CoinMiner)", "value": "c015392e6855fac04837fe92af9b6da5f7a44cfff68392896120ab6f84525e05820ba9c8df1bf594fa855576851568f8", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705107413, "uuid": "9f05ed18-1edf-4600-99d0-eed424188840", "value": "T10975335C07C960CB0516866CF14247EC85A7F5CC9AF0ADAA47097EEEC40BF252BF4B5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705107413, "uuid": "befa3bac-ce24-4c40-baf6-116faedb7be7", "value": "49152:Wplb83xXyyDKgOWoNlOKM1F0eJ3weyHgUnNfI:QlABV2gqNlBYq2weytm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705107413, "uuid": "50eb807d-41a0-4611-a753-2271cfb38c5f", "value": 1682940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705107413, "uuid": "857a2b73-0e6b-4b1d-837e-30750f33f795", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705107413, "uuid": "c7c8e2d7-0e07-46a9-a3fe-4d8a16883123", "value": "runing.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f0264fc-b264-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GCleaner)", "timestamp": 1705185572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705185572, "uuid": "1e85a4e8-dc0f-481f-b5c7-7b2a893bafda", "comment": "Malware payload (GCleaner)", "value": "b24eab642f6d03f7d60a1896760572f5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705185572, "uuid": "f41e6808-2de9-48f1-88f1-b8eab3b78d3c", "comment": "Malware payload (GCleaner)", "value": "1ae81612a07bd1a1f8e15cbf91f98d1d077702f92becebabc90631191ddf998d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705185572, "uuid": "b02e2a64-2f30-4116-a8b6-1d328a486973", "comment": "Malware payload (GCleaner)", "value": "d5c099874196910bb8c3377491afe09bba927d00", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705185572, "uuid": "6ca85863-497c-4910-977f-c4f7f9ffca4f", "comment": "Malware payload (GCleaner)", "value": "eb6507f39b7c2f66ee0e588265ddd1130f7790b25278f484060b66e2c500a9a87c26d0430a5ee32bb2a2060997539054", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705185572, "uuid": "157bf821-9e46-49ce-885b-f4cf83732e70", "value": "T14554AE1175F5C532F2B3697A4831CBB94ABBB8726E319A8F36C046BD4F256C1CA25307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705185572, "uuid": "ab2b261b-2e75-4f3c-a7f6-8defd38516cd", "value": "5ed00a86888d3bcd71c89e026f9d181b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705185572, "uuid": "db08a5fe-b30b-4d5a-bdee-7c5b8c17c717", "value": "6144:y3VlZUAx/6rS1PT4h+MOoQE7bZ3U2eILY:y3VlZR/6ruT4h9X7xp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705185572, "uuid": "322122af-42a0-4a9e-8609-0c7575265781", "value": 293376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705185572, "uuid": "78dc9ea6-dee6-4a47-b010-2e13145ec7ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705185572, "uuid": "d01d8673-1e60-471e-808d-f23199d8939a", "value": "b24eab642f6d03f7d60a1896760572f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7dc5fb2-b1c0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1705115177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705115177, "uuid": "f5716056-547e-4518-8a69-d9b32f9e4eb9", "comment": "Malware payload (Stealc)", "value": "e2ebe1a39955919490d77003ebd1e24a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705115177, "uuid": "76a6ff2d-b175-4ef6-b0a6-66983b9a52db", "comment": "Malware payload (Stealc)", "value": "1b9aa5466581a39963462602ec9b3fb18f7afbda1175d6b3460e035a7ba485d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705115177, "uuid": "379112c2-6942-4931-b649-f914a932d63d", "comment": "Malware payload (Stealc)", "value": "c7cf7e7fc6635577842251fbef01695aa2dfa029", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705115177, "uuid": "8ae74e09-76e9-4164-87e6-9898f1a0fb88", "comment": "Malware payload (Stealc)", "value": "89c9c663a293d26ff31522d053945439e6ee4aaea9d2cbaeb7b43db7df4a0fb849f6782e490bde866c73b6098a24a28e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705115177, "uuid": "f6ef134e-6e7c-4167-b081-f7c5c97f9586", "value": "T126B5235149C24C62F5A60D70183A70D64BA11EB7A5C5E493D3C2FC985EF3741A38FABE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705115177, "uuid": "644a1e65-7af9-4365-8a6d-c34a63febb40", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705115177, "uuid": "6d48f606-429f-4916-ba53-a5e86dd2f56c", "value": "49152:vk2s5FXQ4EmojLjCRELVf7Avil+dHIsLp1thIikN+6u2hs8:v8zX71oDCRAZUviAHImDqia7hs8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705115177, "uuid": "b9bd54d5-c9c9-4300-a834-c825ebda1206", "value": 2467261, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705115177, "uuid": "36a4d64a-0ec6-4fbe-9e84-ae42ff7002f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705115177, "uuid": "8d8c009f-d31f-4a97-8912-ffe0f57c9ba4", "value": "InstallSetup7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb44a9d4-b1c0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1705115263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705115263, "uuid": "12ff09f2-c308-4b93-98d5-cff11f993737", "comment": "Malware payload (Stealc)", "value": "d5610fe6893c1bb0df7b32471f878839", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705115263, "uuid": "b32f3b22-4aff-4205-a0a2-2ae9118523b2", "comment": "Malware payload (Stealc)", "value": "1be268eaff61a1b16c5707f42075e1ee1af7a8f746ee458869c977fba0f2b28d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705115263, "uuid": "862de24c-3f9d-490e-b094-cd3a9dcb4ebd", "comment": "Malware payload (Stealc)", "value": "fff1ac008bc791187392c010c04958686786ef52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705115263, "uuid": "adc98dd9-3b2e-49c6-b201-4947696efb5a", "comment": "Malware payload (Stealc)", "value": "44fcdecfbab522b486b136889b249afffa4811d63f1a224df75247bd8ec605833ba27a349012a83e063834daae203d55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705115263, "uuid": "bbbedd09-16c4-4969-9ea1-b2a41f2afae7", "value": "T15EB5235149C24C62F5A60D70183A70E64BA11EB7A5C5E493D3C2FC985EF3741A38F6BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705115263, "uuid": "2b32fab4-b080-48bb-bb1f-d725b4b5f8df", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705115263, "uuid": "1060ede7-814b-4440-a953-a26b6e0d083f", "value": "49152:v82s5FXQ4EmojLjCRELVf7Avil+dHIsLp1thIikN+6u2hsh:vEzX71oDCRAZUviAHImDqia7hsh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705115263, "uuid": "65ff8537-dc3c-474e-a52d-86983dcf6c5d", "value": 2467255, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705115263, "uuid": "64c6340f-8afb-4fed-8d02-6a02b7420459", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705115263, "uuid": "74b76164-f7cd-4bf8-b2e2-587e13fdb3a9", "value": "InstallSetup10.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b849ec1f-b1ac-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1705106587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705106587, "uuid": "8c3d1146-063a-478b-b240-c78863deb352", "comment": "Malware payload (Socks5Systemz)", "value": "4fb9546e9f84008fc3265f0543319d7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705106587, "uuid": "06bfb852-d9e0-4bd0-8c61-84cdc000990a", "comment": "Malware payload (Socks5Systemz)", "value": "1d375b0d72b8e70a588f3759d0ff9366475478d08b4c37f460c432a719259480", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705106587, "uuid": "34f4d609-50bc-4b95-8231-0ff561aba7e5", "comment": "Malware payload (Socks5Systemz)", "value": "dee6502d50062a4a83a6e9d3cb72287c232a68af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705106587, "uuid": "954a8735-45ad-4071-a372-97a24f7e132d", "comment": "Malware payload (Socks5Systemz)", "value": "f658627bbfda8d7b0124b7c382efe21f447d2d08693104130a375b63fbafbe88e36569e2e241a2eba13232d83e9e09b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705106587, "uuid": "a166cdca-e1b9-4726-8e7a-4c08b8dbb06e", "value": "T1E8363312F1C3A6B1F8618FFF1D9F062A9A1A1854FBB51CAA3BDD09A4E373970D60D501", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705106587, "uuid": "d49bff4b-5f2e-4373-a585-e48be9b72818", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705106587, "uuid": "eb614ae2-76f9-4c89-b168-9f235a8604d1", "value": "98304:QinIBnMON9Ch9Ax8Gxt6ab8q9RvJJm+ZteJtZVC4vCNifVZ7QgzX:BGMO2tGxtKKva+Z8jZ0T0fV3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705106587, "uuid": "ecd547f0-7521-406d-886f-9f1e79ae5489", "value": 4931698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705106587, "uuid": "7919e6ca-3d72-4947-b862-7b9272e0a28a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705106587, "uuid": "fdc4e279-3f61-4255-bbd8-abf85023d7be", "value": "tuc6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e659c861-b25e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705183115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705183115, "uuid": "ffbe4055-897d-4f66-8081-98198497ea36", "comment": "Malware payload", "value": "fd4dbfa9eedeb18ec739a5f20efdcbd0", "object_relation": "md5", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "PlanetsTherapy", "colour": "#A55C4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705183115, "uuid": "9d554899-1da4-4753-88c5-61dde90b2a83", "comment": "Malware payload", "value": "1f75823631e70c74d3c906e6e51bd24d6e109729a8dc703aa712e8174e208330", "object_relation": "sha256", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "PlanetsTherapy", "colour": "#A55C4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705183115, "uuid": "c08d715d-50b7-4a4a-8ec4-e9c0fe020a3b", "comment": "Malware payload", "value": "bd43488646ad1aa544e3ccc8bbe3c334918dbf46", "object_relation": "sha1", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "PlanetsTherapy", "colour": "#A55C4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705183115, "uuid": "e035fa80-f750-43e5-8e6d-06850f443b5f", "comment": "Malware payload", "value": "6c131ccd74ab07117373c1486c021cc4815947ae4ac1569c1661a350894de685121c9dd35f8454e22fc91d0641efaf81", "object_relation": "sha3-384", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "PlanetsTherapy", "colour": "#A55C4E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705183115, "uuid": "3a94bc8e-92ed-4444-9151-b63e305c3ffa", "value": "T18EF7332A1F8D08F7D864D7F1B4B9064B6A48A100B572D663AC6F567D32CCE1E6D23F84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705183115, "uuid": "d08af2b1-07ad-4aa1-9ff5-f1cf94b9bc78", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705183115, "uuid": "70e015fb-c68b-4f99-8bc0-fdb2b6c43a46", "value": "1572864:L4/4rzOchPPuF5mAXJP4adwv4Xn4Rkb6n7IFWEOUuqPf7JPV277:0kqcdPQcAd4d4oRkmn7IFqDqPTS77", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705183115, "uuid": "a46160d9-c009-4b91-ba7c-96a29f930e77", "value": 74793161, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705183115, "uuid": "974f4ca3-b299-457a-b0d7-ab219f967831", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705183115, "uuid": "e7b16216-e99a-40dd-8313-b84610bc8a4a", "value": "PlanetsTherapy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9d75ed6-b1ae-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1705107530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705107530, "uuid": "64f87daa-373b-406b-a4eb-8aa97de6dd19", "comment": "Malware payload (CoinMiner)", "value": "199b790d05724170f3e6583500799db1", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705107530, "uuid": "ce87af85-55a5-4e7e-8a84-4327c6ae268b", "comment": "Malware payload (CoinMiner)", "value": "20a0864cb7dac55c184bd86e45a6e0acbd4bb19aa29840b824d369de710b6152", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705107530, "uuid": "0bd255f6-98c6-40f2-87a5-d3171c0d2459", "comment": "Malware payload (CoinMiner)", "value": "c0cab89a9dc3eb30f99d3577ffd82defda7dd03b", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705107530, "uuid": "38364ceb-ffb5-4a59-b088-f1051c3e7f2e", "comment": "Malware payload (CoinMiner)", "value": "9ac09a315919f4a811ded6b647c7bf87a0416daad2e6560979bc268cf78adee4a07e2cb6cb46c0f062d73bc8d7bd2477", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705107530, "uuid": "26a5a8a9-2316-44dd-bb63-d012fc7b68f0", "value": "T1F6666D07B6A218FCC1AAC870865FD573B930B8985211797B3795A7302F27F605B1DFA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705107530, "uuid": "a1d592ad-d80c-4bf0-a32c-c4fa67ae0e9f", "value": "196608:mGyx2Z/ccFGeLoC0Sbg7X+WloiMbqRoQ6:msioQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705107530, "uuid": "7cbc27b0-fb74-4a05-8a5f-bc1a51e9b58d", "value": 7047392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705107530, "uuid": "50b1d0f6-f1c5-4969-b4ee-12ce5d217d42", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705107530, "uuid": "a1140f3a-d3c8-49a9-8de4-3f535d6e69e5", "value": "runing", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3180163-b1d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1705125154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125154, "uuid": "3091ba57-0b71-4896-bdd4-6b6dd3e78fc6", "comment": "Malware payload (Smoke Loader)", "value": "a485d801207028ed11b63726864dd12f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125154, "uuid": "e2022dde-9203-4f2e-85f8-c3336427735f", "comment": "Malware payload (Smoke Loader)", "value": "20b50cb986027fbd7dc77c6cb6008ac9318f71287e73732433a6cebca929cdfd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125154, "uuid": "4bd679c6-4468-46a3-b188-670463ad979d", "comment": "Malware payload (Smoke Loader)", "value": "01d73e5be0faadc2cea2cf219a23559573f673c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125154, "uuid": "987dd973-bbb6-4603-beb5-b58a97aa3495", "comment": "Malware payload (Smoke Loader)", "value": "e1ed0f016ea126b246d2f2b6150dea02d34abfd8a8a6a2d5da69a38f57e02189b63710bdac79536ea99d4969b030c16e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125154, "uuid": "beaf8d0c-fef6-4ae3-8597-2c6d4b6921ea", "value": "T162447D0176F1C032F2B3697A4831C7B44E7BB8B66A365B8F2AC41A794F256D1DA34317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125154, "uuid": "cc9fa661-0466-4a5f-9125-a221e89e8b88", "value": "d8dcb51c50d0ca58adf96a087830e3b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125154, "uuid": "97ca10d3-fc45-47c2-8271-770cb2e12d8d", "value": "3072:kuLk3u+VAUxptxJi2v1KdD6T6zDoAObHvEZaB7rF5BlK6zycwB0mR/2e:k0k68tr6BObHvJrS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705125154, "uuid": "b226f9ed-297b-4267-8a59-5f55cb079ca3", "value": 271872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705125154, "uuid": "bb25e961-01a4-4183-8313-45605a308c52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125154, "uuid": "5a190ca0-8d77-4b25-9d4f-df190f391793", "value": "a485d801207028ed11b63726864dd12f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13adf2bb-b241-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705170306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705170306, "uuid": "0c641844-5534-452c-a498-d625d43e2c5a", "comment": "Malware payload (AgentTesla)", "value": "f388e9f5421968043b219eb564004363", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705170306, "uuid": "4800e488-98d0-463c-8cc4-13ae08edf327", "comment": "Malware payload (AgentTesla)", "value": "22c9289584b472d01af24595a95083cc71d9fc1d273914d4c367e74add1c36e8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705170306, "uuid": "ea000528-49fa-44bc-9731-f5ec1e64610d", "comment": "Malware payload (AgentTesla)", "value": "8d8ef8a58aaf7aba3523453b99c25c02d648d543", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705170306, "uuid": "1981bbaf-f67f-4171-9961-3af7ff08d8e8", "comment": "Malware payload (AgentTesla)", "value": "fd7a07e7f0bcf5b73f0751bf2c1e73e0aa0124f54e6a94004e7dbf393a1b59d73ea5f8448c32a3c85fdc4360f28149b7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705170306, "uuid": "9fb21905-e8de-4881-9642-91c1b245133f", "value": "T1D683084BBA7A84B3E248473BE557912003A4DE427643FA0B75DD339B99337E98E01D4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705170306, "uuid": "cb085093-8d73-4d81-b02d-6148c04d08da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705170306, "uuid": "92a09a76-d398-4fef-85bf-b919ff01f8f5", "value": "1536:BuKE8W3pzHYrAkHbaG0i1TeTylwZ0h7huWc4+P:UL3pD/kZre0K0ZhuW+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705170306, "uuid": "dad9aaa3-a2a7-425e-979e-04282f2a96de", "value": 81920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705170306, "uuid": "96ecd85f-63aa-46b6-a500-c3ff85e6f165", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705170306, "uuid": "62ee5a71-25a2-4a10-ad1e-44add35025a6", "value": "SecuriteInfo.com.Win32.TrojanX-gen.27406.21323", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a739cbe-b207-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705145595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145595, "uuid": "14ea0460-4475-404a-bb9b-8627d7d7864e", "comment": "Malware payload", "value": "8a68eefd52aabf0ea6248ed1a3ec425e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145595, "uuid": "7a675467-04ef-4a42-8859-34f97df85ac0", "comment": "Malware payload", "value": "2365625d754df11cd7866801949259bab9760ca2c804640e4eb8ec19b92fb87e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145595, "uuid": "599982db-6297-4697-b862-c5288220c5af", "comment": "Malware payload", "value": "ee25affe8d04a1d6cb8fce2cb4cee7f2296e78d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145595, "uuid": "da509b98-867d-4acb-9f85-d07aa2f02097", "comment": "Malware payload", "value": "5d2d5a0e4635d5ee45ee9cd9aab9176548873d2933db89cee0e6070f95af63bd4aa57da2eb7467efd4d439c8f2098ae6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145595, "uuid": "7a32a8b6-06f5-4baa-afcc-17e5a1dd2bb0", "value": "T1B6F48D22B3915833C0631A389C5B97B4593AFE113F28EF462BF51D0C5F79681792A2DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145595, "uuid": "7779f35e-afe2-4b31-b2db-4b572c6e70fa", "value": "4f3035d79f2b10cf0d2afc424d583f57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145595, "uuid": "55cfd2fd-655c-47a7-8881-bb59b6408ca7", "value": "12288:CyXT29cJwekGEqMOe1l+TRNSQ5KQC/ITSHlwfZk3:lCW2GMOEHQCGSHOf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705145595, "uuid": "548f737f-0ae3-4781-9e8b-9a67442b4a6e", "value": 752640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705145595, "uuid": "5f9b8c30-984f-4101-857c-b162fb504a2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145595, "uuid": "b9389289-d1d9-46df-9e04-81bfd768d88e", "value": "SecuriteInfo.com.BScope.Adware.Presenoker.11162.9800", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67144323-b1d8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Tofsee)", "timestamp": 1705125349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125349, "uuid": "c1976c64-e280-4068-9c1b-6c053b9e0789", "comment": "Malware payload (Tofsee)", "value": "b9c89c3ed216df0e259b9d0b38a2dc94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125349, "uuid": "df31703d-fb8a-42e5-8d54-a8edf4ed10f8", "comment": "Malware payload (Tofsee)", "value": "2496bd1f22e675f292a9176022379b39bd6c0a74ca928ca3cca4d639a66f108f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125349, "uuid": "6019ef3f-a5f8-4bcf-a40e-910d2bc8d262", "comment": "Malware payload (Tofsee)", "value": "ea82873249048a2dc026d8bb24616147a9d95729", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125349, "uuid": "53be7b96-e80d-498f-9f30-a42d45914170", "comment": "Malware payload (Tofsee)", "value": "4700f421b5a9e79304e9b89d8195fb936e7aaadc715bf0757d9727fc80dc2cbc7f105bf39f9867158a952b398934564e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125349, "uuid": "7ca2b8bb-ec27-4818-8bd7-1e0e51f8df82", "value": "T111348C1136F1C032F3F36A795871C3B54E7BB8666A3296CF5AC81A7C4F25AD19A20317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125349, "uuid": "5a119507-6923-48c5-bd32-1e554465b487", "value": "d77b02f65b7bb86e8f742226786b42db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125349, "uuid": "2c230758-33fb-4f23-8917-bec98cbe3c38", "value": "3072:rJWQg26WaXsiQLhJi3s1KMnwFlscekf3O2D+sYc+VhfRv9ae:rJrSiLslsclz+PZ9f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705125349, "uuid": "7a59a548-2e7f-479e-8f89-9c048619d389", "value": 238592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705125349, "uuid": "6ac26d22-301b-4a32-a163-699d586c9364", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125349, "uuid": "7ebc5a97-15b3-48c4-b3bd-154447bea40e", "value": "b9c89c3ed216df0e259b9d0b38a2dc94.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c9d6bbb-b207-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Riskware.Generic)", "timestamp": 1705145625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145625, "uuid": "fa5c7651-3eb5-4c71-9343-526696c1a8d5", "comment": "Malware payload (Riskware.Generic)", "value": "d2ccddf867ce8b8d79cdd06f3bfc779c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Riskware.Generic", "colour": "#081407", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145625, "uuid": "852c05f7-ee14-4c28-b994-7bc85bde1db3", "comment": "Malware payload (Riskware.Generic)", "value": "2813de70df16750854f14c79b9aa846f92d7f470e9cb0b983b5381828d064a4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Riskware.Generic", "colour": "#081407", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145625, "uuid": "68ac0542-04e6-455b-abd9-33d68f166eba", "comment": "Malware payload (Riskware.Generic)", "value": "4503877ea98f891136fd4170f8264004e078dc07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Riskware.Generic", "colour": "#081407", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145625, "uuid": "38a73621-c764-4609-bd53-82361234f649", "comment": "Malware payload (Riskware.Generic)", "value": "e8782f3dd870c27657875fdee64fdd124ba91c8ffbb0418850c8f533a6e52c9880408dc3d13f527c1826c49a87794ea8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Riskware.Generic", "colour": "#081407", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145625, "uuid": "6a27d1ad-b79a-4e97-8cd1-45de4857aef0", "value": "T1D165239C5A620F03F7E208B00DFE2D5CA57C25BF977254BB64B5404534202F9DABAAF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145625, "uuid": "14d57ddc-1616-4a06-b56c-196e675f5b91", "value": "d21ba06a86ad93e1f32dd365cec0bfdf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145625, "uuid": "cb585726-9c14-42cf-a750-aed032eaa847", "value": "24576:J9mhfKfTtFbY3CAvB5qg93RfVgOGhFRwGBos4yAjyBysqQRus5E+6S8czx6z:JsKZSHAg93IlRrB1IGBvqDzTem", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705145625, "uuid": "1771f62e-c729-440e-ae9b-c16cc6acbcc2", "value": 1458176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705145625, "uuid": "0261531f-d0c2-4854-90f1-47c1649eabe2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145625, "uuid": "8354b16f-da1f-4ed1-a950-2ddfbd74d9da", "value": "SecuriteInfo.com.BackDoor.BlackHole.40279.15930.24361", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8701517-b23d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705168838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705168838, "uuid": "5fd4e45e-2bd9-4d2f-8942-825bf8484e7c", "comment": "Malware payload (Mirai)", "value": "be7a7e0e8355279f2c61d2bbd3f50b51", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705168838, "uuid": "68cd31d4-7595-4940-8edf-8d881a0c3347", "comment": "Malware payload (Mirai)", "value": "28ee3ff9eaea1125066a92cd4b437de9a7e46d206d331f234b8ec321c4eb1a96", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705168838, "uuid": "099b0acf-c9d8-40f0-bb4e-cd48f5272fd8", "comment": "Malware payload (Mirai)", "value": "786bb300d0d80b9b6ab3997f8c03963473990c6e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705168838, "uuid": "2361ed6b-1ce0-4d69-abab-0717db44af37", "comment": "Malware payload (Mirai)", "value": "56e2dd72a248de85ddb5a90764979789804d1421f2ebfa2e815c81246bb1bab2cf283066e0bb6e21f5208767b2fdf6ba", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705168838, "uuid": "e13fb627-23dd-483c-9bca-ba890e69d3b2", "value": "T113141A46EA414B13C0D627BAF69F42453333AB9493E7730699286FB43F8679E4F23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705168838, "uuid": "41530052-cfea-4ac0-aad4-84bd1088e802", "value": "3072:GhqO/YX0gVUWeIWZgI1aD18V336nE19D94Ew3eBMowM/RX3J/Hf4896:zO8sWFyj1aD18V33+O9jw3IRwM/RX3dg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705168838, "uuid": "ffcf3fbe-b6eb-41a3-9caa-fa8b6ab9d6b8", "value": 196551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705168838, "uuid": "2756a629-f899-47f1-8118-ee1ddca1042b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705168838, "uuid": "957d7268-6f86-4ba3-b787-c55008abf6b6", "value": "skyljne.arm7-20240113-1800", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53ac6428-b1b1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PowerSploit)", "timestamp": 1705108566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705108566, "uuid": "db13bc60-53ad-40a6-9328-178376db1e52", "comment": "Malware payload (PowerSploit)", "value": "c5eb4b9c0d4d78d3841d7fb2e6f13b0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PowerSploit", "colour": "#4AC80E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705108566, "uuid": "f5bbd532-bdcc-4d7a-8c72-42d50e7ffccf", "comment": "Malware payload (PowerSploit)", "value": "29b4af761cd73fd704200ad6b80aa5284048584a3c6e431574397bdbf6096d40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PowerSploit", "colour": "#4AC80E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705108566, "uuid": "89d5dc26-3334-42e2-bc96-1dd9f62bf1d3", "comment": "Malware payload (PowerSploit)", "value": "fdf036a879a50dde7e3796bdca1efc62c3fe1c7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PowerSploit", "colour": "#4AC80E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705108566, "uuid": "1f004804-28b5-4921-b7bd-eeb68abbd3d6", "comment": "Malware payload (PowerSploit)", "value": "696b159b41839df4f1eaee82120688760819f797d6e5b36a14e00fc5663e08625e90f182bcbadb1907c8a5a4abd2fe5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PowerSploit", "colour": "#4AC80E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705108566, "uuid": "78ef93b6-70d2-45d6-ae61-e3a606916401", "value": "T13C063300AF95AEAFC9A8863D70F76F2D07F01B445008F5DA4AD554CF27AEF90582786E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705108566, "uuid": "9117b71b-d6c4-4070-b785-bd5a8cb00413", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705108566, "uuid": "a77e6c34-8e5d-4842-a282-0dde1a11f608", "value": "49152:Yl/pro5oOqDmoOOPFB3dJWiaJhEn7whFgPOYNIPx:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705108566, "uuid": "29628293-fea9-450c-9ab6-b919276659bf", "value": 3730432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705108566, "uuid": "3794a4a5-a353-41fc-bbe8-c3a443727e84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705108566, "uuid": "24a9b798-1ae6-456a-9112-c64906aef69b", "value": "shellenium.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88d330e2-b207-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705145592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145592, "uuid": "a0c98ff9-7dcf-4234-b33c-a266fe2b20f6", "comment": "Malware payload", "value": "52b89cb22ae99303bde4e89607e6695b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145592, "uuid": "2a8dd4fc-647f-48e7-8eaa-f865ec7fcd09", "comment": "Malware payload", "value": "29b6d72d8d6057f87012b27407444391b183a95cad700d396f01dc4314feb31b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145592, "uuid": "04a047a5-b5fa-4c36-b5f6-d2cb3b50353c", "comment": "Malware payload", "value": "0a769f1e4f65f68c191d8df4bb087abaf6998aa5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145592, "uuid": "3c734e2e-274c-45d1-b78a-142587dc21d8", "comment": "Malware payload", "value": "a07782b2f1b064ff70eedb27dda2c3dd01b84ce25dbaf742c8333daf1647e4bbfa2bc48a1af5eb6e591edc84c227caca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145592, "uuid": "b6a87483-3189-476c-8c09-b229c78d422b", "value": "T1A2C49E42BAF390F5C63951F02D5A6B3EEA758AC90B15DFC39350DE2D9C32580D93B226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145592, "uuid": "2ed5571d-8006-45e7-8d7a-4299e264928f", "value": "4b95d010be1c329f6030910d804df448", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145592, "uuid": "b10409fc-f489-4e80-a742-fb89d05d455c", "value": "6144:DxjTaukfMlfmHJgtrYifrdZOrf+05JiCukiYMBcsshoMZdD2sowjvPgRq6QLMA0Y:Dx1k5HJ6jdZOrfn5bPhmMZ37EvK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705145592, "uuid": "df7e2952-6732-46e9-b6e8-ec42e8c92633", "value": 581632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705145592, "uuid": "d5207a26-613a-4cea-b4e8-101423415026", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145592, "uuid": "bca663d0-cdc7-43cb-98c4-5da58d1b5dfb", "value": "SecuriteInfo.com.FileRepMetagen.6768.29201", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5de725e1-b20d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705148097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705148097, "uuid": "41e73760-f6f6-4c2a-8d4f-1901e6513479", "comment": "Malware payload", "value": "26617e8192950714d7d9c7548fbc262d", "object_relation": "md5", "Tag": [ { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705148097, "uuid": "cd4c3d33-7f57-4018-8766-cf4663169350", "comment": "Malware payload", "value": "2b32d8616ebaa2e748977dcdc8cd8ced6dfea14d0025bd1494b8dcfd34694c69", "object_relation": "sha256", "Tag": [ { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705148097, "uuid": "7a6b8589-9a1f-445b-92e4-e3966c5e638d", "comment": "Malware payload", "value": "49e1a27d74017d04623a5401cbdd203a87dde7c5", "object_relation": "sha1", "Tag": [ { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705148097, "uuid": "bb622bf4-29b5-49aa-847a-f6973230c83d", "comment": "Malware payload", "value": "2a493c8a2b255e1d6ea84b492c580ef9251932eb7c09195e1b108a1f2ba03ab7c8cd58f79a2978ff7c3516bded153b67", "object_relation": "sha3-384", "Tag": [ { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705148097, "uuid": "d43947d4-1458-416a-b061-9d1622a733c6", "value": "T1C5183323F285A13FC06A17369827A715993BF7602B1B9D8B97F44C4C4F365903E3A687", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705148097, "uuid": "165981a9-cee2-41ba-8b69-9e09db05df70", "value": "7e0b2c8cee523b3f3a7a127ae6de5d80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705148097, "uuid": "4a9f6cf9-7dd6-4e98-8461-a09dd9d7c84f", "value": "1572864:oFq6qBAr8xoTN6oRGl9ipf2ouSYrZ9Q9G3ax64AbjuYruo4qn+:oc1BvoRGl9ilHuSa9+0i+uotn+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705148097, "uuid": "e5c1b14e-f272-4cb0-99b1-7a7302cac085", "value": 91739040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705148097, "uuid": "42c939e4-ee3e-4cfc-bf47-490679076148", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705148097, "uuid": "8278590a-1967-4c68-95a0-31173a053cb9", "value": "Cheat Lab\u2122.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a93e5f3-b1d0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705121785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705121785, "uuid": "6780ad06-906c-459c-bb3b-69dfb03fb0f4", "comment": "Malware payload (Mirai)", "value": "97a4365ecb8ae7b184e2b24d71388172", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705121785, "uuid": "8c0dfafd-8e7c-4dfb-8880-e24041db663c", "comment": "Malware payload (Mirai)", "value": "2b35407f50b48294e3ccd02c06f5f26416ecff3c266c22c2a0e9191f9d6fbc98", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705121785, "uuid": "9cf767c3-81ac-4e9f-8992-a64717775a6b", "comment": "Malware payload (Mirai)", "value": "598b71a206374a63b18a9e648568e125a8b0ceba", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705121785, "uuid": "7b1fe272-f08f-4dea-9b28-092705c2e5c6", "comment": "Malware payload (Mirai)", "value": "713508e97f8922c77b42354a7c4964471efde30c1dbecdecf94612d364f2c7d4494a6d200512bebc13a92937e79636a1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705121785, "uuid": "b9e31cc5-b7dc-4b88-a469-7292bcab7e82", "value": "T1B5D32B56EB408B13C0D61779B6EF424533239BA493D773069928AFF43F8679B0E63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705121785, "uuid": "1d5e8be8-d9bd-4f97-8839-ea49e2a39ea9", "value": "3072:yzGtlgQ5taOgQ5pDYY06MATSivRoau+EkfM/9/M6H:yzGtxtaOgQ5pcMMGJoau+EkM/9PH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705121785, "uuid": "f6707fce-b4a0-459e-84c8-e3700cec298d", "value": 140758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705121785, "uuid": "3923c029-ba20-4790-be90-4f2bb43c8148", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705121785, "uuid": "eaa2c39c-9b31-44bb-a065-fa6ef9e395c7", "value": "a7.nn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cbfc760-b207-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705145599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145599, "uuid": "b58f448a-3f7b-4b5c-9070-ec88cc9d3c45", "comment": "Malware payload", "value": "3aff96583899699964dc767bae529c9e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145599, "uuid": "d815d7d6-f9f0-4f50-85e6-b54e157001f5", "comment": "Malware payload", "value": "2cc3aae2471c8ef792f276dcf832e314936a02a23e08b0bda82d09cd110e572c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145599, "uuid": "852d496d-5117-4365-811c-06aa7a749e03", "comment": "Malware payload", "value": "b582d6cedee847c4e82cf01b4924b4b8a1e12a5c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145599, "uuid": "c4b3e3cc-b4f5-4443-ab1d-ee7f0baefc80", "comment": "Malware payload", "value": "c36cab3fe4e69b13eeb9021377b1706b171da771eecfc9b154b66580117685d33e0676ed66dad1fbf80063d4bc4471ec", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145599, "uuid": "0cc5b18d-b00f-404e-9d9d-bdb9a4e6b391", "value": "T1F414723A39F1C8BFC02A49308CA346E45977FC129D92824B5A587BDC6CBA1C85E37577", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145599, "uuid": "a759f0b6-f878-4f4c-bedd-5301d28a9fec", "value": "092ec812e52bc82d25a6b0905da4233c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145599, "uuid": "e3b44ba9-c31c-4039-bc72-b998f20a54b6", "value": "3072:J/zzG8EMjoS4X0tceXBCEmL7EynwVJcXjVTeOI9K14xymWuQti3dT0U3tFQxf/g3:J/RQX0tceXBCEmL7EynwVJcXjVTeOI9r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705145599, "uuid": "6952aac9-7f3d-4108-b12e-b08f303d4aa4", "value": 196558, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705145599, "uuid": "f2303316-05db-4948-8fd6-2cf306402a8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145599, "uuid": "67a3743c-b868-45d4-ac0e-a3bfba7ee777", "value": "SecuriteInfo.com.Trojan.Win32.31550.8494", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7244c5a1-b257-11ee-b7ea-42010a9c0006", "comment": "Malware payload (NanoCore)", "timestamp": 1705179914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705179914, "uuid": "0c19765a-1326-4d56-83a7-d6e3a9fb4527", "comment": "Malware payload (NanoCore)", "value": "c088d86f7e3b1ced5a0fe388fdaa7d08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705179914, "uuid": "b48ca754-94dc-4d2c-a72b-aa0909eed914", "comment": "Malware payload (NanoCore)", "value": "2e197a2aed5649a377f6143d0c36adc3778eb258fcba43ab49e30013ff25cd77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705179914, "uuid": "05686a4f-e14e-4d32-bfb4-65a8dbbc76bb", "comment": "Malware payload (NanoCore)", "value": "5496607945009d80f9ee4b2b0d5245d20847b33b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705179914, "uuid": "c298c166-43ea-437a-94ba-2eeeaa99c4a0", "comment": "Malware payload (NanoCore)", "value": "f2707f13a3596fb7647fd00d22fb9e5ab72de7f85062b5380f02c12fad455817693d33948a5085d0963465c59083e322", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705179914, "uuid": "95cb94eb-7944-494d-b843-5c70efdc4cb0", "value": "T1FD34CF163BE8462FE2DE4A79602212429379C2D39CD3F3DE28D455B75F227E44A072E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705179914, "uuid": "6eae7bda-7042-475e-8f71-0cc4dc72d45a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705179914, "uuid": "1bac43dc-89be-430a-9aad-6acf2c9f7aa6", "value": "6144:xLV6Bta6dtJmakIM5Z55BNb6EmcoPaA/X9bvJ:xLV6Btpmko53IVvaAPpJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705179914, "uuid": "c79e6a5b-6e6b-4835-b2d3-5763115f1582", "value": 238080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705179914, "uuid": "1f86f859-77a9-45ee-b09c-f2cf3b0af80d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705179914, "uuid": "31493498-f439-45fc-8581-a2276d0fb276", "value": "c088d86f7e3b1ced5a0fe388fdaa7d08.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2a20192-b1d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (OskiStealer)", "timestamp": 1705125019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125019, "uuid": "d8d4469a-9923-421f-9b3e-09a187e96764", "comment": "Malware payload (OskiStealer)", "value": "8c36f8a010e9781bda4076852efb05a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125019, "uuid": "5453cdce-c9b7-48db-9a3d-7e228bbd4ea0", "comment": "Malware payload (OskiStealer)", "value": "2e77a1b324229a10ce5ac15a916526eff4a1e44c291bb918d6ed5329bc56f81b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125019, "uuid": "210bc55f-51b3-426e-89c8-ccbc764abec7", "comment": "Malware payload (OskiStealer)", "value": "155d37c5d7cfda081a74080dc288a80c7ecdc643", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125019, "uuid": "742ed2ac-8297-4026-9c02-ca16752f35c2", "comment": "Malware payload (OskiStealer)", "value": "35cc6f1926d810c944aef811a3f649fa5fbef95923694268d1e64e66425fefbf4072b55a25aed9df417c42155423ceeb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125019, "uuid": "371e628d-919d-45d3-8710-a2f30fd0a46c", "value": "T1C4146D30B690C035E8A310BCDDEE86BEB96C7A301F5950C3A3D45A662F712F27A71657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125019, "uuid": "cee7f4ca-a36a-40bb-b8d5-5664ac354893", "value": "7bb9d345a5fec4fbbf5100d6a3ffbb8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125019, "uuid": "15c2563c-2ba5-4573-a4b9-28a0d26360f9", "value": "3072:WfUomEuYm98dlSq7gt5q7Dx+XgS6aCEwhOfUbCalNT2pbB3fIr1Xi6FLPo3c:WfUauY68uSWCx+XA7mg2pNS1Ljo3c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705125019, "uuid": "1de4d2bf-f9f2-4b80-9449-5fe6fa1e1f67", "value": 204800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705125019, "uuid": "340a7972-5570-4f00-a4e4-02ad42dfaa7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125019, "uuid": "5c36b929-5272-4ef7-8ba5-bcf65922eddc", "value": "8C36F8A010E9781BDA4076852EFB05A7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d9ff124-b207-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705145600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145600, "uuid": "86e39619-169e-463b-8086-ab9df836c7fc", "comment": "Malware payload", "value": "5ba5e7638d83c91e2053391ec60f0e08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145600, "uuid": "7647b0de-21cf-4903-9cc4-fbf27c4b5886", "comment": "Malware payload", "value": "2efaa0d4a6bdc268547ad87f11818fa4a75f826ff170b9ced38d0095b9c37bd3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145600, "uuid": "d1534ad3-b8c1-40b3-b322-9db6db371d34", "comment": "Malware payload", "value": "4ca193325e531d9af8ba2473cc1d47e4b6290087", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145600, "uuid": "5d53b65c-2697-4fbf-8c34-71f5abfd897f", "comment": "Malware payload", "value": "dc748089579fec49247345700773ca1db11b7edddc04ce7ebf87d41e4e414f0e44d7043daae802999b7bbe4bdb9331ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145600, "uuid": "7728c940-d501-4ac9-a86c-30259d5c0af5", "value": "T12BE49D16FAE640F4CBC155301867AF365EA859C68B9C8FEB513AFD980B321D1E437272", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145600, "uuid": "85d99957-2451-4f18-b27f-38fb432b5aeb", "value": "6144:xWQuaUFb+mEwvOuXkOea/ISkjARIHwQ+8NojTTzRPjJsAE:xWQ6F5ivOea/QjGuS3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705145600, "uuid": "6131f827-7aa4-4eb6-8a31-60c5bc65550d", "value": 688128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705145600, "uuid": "548b34eb-a214-4d4d-b4dd-ac07399e4386", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145600, "uuid": "1a368899-d1f0-4e91-97b4-e9095bca8de7", "value": "SecuriteInfo.com.Win32.Trojan.PSE.15IBL0F.5263.4936", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecc23105-b1d2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705122996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705122996, "uuid": "98b22a30-ed46-4031-a079-53e82f04f1c4", "comment": "Malware payload (Mirai)", "value": "8132435b72b9d362f1509995ffecf453", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705122996, "uuid": "100ec503-068a-4641-b875-b3c8e2915c0a", "comment": "Malware payload (Mirai)", "value": "2f04bd784e5d0afdb75ff1c2946cbf3b37214b4c8d32a96b2a7a0e0e940e8354", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705122996, "uuid": "105e04aa-f9c3-49f6-9447-aa5e3f9e6f8f", "comment": "Malware payload (Mirai)", "value": "3cb3f7acb8a84128479425210728bf413b74c43f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705122996, "uuid": "071ccb87-af6c-4b96-aa0c-6c852dac6188", "comment": "Malware payload (Mirai)", "value": "93615b271eef8831ae9f986c46b746d86a0e2cbac9f8b38a0fdb4e04810e1eb17942e0a20913639c58a9ccbc657ea614", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705122996, "uuid": "f6be0de4-2c85-42f1-9301-c80586092a3d", "value": "T184531A9AF801CD7DF81BD77F4457490AB631B3D142831B3627A7BAA3BC721991D22E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705122996, "uuid": "aaa8a11e-7602-422c-a8ed-5705d1a8cbaa", "value": "1536:bZ+LRR5O5wUUoG8ogEX+IWQWQ4rH0JfW2xBYUB:bMM5xUoQUIVW91gBYUB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705122996, "uuid": "667cc0cd-c290-4ef4-9871-aa272cf639ae", "value": 61856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705122996, "uuid": "fbb1d9f0-aed9-48a1-84b8-6d71965d0771", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705122996, "uuid": "eb9cab98-8a84-48cf-9e64-27648f2cb25c", "value": "8132435b72b9d362f1509995ffecf453", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4409a465-b1cd-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705120566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705120566, "uuid": "72b891cf-d14a-4b08-9146-0ca8da30333c", "comment": "Malware payload", "value": "83665b539d42d8d214c85af930a894d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705120566, "uuid": "a169c9dc-36f6-4452-acb7-6c4a5e60ed56", "comment": "Malware payload", "value": "32067ac3e8697093f5221963577e390306e9f062ebcf4eb93b6c6e6e1d2367e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705120566, "uuid": "84d9adc9-2f22-43cd-89a1-dd2776b91be2", "comment": "Malware payload", "value": "b4b6def53e2bef7543da5f7b27047e669e4a25db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705120566, "uuid": "3240cda8-e09a-4431-a98e-9385594ca9b4", "comment": "Malware payload", "value": "9b53a249e70fd023f7d9bb7ae4376c86c0d18148c87f513cefff9bba25ceae94b2603f59b60cfc91fe998443cdd6eb65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705120566, "uuid": "eb9870b0-3fa0-4321-bed6-3372b8a40cf9", "value": "T1EE248D0075D1C432E47314374AF99BB99A3DBD20076A69FF67E40FAE8F202D2B631566", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705120566, "uuid": "b1c41d22-f906-4fba-ba5a-12dee836214f", "value": "678588e4f34f59bf49f258aefdf6f6c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705120566, "uuid": "a926ea01-ff6a-4882-bb37-f45ef23ae27b", "value": "3072:yLmN3vaYsXy8AFZWMap0LWgOlrBBL8OZg9aL7BqAI5igq5UuAg0FujacWPK:yLPy8mwxWW/lrLwO97BRxHAO+PK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705120566, "uuid": "2208b446-f799-4df7-97b0-07bb5cbda78e", "value": 218112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705120566, "uuid": "9159cbd4-9aec-4d93-a3e4-bcac2363a1b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705120566, "uuid": "54e5072f-9119-48c4-8f64-043fad0c99e0", "value": "32067ac3e8697093f5221963577e390306e9f062ebcf4eb93b6c6e6e1d2367e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e944b7d8-b226-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Vidar)", "timestamp": 1705159068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705159068, "uuid": "3c52a290-67b4-4351-9d6b-7af15e9eafa5", "comment": "Malware payload (Vidar)", "value": "9cc5ab9f921d3d7cb2e627fc9a89e901", "object_relation": "md5", "Tag": [ { "name": "32-bit", "colour": "#4D0C66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705159068, "uuid": "98fa9164-e5c0-4b6a-8325-3496d18bc6eb", "comment": "Malware payload (Vidar)", "value": "32df75ebdf0e44f9351863160e89c89a000bebfa038ebb36dbb9e668ebcb045f", "object_relation": "sha256", "Tag": [ { "name": "32-bit", "colour": "#4D0C66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705159068, "uuid": "3672e4bd-d236-4a66-9c91-0bcdb6de1c8b", "comment": "Malware payload (Vidar)", "value": "738d1eba7455ef319fe35014defd4ab1623d187c", "object_relation": "sha1", "Tag": [ { "name": "32-bit", "colour": "#4D0C66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705159068, "uuid": "bcc5597d-abdb-4660-b8cb-2362e62f3f07", "comment": "Malware payload (Vidar)", "value": "d21168cf2c3c520a2da932c7a3456ae282dfd060b0ce52dd3830b5327808d654ec7549054c202fdaef8c90cc696b69b4", "object_relation": "sha3-384", "Tag": [ { "name": "32-bit", "colour": "#4D0C66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705159068, "uuid": "b84d7401-d399-451d-bc2a-0a7c4837292d", "value": "T195547C1091108031F3341573D65DA6ADC99F9AB22371F4CB6BA6287DDE259C2E339F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705159068, "uuid": "8da1e0e4-c535-4015-957e-138d9963ea08", "value": "bcf77c2c3cd3748f83f9c44cda23fdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705159068, "uuid": "e50a6db5-27b3-4604-8aa2-697a014d60ea", "value": "6144:MiKNqzy8JFjVSZSJOyBiCmL5QZPNKNSQ7+STtqR9YjgD6vizk13Kb:Mi+q9I92Q1Tt3xvOb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705159068, "uuid": "391fe137-fd03-46c7-be45-3256e891f0b6", "value": 299008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705159068, "uuid": "3f6506af-0b56-4cf1-a639-d41504bc14f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705159068, "uuid": "2f14ca5b-f0cd-4969-8372-780db3ff437c", "value": "vidar_02520000.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2a07487-b1c0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1705115222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705115222, "uuid": "090df7e2-1f1a-49f4-9a09-fb6a20902ce8", "comment": "Malware payload (Stealc)", "value": "56bfa5564a897e89e86926dfcb38069e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705115222, "uuid": "f362b0f0-e40a-4607-b119-2a038e42ea41", "comment": "Malware payload (Stealc)", "value": "3543966d3eff9000b0ddb417c6e15f75ca80b48c1abdafe629f3915458d4254c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705115222, "uuid": "4157c9d9-bc1c-4e05-8d6d-78b093e3af6f", "comment": "Malware payload (Stealc)", "value": "0396d4b21cc77d3ed07766e1c7b3670e126d994f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705115222, "uuid": "23e241d4-c841-4265-91ef-d6c8ccec9e60", "comment": "Malware payload (Stealc)", "value": "549ab05a6a3b9e2d9c1f37c461a278273ccd1690cd8ce330aef61ca8c878d46cc7492f255b8ea1ea3902115b48dfefbe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705115222, "uuid": "ee56bb0c-2950-4715-ad6a-ea93608d49dc", "value": "T157B5335249C24C62F1A61D70183A70D64BA11EB7A5C5E493D3C2FC985EF3741A38FABE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705115222, "uuid": "ac7bb51b-5fb3-47c5-bc49-7d924838779c", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705115222, "uuid": "badb19af-e456-4fb8-92bb-57ca0532a17c", "value": "49152:vS2s5FXQ4EmojLjCRELVf7Avil+dHIsLp1thIikN+6u2hsJ:vqzX71oDCRAZUviAHImDqia7hsJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705115222, "uuid": "1fa30d6d-ee91-482e-b21a-6f2ef730389b", "value": 2467258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705115222, "uuid": "28b0cef2-f2cb-4c30-87c4-e5e43e9d5762", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705115222, "uuid": "65df28af-bf9b-4c00-b5eb-16de13999610", "value": "InstallSetup3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7e0e77c-b1ac-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1705106640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705106640, "uuid": "13ce1d5b-1305-474c-888d-c7a59943026c", "comment": "Malware payload (Socks5Systemz)", "value": "fb4906179ab0a40e7a54f2f973c5a885", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705106640, "uuid": "eafda416-72fe-4847-8341-696893e6a4cd", "comment": "Malware payload (Socks5Systemz)", "value": "35b4d405ec078d4a5e3ea6d9e9ec2657962c8122e59ffc3dd5f52534f31fd52d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705106640, "uuid": "4726f9b0-3ddd-46c8-9fe4-0d1fbad4afd5", "comment": "Malware payload (Socks5Systemz)", "value": "d6ce6dba1dfefd352c74d859750ad81b0f615d7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705106640, "uuid": "a5fd1aee-bb9d-40e9-a88d-53bf431baefd", "comment": "Malware payload (Socks5Systemz)", "value": "543ca121a8ca8842f062f788bfc706a59dd8c322831db0043d80a2c70cbe9086f06550d9adb64cf3581eb5da956431ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705106640, "uuid": "87f2ada5-506a-4e96-ae1c-866850bfb35c", "value": "T1A136331965E92036C875DEF93E38C4CC9D1F26AC49F869F7328C99A41B366C1B501BF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705106640, "uuid": "da466572-9aac-4467-9341-a306350d26f5", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705106640, "uuid": "ea37a3d3-66f4-4dc1-8643-890efeb00aed", "value": "98304:QJDPl3J/vseAHsUlPmjUs0E++Wxrn4P1DJ8fCXibV:4RJ/clPnUMre1DJ8bV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705106640, "uuid": "95719c64-ebb8-46fd-a12b-d2d808dcb0b4", "value": 4930421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705106640, "uuid": "8a8f2a28-fdd3-4f16-8a7e-30e406fc3a43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705106640, "uuid": "e8eefeb5-d2af-46ea-887e-d7746a055e31", "value": "tuc2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aebec25d-b1b0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PowerSploit)", "timestamp": 1705108289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705108289, "uuid": "27a7e921-f800-4dd3-9367-a0f4c90c8edf", "comment": "Malware payload (PowerSploit)", "value": "8d110271ce2244b30d00daa63a0bde62", "object_relation": "md5", "Tag": [ { "name": "PowerSploit", "colour": "#4AC80E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705108289, "uuid": "5ad23cb3-e027-4522-aa23-6d45ce70de1f", "comment": "Malware payload (PowerSploit)", "value": "37504346664f1aab2e0ba34d2ee0da58d9d38d1e14ba2d7fe796a327d286bec4", "object_relation": "sha256", "Tag": [ { "name": "PowerSploit", "colour": "#4AC80E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705108289, "uuid": "a7125638-8b70-4c19-b848-63c542083d91", "comment": "Malware payload (PowerSploit)", "value": "df9dde0219f99c2fc0d76cb2d4297efeceb8c190", "object_relation": "sha1", "Tag": [ { "name": "PowerSploit", "colour": "#4AC80E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705108289, "uuid": "6c3ae494-3267-4fa3-a7bb-791b434cceb3", "comment": "Malware payload (PowerSploit)", "value": "2dd776d32606d6b598b4ad20c8e7aea930947d2ef910ae89d9588f53e34ae4020512ba4a486957c0194de549ad446e17", "object_relation": "sha3-384", "Tag": [ { "name": "PowerSploit", "colour": "#4AC80E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705108289, "uuid": "2d66b90f-a4c5-4b5b-9727-e4f86f5d4ea9", "value": "T1B3A29340731DA759228647B77E8A54A69A5CC22384EC2D00FD9CC69C7FEFA39D42D389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705108289, "uuid": "d18b005f-f7f1-47c7-908a-88722b8c7b30", "value": "384:2y9Uv++DRJuvPA7RiaaqzevQFKPzQWOr0Ir:2y9UvbF7kaahIKjLA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705108289, "uuid": "2da3f466-7656-405b-a44a-52bdeeaeb31b", "value": 23305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705108289, "uuid": "5d710a4b-0a78-4873-af1a-8b5d20e42b48", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705108289, "uuid": "7f8d6152-39e0-4c37-b5ab-4e694ce94516", "value": "Invoke-Shellcode.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89c0e80b-b207-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705145594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145594, "uuid": "6e7757e7-3113-4f3f-ac51-6f6aa8a76f97", "comment": "Malware payload", "value": "b5f56ac6c53887d22026b0a99df33007", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145594, "uuid": "9f96af2a-4a4f-4b8a-8403-6354dac03b87", "comment": "Malware payload", "value": "37d327fc54306d75143ad46f6aba00e9e6b5b274fd9ceb6b6551e9495dfa1f29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145594, "uuid": "ed267be6-2791-48ab-98b3-dfff1337bc56", "comment": "Malware payload", "value": "e9c7618e00aeb771b3745beac17417cd22d08989", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145594, "uuid": "d4f8e003-5b3e-40ae-a8ef-aea25d9c1b9a", "comment": "Malware payload", "value": "e709ae47e8afef03c560e149a874fe1f961fc7e7957cd8a689303b650d2f3edb2b0ef4280f33096f15e15a639aa2ea66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145594, "uuid": "978bcfe5-9e93-4c04-b628-80061747f48a", "value": "T13C856C07FA9648A6C9461D755C737339BEB58A435A14CBC3B24CFE247F23261EA1A3C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145594, "uuid": "ef65cf14-b447-4b1e-b32a-fc3577767895", "value": "24576:qksWvMutM2VF5+dP2F9Se6cAT1RzfVZsFbPzqPWXTQP:q7uC27lKeMn4qP8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705145594, "uuid": "05ca5a74-563c-4073-9474-ef05c1e3147d", "value": 1708032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705145594, "uuid": "4aa23659-6990-4bf0-97c1-3dc8e97b012d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145594, "uuid": "6e855b88-b308-4611-8464-91abd4802188", "value": "SecuriteInfo.com.Win32.Trojan.PSE.RV5K4R.2805.15580", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "444f898d-b231-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705163516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705163516, "uuid": "326bf0eb-52c3-496f-87bd-52f56ede69d4", "comment": "Malware payload", "value": "82ce52fd6846cd90540f25420074e6aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705163516, "uuid": "ef5a3ec3-b153-45dd-905a-1d47df4a864c", "comment": "Malware payload", "value": "3a18f390a26ec7de645bd3de51cf1f3113304321242ee9e99ab002fb85b011c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705163516, "uuid": "f82972eb-1882-425e-84e0-c104b3ce0793", "comment": "Malware payload", "value": "fda8c13cd135ef05fcce5b892b9f6af7624770f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705163516, "uuid": "0c6dde71-58a4-4b18-9fee-2d7950c09b72", "comment": "Malware payload", "value": "d954d351c8237e303064e19d5798161c4fc793ae0aafc4413a69562db563090be2f25a9a5ff14c7a6edc61796d9f30be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705163516, "uuid": "64c4627c-fd50-4fd5-9260-dcd8792db6c6", "value": "T191A37C37F1D2A972C1751E789D1DD369D427BAE23D292A5EB3FE1E29CA5C2C1640C083", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705163516, "uuid": "b460952a-a30b-4645-b006-abe4814821b4", "value": "3072:Fv2zTLZlCBSqiKujiJGeQMVww8b2mcwcsncgtGs:FviLZMSAuuJGRQYGs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705163516, "uuid": "28fc3616-9f44-4064-a612-47785f60f77f", "value": 98464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705163516, "uuid": "b73c9665-aca6-47d4-8b75-b9d9fd4a3f7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705163516, "uuid": "a16081cd-d53e-4507-8840-7a60a49f4bac", "value": "SecuriteInfo.com.Virus.Win32.Delf.28202.11210", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "341bcf19-b1af-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1705107654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705107654, "uuid": "76e94e7d-c17a-4bff-9e57-bbed4046be22", "comment": "Malware payload (Smoke Loader)", "value": "f04933261d1172903383bd083d6b03c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705107654, "uuid": "1c7be6e3-b332-41b2-bd0b-647aed22c2e3", "comment": "Malware payload (Smoke Loader)", "value": "3b0a80f2d022f793c0d4d79162fbc334f55300189c846e8b6c4f8cc62ba87f72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705107654, "uuid": "7dc2c446-7ced-4176-8e48-6351340bc70f", "comment": "Malware payload (Smoke Loader)", "value": "0925c5fded5728cf500a64a4a3bd58d80f2c9319", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705107654, "uuid": "6e0e2bea-1a26-4625-aa35-a6610657477a", "comment": "Malware payload (Smoke Loader)", "value": "35e4e33dff8357eebc3c2718bbeb2474d5727bc8f1300e189ae13e0d1817c31c0c4cae8f2d19ff108159f6a960b04718", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705107654, "uuid": "941a416a-5ccb-427b-9ca7-284d895f27b8", "value": "T15703DF161C5981BAD6B0C6B6D7F9EEC1C3E7DC424DA1B31C28302CAE14F078718AEE16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705107654, "uuid": "9e8474b8-16e0-4034-bc8d-a7348e907d60", "value": "768:4raag0YrBHXZUrRhSZOh/q+wjDp8v3uWqeqLhy5:4raDD1HJ+94jDS/XqeqVy5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705107654, "uuid": "741abaa0-9beb-4c4a-ae33-00e4f2ce60af", "value": 41369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705107654, "uuid": "d8c0939f-7e14-4fe2-a014-f61771fa609b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705107654, "uuid": "0325c1f9-3fa6-4b8b-b88a-ca94b7e934f4", "value": "4ac7d8a9a14447f7e60f14699384b340ef2564e6fad91727a0f3f2706c726b03_dump.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1985e2e4-b1d0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705121783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705121783, "uuid": "fa99bc8a-8a71-43ed-badd-6833bd2b23a8", "comment": "Malware payload (Mirai)", "value": "286dc6d5ff18ea4a57b8d7b966a85f06", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705121783, "uuid": "01971bcd-433b-4693-a91b-1f1e9c253835", "comment": "Malware payload (Mirai)", "value": "3b6b6732f7a5e07bf6545efa824498f114e30485c7b66cb5ed6e7fc80f3ccbcb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705121783, "uuid": "0ca29c36-2869-4adb-b919-2a3755f7716c", "comment": "Malware payload (Mirai)", "value": "e28b220766ed36289df641402839a6d27325fb96", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705121783, "uuid": "401cd292-1061-4317-80bb-96cfc252ceb9", "comment": "Malware payload (Mirai)", "value": "68f045f77781aa7f7640688e54987b92650501dcf09b83caf96b47d3db66ff3c417cbfeba67d3d0c6b4ca8f8b1c7f1a6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705121783, "uuid": "2287145b-b1b8-4347-9560-d5c82623eca6", "value": "T173631956F8814B22C5C5027AF92E128E332357FCE3DEB2129E116F2077C696B0E76D56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705121783, "uuid": "6ebe4945-c14f-4670-94d9-c3406188a74f", "value": "1536:dpnFPmBzPrkdYRezXK1GDvOIv7Pa+Y8zgI7iKjbf5AAnrK5gYooD:wzjkd60raojbf5AAnrKeBoD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705121783, "uuid": "d67c7b85-4084-4d45-a333-385feb0661ea", "value": 70964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705121783, "uuid": "f50fdad5-5487-44ac-ac26-0e702a665504", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705121783, "uuid": "dd35401b-2ba2-42f0-9037-ea15bbd79597", "value": "a6.nn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c800564e-b238-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705166743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705166743, "uuid": "dddac015-ef85-442a-87e6-5b926bad23ca", "comment": "Malware payload", "value": "8af69184063dee0c01b19ecc0f7e839c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705166743, "uuid": "9a3b39f9-fa5e-46ad-9005-5eb766304561", "comment": "Malware payload", "value": "41e3cf7e383670798da1639d302f802f35426bfb07ad54ced6192fb0a5e16015", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705166743, "uuid": "2890f8ae-1720-4c86-aef1-2b6e3d43909c", "comment": "Malware payload", "value": "8087a059aa1fb991e512031904dd9b35e847254f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705166743, "uuid": "4ccf075c-1816-4eb0-b9fe-2a7b08653c43", "comment": "Malware payload", "value": "35db9d217234cca6e895353cd1964b92be833b4b42ff5f49b6c9d7b40645b1ef98ce9c2e04edbbbed40e72ce06e6f976", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705166743, "uuid": "90bab8fe-9864-47f5-9a89-1cc4821d830d", "value": "T17064D7236200CC59E5211E793459053E1AB959F8B4EFDC01ABE8B927DCB6F1267DEF02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705166743, "uuid": "930ba661-e0f2-42cd-926e-0abd151394e4", "value": "1536:V0pk8jheE7Fm0Y0gS+uQluoQUmg0LpPcaah9pHYkv0GWKYE4Vc5iBhuLYzKwEzoX:V01hYagSkv6nVciBhuczKwE8RPB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705166743, "uuid": "87c48cb8-25da-4def-9c2e-b32acc144f7a", "value": 319488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705166743, "uuid": "ced13762-bd04-462d-ab7b-7310af13be69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705166743, "uuid": "1522e2e9-baf2-4387-ab3f-5992148d638c", "value": "SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.22573.31563", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e55ccb03-b1d2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705122984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705122984, "uuid": "e7e42f25-bb81-4796-b63a-0fa289b2a9ec", "comment": "Malware payload (Mirai)", "value": "fe9ca4f7850a1159efaf3b19f2b85d50", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705122984, "uuid": "7bf3edc8-2d7d-403c-b701-539baa78d378", "comment": "Malware payload (Mirai)", "value": "421455a013b9e6304de3408c6459bb100071a114ea393a433b0600eff1e1ecf0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705122984, "uuid": "48a069e2-96e6-42ed-8e50-3b1a87432765", "comment": "Malware payload (Mirai)", "value": "aa6fd36c9073584e3601831fe4f6a9a271eb5eb1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705122984, "uuid": "5e8cfc14-b5d5-453c-89ea-6d42bbb1e8fb", "comment": "Malware payload (Mirai)", "value": "99027e74e3919ac3a837a11ba03c37e0e0c01a9ce5bcf9af41c60e3755d5659bc1a249db995289bfe310864538f9c7d4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705122984, "uuid": "4e858d63-3412-44c8-96ed-f6bbad414423", "value": "T1C3432B31FA761E27C0D1A87661E74B25B2B143CE26E8C60B3D710E9EBF61A406513EF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705122984, "uuid": "791a9427-b586-4f53-858d-767a69f0da2d", "value": "1536:EBNZ790epq6IWi5ZYiId2q6Qxvh753S8tNy4R:4LQSXTvhVCYy4R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705122984, "uuid": "1a734177-ccfb-4011-8c1c-9c3f8edf4b17", "value": 60048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705122984, "uuid": "0cb4aed4-1796-4bcb-99f7-2536843f24cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705122984, "uuid": "3fa633e0-39a3-4172-b8a1-05db7692d1e9", "value": "fe9ca4f7850a1159efaf3b19f2b85d50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f4279c5-b210-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1705149254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705149254, "uuid": "3177dad9-12c9-4000-afa0-4034bd1423d6", "comment": "Malware payload (RemcosRAT)", "value": "59e4bee18793ff9c45a6268bbe11073f", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705149254, "uuid": "b41ec4ba-1970-4586-bbf1-0fa935f6a859", "comment": "Malware payload (RemcosRAT)", "value": "4240123d22e3e2623318f278342411e59268a845f1c7c5ce56e2f3cd535eda5e", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705149254, "uuid": "165d25a8-f984-4a03-975c-6257991946a1", "comment": "Malware payload (RemcosRAT)", "value": "a205aea97f83f73a7443a33895be8619d500cc0b", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705149254, "uuid": "a77622f3-771f-48c1-881b-4a9e4ef41a40", "comment": "Malware payload (RemcosRAT)", "value": "a20264c1b5b01b81162553b2ccc60f11700a3a4686667ea7d89c5767c8ba84ca8096e0f8b60072b5a3a78c995527b0a3", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705149254, "uuid": "ec0c3e5e-d8e5-4698-96e5-d6dbd0187e9b", "value": "T10735332BE4583317DC6CBC2CEA4929D1BB490CFE3790F5ABE05EB522741E556BA34470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705149254, "uuid": "dee9a9d7-87c0-4baf-8b29-5a96f9fcf1f5", "value": "24576:gWoFNPhbYbR2UMsLYtHC0VNV3JzAAsrYLG0uvj34QW8CUNRzE29:wFNPebpCTj1AAdydvT4QW8pr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705149254, "uuid": "1b7c6032-8c0f-47dc-bc68-0bd5cc4b8f48", "value": 1090921, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705149254, "uuid": "ff69daaf-638d-4e8e-a0e2-d5d0163bf780", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705149254, "uuid": "c81fd168-90d1-4190-a0ef-1b57cd572ee4", "value": "nFAC98656700.pdf.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4722dc6-b1d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Tofsee)", "timestamp": 1705125157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125157, "uuid": "4c28c2a3-8005-4784-bc6d-762b6d040068", "comment": "Malware payload (Tofsee)", "value": "85899a98881db336949f636dfd6f3d5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125157, "uuid": "f6f76e17-7830-4a03-9ac3-dd074c065fb0", "comment": "Malware payload (Tofsee)", "value": "43428294fd339a6c66b4ba9af723593f386808db747f2b2ba7a0dc0117379171", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125157, "uuid": "9ecb6b88-be54-4c1a-a7a8-ef02a4aab410", "comment": "Malware payload (Tofsee)", "value": "6b59c57d02a4fa9f503e064585e6dba562c63a8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125157, "uuid": "18b9a3f8-ae84-4136-ab0b-66cd60d97bca", "comment": "Malware payload (Tofsee)", "value": "1269effb147943a524261c1dc7ed9e740986f50ac6999f6d5f12bb66f661a4818a2144c7ebbcfd22c7f76988e0bb700e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125157, "uuid": "ce8c796c-8d53-48e6-bd00-a91a8a0d8350", "value": "T1EF347B1131E1C036F3F3257A5871C3B54E3BB8676A3296CF2AC81A7D4F25AD1AA24317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125157, "uuid": "c79a94e5-f3eb-497b-b6c2-8b799a10bae4", "value": "d8dcb51c50d0ca58adf96a087830e3b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125157, "uuid": "a9ad14fa-821f-4da8-8331-f398ba652b9e", "value": "3072:j72kySmwWaXJVCadJizA1KSB2sxhXM3tl64C5ARvc:j7236qahM3tLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705125157, "uuid": "70168c90-b1c9-4d49-bc00-7941bd1cf780", "value": 240640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705125157, "uuid": "ad22bb8b-0c39-441a-959b-929e8a870ed7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125157, "uuid": "a96e1690-4499-489d-98c2-7d62e52b570a", "value": "85899a98881db336949f636dfd6f3d5b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c67e1f45-b1cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload (zgRAT)", "timestamp": 1705119926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705119926, "uuid": "6fd73a2b-f64d-4fa1-bcb5-6f90171dd906", "comment": "Malware payload (zgRAT)", "value": "bd94daa7872d164c29dcdf71a89b4771", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705119926, "uuid": "09678aec-37ec-4990-9efc-27cdc3b770b5", "comment": "Malware payload (zgRAT)", "value": "435a707b6f55a048249ec75f8f52595667538f98d5e71a2f14b094cc6fc289fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705119926, "uuid": "2183df73-15f6-4788-a3af-edf3e2934efb", "comment": "Malware payload (zgRAT)", "value": "e0834fb1e251464b3af81824c954be285373f673", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705119926, "uuid": "d73d3840-b2bc-4c6f-809e-80ef3c897b7f", "comment": "Malware payload (zgRAT)", "value": "cdf9a8894a4c94010637f07e65ef0dcb2bcfedfb6af27be79863d3a2375a0a906dea374f82bca795e324c45bb831a303", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705119926, "uuid": "a637fcae-27b4-4449-b5a8-cb32b02bf255", "value": "T1E7567B06BB99DA13C05D5733C5D6591803F0ED86A313E70B7AC933A91A437BF8D8929B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705119926, "uuid": "bb8379e7-9b40-4ba6-a4c2-faba752cc4bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705119926, "uuid": "8776ff5f-80f3-4e6b-8d47-1e91d2e3e194", "value": "98304:5qmruGbfvvlCTKssjDm6/GEvMjW5sKu9OQBpN:QmruGbfv94qHm6+YMKi4u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705119926, "uuid": "fe71db57-34fa-4dcc-a89e-c8f038f16386", "value": 6003600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705119926, "uuid": "c3d8580d-1e63-41f5-9afc-751c22cdd6d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705119926, "uuid": "e88edc07-76b8-40f2-92df-1ed7ee7b847a", "value": "bd94daa7872d164c29dcdf71a89b4771", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ce7ac02-b219-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705153276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705153276, "uuid": "f4d4a8ac-9914-4096-ad84-7cf1d7a0372c", "comment": "Malware payload", "value": "6b0617e010652ec75088103b4ff1e040", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705153276, "uuid": "7785c2bb-23d8-45af-968b-634ff2e1a5f3", "comment": "Malware payload", "value": "44cb9c0fabb18c491e68b6501b8cab0933b63e9b8382fff827c912a4c9e9025c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705153276, "uuid": "a11e9aef-5714-4b6f-858b-765e9a8bc697", "comment": "Malware payload", "value": "9008bc32ffa31cc6de05a96322d7333166599448", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705153276, "uuid": "8ebe0784-09ff-4dd2-918a-12ac8501de1f", "comment": "Malware payload", "value": "0f71d1e18f92b322d8ba6695f3c991ee38d0087eb5c5ab44547d300d518d02b0ab20626b22995b530b7cba9f3408ddac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705153276, "uuid": "187baa9b-a6c1-41ae-bc81-867e3fefaaaa", "value": "T182236E2BF2D2B571D13115745E2DC368D4373AE12DA63AA693BF5C3ACE8D5C2184C253", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705153276, "uuid": "bee8bef1-390b-410c-be2f-d93853c573ef", "value": "768:A8Unjqt2QkTJZwhcGZdyBLiYdAZqnkf52jFRzuH/4JK9rYAQ6kD8:A8ujqt2QkTLBZdlnCd/S0piD8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705153276, "uuid": "db432f39-0ecf-49ab-a7d4-b7707286d090", "value": 46336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705153276, "uuid": "7ad55c5d-e6e1-4d38-99e2-5b38fbc5ba57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705153276, "uuid": "0e7b7595-c738-41b6-af49-735c21dbc216", "value": "SecuriteInfo.com.Virus.Win32.Delf.24232.25478", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ee46e3a-b1c2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (MimiKatz)", "timestamp": 1705115967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705115967, "uuid": "845c68f4-edc9-4344-8bf8-a88e9436e36c", "comment": "Malware payload (MimiKatz)", "value": "53a0a94fcd38c422caf334b44638c03d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705115967, "uuid": "99f2c8b1-4559-4250-a8c1-bbd8721c0267", "comment": "Malware payload (MimiKatz)", "value": "4585b220fd13925aff301e9ac234ea6edbd25848d437d2a107bc0173e6f9a0b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705115967, "uuid": "6ad6bf6b-39d0-42b9-af73-0ebdfcbae40f", "comment": "Malware payload (MimiKatz)", "value": "edfc0f18255a9a1974e9a720861d5e99d169bd9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705115967, "uuid": "e4867fd9-f726-4262-8c70-ca27bcbf52af", "comment": "Malware payload (MimiKatz)", "value": "ea4175e9d86c233bcf577f9db0fc7d64f015e44ef85353d3fbddcb7620fe1f745d0e9d44ecaf600875c610ed9bc8c052", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705115967, "uuid": "afe1df31-a2ea-4095-ba8d-225ad0cfb75a", "value": "T108150951A7E90098F1B79AB59EF19116DBB378D61930C30F02A8C65B3F73B619D29332", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705115967, "uuid": "9532017f-70c0-4620-bbac-eaf464512730", "value": "dd3ace629f78b9c288f18ad7cc24a005", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705115967, "uuid": "5ca50ce5-8a25-4468-a0ab-b9bf04619176", "value": "12288:9bds4xj16GJuCuwZNxAdccmWwjNXwM82YRi6mT6n/0fnGcih:9bdDxj17JHnGdYjFwMFqyGN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705115967, "uuid": "61c4af1f-1717-4430-ae21-68e7ce10cb2c", "value": 909472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705115967, "uuid": "7a758845-814d-4c2a-b5e3-e6d6966596ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705115967, "uuid": "f2f1a845-13d7-4ac1-bd2f-741c7cfa6a4f", "value": "mimikatz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e59bf71-b207-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705145601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145601, "uuid": "5b73680f-aa1f-4dd7-ba3c-5ecf1a6896de", "comment": "Malware payload", "value": "5e9aeecbcf7c0a235446751cf2e8b600", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145601, "uuid": "f7561f3a-00c6-4d68-8582-0d95fff155e2", "comment": "Malware payload", "value": "4626a7652d661137280ea0af46235fe318cf5c9466dfdae262259acacba42fb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145601, "uuid": "8055b9fd-5abe-40d0-8362-95d6824a2b41", "comment": "Malware payload", "value": "ee07b5d2abb8c59c0443bc3234b42797b5fb8551", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145601, "uuid": "7e78e434-e0a1-4762-9363-5ef2142b5b98", "comment": "Malware payload", "value": "f6635a1a360cf274be29d0131946b59c608699e51b6f7fc879a841f0ab246dba23a8aa5ef30dfca3ba1aeb240cd7cdbe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145601, "uuid": "276b11da-5b5b-4ccf-9e69-308cc26b10c1", "value": "T112457D12F6D340D5D68A31B11973033E7BB9A6861A30DFE31E54CE975E32361AD36AC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145601, "uuid": "c74f3c51-5bc4-4b23-8aad-52d1a4b3ed27", "value": "12288:cVY9v4052WQqCpmbPuapzNy1SL1OHaqkP9jfo:ca9v4OHPvpzNy1ShkaRP1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705145601, "uuid": "ba04c4e6-0599-4209-8667-c9b8e3dfa81c", "value": 1220608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705145601, "uuid": "fb37f7eb-da61-437c-9479-352a15643dd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145601, "uuid": "3c890af5-b4fe-47dc-910e-d997e147cfc4", "value": "SecuriteInfo.com.Win32.Trojan.PSE.1TYMTF4.18481.4524", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6390e3f2-b1d8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1705125343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125343, "uuid": "87fb9977-ddf3-42f3-9f17-d1a244216994", "comment": "Malware payload (Smoke Loader)", "value": "f5fb47c4fe365a3478323507e9f8dd7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125343, "uuid": "66350aa9-d058-4ffa-9eca-72fda49f758b", "comment": "Malware payload (Smoke Loader)", "value": "4677c4aba91d3ad1687bae284e80deae2ebe9dd4a23e5bc071fab312f02baa8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125343, "uuid": "9cb395a5-793e-4703-89f2-ff00405ea83f", "comment": "Malware payload (Smoke Loader)", "value": "8ef08c96a8ee01629cb531315f144b9abada8c2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125343, "uuid": "d454e5d6-79dd-43df-8246-a6a366a59f82", "comment": "Malware payload (Smoke Loader)", "value": "467b793d707659ed0e88b34f5b041191fa7f47f2e1abbd4088d2bc0971591c05a209364430caa66a584b62df10c6dee6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125343, "uuid": "ec85959e-de92-4c94-933b-65073b1896fe", "value": "T156347C0176F1C436F2F3293A4839C3B44A7FB8B66E36998F26C416794F256D1AE24317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125343, "uuid": "03582252-4673-44ca-95f5-c4e75b667869", "value": "d77b02f65b7bb86e8f742226786b42db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125343, "uuid": "2f224d6e-0438-4ff3-bb81-1eb6d43db2e8", "value": "3072:ORSupGanOMAuJi4k1KjHPpxGDo0ixVijrPz5Bafw3ER/I:OR3RAIx70MijrVBQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705125343, "uuid": "054bf27e-ee00-452c-81df-71e7f14f8a11", "value": 239616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705125343, "uuid": "b787e5bc-4810-4405-a1fc-c4354669e85b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125343, "uuid": "980f821b-d17c-4893-897b-67e17271d914", "value": "f5fb47c4fe365a3478323507e9f8dd7e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1946b6a-b1d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Tofsee)", "timestamp": 1705125152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125152, "uuid": "867259dd-13d3-44ed-a597-4c0dd59fb43a", "comment": "Malware payload (Tofsee)", "value": "50d80adb391a32562abd1bbb1ca44d54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125152, "uuid": "c1ba6710-9d64-4e11-ba5e-9d4221d4267e", "comment": "Malware payload (Tofsee)", "value": "480bb7c62d6d596c5c800503158a552287674a749640cd93d17fd731566a9824", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125152, "uuid": "ede66eb9-9091-4b7d-8563-03f0878b1559", "comment": "Malware payload (Tofsee)", "value": "6b2f264f7929a5315a783e310a521677be483e9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125152, "uuid": "240703ba-c282-4148-ac04-f141ebbfcf47", "comment": "Malware payload (Tofsee)", "value": "b75fc3a466e52364e2a3955c1a2a063979f3beaac8f107d5ed18126309685fe223bc0a54b8738d91e4644d08a7839a58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125152, "uuid": "0e89f3fd-4eda-4db9-9e84-08fe8860c792", "value": "T119447B1131E1C036F2B3697A5831D7F94E3BB8663A36968F6AC8177A1F256D1CE20307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125152, "uuid": "6306aabf-d19d-4b58-a5ff-122b36cbdb30", "value": "d8dcb51c50d0ca58adf96a087830e3b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125152, "uuid": "6c549eaf-8ea7-4361-b755-22db9d14241a", "value": "3072:GBp0+j2liTED5ID9bJiJn1K2Dxodv32z+1EeijhVP/EmvI9G5qpRvm:GBp0OD/2zGQVP/em", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705125152, "uuid": "ac490b94-bf72-4e54-b14a-042d62d53cc5", "value": 270848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705125152, "uuid": "3fddf611-19a1-4776-a215-f8204ff27d19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125152, "uuid": "0f480d86-3fe7-4fff-8f40-f9cc46af9fbb", "value": "50d80adb391a32562abd1bbb1ca44d54.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80d04128-b207-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705145579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145579, "uuid": "c2a2ddd6-03ec-4a0d-9d59-7d7197034b75", "comment": "Malware payload", "value": "87e47797364c4fc8e7520072007705f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145579, "uuid": "4429e2cb-cea4-4ff2-9e7b-c46e122009ed", "comment": "Malware payload", "value": "4bcf0ae16350b55a5fed1b26f6d46c2aa4a09effaa651f61e102727010be49ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145579, "uuid": "2490605b-f6b5-4b1c-b514-38152dcdcda1", "comment": "Malware payload", "value": "818b059336ee41e5c901cc37ca0a54d455f7b1b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145579, "uuid": "a3213258-f494-422a-bb22-86990f98be47", "comment": "Malware payload", "value": "a361c2c08e0786ef53de60ce3784c1d83d5455c1f1d6accb4ee0a0816db5540180d28c9491e388d2dbeda29c912a2b2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145579, "uuid": "6b93de19-864b-4d30-baf6-27be88c96a0d", "value": "T115D48D36BAE6A0F1C61515F04DAA6776AA75EE030B12CFC3A364DE1DAD323409E37135", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145579, "uuid": "009d7104-e266-4eb9-bf3e-d866ed1409f4", "value": "efbc0470f4fe2b0883dc2c2c51732fc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145579, "uuid": "8eef4fe2-79b7-4acc-850e-8cf4bcbddddc", "value": "6144:yDvcMRajwMB6TN3Jj/550FBEtKHjYxAKJYxSc9W6u/tQ48AheI6E4O:yDvb3MBa5j/55YWI0xYR8z/tCRIH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705145579, "uuid": "f3a1a7d6-0c36-4ea7-8932-4b78bf0c1f1a", "value": 643072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705145579, "uuid": "e24f3088-8e36-48dc-ba8e-0add4d0fd79c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145579, "uuid": "cb4d197a-9da3-4b01-9fe2-eb9d8096a178", "value": "SecuriteInfo.com.FileRepMalware.20674.17702", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ca40fe3-b1af-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705107642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705107642, "uuid": "1b262b69-dd10-4b64-a0b7-99fa08b9489b", "comment": "Malware payload", "value": "09138fbc8b6a49d48ad0cab4f8ec891b", "object_relation": "md5", "Tag": [ { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705107642, "uuid": "7aa048e5-4260-4a20-8c52-916be0d20b43", "comment": "Malware payload", "value": "4c2cae46c0bddcf2f1558e97b3e842d2f3ce729373d1fc3b49bd27c43164b1fb", "object_relation": "sha256", "Tag": [ { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705107642, "uuid": "f8de532e-9b2a-4779-879f-127c903edf2a", "comment": "Malware payload", "value": "116af1920b8889b56f402fb928acb82a21f0afcd", "object_relation": "sha1", "Tag": [ { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705107642, "uuid": "0ebdae21-1e66-4ae9-be19-782bdb0d845a", "comment": "Malware payload", "value": "eaed447bdc76be93ef68bc5aa07fcf0b088965aecd912c4f9ac5be549085887146e57719f80d81c9e0e688b96223c555", "object_relation": "sha3-384", "Tag": [ { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705107642, "uuid": "498ee0cd-56bf-4fb9-8f24-005e7d9096cd", "value": "T1DF13D01A0C488267E571C2B2BAF9BAC5D6D3DD764C9272191E202DAD14B0BC305AFF13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705107642, "uuid": "0c9e478e-f816-4378-a95d-4365c58bf1b8", "value": "768:YNbvbVqraag0YrBHXZUrRhSZOh/q+wjDp8v3uWqeqLhy5:YlDsraDD1HJ+94jDS/XqeqVy5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705107642, "uuid": "6afa79f2-8edd-449b-ab7b-359aae51f4e8", "value": 45056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705107642, "uuid": "0c917f47-a092-4b71-b64f-d226d6d9e8f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705107642, "uuid": "99286cb0-e658-4813-9ed7-252d38967962", "value": "4ac7d8a9a14447f7e60f14699384b340ef2564e6fad91727a0f3f2706c726b03_sc.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae69f225-b1ae-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1705107430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705107430, "uuid": "6259df07-6088-4c41-817d-cc650c84f3d4", "comment": "Malware payload (CoinMiner)", "value": "a462d04e3c550d9e2f759b9dd82f2d45", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705107430, "uuid": "2acf21c3-44a9-4095-970d-d44fa57662dd", "comment": "Malware payload (CoinMiner)", "value": "4e4c6f9ec188af7478c91101e276674f2854abc64c0dc83c81ad8db7709394bb", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705107430, "uuid": "414a9023-388e-4741-99df-00ca5326d6d7", "comment": "Malware payload (CoinMiner)", "value": "56801fd01ae41779b159a0a295e59c243a9f955c", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705107430, "uuid": "505e134b-a4df-4373-81c0-4cf3bdc658a9", "comment": "Malware payload (CoinMiner)", "value": "9f43bd95f4b4edd5a9b9138d8a436681c132319dc630aaff2527ea51f76557f4759a507ec166d6a2c7caec419d90b143", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705107430, "uuid": "74f5fbed-9f0d-4d77-a6f7-c46bff980764", "value": "T179469D56B2A501E8C8BAC07C86479917F7F2B81543B0ABEF17B452690F27BD15E3EB10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705107430, "uuid": "b3100320-52dc-49b7-b8ef-7f6313bad218", "value": "2e3e4d2cfd6226981f42ae1c2abe7b12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705107430, "uuid": "118e9d58-1d16-4c9f-b78c-7312a669ca07", "value": "98304:4iX2isksvJauI4D1ckKOpLryp1JAX+uI2+lQomLWtYmpi6Quao7bbeC6q:bskxp7M+B2QHmbmpi6/p3eC6q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705107430, "uuid": "2be0ebf4-1daf-4061-b0c8-3969e480ef1d", "value": 5412352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705107430, "uuid": "9df3f75d-cc7e-41a8-a38e-6e05af2116bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705107430, "uuid": "27d33f8e-74f2-41c6-bc7e-0286bd64a64b", "value": "runing.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "639b9cc1-b1d3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Metasploit)", "timestamp": 1705123196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705123196, "uuid": "f1042747-65e5-4eb3-9f75-977807891d48", "comment": "Malware payload (Metasploit)", "value": "4952f7d5dbfdd54e151d6cd75afcc930", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705123196, "uuid": "9a735293-4e7a-47d1-a312-58152b171028", "comment": "Malware payload (Metasploit)", "value": "5027e50a930fe5890e729194116e23a12f3109606346941c6f932008fa1829f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705123196, "uuid": "b0a9d80c-4ee3-48b1-9911-b9e358249dfd", "comment": "Malware payload (Metasploit)", "value": "6c435a541ded1f138ca3eacac38136e0173477f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705123196, "uuid": "c450f0b2-08ff-477c-a788-68df8fa2be43", "comment": "Malware payload (Metasploit)", "value": "f10f4c90de802b46a87c655ae1c07cc587f47d9b689a33ea00f8728657349677b107baf0b525bb52c9157f39f2d92f8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705123196, "uuid": "c20cce84-73fe-48ad-94f1-4a062ad41b1e", "value": "T113522A43FB55A8FBD6280238C43B4B9BD4347D129BA39BCB577432590E376D03627689", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705123196, "uuid": "5167cfa1-cc3e-4550-a967-7ed8e4968045", "value": "07e4d3f8fedafc070f7b31eddac6ba20", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705123196, "uuid": "9a5d440b-1a04-4054-9b18-8c6f5dbeda03", "value": "192:88EkmyjZ8fjTVfFaCZ7AamqnrAgVhl3Q5tfDXU/tr:8Cmy27jZ7AWR3e0r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705123196, "uuid": "0ea77757-9b1e-4e87-a8b1-bd07b9a4ceca", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705123196, "uuid": "52b11526-c446-4312-a28d-df6d820429d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705123196, "uuid": "d131cc93-21be-441a-9b91-771b7dbb3231", "value": "winserver.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61545949-b25c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705182033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705182033, "uuid": "5b94b6bd-a375-4f28-b09e-5387da271bde", "comment": "Malware payload", "value": "fb60ce288f0a46e4a3fb0c675337fed2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705182033, "uuid": "ad0b556f-ef69-4e45-8e73-0b5c528543b8", "comment": "Malware payload", "value": "50ae0d2d366fac758dbcdfde5e61a3c15c677630dcf166d5cd5b65e1cf2bdcfb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705182033, "uuid": "d7390d82-cf86-4f2f-9ac2-396cce46417e", "comment": "Malware payload", "value": "071d583576915c478a8f86071155e8f0613f9136", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705182033, "uuid": "ed15393d-5c94-4297-ba4f-161112084595", "comment": "Malware payload", "value": "6def0bcb9dd76b3e35330d341b885096e784af796ffb7033943ae3dd48ffb06940f41777ad0a83abcde59e914bd6b9cd", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705182033, "uuid": "507e4489-c714-488a-8de9-970af2a9aec2", "value": "T136C33C46EB808A13C4D51775BADF424A3323E755E3DB330689189FB43F86BAE0E67506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705182033, "uuid": "eb4b7c84-cd7e-4507-b9a1-8fd24c09e94a", "value": "3072:ISqPEL0JTzSKabuFcpQkzZVt6h+iL8M/9OWz:ISFL8T+zbuFcpQ0VM+i4M/9Vz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705182033, "uuid": "5325a8be-a835-438f-86d0-41618ab2fded", "value": 125754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705182033, "uuid": "e5be50ff-9e6e-4028-a7a4-d4320e779b94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705182033, "uuid": "f9f7c718-56fc-4a63-9df0-7182f316eee2", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "960b1a6f-b207-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705145614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145614, "uuid": "c82892e5-c6f7-464c-bf9f-4d3e5297b1cb", "comment": "Malware payload", "value": "cd2908544287c45c775f024710d5657f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145614, "uuid": "3e2bf59f-a18a-4d2a-bebc-1a9aef0d48b1", "comment": "Malware payload", "value": "514be4f6c06776409d2d9f14e666ae6fe9f8d45037d1a11ac71e148905c9dc86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145614, "uuid": "819d402e-4fd0-472b-bf59-8c6a9e5b9ffb", "comment": "Malware payload", "value": "114f37306d93c3c83523c60d3deff4629503c3d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145614, "uuid": "4615607e-f959-4553-aabd-c4f9e503b9b0", "comment": "Malware payload", "value": "462cd864abe3eb10011683b240b43fd190617a3a4c498ab4fa00bb50abb7bf6d0c4dc0c938a3ab2f997b2faee53aa16d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145614, "uuid": "da9487a8-b4d3-440e-a38c-777918038535", "value": "T1C18439063B68C822C51E15338582CF74D7A9EF322D75CB6367E93E9E3C312859D66293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145614, "uuid": "9ca688a6-e010-4d14-a606-e347649685f0", "value": "c80e4255a3a76661116077bbde2cd7a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145614, "uuid": "b697f7c4-7912-4054-981f-d1fefc1c0bd8", "value": "3072:w2lmwbeSUcHu6XvIkw9/SUo4fv0uQgUPo0NurGyOo8yOSuRtr9ndhjqZNY6FMfLn:3beSUb6XgkwwovDQdPIrd7gf0hsVi6B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705145614, "uuid": "865471e3-0496-4eb6-bb24-5bc259935a91", "value": 406243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705145614, "uuid": "c87687e3-5f25-442e-8e64-5eca2307b30b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145614, "uuid": "22b85fdc-b7c8-4320-8470-5d9046081cd7", "value": "SecuriteInfo.com.Trojan.Win32.Agent.12072.10693", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98317291-b207-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705145618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145618, "uuid": "d9e658d5-a344-48a3-be3c-7e862989891d", "comment": "Malware payload", "value": "1b46a17dad17dfa62234e2618dc527d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145618, "uuid": "6991c982-3433-444e-87c8-f5e9d7ce62aa", "comment": "Malware payload", "value": "51844064fc7f7bf260458a1a7a24d521b7e4450505ba0d8d8cec4d5530f0bfca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145618, "uuid": "8c6dc82b-fdd3-4823-bb29-67161af015d8", "comment": "Malware payload", "value": "45185a56c826a72594a5d0dfbfd61524adea65ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145618, "uuid": "90313483-26c2-4066-966b-40cdf5375d51", "comment": "Malware payload", "value": "61df91692ce6d447213cdd26722f385e85e30e4f34ba7084f25be806db1354566455a59d3d0d50806d0f8602bbfbbbd8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145618, "uuid": "05a04041-9da7-45af-a5fd-b41e52e1beee", "value": "T170459E05F18290A0C15B21F11A672F392F75E6E73E318BEB0B77DF645E63A61AD63201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145618, "uuid": "0fd657fe-9a0d-471e-adf4-c4a49cf24060", "value": "12288:CwkOr+hysNoyrcVVJW/Q70wR9b08Nl9Z:Cyr+47VjW/QgwfY8Nl9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705145618, "uuid": "dac961f6-b31e-47b1-a0a4-2441ec24c239", "value": 1216512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705145618, "uuid": "9da3fa77-5cb8-4cbd-b9a1-0f736e995469", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145618, "uuid": "73fe542b-c351-4c0d-a5ef-7d43da671e6e", "value": "SecuriteInfo.com.Win32.Trojan.PSE.1TYMTF4.17705.25825", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb4c4181-b1c0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1705115209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705115209, "uuid": "f8025deb-1999-416a-8779-5765fa23ee8a", "comment": "Malware payload (Stealc)", "value": "9031b184a00a15d693de75786edeb1d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705115209, "uuid": "cf8a298a-bcbb-4720-825d-86402a463d63", "comment": "Malware payload (Stealc)", "value": "52153ae2e71c5fba7369ff6b92e88063f17919f157fe98a6d32f62ab97385532", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705115209, "uuid": "d5f7ddf8-2d1f-42ad-829a-b20642b210cc", "comment": "Malware payload (Stealc)", "value": "edc07e9ff217879b20b5abfce67efade10f84bf0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705115209, "uuid": "491246e5-e526-4466-b5ca-84992b6473d6", "comment": "Malware payload (Stealc)", "value": "242d8656057f834e478afa0913f42d44518a54981d7a4fbf791504c4e1049a6eadb87ab00668af7f26fd1a678c24b16a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705115209, "uuid": "bc545542-fd77-452f-b1b8-cb510b921cec", "value": "T184B5335249C24C62F5A21D70183A70D64BA11EB7A5C5E493D3C2FC985EF3741A38F6BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705115209, "uuid": "7c5fd9ae-7be9-41af-9e51-5a4c40fb92f9", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705115209, "uuid": "4e826f23-6838-4024-851c-0ce797f230a5", "value": "49152:vT2s5FXQ4EmojLjCRELVf7Avil+dHIsLp1thIikN+6u2hsE:vBzX71oDCRAZUviAHImDqia7hsE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705115209, "uuid": "a0b5e60b-f5bc-4391-b322-e63b1d776336", "value": 2467255, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705115209, "uuid": "f450ae1c-bfb7-40c6-be38-e2904aebb83c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705115209, "uuid": "ba6f475f-9195-4a0d-8b03-e7e8d44f5885", "value": "InstallSetup4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e99449e-b1bf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1705114490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705114490, "uuid": "e753fbd9-1a0c-430e-b945-c0287d199415", "comment": "Malware payload (AveMariaRAT)", "value": "95955f84fedd9d7cb867638e65f6911b", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705114490, "uuid": "97f5351f-c9f8-4ee6-8525-47cd32e977e5", "comment": "Malware payload (AveMariaRAT)", "value": "52de83987941b92875cecdd1661cc2757eae4f02ef564fd2e147d06eb9d8ab44", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705114490, "uuid": "2f8ec0b8-03ed-40b9-be0c-42926b711984", "comment": "Malware payload (AveMariaRAT)", "value": "49ab9fbe607129d70702cee541133002b3b9e15b", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705114490, "uuid": "b7fd838f-81f2-4118-b7e2-4a645348c5b6", "comment": "Malware payload (AveMariaRAT)", "value": "9b0f8e1a4b4efb14d8bdbe52cf98bc34afdd077ec0fc14e90275491aa4189c897c4b1a8ff825ece52b9bc9d5d8648bd7", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705114490, "uuid": "81305437-7c3f-45bc-aa22-4a1cee62a1f9", "value": "T169347D236B28842DD5B987F174B1822973719D1A0B91DE1B67C3BA843A71703B9F437B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705114490, "uuid": "4612b5b9-708e-4fa2-b936-ee529e7eb881", "value": "8c16c795b57934183422be5f6df7d891", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705114490, "uuid": "a00c577e-043e-4d76-8786-fc827af4b4a5", "value": "6144:UsLqdufVUNDaTeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeel:PFUNDaTeeeeeeeeeeeeeeeeeeeeeeee1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705114490, "uuid": "75094615-3d99-40a4-a85e-00dc0c2fe5df", "value": 240240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705114490, "uuid": "bcbb2a53-ba4c-4f37-be03-fee130b7a683", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705114490, "uuid": "044442dc-88a4-4dff-85e0-548e24d88abd", "value": "tungbot.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75612b31-b25f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705183355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705183355, "uuid": "57824a21-8ba6-469d-9d01-7e0f3f2c188e", "comment": "Malware payload", "value": "3feb95b3d2801fb6e8b0aa554983990c", "object_relation": "md5", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "PlanetsTherapy", "colour": "#A55C4E", "exportable": true, "hide_tag": false }, { "name": "pw-beta", "colour": "#37A355", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705183355, "uuid": "2a82b57a-9416-46e3-bf4a-62c58469c887", "comment": "Malware payload", "value": "53e61067c0f26d6d127ceed558a5ea4f3058ea46990c7221bbf039e7cefbee9e", "object_relation": "sha256", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "PlanetsTherapy", "colour": "#A55C4E", "exportable": true, "hide_tag": false }, { "name": "pw-beta", "colour": "#37A355", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705183355, "uuid": "2ec6cedb-296a-4a50-8a08-c38780de4a0c", "comment": "Malware payload", "value": "d436df52b47fc2181bdce97c73c1452761c14375", "object_relation": "sha1", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "PlanetsTherapy", "colour": "#A55C4E", "exportable": true, "hide_tag": false }, { "name": "pw-beta", "colour": "#37A355", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705183355, "uuid": "033725c1-ceab-44d1-9878-b99ff2beaae4", "comment": "Malware payload", "value": "37abe4dd70103948f27dab903d9a2aafbce7498bc7ffa99a2554579c5c68c473ee7ae76eb632c742113b4aa658016f70", "object_relation": "sha3-384", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "PlanetsTherapy", "colour": "#A55C4E", "exportable": true, "hide_tag": false }, { "name": "pw-beta", "colour": "#37A355", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705183355, "uuid": "f1f0177c-b76f-4b01-a85e-0e5e1370ab77", "value": "T1CFF733FFE7A0E710248E56A7E114421D401C0FCC9397B79FC04BB23926BB6E995FA562", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705183355, "uuid": "4e5a1008-693e-4410-ae74-718f55c7e95d", "value": "1572864:DxDNYgmsY++JEXG5lAv+PQUnxUXTdVB15PjMPnK8gGnShqvo9:tGeY++ut+P/nxKdVtPj8K8tSWo9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705183355, "uuid": "f9daaa7c-c0a9-47d3-8f57-b84bdbd86359", "value": 74910584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705183355, "uuid": "c5c5ae18-d6c8-49c9-b6e8-c71f8be45d52", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705183355, "uuid": "8c94c313-d21c-4ca7-b796-ba319a7e01f8", "value": "PlanetsTherapy.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8443e54d-b207-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705145584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145584, "uuid": "6dd6e822-513c-4b03-b79c-58fac3473536", "comment": "Malware payload", "value": "6a565b61fdddc224ba40298fe39ce1c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145584, "uuid": "b3a588f3-b09e-4c36-a059-4bd40c633905", "comment": "Malware payload", "value": "5554f10e29d82738aedbb82b57b237fd99125560682024966b650ef4fbc8a221", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145584, "uuid": "c5cd2fdb-de01-4212-98f4-673458e1b04f", "comment": "Malware payload", "value": "003e56eec4feb8f3431679c105c0031843d22851", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145584, "uuid": "cc18dd7d-2eb2-49bc-b7c0-b7e2b4801457", "comment": "Malware payload", "value": "d94c9f4dcd64537e0f8a174a4436f14b0adf76748f77a6657264fcec68b64dbd31ca9cda08360e0bd68c135b14c560bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145584, "uuid": "935df524-2f37-4c03-b84f-f005ab76f64c", "value": "T1F1263303B4D89678C186D9B7AC76AF8465334D307981C87826EBB37C0E972D158BDB32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145584, "uuid": "ebfe35be-ca3e-46a6-ba51-1452e09fe32d", "value": "aa770df5b9e208c1ca436e9267f0d390", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145584, "uuid": "2e5813d9-52d4-491b-a73b-dc2516bbf71f", "value": "98304:iYK/7gLIUi7g7rlIibe+kX82pkCyeo5D9H9s6WR+MCym/QkYBV+AICd9bCRVAd:nK/Ais7rlIiaFpkC52RHq6W4MCyy3nuh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705145584, "uuid": "6531e304-1f49-4ce8-a277-ae7d77004045", "value": 4798163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705145584, "uuid": "ab2c84f6-d67c-4bdb-8ad0-adbd6f526a41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145584, "uuid": "4819e106-bce2-4e28-89bb-d17ce9c1d4a0", "value": "SecuriteInfo.com.Trojan.Crypt.23423.15404", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e5074b1-b207-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705145628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145628, "uuid": "1e87c8c6-759f-46e4-bc21-2aadbb2b9ce4", "comment": "Malware payload", "value": "f8083c25fe753917efc2f6cd6a87325a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145628, "uuid": "ea1dcdfd-8016-4f95-bf41-37c024dc11c8", "comment": "Malware payload", "value": "59ce01d36a49e7c2e7295dc75c1fe57e2d0b876dc011acbb3c8554f6577281c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145628, "uuid": "d0e97b40-d6e9-4a25-b6ca-c7a56eb8307b", "comment": "Malware payload", "value": "0dc4aa783033242189c0f6abc682fa222a7e9d96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145628, "uuid": "ececf4d6-4b7a-4d21-a48d-23513dcb4d20", "comment": "Malware payload", "value": "ba45b3759e010fb17cfb14b5084450cbf88c6f5e9d854ddf7d78ef9e2c2159dd9e55a551417b9b2b2a54fd0fa956ec1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145628, "uuid": "fbf5b2b5-a114-47e4-84b1-d24a91dd8d7b", "value": "T18EE49EB6B6F280FEC719613089B76731EA75B6060F118BC79354DE1C1D3A2A29E3B135", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145628, "uuid": "5ee3814d-10f9-427f-97bf-5bb9517cdf9c", "value": "2da325c32c94181ba6b12cb6864902db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145628, "uuid": "1fee89a2-fdd0-4867-b5f2-eefa97381c8d", "value": "6144:fajqre9wBYNGioLJvfUKyXpgoP2s6Y20cw++tkzJ4EecqxVUdJD1OlASL2NTL:fajqJE3oLJv8Ky5nhG8kzJycq0dilsTL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705145628, "uuid": "3d6a8d72-e848-4529-af8b-1ac205715948", "value": 667648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705145628, "uuid": "09666480-4885-4e0f-a86d-27ab8ae35fd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145628, "uuid": "970460b9-2314-434d-ae7f-18b698c2ef01", "value": "SecuriteInfo.com.Variant.Graftor.285977.2380.28926", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d6a0399-b21f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705155881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705155881, "uuid": "d90b1e26-538a-46e1-9dbd-47ff1663bab7", "comment": "Malware payload", "value": "eb895f707cdbf8a491a50656eb3b2fc1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705155881, "uuid": "2cb1ed3e-6100-4ba4-a1c9-e3a97262bacf", "comment": "Malware payload", "value": "59cea3baa53034b4e41b5fe9e303ad282437d36ef077dff58ae679685dd09811", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705155881, "uuid": "bf0de36c-ccb2-4e5a-98d5-af25895b41f9", "comment": "Malware payload", "value": "9c7893e52d4ff9dc7ac44dd5957cd79291670fae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705155881, "uuid": "4cdf64bc-6f43-4098-9ccf-478a6015b262", "comment": "Malware payload", "value": "b844ca811d6027468b1ef40a6cf8e1caff1a7fffd03b8ff4c428df1b94c03802ad73d896a1d43fb4ae344928d24ef3d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705155881, "uuid": "380e998f-adaa-4103-93f1-2df1695a4096", "value": "T184F35C37F1C19933C2761A78DD5E92A9941ABB923E2C295E7BFD1E088B6C3C175181C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705155881, "uuid": "d824ae8a-6e53-42e1-8e8e-51cd305f8789", "value": "3072:Fv2zTLZlCBSqiKujiJGeQMVww8b2mcwcsncgtGFV3hIrmoQhTfhTBqINrxDY3q+b:FviLZMSAuuJGRQYG5lIoxDYq+oaUi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705155881, "uuid": "131678c6-7528-4f30-94a8-b3c37d3ece58", "value": 163624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705155881, "uuid": "1bf7543b-960d-4122-8fbf-f03dc04965e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705155881, "uuid": "023aa3f8-fe3b-4a43-8902-dc5a2f433320", "value": "SecuriteInfo.com.Virus.Win32.Delf.4745.15567", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43b576d0-b1c1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mimikatz)", "timestamp": 1705115411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705115411, "uuid": "77c7c539-a2ec-4f8c-9177-4e08075f2220", "comment": "Malware payload (Mimikatz)", "value": "b4c3aac58bfdfdaff5a51ec9370d0bc0", "object_relation": "md5", "Tag": [ { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705115411, "uuid": "59e871e1-5fe8-4cfd-8545-855d223fc22a", "comment": "Malware payload (Mimikatz)", "value": "59d685f1d64f166b94d788b72d4f101dbb41f8f14cbedebcd5a896f849cdc953", "object_relation": "sha256", "Tag": [ { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705115411, "uuid": "73b309cc-8f16-484f-8995-ec0025cbd829", "comment": "Malware payload (Mimikatz)", "value": "6739b20fe1bc058784ccc18ef837faed12f014bf", "object_relation": "sha1", "Tag": [ { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705115411, "uuid": "7306c0ba-ce22-4285-84ad-9adbaace1ed5", "comment": "Malware payload (Mimikatz)", "value": "6d92bd831958a145ab1ded61fb66fb8e4243676c9603e7a22f0ae7d4c95df18d7f378caadf3fefb790d9b3b91b2857b8", "object_relation": "sha3-384", "Tag": [ { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705115411, "uuid": "aee9b465-f617-44e0-a44d-8a32ec7b0eab", "value": "T13DD56B39CE77FCE5137C3980A4153E5A1D6C2A4347B8665CFDCD18B62FA8604CF2A5A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705115411, "uuid": "1b482ef2-29e9-4f26-9ebb-7a3167d57992", "value": "24576:9gDA8A156GVpCIXdQW0zhBl+RAV5lAAKc5Gk96NPJ:9gjA1sqgWiW09vyh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705115411, "uuid": "9352c68c-623d-49ab-829f-9380d4f8cf3f", "value": 2803030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705115411, "uuid": "3daf3f54-1533-456d-8c2c-c3db8fd543e3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705115411, "uuid": "e45662ba-2b50-40a5-85cd-78f24b5a2ee1", "value": "1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93857ef4-b207-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705145610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145610, "uuid": "ad1546e6-69b4-4b9a-833f-811d62108662", "comment": "Malware payload", "value": "5eb84c2f97ca5c9c9d78cd7bfa895dd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145610, "uuid": "7c8fd86a-b348-4432-bbad-94d6c40f33cb", "comment": "Malware payload", "value": "5a379e224663e624b4362fb3f68b7e4d9279830b96f76b8ea3b5d611a01a268d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145610, "uuid": "60b70c73-80f5-44a8-b7e4-ad9432bd4a6c", "comment": "Malware payload", "value": "deee522e8ee77f0c6c69533946614ef773b05a62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145610, "uuid": "f51cf9b5-677b-4769-aab9-d88c36c42c61", "comment": "Malware payload", "value": "f08d3413e9ec321df8f5c363726ec129bdea8360b6ea6fe51d99335ac9badf2997d5787440893b804e18ea085ceb77c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145610, "uuid": "789500ac-ce57-484c-8251-06a7f18d3b5d", "value": "T1C4263303B4D89678C186D9B7AC76AF8465334D307981C87826EBB37C0E972D158BDB32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145610, "uuid": "663a4e69-4357-4c18-b9bb-2f041722015d", "value": "aa770df5b9e208c1ca436e9267f0d390", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145610, "uuid": "2168871d-ce95-4447-a54a-acc0d8f9cf12", "value": "98304:iYK/7gLIUi7g7rlIibe+kX82pkCyeo5D9H9s6WR+MCym/QkYBV+AICd9bCRVAq:nK/Ais7rlIiaFpkC52RHq6W4MCyy3nu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705145610, "uuid": "aae27bed-a0d2-4de6-8cb3-a6b9f46b1a1f", "value": 4798159, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705145610, "uuid": "4ae7a351-b25a-494e-aa1e-aef847100c93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145610, "uuid": "af600aae-ed12-4f01-98cc-c3b72f63bf6e", "value": "SecuriteInfo.com.Trojan.Crypt.1551.28292", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94563762-b207-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705145611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145611, "uuid": "5b0ceb54-35f1-4f69-8974-d803cb88b1e4", "comment": "Malware payload", "value": "1bcccb3aeb912ff071ad3bbf16ead8e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145611, "uuid": "020ce2a7-e7b0-4e6c-8244-0db11c80ab97", "comment": "Malware payload", "value": "5bf85dbbad7500c543767d5315bb9639e7b3b21edcf154db0616176665eecad5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145611, "uuid": "9b77da5a-82a9-4fe3-8622-d8f571ea4821", "comment": "Malware payload", "value": "c5fbb85ea10792bfa6e915c270ed5051e155c1ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145611, "uuid": "6f045312-ae4c-4c80-abb8-66d1861b6674", "comment": "Malware payload", "value": "932904d37e04cda9ed64b6917e1e4c6fcff006389de16d35b1ba3e38a0a65cb16b2a4f914a6dbeee98b5735f3118ff97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145611, "uuid": "a3092f58-ce3d-42b7-89da-61f0b5fb12c9", "value": "T10A84862B202AA0CBE04887F34673C99E9C599DFE9A01217A17D4F1BB08F758C7751E67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145611, "uuid": "64937643-1e3a-4531-ab7f-271fdf1f2fcf", "value": "821c455b475c3595aa1e4e6ad93e77fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145611, "uuid": "dde28194-5c58-4caa-93c7-730b4b247745", "value": "3072:Xkr4yOo8yOSuRtr9ndhjTvmhygjCmCv+oUQQydj8Zmhyge:XFeKHd/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705145611, "uuid": "d49ac0c4-2e7c-4dcc-bf7e-1dd2d39093d4", "value": 382275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705145611, "uuid": "a9b3e3a5-8728-4974-bf46-67c6c5bc17ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145611, "uuid": "60584404-a128-4216-bfd9-0ef5fbbbbead", "value": "SecuriteInfo.com.Trojan.Crypt.8237.20079", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b706fd9-b1d8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1705125249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125249, "uuid": "02b07a31-5f81-4c01-8d24-0929b2cc8a10", "comment": "Malware payload (Stealc)", "value": "ee3df40c1d435258b9398c4d1d2c0337", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125249, "uuid": "0b219e07-8d3f-4640-8efc-5c8904b2cb29", "comment": "Malware payload (Stealc)", "value": "5cc850585eaf0e782481a30f836d40d18d51315d6602b1a37243cfab06965ab1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125249, "uuid": "9dcc6748-3335-44e3-a8c6-636d85f5ba4f", "comment": "Malware payload (Stealc)", "value": "93e2d7ed3d4cca0f6b90a798e1d405aa3c8bfedb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125249, "uuid": "70fabcef-b28f-4137-b82c-3611db57b7ff", "comment": "Malware payload (Stealc)", "value": "534185c6f73bf75dce2304b68e54efa84ce2efd85fe96f82f55c6be21463a4e0cea2c77be9dd786c26ce657d9663f18f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125249, "uuid": "82fedfd0-b90b-4b8c-9085-86daf7ad6cc3", "value": "T1D3348C1035F0C072E2F36B754CB4C7B41A7BB9666AF9558F3AC81A790F25BD18A2530B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125249, "uuid": "69ccd319-70f6-4aa7-ac58-cea545f3c30c", "value": "9a5a0ccd3ccd4b18623b778491d8a47c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125249, "uuid": "5a7f18db-43e5-4652-9b63-d5fa703821f4", "value": "3072:oJOKSQ+jJx3AdF7mSJief2m1KpEtOBHypKIyy+SIm3lUgOUHPeRQC5gwT:oJOKSZEF76BHyZ3lUL49", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705125249, "uuid": "02ddf43c-67f7-4288-848e-fb6ef30aa2db", "value": 242176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705125249, "uuid": "651d8a2d-3466-4480-986e-b7fa0f9119c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125249, "uuid": "e59424fd-73e6-4843-b1f5-4ad61d854c3e", "value": "syncUpd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da5db3fd-b1f3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1705137139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705137139, "uuid": "b65670e3-d1db-4e47-ba60-246dbd525028", "comment": "Malware payload (Gh0stRAT)", "value": "4116491947fa0f5d455adab495d05a0a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705137139, "uuid": "467fe912-5694-4c6b-a4c5-86c47c4ff656", "comment": "Malware payload (Gh0stRAT)", "value": "5e4f250d0488ca67cd13e2e8c50eba3f8b6da8b99095a561378eab18bcd4a4a0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705137139, "uuid": "d59f6f3d-84ba-4222-8f80-4a17653cd172", "comment": "Malware payload (Gh0stRAT)", "value": "ae8ed034f1d8359fb7cb27e083093bae4340c0d0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705137139, "uuid": "f452ec7d-40ed-4455-8bb6-75ac4bfa0056", "comment": "Malware payload (Gh0stRAT)", "value": "322ae1301ea61f73fad5fe8c48e9dd412d5c1f79d9971b835a1ed6d5cc335cae6d21b194204ce228552e660441b284b5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705137139, "uuid": "137f1671-7053-4d6e-aa89-dad81d5f6349", "value": "T16C4559691BAB4256DB553BB9C8B6929409190F531F28C4B16E310D1EBD2724FFC23EBC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705137139, "uuid": "0677df0b-26e6-48fc-af41-532f68c57936", "value": "de6942886ea1706308de6a5dc748b51c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705137139, "uuid": "213f972b-4a28-4d62-8c61-46ad6870db91", "value": "12288:zcWl26g/UBlRn5DzZ3TTP+5WkOVHK/H7sx117ksgSh20RUTMkzVSleJHcT/rBMS5:gWgHN8kSszVSlMHcTDBMGr9chBMUk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705137139, "uuid": "96106065-68a6-4564-8a8c-da0bd8af3506", "value": 1242112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705137139, "uuid": "302bc9a1-3c72-44d2-ac0c-f224b23f0b92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705137139, "uuid": "c5457ad2-cd7a-4391-b75c-30768a3d6653", "value": "4116491947fa0f5d455adab495d05a0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce54391f-b22a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (IRATA)", "timestamp": 1705160741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705160741, "uuid": "b559b19b-16e1-438a-b4a3-3acd00cae3bf", "comment": "Malware payload (IRATA)", "value": "e711c165643168c7c547fd5833f8458f", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705160741, "uuid": "a2fc6769-7dc2-4af8-acab-2174e3518d69", "comment": "Malware payload (IRATA)", "value": "5e901a7e2b0fba0975321efa770302c73488b50faed9daace1b7c37dc5d017c2", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705160741, "uuid": "d90c7b4c-044f-4367-95ab-ba5e554e5636", "comment": "Malware payload (IRATA)", "value": "d8fc959a324beaa192501f7a4f4abbb2b262dcda", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705160741, "uuid": "ac2e3c84-5cc9-4733-b319-9294f39f4b53", "comment": "Malware payload (IRATA)", "value": "e9f20045bfcf2fa1c03e3f14b5eddb434f8bd4c71628daf03957317df252830768b6bb7496de0e18e3e12fd9b0ac216c", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705160741, "uuid": "605b42ac-a5c2-43c3-aa26-091231a13b06", "value": "T16416F32E5BD27DA9C1B40AB1688B05D6222A078E5599F53D1874B5E13CBBFE83F40D3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705160741, "uuid": "196b863c-6047-4aee-9dd1-d673670daa7f", "value": "98304:SWlkyUb0jyUrwe2kx3TUEl7XBkkW8st6Hx:SWlkteLx3TUEl7RyzM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705160741, "uuid": "9f315924-7de5-42ce-90fa-3bf31ef0cf27", "value": 4141313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705160741, "uuid": "102bb788-c4db-4bfb-9fee-46efeca7008a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705160741, "uuid": "862ec5e5-c819-4bb7-b1c6-4c13f311c728", "value": "edalat_irani.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bb96066-b207-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705145597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145597, "uuid": "0f4d44ad-9dce-4824-89a9-0273377bba75", "comment": "Malware payload", "value": "c7ff7103677cc4e424e0244a9cc25a69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145597, "uuid": "0778440e-9c37-4e1c-8fdd-571fc5db1005", "comment": "Malware payload", "value": "5fe3c2e8e46c84effef3290746384e42a8f07da2e77a4f3df54b91d856129072", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145597, "uuid": "175ebc5e-96f1-4486-97d7-a60c1d4fb6c1", "comment": "Malware payload", "value": "bfb280454e2a6227bd426d1e1cbf035f86f78662", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145597, "uuid": "2ffc7087-cc45-433f-ab5a-0f30ba66cd17", "comment": "Malware payload", "value": "edd4763d324f0f53eb381ba6c0ec4c4fc5c201a0bd2960692e1cfdca29cfe572251cb753b0ef45701e2454b5c2ac61d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145597, "uuid": "86187ad9-f976-40e5-ad9c-94663133e134", "value": "T15DE48C22B6F380F2C71929300D766B76A579AA471E21CBC3D364DF5D1F3A1649E36322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145597, "uuid": "d0dc04b2-3d61-4381-a85e-0e89680dce2d", "value": "2da325c32c94181ba6b12cb6864902db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145597, "uuid": "092508b4-24d0-43d9-9a15-d35015eec181", "value": "6144:dWzyxLUsjdShnOdiEzu/6WOfHrgCQiYlccfcBDcu4hvCg0UX11ybFpy9Ud7KT7+D:dWzm45oiEzuCWeMRX0NcuSC39CGKT7Xy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705145597, "uuid": "33c76526-ffdb-4c69-a8eb-472e93fe6c8d", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705145597, "uuid": "c20ea648-b6ef-4560-995c-e1ce2422a9b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145597, "uuid": "f30bfd0b-ae36-4eec-b98a-020ac46172d7", "value": "SecuriteInfo.com.FileRepMalware.19432.32142", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6413e27-b1d4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1705123844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705123844, "uuid": "f772ff86-e4fe-463b-bbd0-af5a4655c5f9", "comment": "Malware payload (Socks5Systemz)", "value": "e9a2997ee4cfb48cb3988f3048e041e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705123844, "uuid": "afb10335-c80b-472a-b3fc-3055a7e2252e", "comment": "Malware payload (Socks5Systemz)", "value": "6b05ea2717ccbe9837f6b5108900f96c169d9e252b595ddfec97b071fb67dcae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705123844, "uuid": "3a95096b-5aa8-4fd7-9cf9-d1c858b4c31f", "comment": "Malware payload (Socks5Systemz)", "value": "303d4cb34333e085c47ec565a25abcfa2376db6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705123844, "uuid": "bd09dc54-d8f8-409b-b802-9c46329920d7", "comment": "Malware payload (Socks5Systemz)", "value": "52acaa5ffea6c4ce6423885a90855125ea5ed63e5f6fd75076a37a40f31d1d2fd59b38632fa4dbc8a611a240739481a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705123844, "uuid": "72837f20-790c-4d06-a028-1c983e7986e9", "value": "T121263324FD732332C5B20CB89A66BF1774346C3F92F994352ADC4DFD5BA7542A6022A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705123844, "uuid": "de05d5f7-6254-44dd-aca9-2e3630f543fd", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705123844, "uuid": "f2ec3557-1694-4418-8f20-b0a0e6491b23", "value": "98304:QImrB3xNJVSKxvPROQR9FMrBcbYQ6RF+I5GtvB7waAipLdAP95g:HS3xNJMKxXkwFMrBu9m+VfDldQ95g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705123844, "uuid": "fb80887a-6214-467e-bdd4-50610f16b197", "value": 4855286, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705123844, "uuid": "ef2d46d6-600a-44f4-a88b-de90ac5f7d85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705123844, "uuid": "f8f9aac8-e273-4359-b272-d6efd4e67ada", "value": "adobe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e81ef5fb-b1d2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705122989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705122989, "uuid": "a4e7dee6-a28a-4d1d-8c83-43c381df4dec", "comment": "Malware payload (Mirai)", "value": "f1ac26ab266ebd428470d3a71127840a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705122989, "uuid": "62f3ebaa-b697-4b8e-b803-9379578a08b7", "comment": "Malware payload (Mirai)", "value": "6bc44b6b0d06b730fabe40fc2701616a0407fe2201d24029e44fd621a80dda3f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705122989, "uuid": "b225cdb7-9300-4713-8034-982c39f6c535", "comment": "Malware payload (Mirai)", "value": "a0fa0e55d323e64c166f45810cdf673d4e8c8576", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705122989, "uuid": "7cb66207-60e1-400e-b64d-ed940d469a6a", "comment": "Malware payload (Mirai)", "value": "de2d97ee21667fd159c610277eb516593a0f0767e7c09621cc732d68eb309993fdf1486984c257471e119f62d881186e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705122989, "uuid": "093ae014-6ae3-4260-a18c-a2c470899359", "value": "T137339D37E82A5E54C09A817075788F751F23F4C493432EBB1AAAC2795497EACF501FE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705122989, "uuid": "8a27be8e-771c-4ebb-8353-eb9a1f5fdf95", "value": "1536:2ao/3/UuiViCpWAKmv3GRpV3CVn5UPVYo+:2n/3suiUCgHm+pV3dYo+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705122989, "uuid": "f9433d4d-fc78-4669-94c6-bd9457cb746d", "value": 50816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705122989, "uuid": "3c1f4ae2-a24d-4be4-8e43-ebe54c4e7966", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705122989, "uuid": "ae1d269b-e4a6-4f16-a7da-f1f7650c7fef", "value": "f1ac26ab266ebd428470d3a71127840a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91969476-b207-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705145607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145607, "uuid": "da7f948d-4c62-4695-a191-b649413e3429", "comment": "Malware payload", "value": "d08c9d9eb52907c48a8b05d69e175ade", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145607, "uuid": "865263f4-58d1-480a-8a31-05faca59a60c", "comment": "Malware payload", "value": "6c23ae8af03f39b81638db1cf0356f9985ed84ffe97755d426493b7b4b901751", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145607, "uuid": "b22d5287-917c-4774-970a-6f43784f4a82", "comment": "Malware payload", "value": "a442f482636a48323b9a32a6e80af5fbed8be511", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145607, "uuid": "e4839bbe-0c07-4dbc-8c12-fe73683a544a", "comment": "Malware payload", "value": "f25c14eb6b640d5a23fbdee5c55d2e7cb61aac13aa22af86585e627a701b369ca7761a9b3d0b5d78f30f84e3bbaea9df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145607, "uuid": "1ee4a495-a541-4627-a134-85a280b34248", "value": "T1E4057D13B983C0B1E325153049E6DBB6B9785F650E30EA8393A0EE7F7E761A19D2701D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145607, "uuid": "9b9361c8-94f2-42f1-a9df-fe9928ae8b51", "value": "594fc314f88c095f7c06c284da5702bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145607, "uuid": "fec00778-d071-4035-9e64-241ffd432127", "value": "12288:d4IppKnmAV4Ze8V3gQQMG1GyZj1thbMqTcGIUwJhJR:dbpKnmAV4UWJGEyrthbsUWhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705145607, "uuid": "f0ecd833-01ab-4207-94d6-d013894bebb0", "value": 847872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705145607, "uuid": "25dd30e9-ed6f-42f9-b12b-d3269c3b76cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145607, "uuid": "98f74afa-85c8-4731-8fd9-7ccaff51e03c", "value": "SecuriteInfo.com.FileRepMalware.8475.9031", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23e3a299-b1d0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GCleaner)", "timestamp": 1705121800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705121800, "uuid": "d3efd508-8bbb-4ec2-b1de-1a7e1a578f25", "comment": "Malware payload (GCleaner)", "value": "2272504bc9b18e699a51c919af41fb59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705121800, "uuid": "68475264-78c1-4713-83cd-bb1f4061dcf8", "comment": "Malware payload (GCleaner)", "value": "6db92d356c49fcefe97ff35fe415bbf0d83a94e33272c5ff2197a42af44b5fc8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705121800, "uuid": "bcaad2ca-712f-46a4-886c-cdadc2bd966a", "comment": "Malware payload (GCleaner)", "value": "bcb2dfbf9bdbf30a1a84196b1f17e98629e747f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705121800, "uuid": "5a6197b9-f012-4b30-ad91-1348c4cae7fb", "comment": "Malware payload (GCleaner)", "value": "8004ff4feafb933028129b41563e26bce521571162a31de81dc14f12928e3d2056ccd06bcae1542918c7cff151d889dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705121800, "uuid": "867fafba-a89c-4f0d-bf66-03b78f308eec", "value": "T191549C0136F0C432E2B36B765C35C3F44A7BB8626AF1598F3AC05A795F257D19A2831B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705121800, "uuid": "89a5e649-af05-4a29-9fa1-2ad6a9afe60a", "value": "9a5a0ccd3ccd4b18623b778491d8a47c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705121800, "uuid": "12692b71-e248-4a5c-9f1d-91ad635b090a", "value": "3072:GNdwv3S/lrWXXeUJieXQ1Kv9Hu9m8kmMUxZTZc1GhxDZi1oL9tDh9McRnVVbgwT:GNav3SqOJ9fIUXZc1UYoLvhauE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705121800, "uuid": "b28179e5-3053-4f1f-a701-87058c81bce2", "value": 295936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705121800, "uuid": "049894db-e314-4311-b7aa-25c925e2e1d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705121800, "uuid": "25188c63-3714-4c99-9438-6fe570dd4d25", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9321cbc-b1d5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1705124171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705124171, "uuid": "1fd4f911-d9a8-4596-86f5-f115a3cec962", "comment": "Malware payload (Stealc)", "value": "fe0baf4affbe6d983e55c9b7d42c9420", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705124171, "uuid": "2fa4cb8a-4456-404a-8d91-66cb8dc2e19b", "comment": "Malware payload (Stealc)", "value": "6f903b80879fb45aa72f83d9bc35724d6ea48ad34f9aa80a0897e1d5f971d1b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705124171, "uuid": "b09bd271-ae04-4a42-8670-50c025469e54", "comment": "Malware payload (Stealc)", "value": "541c492fa557f2fcb24124b5f37a33690eac54bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705124171, "uuid": "cbc15841-ff73-4f05-890e-5394683d5a98", "comment": "Malware payload (Stealc)", "value": "a3ce1c8cebcfcbc004893d95af0e1985798ee29936bac59f48b4175be0f1ac54b3e8904c44711f40e07198dd862e20c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705124171, "uuid": "30bb8725-b5b1-4b22-9508-3dbc3df76d32", "value": "T110447D1175E2C432E2B3297A48B1C7F45A7BB8A32A3599CF2BC5167D1F256D2DB20307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705124171, "uuid": "6c90197b-3844-43aa-a66a-8add79528509", "value": "1219152ca9012f009c52738038ecb485", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705124171, "uuid": "c3dcbc61-d937-417d-89fa-d195f03e9566", "value": "3072:5jf8lLZvrMxCoKTjXJieti1KEdjpgawOFkAWfssFehxHgIWbb8HFRwJ0:5jf8ldb7YYl3ssFgTWnfJ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705124171, "uuid": "ea10aff7-a18a-44e2-8e00-d29fb226f654", "value": 260608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705124171, "uuid": "1506e56c-4ac8-44c1-8192-c580ab20dc64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705124171, "uuid": "a7a1f869-0abf-4cb3-bb52-77049cff0ac5", "value": "fe0baf4affbe6d983e55c9b7d42c9420.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d581e7e-b210-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1705149331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705149331, "uuid": "8c4c1aeb-4aa3-4792-ae14-3e5b45a7b24a", "comment": "Malware payload (Formbook)", "value": "699e3affc886e4d354de82b9c2898c2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705149331, "uuid": "ee1a7a4e-d2b9-4768-8c9c-51171042ed92", "comment": "Malware payload (Formbook)", "value": "715dd87ef7b32eca897087684aa5267e6284460b8bbb1a8f03e50ae1b0cacd85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705149331, "uuid": "cddcefe6-d8fb-413b-8179-7d329567cb81", "comment": "Malware payload (Formbook)", "value": "2a34f358155ceccdbf91d2412b8c7afe7ee33142", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705149331, "uuid": "428cfdd3-f8d3-4bd3-a789-ba65ce11c7af", "comment": "Malware payload (Formbook)", "value": "ce765379016550fedea2c42d6b63da769d62fb323a03d9b73e25d6d605dfc37a2c6fd11c6735ab1d3263cfc8a3d16b93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705149331, "uuid": "47b25873-4dd2-45ce-8369-de774afae0b0", "value": "T116E4122C2B9CAF22D09F537DA164606363749692E653E3581FC1B4FA2C73BD18245ECB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705149331, "uuid": "036fc84d-f118-495f-acf8-d0bdd01322d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705149331, "uuid": "3cea6c80-f111-45d0-b05e-dd72353d13c3", "value": "12288:EewoIc00MTJp0UOWumdRsoWZkz4VW3NPny3SVGjyR+Hq9bU2Hslb76:JwoIc0hJp0UOMLsoaA5tkHUbU2Hy76", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705149331, "uuid": "301e7b47-978e-4262-b316-f1da72d403cd", "value": 707072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705149331, "uuid": "53327690-fe31-4f17-85f6-b7be04e98dd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705149331, "uuid": "9d87c36b-13b9-4884-9418-9b7bb23def20", "value": "z18BankAccountDetails.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12ef824a-b1b1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Metasploit)", "timestamp": 1705108458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705108458, "uuid": "fe46c86f-7783-4b8d-8a92-a13e71b3e92e", "comment": "Malware payload (Metasploit)", "value": "9c1dc78462bfce4ded92e18ce7e15d9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705108458, "uuid": "ef9f46fe-fc5b-476a-a73e-506cafc7e144", "comment": "Malware payload (Metasploit)", "value": "724d647d2a6a0bdf31465bb40fba0bfc89cebd578c6af851099d997857c09b13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705108458, "uuid": "d2e07038-507f-4c83-94e8-a8c3c7cb4067", "comment": "Malware payload (Metasploit)", "value": "c24e9b14dc2fcb1b36bd6085063a1869a374c476", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705108458, "uuid": "020ecdd7-36ea-49e1-b99b-093c2ce18544", "comment": "Malware payload (Metasploit)", "value": "4539fe15bdad11cb91da7d23dfdbf0c3d0fb322d67793011ecd4609d1403630f39b096e448965ad31e634141dc736043", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705108458, "uuid": "db2876b1-e11c-424f-993f-cf3514a45077", "value": "T1CAD36CC7B3E530FBE1228574C451267AD732B83706319BAF47A4424A1F276D19E3AF62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705108458, "uuid": "5b18d945-c6d7-47a9-ac2b-e8eb175033b9", "value": "3ac7ad87148ae67028682182f6effb86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705108458, "uuid": "57bb032a-29da-4df7-acea-c3bd8efd3d90", "value": "3072:097aqC/YqXfFCgYljn9U4/vimSU7v06UTSy:09mqcYufFCjnKUD06Ux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705108458, "uuid": "f76aefd3-0a85-4b0a-92d2-38aa01c71c68", "value": 140712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705108458, "uuid": "b65bac88-43a6-4692-b3fa-671d19c1d97a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705108458, "uuid": "b5cc9ca7-5590-4da8-be09-441586bee4da", "value": "she.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9f0b582-b1ac-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1705106617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705106617, "uuid": "db7d41ee-c51a-4f05-98d5-753d6dd1558c", "comment": "Malware payload (Socks5Systemz)", "value": "0fa21a39b7e1858af3604852116b7af1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705106617, "uuid": "9ad98365-d0e3-4bc9-bab4-a598e03e075f", "comment": "Malware payload (Socks5Systemz)", "value": "74a74a949bf4727ce7b8318c1f5baea1ca58b8bbd6a6b65f89f56ac5470f2c65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705106617, "uuid": "54c31418-8a3f-4e01-95c0-df025bec4029", "comment": "Malware payload (Socks5Systemz)", "value": "41cf29a9656ebd1afb4f4e002e244dd683b31b90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705106617, "uuid": "b7c5567f-5092-408d-8ea8-081d19800d5b", "comment": "Malware payload (Socks5Systemz)", "value": "12828b988781fa73aea3f308ffb7607f8075fdaaa29a1b6f660c5ce150c18807d85f96ae0a2893c4ff1386f53da0bca5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705106617, "uuid": "2cdd6df3-f6d6-4f52-8331-f9a5156bb626", "value": "T10536330796E26CFFE032497F1C3EE8B91753A5D6297420022FBCC6CD6E3B550A8A1759", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705106617, "uuid": "e6a13ba5-a925-445f-8af1-07fa4571ccab", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705106617, "uuid": "aabdb65a-0b3b-49a4-985c-05d1625dddb3", "value": "98304:QH3JTLD2jemwcgivyfuqfm72g3dfgenEu6Aclytu:k5T3282qfszdfjnhAku", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705106617, "uuid": "4cb81ad8-f182-4866-bb21-6174b6d41726", "value": 4933777, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705106617, "uuid": "2abe25b7-e50b-4051-b525-a47497a3f9e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705106617, "uuid": "f098b699-f680-48e1-9947-1d34f3b168b5", "value": "tuc5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97e607c7-b1d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PythonStealer)", "timestamp": 1705125001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125001, "uuid": "c6935507-7168-49c6-a151-a01aeed32e8f", "comment": "Malware payload (PythonStealer)", "value": "15364923bbeeffbc51b7592f97030bcc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125001, "uuid": "8fdcc7fd-2e62-4e5f-9ab1-d0d267d357b3", "comment": "Malware payload (PythonStealer)", "value": "74f3138036e7fac6464e48b866197afc56d80b3bfa9c1944d3226258ec49492a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125001, "uuid": "024f1b99-fea8-419b-9585-2f2e0cdd7af0", "comment": "Malware payload (PythonStealer)", "value": "5c5d6af10bd1ab99b926770c23613b8ff88a7f6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125001, "uuid": "850bc60a-85a6-4ad3-b2aa-8b7689e0e0d2", "comment": "Malware payload (PythonStealer)", "value": "940e4b3a9e76540eabd4f18cc44b21fc64c8eaf287e361f9b1dfc1284975f5ca1c1cfe18bc5898bc512d88add0ae4a88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125001, "uuid": "5895a9da-b8a9-42f9-b961-612f064c570c", "value": "T1DD07330D81D7EDACD523F176A816F3B3BC36F8D01B2196BB9A99B1702773524121A378", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125001, "uuid": "19fd4a0d-0422-4ab9-8272-0f427371486c", "value": "a7b0793ae6dd3f16ef244d19e4de0c24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125001, "uuid": "3b3d85de-d5e1-4254-93c0-ae2cd9c6dca3", "value": "393216:mgIylbDWeXz9Jg8WBJWvVPtMkwek5VJFvXZ6:MyVSrBJKPtOn5zFx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705125001, "uuid": "6eeb9f70-96f6-4ae7-8ca0-0ec4938db0ad", "value": 18050048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705125001, "uuid": "6f21946a-6b98-4453-8a70-eb3ccbb665d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125001, "uuid": "05bd76b5-48aa-4657-b3b7-9ce6d8f3048c", "value": "15364923bbeeffbc51b7592f97030bcc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df55bf05-b1c0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1705115243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705115243, "uuid": "9eab4589-fb47-43c4-ab7e-9507bb0903b2", "comment": "Malware payload (Stealc)", "value": "ad3a89e0220aed5210d7ec399dcc3d88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705115243, "uuid": "237627f1-c08f-49ee-9dd3-5558e5b13eb2", "comment": "Malware payload (Stealc)", "value": "75a12cb6482913d06c937ae11d60924c7be2185efe86f797b7cfe7dc5a39194f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705115243, "uuid": "676d7932-b9fd-40e0-a3f8-925a0f066276", "comment": "Malware payload (Stealc)", "value": "2f63bcacfd38744f2c14de4e9f877807f233a648", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705115243, "uuid": "faa99809-ceea-46f1-8b73-eab4652fb917", "comment": "Malware payload (Stealc)", "value": "189550bcc06b3c1c69a29e879792fb282f8119fcd8a168576b3775d54d7c9f3226ce9be5bd52b44d2bd006315023baac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705115243, "uuid": "63c17cd4-4cb0-42cb-83ee-edb78859ed63", "value": "T1AEB5235149C24C62F5A60D70183A70E64BA11EB7A5C5E493D3C2FC985EF3741A38F6BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705115243, "uuid": "17d3f42b-0fb3-40a7-908a-b3283d00d8d6", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705115243, "uuid": "fafa0c64-2179-47c4-8d51-faccaf349e60", "value": "49152:v+2s5FXQ4EmojLjCRELVf7Avil+dHIsLp1thIikN+6u2hsp:vuzX71oDCRAZUviAHImDqia7hsp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705115243, "uuid": "9e3ebca1-f4de-411d-8694-2612962ef00e", "value": 2467806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705115243, "uuid": "0ffa0d82-d5a2-47ca-963e-f160d3e2fe7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705115243, "uuid": "9b92f628-7534-4c29-8533-919aafa58918", "value": "InstallSetup1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fd6ff65-b207-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705145631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145631, "uuid": "ad76c263-9ee7-4860-b53e-13d13afa95c6", "comment": "Malware payload", "value": "9bc00ff2ec36ec080fb9e515da080e4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145631, "uuid": "9e7117b6-4475-49d0-92ce-c40f470185e6", "comment": "Malware payload", "value": "77bfade61b714d159eefbab58c9591b6850530817d460865fd91916f27ceddc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145631, "uuid": "6396552b-dac2-4ee8-986c-26b043a565f2", "comment": "Malware payload", "value": "592ae09d46fcebd720d364f41fe0f86304994e18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145631, "uuid": "33272e54-f2f5-458e-8389-bc426da2974d", "comment": "Malware payload", "value": "f63a5c87d3cd1d5c6c67c0a11b42699cffa8efb33f84fe28ea790c97b179ce83e5566ba8671c393aeaa81c14f1804314", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145631, "uuid": "acb7cafe-8ff5-4620-baa1-13a0bc9147d6", "value": "T118E48C22F6F291F5C615153118FA2736EB79BA0A0B11CBC3D364DE2D6D361A09F3712A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145631, "uuid": "fc07a298-1b44-4f63-9f18-74d607b3fbd7", "value": "5b87bcc1361b3ef23307ddfd475d4816", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145631, "uuid": "0d9d4e1c-87c7-4bf6-907a-8975b517e993", "value": "12288:3/JR0EKESiF9+VIdAGU9BMvdog+LdG3gpuz:3/LlK9iiVIdAGUbMK15G3p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705145631, "uuid": "fbda7acc-106a-4268-a2bc-90af9c00cf17", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705145631, "uuid": "62703fff-fb61-40a7-82a4-431fa9343ca6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145631, "uuid": "f9121f24-0604-46d0-974e-a0aefffd222a", "value": "SecuriteInfo.com.Win32.TrojanX-gen.11790.11677", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e9453c5-b25c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705182028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705182028, "uuid": "34a62865-9685-4741-99db-3adcee9c1150", "comment": "Malware payload", "value": "d3ec0231992e140fdbf3b3c074049049", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705182028, "uuid": "be2bc579-e42f-4a1a-89b3-18d8ead2a870", "comment": "Malware payload", "value": "77d0caf538fc7c1fc5cc7ff2be7ff480c8ce67146417788364969898b45ac978", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705182028, "uuid": "ba2f99b9-6de5-4ebb-8a4e-444f1ea38c47", "comment": "Malware payload", "value": "c9c1140af9121f52a9bc0640ff9b272472de2991", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705182028, "uuid": "2400ba6f-78db-4575-bc94-3aae739e9283", "comment": "Malware payload", "value": "a7d700cdde9c153ce97ce7900506d9f698ef684d217f9813148e93e1da07d3b6732a3cd494c0e39baf577c7737218c07", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705182028, "uuid": "b403d4a7-6b22-40ad-b656-34aec1c7133e", "value": "T1C6234BC9A587DAF8FC160B742172EF325BB6F93F1018DE87C7A59933D942602D10A1AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705182028, "uuid": "f4ec802b-6882-44dc-88b6-a09779b51b7a", "value": "768:13sPWVrWy7PBIe9iFokjl3dMhc0otXztFxK00Gjww5TKIL91YiG64lM:DD9IciFokjl3dMO0itrK9Gjz5TTLLrGT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705182028, "uuid": "377229e6-3b67-4ec5-90fe-230d65695a71", "value": 47056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705182028, "uuid": "c1bfec56-5d30-4efc-af8a-5bf2f58bd009", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705182028, "uuid": "fd7dbaf2-3bc5-4153-9ac3-291c768c03c0", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c23a9a0-b213-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705150564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705150564, "uuid": "7448df19-43f6-4b20-95f2-035a90da948d", "comment": "Malware payload", "value": "4c4b53e5e75c14252ea3b8bf17a88f4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705150564, "uuid": "88a0324e-6150-4178-b51b-e4b4d05c5a13", "comment": "Malware payload", "value": "799b9238ec23d902f6a9172e6df87f41faff3f639747f5f70478065a35a37598", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705150564, "uuid": "b9ca048e-3e58-4e4a-93f4-9d2b322dfbd1", "comment": "Malware payload", "value": "08c04b83d2c288346d77ec7bc824be8d7e34e40f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705150564, "uuid": "11c22d95-7782-4c11-977d-22baa62dc2f5", "comment": "Malware payload", "value": "8d2e14970346bda8dae2e636a74c97d926ebfcb3b460724f155b0cb8f1735895c9860a501e65d000de171bcb10bf313b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705150564, "uuid": "079bb3c6-1097-4193-be8b-d8789b27b5ef", "value": "T1E6A4E10491E79E21C79822B5E5AB102927F2E70EB277F30E7A1921356D427FE1F463C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705150564, "uuid": "c67e58a0-5725-4c31-a2d9-660a8f435eac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705150564, "uuid": "9d3309cc-dc49-486d-a1a2-e8a979668ac8", "value": "12288:mpthVGWZ9xr0O8lDcZwZGAUcNsEjjrDi1mVN:mpB9/8lDMtcNsEvr21A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705150564, "uuid": "cac1a870-bdf6-4a75-bc59-f7658129ec3d", "value": 475136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705150564, "uuid": "f1b84683-acfb-4dd7-94d3-cf91741d56d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705150564, "uuid": "ba17cbce-3447-4ad4-a0cd-9bd3c4d08dd5", "value": "4c4b53e5e75c14252ea3b8bf17a88f4b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4c6bb07-b1d5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705124191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705124191, "uuid": "633c4ad0-000a-428a-8301-88a317a408c4", "comment": "Malware payload", "value": "ed5b800ad3afbfc255fd7de1184ba31c", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705124191, "uuid": "3f37792f-3af0-40cf-8250-77f0cf58d76a", "comment": "Malware payload", "value": "79c917b7bd39bf111ae99b0ddb88e99c11063fcbc0aa6c987f797ebe7944cd07", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705124191, "uuid": "de2db9e8-e504-4eb8-8f1b-81613bd1cbfd", "comment": "Malware payload", "value": "bdd87779bd83b06751b17b72b39d01d51d143abc", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705124191, "uuid": "f962ddda-12ab-44cc-8ae5-12b0134f68eb", "comment": "Malware payload", "value": "aa0bb109868a4c9d9a9ee71d105eba5dc21615cdd9d94fb758862e8a1943e219e9ee9edc8213ea1b48815ca0f26cb56d", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705124191, "uuid": "f01c5d41-4a18-4519-8cc4-b8a2e6cb5d5c", "value": "T1C1A23F552AFF500C71B3BF611FE579E94E6BFB716A2964AD104403078B63D84CEA2732", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705124191, "uuid": "91e5e44e-af18-483a-a3b3-aa24e69876c9", "value": "384:k0CcO0C+m0CK3qd4p9LZ9lGqh0bAqI+AqGa:CcY+wK6mXlGqhAAqI+AqGa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705124191, "uuid": "7a345700-1090-4e5e-9d6a-10063eb45c79", "value": 23086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705124191, "uuid": "aa55521e-906b-4668-ab76-2c4f2dc88804", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705124191, "uuid": "b79d7c0f-36f8-4651-807f-df83e230c389", "value": "DHL AWB,COMMERCIAL INVOICE.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "625a9ee4-b25c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705182035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705182035, "uuid": "e50019e3-e173-4f9b-9ac3-113dbfe4f4a2", "comment": "Malware payload", "value": "84c2aeeea71b4c4d308ac12f562db327", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705182035, "uuid": "beb937c1-0d46-49c9-844e-8e3423ce457d", "comment": "Malware payload", "value": "7a6e173034edf930598f5c7530c03444aef6bde44afd1bb5d324ef30205eed2b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705182035, "uuid": "cd8b50a1-98b5-44f3-8512-38bcb4f6ccd2", "comment": "Malware payload", "value": "7bd59f1aeadad1879bb60aafd65f925841376cb3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705182035, "uuid": "ea7e3edb-36aa-4d62-ad76-11c98d3a7cac", "comment": "Malware payload", "value": "241a8510cd9ad04f35c64c617f24d80e89107f878a3e5ec527accac993f6aee315e350639453eeeb52576e0b407b1b1f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705182035, "uuid": "45ead465-3082-4d78-8693-55e80ec9b51e", "value": "T109132986BC829966CAD01776B62E108E3321B3E9C1DF3217CD245F1177C9A2F4E37A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705182035, "uuid": "3930f64a-3c20-48aa-b9c2-d9735e24f3b4", "value": "768:4e29cZjBmP2XBDFlumI9NY+uanihajapr8pgwmbSWAySxoNZmBNs5:32uZFmP2XB3uVO5Oihaja62wmSJd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705182035, "uuid": "7c4cbbcc-1811-46b3-8d71-c133353a865c", "value": 44128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705182035, "uuid": "d84d5328-b8cf-4618-a2b6-653d3e664db1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705182035, "uuid": "74a05969-e116-420e-b3f5-fd8cef6a4b12", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7344f2cd-b1ae-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Sliver)", "timestamp": 1705107331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705107331, "uuid": "abc3b5c2-be22-4d0a-bf7a-8059f260baec", "comment": "Malware payload (Sliver)", "value": "03be755877c40cf79150fcf5f752b82e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705107331, "uuid": "9eab231f-940a-4d11-a76f-957d3a793987", "comment": "Malware payload (Sliver)", "value": "7bf41938e25df8385ad137cb33c5b6ef3479211ba237c4e4eaec4e3654eab00b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705107331, "uuid": "e4a34548-6c82-422e-ac93-999156419c2d", "comment": "Malware payload (Sliver)", "value": "e5b6e62c4532c71a364c9128e104b7c3e2e13b98", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705107331, "uuid": "158d75fc-01e0-49c5-bceb-2136a31bfcf3", "comment": "Malware payload (Sliver)", "value": "5f0f5921ea0123d60b0950b8f45affd88711bd874c5350c7fb7469e4de512262fddc03f190ad4f45add235023f3a3bd6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705107331, "uuid": "ae36dd44-a51d-4fb2-827b-c8d1ba27e475", "value": "T1B1E61A03E8D624D5C4FAD1B489254172B970785C0B7923DB3BA1F7B42B32BE09E7A791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705107331, "uuid": "92aebc4f-1a70-4a3b-81ad-61747ace7cd0", "value": "98304:QpvlW8f3YCLdiIlPjQLLMeR1yHkE/QxT+t2Jh0:Qp55htPjBeRQHd/V1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705107331, "uuid": "1e14467d-cd0b-48e1-acae-660bd77ff60b", "value": 14479360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705107331, "uuid": "3d90680b-6b84-4793-861c-7ae5f2aa1114", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705107331, "uuid": "23766e1b-9374-4cab-95e8-f957976b2c3a", "value": "psauxsliver.o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e434b07-b1d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705124797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705124797, "uuid": "8494298d-3ffb-4ac3-b8d6-53873341f233", "comment": "Malware payload", "value": "9f26f723df0ce1ad3e928f983dffc61e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705124797, "uuid": "59a27e42-8dc6-4904-900f-18c2038aa57d", "comment": "Malware payload", "value": "7bf634e0d7a0b311e08ad0d0d453628f4fd559bcdd4bf9f05744571bc0e0f885", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705124797, "uuid": "31bf31cf-90e3-4e3c-9967-2630542d7bbf", "comment": "Malware payload", "value": "60fb9a9d10f80b7de491df753eb96c97d7f0cff3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705124797, "uuid": "ef84983e-9a3b-4386-bf83-53461816d740", "comment": "Malware payload", "value": "db35dadd005f98c0227e78bf9c9d49922cc190b49317617e2e4a0961afdae921142dbe231f3360410ec4d3fb30bcc7bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705124797, "uuid": "fb74b36c-1cd3-421c-ae9f-6727e6c9e858", "value": "T14C16DF3132E50B34D5BB8B3958FAA024493ABE475E50E64E25FE394C8DB5343BE12673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705124797, "uuid": "feb4420c-1f28-45ef-ab63-90b17a2dac2a", "value": "332f7ce65ead0adfb3d35147033aabe9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705124797, "uuid": "c55ec8d2-c1d2-4263-a456-a05d12d1317e", "value": "49152:ynsHyjtk2MYC5GDyQBh/VoRYskNIXyjgYLriNw5mPPAy0ezYu6KD63AvHZ8ko:ynsmtk2aUhXMy81/PAyTznI3Av5s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705124797, "uuid": "47b803f7-412e-4354-bbf4-47e4dc119fe9", "value": 4188160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705124797, "uuid": "b67af5a5-3237-4cf7-8472-6215b2ac4467", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705124797, "uuid": "e17c3bda-b714-4bc5-a45d-21102c1fb090", "value": "PsExec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41baa98f-b231-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705163512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705163512, "uuid": "4dc54509-4fc7-4ebc-97fa-980732ef9fe2", "comment": "Malware payload", "value": "bff95ba6690b0991b2fbe209a9dc46a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705163512, "uuid": "23cc3a83-abbf-4cc7-8e18-f867ca8290d1", "comment": "Malware payload", "value": "7ee5e15ed08b1f9320b9b86e3f9a383c6ea4269eecf07870c29968d95e681e76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705163512, "uuid": "bfceca25-69ef-41cb-bc4e-d802e86388c6", "comment": "Malware payload", "value": "3a912b0f1fa062b662484760713676d0e8d0d7bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705163512, "uuid": "1b835de5-7377-4ce5-b80b-1a4d0750b9c7", "comment": "Malware payload", "value": "8e978df0fcecfad06fcabf4802b89f3d90f1ea29ac2194b275bf330e987e3340d55d7ffeaf320a310f2ecabd404ff70f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705163512, "uuid": "7fa7962c-00b4-4258-b18a-f2a1c0e8913f", "value": "T15CB48D47E2B841BCC1ABD195CE55925BEFF2780A2134934B57E1CBD61F23B32A21E316", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705163512, "uuid": "b2867a1d-0aca-4d91-820f-f8efd0eedbc3", "value": "12288:APnOLHovk7WfaB8HVvle0Uy3ofLSqKvDSbQbcaX2cs:APOLHP7+a2HVvM0UyYG7SbQbcaXjs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705163512, "uuid": "8a188480-0e1e-416c-9e78-7eb8f21ec6ee", "value": 529968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705163512, "uuid": "ee5c248f-f99d-4faf-b9dd-8469e5454317", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705163512, "uuid": "7183de74-326c-40b7-8def-2f28abbe80c4", "value": "SecuriteInfo.com.PUA.Tool.Mimikatz.1166.22038.381", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7e1f30f-b20d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1705148275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705148275, "uuid": "7acacaec-c299-47e7-9e49-eab94c6a821a", "comment": "Malware payload (Rhadamanthys)", "value": "78ca6ef28110000e4a9007499388cb84", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705148275, "uuid": "277354a4-2962-46e4-989b-e8c61f85d9ef", "comment": "Malware payload (Rhadamanthys)", "value": "7f30a21151eee81870a014119d6824a245b8d534f0501917d8920f8ee1188bac", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705148275, "uuid": "acc46e93-b101-4d00-b00f-4e3436664986", "comment": "Malware payload (Rhadamanthys)", "value": "c8c71aa3a3d2e0710748c8433d8088fa3b37d357", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705148275, "uuid": "71eb0652-4748-42b3-9927-52242546e6c9", "comment": "Malware payload (Rhadamanthys)", "value": "7def5f9bd78d40d0193b13213ca46f84be74a0ee4c6bc5ab9a6df44f6b41aa3c21954b3a4def78e0625602886b910d35", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705148275, "uuid": "da50f618-51fc-44eb-84d7-6aa95748ba5e", "value": "T1BF55E04A376C42FAD537D23888428A41E9B37C59DB20A34B4BF507AD1F136921E7FB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705148275, "uuid": "b6e32f3e-fcaf-4d6a-a825-233a53ec7a47", "value": "17b6070dedaba4858a1aebc60679f517", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705148275, "uuid": "fe255164-ea93-4f7c-8601-6c98ed5607fc", "value": "24576:GSeLmAfyrmtqmKdIn1lTrTYxxN7Gu2mbmrU3WmiYESsf+PByu/:Qgc1lTrTaxNn2mclXSsf+PE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705148275, "uuid": "e285a52f-37bd-483b-b07b-647a085e4a8e", "value": 1305600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705148275, "uuid": "6785b62c-c9c2-450b-9aad-4f0a1ff04bc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705148275, "uuid": "a8806abd-126c-4a5a-b670-f4992ab2a14c", "value": "78ca6ef28110000e4a9007499388cb84", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e230ee8-b1bf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1705114677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705114677, "uuid": "2236da09-09e2-46e3-9bb4-8cbcb6ccfc4e", "comment": "Malware payload (CoinMiner)", "value": "b8c67a670a12b9c637e8d1a2d081143d", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705114677, "uuid": "73281abf-157b-42aa-9cb5-c42c1272ec59", "comment": "Malware payload (CoinMiner)", "value": "802cfbde432429db1ca6c7d4165a1ae120a94236b094b22fc1303c6284f6512a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705114677, "uuid": "efdebd14-39b9-4fa6-b14c-f4fedf7d37eb", "comment": "Malware payload (CoinMiner)", "value": "8776248ccf67702157f4f687fd2f758552193276", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705114677, "uuid": "4c62cf3f-eddf-4ef2-bd91-336d23c15c2c", "comment": "Malware payload (CoinMiner)", "value": "61de6ed54fd280e394f030527c352688a5cbe421eb6c1c05c846541d4b953c24499bbf43e413be1e5a0454e145f430d5", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705114677, "uuid": "7f71d172-2db2-4166-ad0e-3dca3ed05b18", "value": "T16A96C541B77C8923EC46D6F2C3E2C40907ADBD6B5312D70A798D3A6705BB39E488B1D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705114677, "uuid": "74afad8f-3e85-412b-9470-8216019efd4c", "value": "49152:Vw3JZxtqglDaDW6QCdevvoKOXGp8mih7NUfXUu4tEqNrqcqapPeDkwVzMemuYTwb:CZZqma5G/Mul2rq/aReDkizMeQU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705114677, "uuid": "9ab91e9f-e1c4-47e1-817d-068e8737cb03", "value": 8809984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705114677, "uuid": "fc8f0a5b-3c05-49b5-92d5-ac8b203c02c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705114677, "uuid": "5e961cd7-1bfa-4290-bcfd-fd91589da26b", "value": "ma.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c74a2972-b1dc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1705127228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705127228, "uuid": "7b60cd96-681a-45dd-9421-55e2ce3c0b6a", "comment": "Malware payload (RiseProStealer)", "value": "a68a49a6f188cc2487020566d50b8b8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705127228, "uuid": "6f1b3d1e-0f1f-48cf-b5b1-b390836428e9", "comment": "Malware payload (RiseProStealer)", "value": "83ffdcaa30a677880d808a41a70b937cf4a1f1bc853cea431f861b94e6a4dc78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705127228, "uuid": "0f576ff2-8d4a-4f76-aeb2-7cd9261cf552", "comment": "Malware payload (RiseProStealer)", "value": "a428842d7299f9af317beb78d84460e1735fa1be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705127228, "uuid": "f1fe6bcc-192e-44b3-936a-66ae10b76588", "comment": "Malware payload (RiseProStealer)", "value": "e7638edd08c1a185cf593bad5eefe742f87a4f4a1457d2c43f10966590263375f0e858e06c629af43a0ac7aa5543ee6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705127228, "uuid": "5e7c54b4-e7ae-4139-bc91-0f7f246e68fa", "value": "T1879523F033F8568DE5CA83F18BB6E66A53D06DC1CFA08EE3C8A7016637275C29995453", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705127228, "uuid": "b48d6a0b-d49d-4441-8faf-506d69cdac59", "value": "1e453fd81736fddb1b5f5ce807c79734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705127228, "uuid": "5ce11a00-b04e-4171-a718-12e3acbb4c32", "value": "49152:TWQ0lbkT1n7mOo5crAeXVStAmTApCjiSvGxx7H4f+r:aKaOo5crAeAiCLWH4fe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705127228, "uuid": "07197829-d4e0-4b70-9569-3ae05f8b23ba", "value": 1878016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705127228, "uuid": "65e6fec4-1cbd-4f20-b0c7-6a05db83f8e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705127228, "uuid": "a2bf3cb2-2e23-4edf-a08d-6321e9727952", "value": "SecuriteInfo.com.Win32.TrojanX-gen.6379.7353", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dbf28e5-b1d9-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705125790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125790, "uuid": "d08a3d94-7395-453e-813d-5a57d2db1640", "comment": "Malware payload", "value": "b202c04f992ff0c2ea95e366c41a6b5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125790, "uuid": "e4171bd3-590f-44f9-a571-438eda1e4ea4", "comment": "Malware payload", "value": "8621fcce46af6801e66cdf04902595e39729bc878e4ab17c0de51fdcab6e1e73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125790, "uuid": "ded39ac7-b587-4465-8e69-5794bc6ed71e", "comment": "Malware payload", "value": "9b9682a2faa946180d285574a1002c7cb8154e81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125790, "uuid": "7e5984ad-05a3-496f-b3a1-46c95b419cf4", "comment": "Malware payload", "value": "8c6978038d1fa11333704435993f2178c28b48c6a47a069824073a81ea445b517742d4637c5ed64a1c97b74de4d7ca91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125790, "uuid": "6dab7d5a-fa07-40f0-9582-462d44759c07", "value": "T16AA633188F727A79CD48413D648F1F0AAB91CFC40C78D19757A039DA22BBB5B9E2B471", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125790, "uuid": "f0c9fd7e-42db-4c0c-9242-81ad1b8bf5b5", "value": "c9a3edae9204609d90d0770c3583acd8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125790, "uuid": "1768a341-f3e3-4dda-9a1a-197cb9f89d79", "value": "98304:2jTTsHU+DTwl9zOHz7t1Q5RRlWY9HJ3CChZfYQmGKd1q1pjc:ITqU4TIqY5BZdwnGO1q19c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705125790, "uuid": "43068599-e3ac-4efc-ac81-4416c0e630e3", "value": 9908420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705125790, "uuid": "ec173e4e-dc4a-48a1-ab5b-06de507ac8c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125790, "uuid": "26831a3a-8c08-4872-b0d4-4b4b468db8ec", "value": "up.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dea8e508-b24f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1705176660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705176660, "uuid": "5e27a8e2-a3c1-471a-b327-01b79faab41e", "comment": "Malware payload (RiseProStealer)", "value": "0669f69c629a17748e867dac18c54839", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705176660, "uuid": "5fed3032-3b6d-43c2-9263-618dfe4a8f29", "comment": "Malware payload (RiseProStealer)", "value": "8743f57c8c4677bf6add3d27ddc72dd7ed3f12feb79f5634820598bdc01e35f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705176660, "uuid": "b9e4fbd5-8d1c-4658-a131-6967123eb277", "comment": "Malware payload (RiseProStealer)", "value": "b1f4b05de8f69ca649ea29b9b4b369987fae3992", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705176660, "uuid": "55004f10-75e8-46f0-be4c-9269e617e105", "comment": "Malware payload (RiseProStealer)", "value": "93aafb4d248fb37684f4181a94aec68ec9b6add8b010e79db72ec834308c9b8d2959214021decb28f17dd31f40e1377d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705176660, "uuid": "cdf551da-92bf-43c4-85a5-8231e607bba3", "value": "T1D45633C1F9C92098D49FD574165BBE6DB6FD3E720100CA1DB4A83FCB95E3666213A2C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705176660, "uuid": "30c933c7-e86c-4317-9c8b-693a9ccfe2e2", "value": "72a8640cd0f5e69c853fcaf6ca56a023", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705176660, "uuid": "c271364b-1227-4fc5-9b5d-c84826e7393c", "value": "98304:oOPtun/ywC2s3KfO2mRR5UYQpV5436w54PVLWJW2U40JYm8x9:oscywCj3gY7inC240um8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705176660, "uuid": "6e98dc06-4943-478c-b223-8d0da855d154", "value": 5910672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705176660, "uuid": "f5da5331-73ca-4ab1-80ef-80713d724c7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705176660, "uuid": "515aea36-16ec-4387-9d96-e05248e55db0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d481c167-b1c1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mimikatz)", "timestamp": 1705115654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705115654, "uuid": "db810af1-94dd-4767-b535-7228908be269", "comment": "Malware payload (Mimikatz)", "value": "5d570daf6dc6db5253b789192d6f0c5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705115654, "uuid": "a0f64970-03ab-4b3e-8c83-a6e6ea07e6fb", "comment": "Malware payload (Mimikatz)", "value": "87a4adcc8c5c10bdf57e4b5ec13b2d2567437034e908982ed276aa4a62a01eb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705115654, "uuid": "e1b9c389-1c31-49db-b515-04d58657e897", "comment": "Malware payload (Mimikatz)", "value": "bdc8506df8aca91ae9f646edc6e9f8aeb82b02f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705115654, "uuid": "ca71f1c8-8c53-403c-b416-5746b72e810d", "comment": "Malware payload (Mimikatz)", "value": "bfd37f90e93988e704173a32545d209aae64d099326e173d5c1121b4f981bbeece0c04933e99ea03a68cfda91dd55a74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705115654, "uuid": "6c2bb947-a10a-4b36-a891-dac6e5aa07f2", "value": "T17F5622BE234433A8C05AC5745433E954F2F6558F07D8D9E9B3DBA6C06BBB810EA41F4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705115654, "uuid": "f5dc2b1e-bc9e-48a8-9611-59c12d8b90dc", "value": "f9e4e52991070df47f71115af20a8652", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705115654, "uuid": "4c402db2-1f9d-4062-b2bb-1100f80b47d6", "value": "98304:5s4aXzeiPlTQ3PmTqlzdsZl5TGiPFsV7bvDdpEPnBg+kJM5:5lOImGFd0THPSDDdsSj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705115654, "uuid": "0231e805-262d-423e-8be6-d4750d4acf98", "value": 6055424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705115654, "uuid": "a45ca2ea-b260-4eb9-9e17-c9fc48d8c33a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705115654, "uuid": "ab14ba20-9009-41f8-a390-c82717f7c505", "value": "mimikatz-vmp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b293e93-b1c1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mimikatz)", "timestamp": 1705115531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705115531, "uuid": "4efddd73-3ca5-4de2-8fb1-8504054eead0", "comment": "Malware payload (Mimikatz)", "value": "6bddac15809ba55193252c4da3849933", "object_relation": "md5", "Tag": [ { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705115531, "uuid": "f1956451-3ce9-4d6f-95d0-0c3b9b38a283", "comment": "Malware payload (Mimikatz)", "value": "881767ed394cb6a24d629f105c8bd9451143a8e5147e14dfb621d270dbbee431", "object_relation": "sha256", "Tag": [ { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705115531, "uuid": "761a5ddd-8d1b-4c60-a534-01fa3190f62f", "comment": "Malware payload (Mimikatz)", "value": "bdacb11aeded5bc985a2378174fdbbb3290931be", "object_relation": "sha1", "Tag": [ { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705115531, "uuid": "055d5817-ddd6-4847-a654-631fc9fe6b24", "comment": "Malware payload (Mimikatz)", "value": "17bef59553042a20674508a973a33598d0485b440227bed53780adc164adb92851b275949b923422ecb85c3c500551a7", "object_relation": "sha3-384", "Tag": [ { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705115531, "uuid": "111b01ec-1b38-43c3-ab17-31f4b22ba9d5", "value": "T1DBA58D3ACE67FCE9176C3980A4143E4A1D6C265347B4665DFDC518B73EE8600CF2E6A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705115531, "uuid": "ff9aa8d2-dc14-4c1c-b09b-6b28306f6077", "value": "24576:0QX2Q3g+GP+61ItrfKlOlySj2z4egGnRqWCUpmkFL4TLm:0QXD3g7VGyNRIKH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705115531, "uuid": "983af61c-2272-4188-a39f-803dd9987c9b", "value": 2189572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705115531, "uuid": "78595ba7-a26e-439d-a266-467ddcdad1a6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705115531, "uuid": "efcd7106-a52d-40dd-b8a3-ad03d95a01ad", "value": "Invoke-Mimidogz.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2a348b8-b210-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705149608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705149608, "uuid": "8112e5da-a6b2-4528-b8b3-9bbb2f73f886", "comment": "Malware payload (AgentTesla)", "value": "ff3ac5786df144c961197ec916d3e559", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705149608, "uuid": "423baba5-d87f-4725-8022-3d425811165f", "comment": "Malware payload (AgentTesla)", "value": "8882474c86b687c35ff9f5cabaf95d48ffb1e8a6ae279182f41ccd9d58123f95", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705149608, "uuid": "c04004c2-e451-4808-8557-2e938d204e4e", "comment": "Malware payload (AgentTesla)", "value": "81b87d93613660dea1d981fd8394d6b80e281ba2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705149608, "uuid": "5de1f679-548f-491d-b728-f135ff24a89f", "comment": "Malware payload (AgentTesla)", "value": "73be12daee3eda5289a1448d3708b6ccfa6dd9ee52fd1129292905071e6a145ebf7006b05ca5ef76bd31292145881ef1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705149608, "uuid": "2a9f2b20-5ed3-4f56-be6c-20806ff5b35d", "value": "T12FF4E53C18BD2223C179D7A68FD49427F6A088AF3121DD2659D75796060EF222DC7E3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705149608, "uuid": "309e1871-72ba-4159-9dd8-052f9a3025cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705149608, "uuid": "2dcdfe8b-9cc2-4616-a1a3-78842d2b91d3", "value": "12288:0ETzLIVzoboS4ZudWzVlQjzPhoVE8DljtHM0VOx7eyHxIhMSPA22f:rI1obLdm2jzZoVEetGHxEb2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705149608, "uuid": "8a0c6462-aee2-421d-9e56-9cc71e87f547", "value": 777216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705149608, "uuid": "8c0f8ecf-7a89-417c-98d1-45d790402401", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705149608, "uuid": "13f0e093-3a20-414c-83c7-2a5da92d2907", "value": "SecuriteInfo.com.Trojan.PackedNET.2591.22896.11490", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b67c8d93-b1d5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705124194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705124194, "uuid": "7c83d1bf-aae6-4d21-b0e3-b8fd2f947201", "comment": "Malware payload", "value": "339de6b0eff6869c55c2f494d965fcc9", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705124194, "uuid": "662d1633-9bc1-4c5b-bd7a-8ad7f43f4c94", "comment": "Malware payload", "value": "88887cd7f346b813ae0735fa78c1574d49096e58b08fd4681205cc6dcda9b455", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705124194, "uuid": "a6c31b9d-b34c-4d8f-962e-8ffa6910d5c7", "comment": "Malware payload", "value": "0cf30e0e4ac4966681f019b4654d3841fef8f252", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705124194, "uuid": "2924aa74-aeeb-49d9-932f-0ef9af21490b", "comment": "Malware payload", "value": "203b16c9e68eac918035d8e074a09f5d089de72baaed5228df59b6693694d62d9a477749838fb1764142cb0ee0bcd791", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705124194, "uuid": "8596121b-98d3-46cb-b70a-46f971842786", "value": "T1D7A2FB2135FF911C7273BFA11FE9B5EA4E9BFBB22625A15D100402074B53E91CEA2B35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705124194, "uuid": "5d14aa32-c028-48d9-a13c-389501019260", "value": "384:rhLZ3+t4LnhkELZ3+thwOq+cdObdYbdc1LZ3+td:dLp+yhLp+H1cdObdYbdc1Lp+n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705124194, "uuid": "a426b85a-6394-4233-ba83-15b45456d303", "value": 23082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705124194, "uuid": "e08b9b1a-714e-4be0-8298-8d88612c0e9b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705124194, "uuid": "a5a2a085-b6a7-43bb-a0e4-f9584fa51e34", "value": "PARKINGLIST & ORIGINAL BL.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "add62d3e-b205-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705144795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705144795, "uuid": "5aa96154-05c7-46f9-94b9-9ed1496fd993", "comment": "Malware payload", "value": "36596017a30a6def73ebb20034367b55", "object_relation": "md5", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "EpsilonSpaceworld", "colour": "#39C295", "exportable": true, "hide_tag": false }, { "name": "pw-beta", "colour": "#37A355", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705144795, "uuid": "94135c43-9602-4f15-9e78-ef08dd5ccd20", "comment": "Malware payload", "value": "8b2d2f460e5c17bd17bbfefe230b8d48fbde11b35fb04381a347e23fa345334f", "object_relation": "sha256", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "EpsilonSpaceworld", "colour": "#39C295", "exportable": true, "hide_tag": false }, { "name": "pw-beta", "colour": "#37A355", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705144795, "uuid": "791ba880-5dfa-4787-9785-6e97b230710c", "comment": "Malware payload", "value": "ccd8601694f9af88d6a77c0c4e96dde5f14a82a3", "object_relation": "sha1", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "EpsilonSpaceworld", "colour": "#39C295", "exportable": true, "hide_tag": false }, { "name": "pw-beta", "colour": "#37A355", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705144795, "uuid": "f2be9c9d-0177-43bd-81cf-93aa41213927", "comment": "Malware payload", "value": "e40fee5bf79ee127dc75fe0b9bad04bc64b406131252ee2eda506243bee159e804e0caedd53f2b41f19affc88a82f811", "object_relation": "sha3-384", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "EpsilonSpaceworld", "colour": "#39C295", "exportable": true, "hide_tag": false }, { "name": "pw-beta", "colour": "#37A355", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705144795, "uuid": "edeeb3a8-827e-42cb-81e7-44e8acb00a4c", "value": "T1F0E7330323A5F81D120093F24A5EE7967E57BB22C980DC577747E720D8AF33C99686DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705144795, "uuid": "eee1f01b-b21d-4719-b125-9f3e80499f04", "value": "786432:miyE6o2q1d3/Bl3LvHSMlLCiRHfoV5DGilIKZxn6NnXvvP2ek209p1u1w81zlK2a:4xovD7vnLCa+uKZUdv32em9fuG81zlKL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705144795, "uuid": "063a39d2-00cb-4333-8ce0-a5ae9a6b5abd", "value": 65355714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705144795, "uuid": "6fe4d18c-6d22-4c84-aac9-29cb9413ac38", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705144795, "uuid": "94df9055-05d5-4ced-9f6c-36c71f1d02b0", "value": "EpsilonBeta.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65662b10-b219-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705153264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705153264, "uuid": "3f8971c9-3383-488c-9825-a59e08f05c28", "comment": "Malware payload", "value": "639a374dbcd6c3545c9ada9d473fb257", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705153264, "uuid": "ec9ad371-61a5-4040-aafe-f501c0777e4f", "comment": "Malware payload", "value": "8b4512ee533e7cb6db317a4f6a85a8bbc78c66e6a337f68ce11925bc500e8cd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705153264, "uuid": "e5ddcc3a-df69-446a-97b9-bd91f3ee1dfb", "comment": "Malware payload", "value": "7c851e32c23dfc39aac90b7fd4927ccd9631010a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705153264, "uuid": "a962f80b-5d4c-4549-9263-87e0919dc4ae", "comment": "Malware payload", "value": "cef77f43f33567aed4b22b38b8befe927b1068bca4c28286b5dafe5f6b4edf208067ca3a17ac54ce1d541be83ccbc5ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705153264, "uuid": "f9381159-0837-49d3-af93-423aa0a58c0d", "value": "T152846C9BE3A800B8D5AFC196CD56D65BFBB278092174935B52E0CF922F33B32911E305", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705153264, "uuid": "b0ebb842-8784-4bd1-9563-38268a353bcf", "value": "6144:9k4PdslmxMw16L7Unn2E3uxapu57tc9BCXWmwx6JndckQNm1XeJWwjNXpOMhOF:9bds4xj16GJuCuwZNxAdccmWwjNXwM8F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705153264, "uuid": "150377a0-69c6-4bf8-accc-ff267ed8e8e1", "value": 388064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705153264, "uuid": "eeebd459-fec5-4276-b596-ac7802a3fc53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705153264, "uuid": "138d0b81-b5a8-43ce-b2bd-09ccee00da37", "value": "SecuriteInfo.com.PUA.Tool.Mimikatz.336.21868.24369", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85939eee-b207-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705145587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145587, "uuid": "a5950247-0d4f-4075-b8d8-8f2edc898fd2", "comment": "Malware payload", "value": "05ffd2dab6f63e237170bdcddf541127", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145587, "uuid": "711baf00-d5d1-4e12-8954-acb9788faa80", "comment": "Malware payload", "value": "8d628dc2566e402480ac7abdcf03d380abdbe3629be7ddbfc3aa71c0d2130038", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145587, "uuid": "2163bc28-f3a8-4f07-83f0-00bb87f9d894", "comment": "Malware payload", "value": "904a6194cfa8fbaaed3e0e33b4c86a5ab98509d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145587, "uuid": "81647403-10ea-43a5-a3a2-a585f9e8d09c", "comment": "Malware payload", "value": "a43b6cc821e43b65e612f017652c2aa765d1e07c2c90cd6efd3fd63b7107b4e7a9054bde89a9707534681bebce4a7576", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145587, "uuid": "11571091-7b0d-4da1-b3ac-b18d3194e176", "value": "T180F48E12B5C280FAC71514310D7A3F75AA3AFA460B14CFC397A4DEAC5D729819E3B279", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145587, "uuid": "ed019e39-c099-4c5e-9b44-fa60c5516464", "value": "7f56953bc994bad607fdfbee35ce6a06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145587, "uuid": "73a55a4f-48b4-4abd-bd01-7ab5865d7040", "value": "12288:f8L3a3IXRyOINsXVxhJIWz2rwebU7TUvmFYsYfL65He:f8uYgGVrJBz2UUUuBfL65+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705145587, "uuid": "5346ae7c-b7f7-482b-96a6-d7490d2e8172", "value": 778240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705145587, "uuid": "b25ac1ee-e324-46ba-a776-ffcf942e4845", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145587, "uuid": "53ffa70a-61c2-4380-910d-3893e670a93a", "value": "SecuriteInfo.com.Win32.Evo-gen.25243.12011", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19768da7-b1eb-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Fabookie)", "timestamp": 1705133379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705133379, "uuid": "15fa9432-e819-4288-8264-3e95f91c360f", "comment": "Malware payload (Fabookie)", "value": "ef895c5307108231ad39d601a38a098f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705133379, "uuid": "6c46a15d-a3fd-4599-b4f1-19d5c590778b", "comment": "Malware payload (Fabookie)", "value": "8f0f0b3f99aa73ac9ec10753ebdd4043805e470768b8697659801b5c4d516685", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705133379, "uuid": "56c71d3a-fee5-44ca-9181-c8f9526b428f", "comment": "Malware payload (Fabookie)", "value": "97d42174b1334c2af041fd2a45032b24e29b5057", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705133379, "uuid": "ac32ef2f-dfd4-4d29-81fb-623eb117a091", "comment": "Malware payload (Fabookie)", "value": "a67b303c4e1b32437a86aa79e8decb06d1440b779687448383bd9ac3901dbf55fc1a2bb6ccedb1e108a035edc7bcd961", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705133379, "uuid": "74fe2ea7-a5da-4a7f-b49d-f128e8e6e927", "value": "T14484492DBBA84476D163C57FD9B2E665D77238916F208BCB0212863F0D376D89938732", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705133379, "uuid": "80624618-01d3-4e88-be20-63bc8412d6b7", "value": "99782e0cdc1c7b57cdc2cde5daff70c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705133379, "uuid": "ca1724bb-b6ed-4538-8165-409967116943", "value": "6144:uNOy9YUepRcisGiKzD8bFaggXWe0LZEOHHrpm1HUZLxRZEOHHrpm1HUZLx:uE+YUeprv01tLpm10TtLpm10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705133379, "uuid": "560d1ce2-030b-4d25-b5c5-18b4284cdc45", "value": 377856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705133379, "uuid": "47ec501b-b7a1-487e-a742-b29f0038cd17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705133379, "uuid": "6d6e2f0f-aad3-4a09-93d1-3f427435c89b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c31c852-b1b1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1705108580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705108580, "uuid": "a429eb39-0872-4353-a6d6-be8ea2cc00fb", "comment": "Malware payload (RiseProStealer)", "value": "1abfdde35393e3bed6dc4c88ddaec0c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705108580, "uuid": "85c45881-b56a-4350-bebb-67f7163b482a", "comment": "Malware payload (RiseProStealer)", "value": "8f1d09e38fb2d52fff1e84baf161fef2b5e4af4a7d3ab0b198e436bd2da0a364", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705108580, "uuid": "ca8f622f-d312-4a24-bd3f-69ff02f21787", "comment": "Malware payload (RiseProStealer)", "value": "2df6f703ec4ae3c1d98344f9482ad9bf82f030ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705108580, "uuid": "f1fb4dab-9440-4aea-80cc-149490b4a262", "comment": "Malware payload (RiseProStealer)", "value": "564d6db03001f06c7bf433f0710a893403934b1663206a8136829cde13c0abe59678bd55ad18045995d5a8527bc661e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705108580, "uuid": "0fea89d9-2a07-41b4-936a-965d4188d77c", "value": "T123659E627292D079D1C113F1257D6FE1C2EC6E719BA284CBB3C01E3AA5B11D2B539E1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705108580, "uuid": "27c05238-1b56-4053-9696-a8a1b4316688", "value": "96fa9927288c4f8325d3528d85326fb2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705108580, "uuid": "bb97ed13-a2fd-42b7-aeef-585591277c47", "value": "24576:nUalkVcJGB7FyCTEaYtT9SfVK5Y3IexDzSf3Z8MQQvTICTNiUPUXl7TP8o1Cl8:nyWJG7yUVYtT8RSPKqvTVT7s9TP8o1Cm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705108580, "uuid": "d6b5575e-2847-4b97-846a-e7667c5e5527", "value": 1509376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705108580, "uuid": "48b1adff-7d02-473b-a95c-76bd66da8656", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705108580, "uuid": "a7d6b135-a9f4-4261-9fa3-be9403abc3f9", "value": "SecuriteInfo.com.Trojan.Siggen23.22903.19669.24875", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b34147cf-b1aa-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705105720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705105720, "uuid": "56bf01be-e11a-4533-a0ee-5c7188e9bdff", "comment": "Malware payload", "value": "824e2256028beb442d7f878d5fe55902", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705105720, "uuid": "7518e47b-71d9-499e-8560-f41eaaed655a", "comment": "Malware payload", "value": "90200892e5d583be82ac618bc4910245f6a273fb4702f174fdc01d38a806c442", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705105720, "uuid": "3ecd1429-eb04-44c1-bff7-8d88ad38e93f", "comment": "Malware payload", "value": "977ffc1b63a2b61736b8cf6cafd0476de1eb34b9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705105720, "uuid": "870f9447-1250-4afe-9e8f-3f0597621a86", "comment": "Malware payload", "value": "839bf0f0258d6385596fed9da10c5dd8c5f9e216eedf0cd35498228341050525bbb6f729d7f59529891c15aa4b0efda4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705105720, "uuid": "37f3c920-0388-45ad-bb5e-8c3f5f58ebaf", "value": "T19D74DF395A08DCF4771D32BEC424130EDA2CEA5B6761068DF92A58DAF7D6B1003299F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705105720, "uuid": "422f834c-27ce-44dc-9ffb-bbeb4eaf1b3b", "value": "6144:xSdONx90reOZ2XpyXepRrqimLXvKZ2MO7sXNNXubPUhQCUmT7j:xGONxersbGim7vJ76ybsH5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705105720, "uuid": "2188ab36-ecae-4cd8-b7ca-fe78b2f768b5", "value": 362620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705105720, "uuid": "d367a96c-0ac0-4b8b-822c-c0c75dabe7ec", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705105720, "uuid": "db025fe7-cba6-4c2e-9781-ea26b50d57fc", "value": "Viru.aaf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0a33060-b1c2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (MimiKatz)", "timestamp": 1705116024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705116024, "uuid": "3096b0ea-293d-4d71-b1b2-597735073385", "comment": "Malware payload (MimiKatz)", "value": "bb8bdb3e8c92e97e2f63626bc3b254c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705116024, "uuid": "09c98f06-e8b3-47f8-afbd-c8d2985d2c4a", "comment": "Malware payload (MimiKatz)", "value": "912018ab3c6b16b39ee84f17745ff0c80a33cee241013ec35d0281e40c0658d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705116024, "uuid": "8641fa6b-314f-438e-aed0-46402a287654", "comment": "Malware payload (MimiKatz)", "value": "70df765f554ed7392200422c18776b8992c09231", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705116024, "uuid": "c59da0ab-bef6-4f02-9424-d875efcba96f", "comment": "Malware payload (MimiKatz)", "value": "1f80f82a9859878e26a9f8be6b91ccbe7dda5fd7420c97e605bbbb0a1024caece2682bf6a5c034d77406d9ba552e627b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705116024, "uuid": "d3b4ff12-fc10-4ab0-b087-c602c79c10e2", "value": "T1FF551941A7E90098F2B79AB59EF19516DBB378D61834C30F02A8875B1F73F619D29332", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705116024, "uuid": "a6ad13ca-570f-49f9-b9be-8a6035562c0b", "value": "9528a0e91e28fbb88ad433feabca2456", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705116024, "uuid": "10ba66ce-765c-47e7-a333-557da7416ff4", "value": "24576:APOLHP7+a2HVvM0UyYG7SbQbcaXjn4Gy5+aYoNEVJEjA3e:APO/4UgOLaz4FQdoNEVmMe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705116024, "uuid": "c3ca8bb9-4873-4dd0-8630-ac5c6015b051", "value": 1355680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705116024, "uuid": "2e850675-421d-4840-94d7-2b16796af1b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705116024, "uuid": "23bf9adf-668a-4d89-b9b9-feb33e46f0fe", "value": "mimikatz2.2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "410d6622-b231-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705163510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705163510, "uuid": "64a1b0c3-1370-46d7-8142-44c5fd188cff", "comment": "Malware payload", "value": "f3065e50d3584c5832fa5a4be4649c2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705163510, "uuid": "3761b1b3-1753-4ad6-aec5-18ff4f062b61", "comment": "Malware payload", "value": "937b39f6a2f09dc6570c810839cd12b113a35ed411cf3fc13cad44c03781935d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705163510, "uuid": "ba792d9e-5c09-42b6-a187-7ebedc88e699", "comment": "Malware payload", "value": "9ec36dfa534dbc1edab23830fc5079ad0ab30cd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705163510, "uuid": "a755aa8b-2896-4bbd-af0a-6ffa09d1759f", "comment": "Malware payload", "value": "14b8fbe5ee62d9c48f2e2f45a8f2a509e5a9fce1abf62ea71f618e54d6471aba536f5408628690807aa9bf14ccccc31d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705163510, "uuid": "263c8a8c-2057-4291-95a8-cbd9fb5a63d9", "value": "T18F046C37F1C15933D2361A78DD5E92A9A41ABB922E28394E6BFD1D1C8F6C3C275181C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705163510, "uuid": "2612371e-9cd3-487b-a140-08eeb6dc0bb4", "value": "3072:Fv2zTLZlCBSqiKujiJGeQMVww8b2mcwcsncgtGFV3hIrmoQhTfhTBqINrxDY3q++:FviLZMSAuuJGRQYG5lIoxDYq+oaU6tva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705163510, "uuid": "d2aca802-c92b-4445-b076-c21736e13c90", "value": 186792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705163510, "uuid": "a7e0f0bb-37dd-4074-8fd6-6892904eef08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705163510, "uuid": "ff487697-0447-4d32-b9f2-b40cdbd5b306", "value": "SecuriteInfo.com.Virus.Win32.Delf.2902.27412", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99d006d7-b1d3-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705123287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705123287, "uuid": "61f2c8d9-6202-459a-9819-61412db803ae", "comment": "Malware payload", "value": "2974d9875f62c13ba1608e7e541de1d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705123287, "uuid": "ad4fb653-f00b-4796-a6dc-41cc61b1525a", "comment": "Malware payload", "value": "945991bb6aa9d99077c33033476826f5cd2ba2ad9b618dbe6b788f065aadcb22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705123287, "uuid": "192ae870-755c-43be-92eb-b8dd894c18a7", "comment": "Malware payload", "value": "2cf2e9edddfb8371ae74362586678e223a5e1d59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705123287, "uuid": "09535329-bd77-42ae-8357-71334a47f6e9", "comment": "Malware payload", "value": "a23d40a917c08c30fe9fa756cfb35c6505b07ec6003483ea3da3830cfb5b41289b74181c6c6955ef6de7b023e48d30b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705123287, "uuid": "b05de71d-110b-49f3-919a-f71c80745172", "value": "T1E2562A43F86691E8C4AED1748636D262BA707C894B3063E36B50F7752F76BD0AE79310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705123287, "uuid": "76876a06-4b98-4222-bcb8-ebca849ffae9", "value": "f8e2c713d81010b110101bb31c01aa56", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705123287, "uuid": "f62d9891-9590-435d-b414-8cb5ac97e036", "value": "49152:hDVc/xBO9YKtgZHN9hr33sKE4gbv9DULRIJKXpH4N9sQv6rxY2GnvHubh1oIWlnz:/KOJosY+koJUT+ewWwAEF8boOcAi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705123287, "uuid": "56814f06-fc3f-469c-82cc-706aab99d513", "value": 6096896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705123287, "uuid": "4fa80306-c085-480c-8a46-08896e37c613", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705123287, "uuid": "558e8d3c-be40-4b7f-b596-449bdd5c44fa", "value": "yhgo_r.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b1185a8-b23d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705168815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705168815, "uuid": "3212d360-c076-4d66-a43b-443f00287a4a", "comment": "Malware payload (Mirai)", "value": "e5d877ae770422186c9ef7b3576db90e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705168815, "uuid": "df260902-e2f1-45bb-960e-4a8565adceff", "comment": "Malware payload (Mirai)", "value": "951562949ed8a594ff97e181ba5bdae14b0c6fd58d0fa1ea817bb0b01302246d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705168815, "uuid": "e7504769-240b-4dc2-8f1a-2496a5e243b6", "comment": "Malware payload (Mirai)", "value": "887838e67ebe66e95b24799bd92f3216d20c8318", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705168815, "uuid": "149fe124-d3f6-4444-ae41-a596938de16c", "comment": "Malware payload (Mirai)", "value": "4bd22a4f9a74440c60a250a07ff9a28476d9cc33d44ac62a1e360a4022a2d55b9a6d373ec6bfbe13401e590987739021", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705168815, "uuid": "83769252-409b-43c1-8e9a-481413c9ca90", "value": "T1CC14971E6E228F7DF3A8873047B78E25976923D627E1E644D1ACC1105F6438E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705168815, "uuid": "4245649f-e9c5-4894-9e30-d8709ecc38a7", "value": "3072:vcGY9Rk0EetiL8KaAtahZ/f8C5kTF20WDnNcSGMAo:vxY9JiLpk9b5kI0qnuSJN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705168815, "uuid": "dddd1c5e-0634-4727-a19d-21621770b3ce", "value": 194348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705168815, "uuid": "99eae521-f570-447a-bdab-6c955f7c0246", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705168815, "uuid": "b099011b-ff19-4a8a-9bdd-c99b1a6d22fa", "value": "skyljne.mips-20240113-1800", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb6f8943-b1d9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705126027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705126027, "uuid": "3e727a74-6504-4753-b8e7-f9b5cf3d1cfe", "comment": "Malware payload (AgentTesla)", "value": "911ec33cc8ec499e245983a2725eda57", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705126027, "uuid": "6c80dc34-7b6f-4ae1-9c95-340bdf135dc8", "comment": "Malware payload (AgentTesla)", "value": "99defdc6a4ac4d51fac62cf57fdf67c85a75446847bd8ace11fb39ac49cc9d7a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705126027, "uuid": "c5dc6d89-578c-4a5d-b9bf-25254622b96d", "comment": "Malware payload (AgentTesla)", "value": "0bfb9fc8bfdc3849f9c8147ebde1c2b223a82e30", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705126027, "uuid": "bac59e55-8da7-449c-95db-c757a47b78af", "comment": "Malware payload (AgentTesla)", "value": "f16213c3375cf529a41db3d5673a9effa54f3cf7178a3d976249a2a15c01ae77601adb171ff70603328c4014938180b6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705126027, "uuid": "e279ffdc-b16a-4eca-aee3-ec79dc1651dd", "value": "T1EB34FE027E48EB15E5A83E3792EF6C2413B2B0C71773C60B6F49AE5624517826C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705126027, "uuid": "090c4813-b0e8-47ec-9e92-b0531916d9e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705126027, "uuid": "2f224ef1-2e73-40f9-92f7-65153c59da49", "value": "3072:5lIjLv3nff97rT4GALFBBTPAPbQT4tas5ti3ZJe8z:nIjLv3nffBrT4GALFBBDCsTGan3Zw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705126027, "uuid": "36f1d8b9-8d5b-42bd-80e6-d794419c0a5f", "value": 247808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705126027, "uuid": "9e0b3182-52d7-4d1f-9f70-36246d4d8058", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705126027, "uuid": "37261cd1-a85c-45c7-92a1-b5047528834f", "value": "17051260264f8c58ce466c1da9d6926a0e5450e61e49d36b06e92d8a23683369d6a8fb758a633.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a3b9a92-b1c1-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705115315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705115315, "uuid": "fcf17a4a-f82f-4099-b061-729be9f8a6fb", "comment": "Malware payload", "value": "9c7853edf32b544b18dad1591f07bc23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705115315, "uuid": "00ace5cb-1d90-4339-8067-43f34bc7684d", "comment": "Malware payload", "value": "99f62d086a0aac2033b81fdca0ff2dc421314961d690e866845c75d7392026df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705115315, "uuid": "1cac1fd1-5a6e-456f-a7a3-6b4dd041548b", "comment": "Malware payload", "value": "81fcd7084225457c802bece117795a4c9d972017", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705115315, "uuid": "01cc0789-dc53-4589-85f5-68135836a824", "comment": "Malware payload", "value": "dbafd8127b951547b0610e16f82ca52cdc49faa45d55b88a11ca6bdeb0661600bc122ef89112ca57067e5965f5dfb66c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705115315, "uuid": "3d592fd9-8dbc-4737-82ab-49d0c730a13d", "value": "T1C116335037E78703D6EE863207A22EF0408915A2B75A3157D7D58EC9F8EC0EFB459AE1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705115315, "uuid": "5ee68b73-72d5-4805-bc84-eeca9c5ac000", "value": "d5e0355f8764c235b38759b860077ceb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705115315, "uuid": "9e5047d7-bd4f-4f1e-ac9c-5c9de89ec132", "value": "98304:IA2/55jaVorB7+BmeQFqNkRlNaXKASiBJLinHvNJ9o5dcgv7eFt:p2R5jqGl+XQFPA0iBUnHvNJ982gvCFt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705115315, "uuid": "ecbb3d9e-7170-4e01-8d33-0ff4c62eae72", "value": 4068905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705115315, "uuid": "62a69e50-471e-4b5a-a07d-64d1e475170d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705115315, "uuid": "8d75ce00-fb84-410b-bfa5-1d95e8be25ff", "value": "buding.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9adce10d-b1d5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705124147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705124147, "uuid": "59b48ab5-09cd-4603-9bcf-8f9b5978e903", "comment": "Malware payload (AgentTesla)", "value": "90400da38b4cb0b0350abdb9520b3325", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705124147, "uuid": "4da15bb6-e8fd-48b7-9776-7cd29b7c5a99", "comment": "Malware payload (AgentTesla)", "value": "9b72ee0eb019542eedf847b365c21ebb819a8c27dfad2a9404feb9edbd590ac7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705124147, "uuid": "b546d87d-6d58-4333-b6c6-9128bb5504a2", "comment": "Malware payload (AgentTesla)", "value": "605a6e1e04bff496d227622d0579f50dead1d1c0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705124147, "uuid": "2f90b8c3-f539-4608-80cc-4929760a7036", "comment": "Malware payload (AgentTesla)", "value": "eb225d0f9124441f1dfea83c6e4d2afc1852ccb151a85da0bf8ba0fd5a1f2febb8c2b6c09561611a647dd3aaf8343f29", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705124147, "uuid": "666bf4f8-2829-4c81-8558-66ef3a59898f", "value": "T1B4A4120076AEC67FC50793354D9840C6064EFC62DF89A92F38BEB349143CBA5D535B8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705124147, "uuid": "69d56a13-821b-4be2-bdb0-ba2372c92696", "value": "12288:tSLoBC6uEHsu8JAK4g0dhl/FFAOCvI19r08d:Vw6/yAKW3lnC8R08d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705124147, "uuid": "a1515688-5c7a-4b15-bd30-1c66427ca829", "value": 461824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705124147, "uuid": "0220c255-cecd-430b-94e1-e6762ab0509e", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705124147, "uuid": "874de36c-cd08-4975-8588-425e3b439cfd", "value": "New Order.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69e66305-b1d8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1705125354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125354, "uuid": "a2e56510-abb6-49a4-a8f8-b4ebd94e98e4", "comment": "Malware payload (Smoke Loader)", "value": "8c3d529fd4b29823530c3094fdbfcb7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125354, "uuid": "9a643672-aec4-4c63-bcea-ca160bbd7478", "comment": "Malware payload (Smoke Loader)", "value": "9baf3e3ad03c49f08cf1b798d333c586efb74a0fcd64cf38de7f32bbe8951a1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125354, "uuid": "936de096-e23a-4f76-8cf8-a3eacb04263a", "comment": "Malware payload (Smoke Loader)", "value": "2bf10f2ce99c030518b921435dd357b97f95a81c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125354, "uuid": "2e32ac0e-852a-41be-9067-0ad6cbbba8ac", "comment": "Malware payload (Smoke Loader)", "value": "8f3f1de7412262f71b74df88ad93a04a3b82bc1f685898252f499d142446b8a446e8ab74b55d4e39e2c2b674c83d7e76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125354, "uuid": "8eb9a3ce-cb14-46a8-94be-5dce97d5df2b", "value": "T1E3347B1135F1C472E2B35B3148B5C3B41A7BB8A66BF1898F7AC41A791F267D18E2431B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125354, "uuid": "c6eb1625-7d41-4071-a029-bd444dd8e80a", "value": "d77b02f65b7bb86e8f742226786b42db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125354, "uuid": "5646c6a2-d933-4be8-b728-16b9793e4406", "value": "3072:no+TZcw8fGJiR21K9NpOCIZQSeFnrTz2sgyBZLQDLp+QakRoxLWzgwT:noH/8Z+Ffz2SWI3xLB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705125354, "uuid": "dfb36e9e-cdf6-4370-b8fd-cd411d869310", "value": 240128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705125354, "uuid": "3962b9c1-ce33-4a67-b9ff-b751b09d1927", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125354, "uuid": "eaf22a39-e039-4044-99cc-f7987cbcf98c", "value": "8c3d529fd4b29823530c3094fdbfcb7a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7d90ff7-b1d5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705124196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705124196, "uuid": "0f88a771-09a0-4f26-b38e-424705525a8b", "comment": "Malware payload", "value": "c39a820cc6e40072127682118135a8d0", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705124196, "uuid": "1d410305-a508-4a06-a348-28e296b038e9", "comment": "Malware payload", "value": "9e843fa6d2c75e05261752dd0a135b36078bec301e227685c82bf17ca1cd2c95", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705124196, "uuid": "0f235c30-6930-4f05-b2b0-e01fce2d0763", "comment": "Malware payload", "value": "7f1950e04f1bbe376d7ade720e95c4e733733b51", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705124196, "uuid": "95b4bd5e-03ed-4bca-94fc-97739089a388", "comment": "Malware payload", "value": "85bf37a71fa9f80ece78a2bd6d550b8deeab5badaf33a76a59ce4220cd3afaff3e1b1a08cc83319d0d3facc55fabf12b", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705124196, "uuid": "f9c03632-7ddb-49f8-a6af-e80f2511f9ab", "value": "T182A2EB2136EB600C72737EA16FD57AE58E6FF772253A54AE104403078B63D84CDA1776", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705124196, "uuid": "176c58e5-3fb8-4f49-89c4-615e702276a4", "value": "384:a7x8h8zlt2k8JCT8ngK4KubK+W2KTkWTP6+G5zP6+7XM/P6+FXMtMYMJMv:oD32+K4KMKp2KPTC+UC+Q/C+qyTOv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705124196, "uuid": "424bbe2a-ad30-43fc-9257-0824479b76e5", "value": 23082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705124196, "uuid": "0a5320ea-27ef-430c-839e-cb64bf6afc5c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705124196, "uuid": "db445ea9-4972-4c6b-b57a-87656e7736ba", "value": "Booking.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75c1c531-b1f5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705137829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705137829, "uuid": "16111887-d461-49f5-ae20-8aebda42c5c3", "comment": "Malware payload", "value": "6ea38b4720317490c9f3ce180bee2816", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705137829, "uuid": "1b83416a-c5d2-4119-8eff-0f71d76714ea", "comment": "Malware payload", "value": "a01ac4a56d2801d38e198e8997141903feaddce1ccaf0446dce54cf36f496009", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705137829, "uuid": "839f6687-1dd7-462d-b3c7-4778a155375d", "comment": "Malware payload", "value": "03600bf9e8c82c26c3c248e13142c9c41b17c9e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705137829, "uuid": "1bc2c14e-64ce-46cb-b2b6-3a121c9e3cb0", "comment": "Malware payload", "value": "810698315c38e858ffbacca69043f1ec0f243b19a28aaf47bb745dc3fcdfd7b2265ebdb3b90303c88618009234a66c09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705137829, "uuid": "e01f87cb-dd7c-4c7f-81f3-ccc769c13ddd", "value": "T1D6563376EB0009E1CEFE78F295094C732B9B89D5F022AD58E4E3CE2D9DE45EA2579005", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705137829, "uuid": "5bb884b8-f668-4cc9-84f2-484fc57300b7", "value": "49152:5s4aw9wzebmHvlNq0jc3PmTsVWGlrXdHtWTQAN:5s4aXzeiPlTQ3PmTqlzdsZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705137829, "uuid": "40e8e3e8-fbeb-4f45-b297-0d430825f009", "value": 6055424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705137829, "uuid": "58ff4f9d-dfde-4882-b470-48025ea9a590", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705137829, "uuid": "509aad01-766b-403f-89a1-b925435cd301", "value": "SecuriteInfo.com.Win64.Evo-gen.21741.32682", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a9d08a3-b25c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705182022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705182022, "uuid": "51f26e16-c608-44b8-9c7b-8ee42785f8cf", "comment": "Malware payload", "value": "4f84db42155def7f0be152bdb080bfb0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705182022, "uuid": "95cf8a40-f80e-4409-9760-7cf43e953641", "comment": "Malware payload", "value": "a02007c21b2868080d01935eb980c11dc629f60b9e20acc6868d4e98be9b8c5e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705182022, "uuid": "da8fc5e0-e8b7-4ab9-a4ef-bb739d90a597", "comment": "Malware payload", "value": "a4b7d4e64ca6c3645c076fc476affcf2ad2b56a0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705182022, "uuid": "04165d40-6935-478d-bb79-b9bfb9338aaa", "comment": "Malware payload", "value": "b8b27c39b108bfe85bc40ccfe01ae30d7dfae399956adac182bed740e420515eea7613a82a04ecf50c72b7d22d7de511", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705182022, "uuid": "ba20692d-679c-4b87-aa54-4551a6d30334", "value": "T11463965D2E219FACFFA886344BB35E20924C33E626E1C945E15DEA011E7034E745FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705182022, "uuid": "49da2d98-09db-4b0f-901d-cf781697e995", "value": "1536:58B83DOpSxUypP+vntvnCEvnNY8GYdMyH2q9r0t3bCTeJqmw:qK3DUSqks92er0trCTeJbw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705182022, "uuid": "207b2315-9e6e-4db5-8e57-e61498aa60e2", "value": 67564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705182022, "uuid": "daf72dc4-3bcb-4d43-a375-a02028297980", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705182022, "uuid": "3974a56b-3c01-453e-8fef-e40dace259d7", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "566df05d-b1c5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1705117161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705117161, "uuid": "d2adb5e5-430f-42fc-844c-9a29d7e13be5", "comment": "Malware payload (AsyncRAT)", "value": "57c5c775158e4d94c2b0fbe21b5c628a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705117161, "uuid": "f542d055-a9fe-4165-befc-830bbfbed92b", "comment": "Malware payload (AsyncRAT)", "value": "a254213a0f1a40654fe98ad9d94a23bdc624ea6c10d92c676de3912b2a551df4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705117161, "uuid": "62877612-66ef-4273-b835-af6de5d49d05", "comment": "Malware payload (AsyncRAT)", "value": "7ad00d2ef8f0cbe56f5b80bc9a012f4524958d1a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705117161, "uuid": "63a54285-ce58-468d-b631-bd0e08a19e13", "comment": "Malware payload (AsyncRAT)", "value": "f4fcccd487c7ef8bcda70460bb9816311bfc5fc70e7f4ff1ce58523e75289ba8b2c6a3cb0bede9b948bf3c387d6506a2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705117161, "uuid": "e34ef180-fb81-4488-a236-1906358b152f", "value": "T1DB538C8877E60A20E2BF1BB91DB1B155C674F6A35C23E71F18D810DA0B17688CE517FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705117161, "uuid": "b0053657-cf4b-4db0-ab89-d535a5ee3321", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705117161, "uuid": "3e8e6eb3-ff66-4d09-9425-647f39cdaaad", "value": "1536:+fCK96zSVEkxkbZxhWZu5O66Z1fO1bx8XJXF:+f36zSVEUkbZxUkO9tOv8XJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705117161, "uuid": "4cd523e4-9d8b-42b0-b072-b7e185e0389c", "value": 63488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705117161, "uuid": "81c102d7-836a-4ac3-b24e-5fd6455600c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705117161, "uuid": "5756843b-6e71-40b2-9567-264b1f86fd3c", "value": "57c5c775158e4d94c2b0fbe21b5c628a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49175efd-b20d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705148062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705148062, "uuid": "fc7dd9bf-e1d0-499d-b99c-7e3e96236053", "comment": "Malware payload", "value": "4c80acfd25aa4e1a4cb2506d14b130b9", "object_relation": "md5", "Tag": [ { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "cheatlab.app", "colour": "#3BED08", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705148062, "uuid": "3b4496b6-5b44-47ba-a71d-0a31d368c065", "comment": "Malware payload", "value": "a2afe28c0feb23b1b68f2f6dd99e34f75a76fc0a577ab9552a02e9162da64aec", "object_relation": "sha256", "Tag": [ { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "cheatlab.app", "colour": "#3BED08", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705148062, "uuid": "24fe56e7-c946-4ec0-92ff-157b5c4e115e", "comment": "Malware payload", "value": "7ecaaa6d405ffc9cbbe2f67248353cb1c6f8ccd1", "object_relation": "sha1", "Tag": [ { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "cheatlab.app", "colour": "#3BED08", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705148062, "uuid": "a618f0d9-44ab-47b1-8f54-6cab40d84850", "comment": "Malware payload", "value": "fdfa0cd197b5f4ab14250110a023b86be27884e8c49f40432ec668e257af8db91e2546b28650eb06c911214053d2b987", "object_relation": "sha3-384", "Tag": [ { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "cheatlab.app", "colour": "#3BED08", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705148062, "uuid": "c8223b59-3561-4b99-8fad-1b64d119406c", "value": "T1CC1833A5B5B2C3459D249183B9C0020EAB27E7D6770D91A1A7E798310F49D31FB4FF2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705148062, "uuid": "a22abeea-87b0-4905-9c0a-b2808aa43e62", "value": "1572864:aYcwNbwLu75Psxsd4MIUDKNrw3VrjKZ/nStPULBY65Xe8T:aVwBsxsd4tKKN4VfWiPuBL5O8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705148062, "uuid": "8e927d60-37ca-4870-a27b-c1463d247a7c", "value": 89768835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705148062, "uuid": "53a10f07-f989-4ce8-b26e-611f52af3032", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705148062, "uuid": "ee8816f2-87d3-49c5-9000-d6d018500aba", "value": "CheatLab.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45fbea46-b1d5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CobaltStrike)", "timestamp": 1705124005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705124005, "uuid": "5e169f75-f023-48e5-b667-8c700f184143", "comment": "Malware payload (CobaltStrike)", "value": "37ef17ae6a134a55482b0d84126d2ab8", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705124005, "uuid": "17c9fda0-21a3-4e4f-914a-c9ae8eafd68a", "comment": "Malware payload (CobaltStrike)", "value": "a38d5972dfa2fda1c5416ac91034c36462586575097d8b46775b2e689e5d9496", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705124005, "uuid": "d703c56e-edea-41d8-9048-64f6766bfa6c", "comment": "Malware payload (CobaltStrike)", "value": "65efe279e12ea28430bf7f98d7ede8caba0417e5", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705124005, "uuid": "1f1109ba-0797-45e4-8ffb-6cc59a8bc20d", "comment": "Malware payload (CobaltStrike)", "value": "2b3c21ad1daef394b676dc033782f0c0630c919954216656999ef21f2a2862cca09e130696cf507413b549afefeb0d37", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705124005, "uuid": "52940cd0-3a40-4baa-8b2d-48291fd15972", "value": "T11892EA3FE70368E9C506D57845FB7732DCB23CB385A6971E2724D2B42E106A46E7AA10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705124005, "uuid": "57e4fa9c-be52-4d9f-984a-75220a8048bb", "value": "147442e63270e287ed57d33257638324", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705124005, "uuid": "f2901747-d285-4888-8843-002c561ebad9", "value": "192:ZV7qaCF6Op1t2dobVXujRDcBaXWQjwOT/2B5vv7JOWF8qa1Dojjgi:7qaCF31cix+Dc4zjEJJvFF46gi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705124005, "uuid": "47e5cb4f-39cd-4537-aafd-d7ec6cb31b28", "value": 19456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705124005, "uuid": "014314b2-f8ab-48ca-9ca8-c93fa23d093a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705124005, "uuid": "a3504cb5-5c0c-4c0f-9769-631ce7fb1c8c", "value": "axx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4feb999a-b1b0-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705108130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705108130, "uuid": "37738eae-82a2-4909-890b-b3d80cfb414e", "comment": "Malware payload", "value": "11a2c5a1096a4b63edcd96e578b1138d", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705108130, "uuid": "962f42c6-ef16-4aea-9d18-f6e86a47ff85", "comment": "Malware payload", "value": "a496456dafc856b87bdc454753aa7e02e10b62801dc4cea5f4eb1c037d00f56d", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705108130, "uuid": "26129318-3db0-4766-b579-b07b7bc3ae39", "comment": "Malware payload", "value": "a9fe82e3d315a88304ebef5e501de911ef8b4d64", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705108130, "uuid": "b19e850c-00b7-4edf-9013-a20bd0a086f9", "comment": "Malware payload", "value": "97c6003d012ac38bf63126cc0413c5ea0790043fd10fa43da068c26d39d5ad665a5a83fac70b65c3148ecdb0e6c81a72", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705108130, "uuid": "5461e7b5-a013-491f-b942-232216ef7873", "value": "T13FF1C67A9D3BFDDC177EB982C40839120C5D1F479B78566DFE8809A11ED6140CF2A5B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705108130, "uuid": "0511325c-87bf-45ae-8696-bc2f1aebf3dd", "value": "96:FdvbfVjvxwVuECW9wYCpmBMHogquBjYmyIt83OSXpF7dkaIoAtRFlenvPH:FdvbfVmujW9U1HoMBxyPbNdwoKFenXH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705108130, "uuid": "3bd02b46-6eb4-4f81-beed-731f9a2f4f88", "value": 7776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705108130, "uuid": "65f9c96f-3bd4-414c-b87a-20929ab0b9c0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705108130, "uuid": "8c67425b-e09c-4158-8608-fe12ea696cdb", "value": "amsi.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "795ee8fd-b1d9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1705125809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125809, "uuid": "110e0395-abfb-469c-8d42-30670461804d", "comment": "Malware payload (GuLoader)", "value": "97e8176d875adf30d317d4f7d123dd7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125809, "uuid": "0df8aae4-c75b-4539-b48e-aa7522368c01", "comment": "Malware payload (GuLoader)", "value": "a52a70c7f00e5e0aaad1be187d6c5d4883c7e02e0db8ef1b167b372cabee6d98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125809, "uuid": "43702130-9df2-4c53-ad88-15bbf352aefc", "comment": "Malware payload (GuLoader)", "value": "35be6c85f86f8f3f44913fd744549a2f93aa3cbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125809, "uuid": "dac09138-b66e-40b2-8f4f-5b9f649cb496", "comment": "Malware payload (GuLoader)", "value": "baa3f79f895e90a1887a465fd00ca4304035c9ee09328ae4e41c88a59c3250abe5de5c8b73b53d4e912f3b4f4bf54e9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125809, "uuid": "d3be2265-ab51-4ad4-abc7-d2ac5e683dca", "value": "T117436C0BB6455A32C1436BFD4CF3838C9A13EC7B9B4A850B7554B32F5CF4050AA67AAC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125809, "uuid": "b259d989-b32a-4dc6-a0a6-ef7a758c96dd", "value": "9fc149c27ccf41e0782d03d194740841", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125809, "uuid": "96716288-029f-4cc1-9e69-0b9e543ddfe6", "value": "1536:JR7uQzHtttttttttttttttttttttttttttttttttt9LvDLj27GsmqgywDat:3hh27GsmqNwD0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705125809, "uuid": "9b032fc8-2c8a-4fad-8c07-c24cf5c3fd18", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705125809, "uuid": "6632c414-e1f8-419c-8320-75a4f631ed14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125809, "uuid": "07981473-1966-4597-bd57-c8734687e26d", "value": "2k.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bac811f-b25c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705182023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705182023, "uuid": "5f84e8b8-8dce-4772-a9cb-d2ff548c0fd0", "comment": "Malware payload", "value": "7c9850143f2d55df577c8fdc842a38c7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705182023, "uuid": "f053ee6a-0c4c-4400-aa07-6dd8c814a6d2", "comment": "Malware payload", "value": "a5ecbdb727c9486f8c2d72d7457f7f8e64dbdbb915286de9133447745ade897a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705182023, "uuid": "ab8673e2-c857-4206-98d8-30978ce22d91", "comment": "Malware payload", "value": "a4e9472044141ff71c8817a63106adbbd7465d0e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705182023, "uuid": "af7ff36a-d9ab-40bf-bac0-903c439117c6", "comment": "Malware payload", "value": "35a635cf2365428818679e34c7fed27505a54f75b5e8c7a8da1cf673df09ac983e6cfb5644b4c2beaaec6539f6a64360", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705182023, "uuid": "052345f5-e756-46ad-832b-845f74260068", "value": "T176332981BC919A12C9C423B7FA2E01CD372563A9E2DF7207DE216F1177CA82F0E67556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705182023, "uuid": "0ef4839f-c893-42f2-8a8b-edb329bd4916", "value": "768:aw8hF5yjQQsLC3TfWvHbXKspnpeyKNSwrfqUoOPbmBNOS9iVjySfR2MO:GhF5yjQ7LC3TWvHbXBGlSkfqp91", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705182023, "uuid": "6015bb0b-1dac-4ea9-9ce5-6dd19b1aa458", "value": 54268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705182023, "uuid": "8bc8f156-9115-4730-9e59-176edec83f62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705182023, "uuid": "b162b52d-a126-47cc-82e5-81390b6cd97e", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f7a003a-b25c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705182030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705182030, "uuid": "7793f127-c062-4b02-95b5-341b1ff0368e", "comment": "Malware payload", "value": "c77606a9a534a32f7212916aa995595f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705182030, "uuid": "4213181d-89cc-4585-835d-135cc5670e78", "comment": "Malware payload", "value": "a7ecb4cf713ba89d2c8f47b7dc9cf2a1c1983509d358e4c91f899227fb023610", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705182030, "uuid": "e72a0ecd-3ef2-43c3-88b8-e11f95adcde0", "comment": "Malware payload", "value": "400a724cec10048f639416f72e111bb526504d39", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705182030, "uuid": "d2dd9d4e-93d1-4b58-a714-0ef5852a29ef", "comment": "Malware payload", "value": "bc32792b51bcf89c66be99e007dcfdc1b03da41fd8d2e0712b73cf74d243defb00a92a9a1da9e465a7b9b947da3eb677", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705182030, "uuid": "a7673f3b-dc86-4e43-a6ea-e2eef0f67de3", "value": "T1B83308C4FA8B89F5D90749304067F13FCF31D5B941B1C6ADEF9A9F35CA67542920228A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705182030, "uuid": "9b5dc545-e694-4d61-8ddb-9da68e5290b9", "value": "1536:nfyMY0q0Yv5qP69kj0MGNLajP3aL7YkOgxtP:fyMY6Yv5qP6moNLaL3afYBgx5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705182030, "uuid": "51a6abe2-9153-4915-90fe-d3eda9b37d1b", "value": 54032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705182030, "uuid": "a636ad5c-16f3-4204-a097-d8cf32cde0e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705182030, "uuid": "9c10849d-979c-4fcc-a53a-0ec289751acb", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "606465f6-b25c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705182031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705182031, "uuid": "c0d6081d-adee-4324-ac5f-ad54d57624c3", "comment": "Malware payload", "value": "83dde6c0702eaf0dd816a6389d96e06c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705182031, "uuid": "56235816-2048-4514-9815-20f234d99840", "comment": "Malware payload", "value": "a96a1c3b06f98afcde2b77e81c1d966f44f48fe04caea07ba03ff4c6177c8bfc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705182031, "uuid": "07247101-ba6d-4a98-b22e-36a245d8a58d", "comment": "Malware payload", "value": "3339d40d84b40c39352327cc4fe4d49f4e902adf", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705182031, "uuid": "c16af904-56cc-4817-903b-43be18c0de48", "comment": "Malware payload", "value": "9c06bdfccd8806c3f75101ec2b9ec143fd0b636226ac6c06cda6cbeff5c03225095b6e38c4a0d8eb807b443126f399e2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705182031, "uuid": "d5d29bdb-b906-4bb3-92a2-10f58d6a3e0e", "value": "T1CFC33C46EB408A13C4D51776BADF424A3323E755E3DB330689189FB43F86BAE0E67506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705182031, "uuid": "757fe9c8-a9be-4104-8445-c3b2c8d84344", "value": "3072:ISqPEL0JTzSKabuFcpQkzZVt6h+2mUxVOWz:ISFL8T+zbuFcpQ0VM+2mUxVVz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705182031, "uuid": "58419976-896a-4fbf-b63c-fad296036443", "value": 125754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705182031, "uuid": "1283878d-7f8f-4ac2-8597-4b5349aca75a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705182031, "uuid": "b73505d0-d901-4c2c-b9ee-07bb7ca1aa2b", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf853542-b207-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705145711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145711, "uuid": "79adcd05-8208-4134-a62a-7dbaf51625ea", "comment": "Malware payload", "value": "a1be5a9cc2660e483c811d758fa8ed51", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145711, "uuid": "8fe0ca6b-e8a2-4da6-87b0-ab5de3e78775", "comment": "Malware payload", "value": "a9b29d40d6f4afd429412a831266e8290567e2347889c0c061ccd4866c55bfb9", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145711, "uuid": "ffa26e32-efd0-4903-a0f7-43831f94d628", "comment": "Malware payload", "value": "5d52ffeb2760dd84b9cf1cccc5937712a7445b65", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145711, "uuid": "e740fada-2bf6-483b-95ed-eafa7bac86ea", "comment": "Malware payload", "value": "4406c5f2267c8054007b5c675b366a88f89b2b3c42c5180545af4ac0637efb481891164457d5a30ccfbdc643c1f13fa8", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145711, "uuid": "8b2ca70a-04da-4292-a1a6-eb3c800c103a", "value": "T1D3E40A43B02CE1B5E836E6350CD0E6408C2BAE9B121669CDF09877E177FF7851BA591E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145711, "uuid": "b513a67c-8b94-4f3d-9e46-f5515b6b0e66", "value": "852cb63e185fed3cd5137a7895a34d3f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145711, "uuid": "d551630a-2495-4da1-8740-151fb3da847d", "value": "6144:xRwFYknviMev8XMwlugUu1CRt66onaN0K+PRqig5TJwT0gEmZSoM:jwFYS3+8X4u1CRt6KN0VJqfTy0gAoM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705145711, "uuid": "bc0f6302-7771-4eec-9cb6-5866be16ad26", "value": 713216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705145711, "uuid": "783926a2-c782-4520-82a9-eadc09c734f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145711, "uuid": "e680a170-6be7-4c30-8ac4-09be349df588", "value": "a1be5a9cc2660e483c811d758fa8ed51", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82c0eb56-b249-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705173929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705173929, "uuid": "73fb0851-f165-462a-8855-dbc4f8a7d429", "comment": "Malware payload", "value": "b70be8632c7ee0e497991efefa42a9ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705173929, "uuid": "ed20e644-acf1-4edc-ba94-f238ac55c121", "comment": "Malware payload", "value": "abd71110fb0fd39cbe40f75f4b31cb309f3eede263315094769190dd6b032c61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705173929, "uuid": "1a2971fe-8a39-4aeb-8d57-c3280fcceeb3", "comment": "Malware payload", "value": "1e72436d496ffaa425dd939f8469a83f1a2fbc01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705173929, "uuid": "1f7b08d6-dd1d-468b-a95b-88e6fa6577c5", "comment": "Malware payload", "value": "43112db20c2c968db1cc1eec02264fcff033c40c442975f4edb2f261d658c46feb85a6fe9044b54201dd6cfb722d6de6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705173929, "uuid": "93436b58-fd1f-4eb8-a68c-2724cbdc0a0b", "value": "T19D56E943E86651E8C4EED179C636A223FDB134D9833437E79F9096611B26FE0AA7D310", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705173929, "uuid": "04bb2f5e-9b11-48bc-b3d5-9c8c856a7f62", "value": "49152:hDVc/xBO9YKtgZHN9hr33sKE4gbv9DULRIJKXpH4N9sQv6rxY2GnvHubh1oIWlnJ:/KOJosY+koJUT+ewW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705173929, "uuid": "97fd7644-5543-4d30-a9af-3ff8606c9c65", "value": 6096896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705173929, "uuid": "f3bf62f5-f043-4669-98f7-71647e8ee213", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705173929, "uuid": "7bae4c22-b002-446d-977a-971b69c8eeaf", "value": "SecuriteInfo.com.Exploit.ShellCode.26.1755.18443", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "032383ed-b1d4-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705123463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705123463, "uuid": "10f2b9b8-8095-4a24-9425-23f6e366c6a8", "comment": "Malware payload", "value": "9bf4d6b5759418a533f248bae93aebb2", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705123463, "uuid": "bc381c0d-c618-423d-8c30-b7f9204dd773", "comment": "Malware payload", "value": "ac6d4d55c06cc67aaecde771951c27ae09d75c2d0bcf0079c8991cc1b7846627", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705123463, "uuid": "61fca64f-6a9b-48e1-a602-7fb95f6e3957", "comment": "Malware payload", "value": "39dc49cf3f90a7141bddc067e010a1bff87dad74", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705123463, "uuid": "63c39605-58a5-490a-b9e8-fdb359f0552e", "comment": "Malware payload", "value": "bee1a2446acc207b1424d236d820bba8fd54cfad55a0cffc74f26de541481cba9f6ce8dc96d9dea653c0fe55cc38d2c9", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705123463, "uuid": "b00deb0e-99a5-48dd-9cf7-9739a90000a7", "value": "T173E1E608ACC1F25A0173C335F1B2EE15F97692170A464784BCCCD9E62FF309A89A3A5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705123463, "uuid": "385925e0-eb76-4da7-9ce1-3ec38a74a0cf", "value": "96:zFLe38881tfx4/uyqbzNdq0EUZN5YbXJsAb3mL3AMXWjc:Bk87C/uc0EUZXYMwNo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705123463, "uuid": "98bba71f-da3b-4ac2-8f5c-966c6bd27981", "value": 7229, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705123463, "uuid": "f353639e-95de-48c3-b4d6-7f438bd8b8e5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705123463, "uuid": "ff37df67-34dd-495f-b939-2614204416e7", "value": "Schtasks-Backdoor.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de2187e8-b1d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1705125119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125119, "uuid": "019c4a9b-4c88-4537-9754-73861989e4ef", "comment": "Malware payload (Smoke Loader)", "value": "00924a49c1fc68fa7b54e1cacdf19c93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125119, "uuid": "7b65a81a-ca81-4738-88ca-c12b478b5658", "comment": "Malware payload (Smoke Loader)", "value": "ac78b4ea0e6ae2d971799e6505d937f15276df8f34a509983f423622fed31cf0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125119, "uuid": "f30dd2df-c48b-47eb-a4fd-6671b0996f92", "comment": "Malware payload (Smoke Loader)", "value": "391c74453d3c3a23ebc22e307a6f071bcc818c9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125119, "uuid": "d31ee0ca-fe46-471b-8ed0-03f247a7f582", "comment": "Malware payload (Smoke Loader)", "value": "ead0b0085e457923a5d9ca931b2c45b044180ddeb7360e0289c166bfde37a68f76ef59fa2d43112fbffb0792f231a4f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125119, "uuid": "ab4b59fb-0c64-4b26-a1b4-a7f61b77b76b", "value": "T195348C1135F0C032F3F3697A5871C7B44E7BB8672A36968F6AC81A794F25AD19E20307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125119, "uuid": "8b51cb82-391f-45bd-9839-944dde0ac582", "value": "d8dcb51c50d0ca58adf96a087830e3b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125119, "uuid": "5a8c698c-25ce-45cb-875c-1ee522de8c20", "value": "3072:RC2zySmwWaXJVCadJizA1KSB2JybTZS5ygptqwldE2fARvSL:RC2m6qaQMlLgpH7YSL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705125119, "uuid": "8137001b-595a-4233-b72b-942a14f62617", "value": 241152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705125119, "uuid": "f3b15962-f7da-4e71-b80d-f0aff27d0753", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125119, "uuid": "453ca973-f2a5-40ad-a832-51741be41112", "value": "00924a49c1fc68fa7b54e1cacdf19c93.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43ad8322-b231-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705163515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705163515, "uuid": "e54f28ff-5bbe-4240-9311-eaffb53ba94a", "comment": "Malware payload", "value": "75e51df29cea57a01ab6a5ead3aac92f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705163515, "uuid": "3a6c62c5-744f-4ab5-b49c-892d4049d1bf", "comment": "Malware payload", "value": "aff686a8dff0148fa02829d963bc2f6e63cff09068f34b579f3a223dd8a0fe59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705163515, "uuid": "407b5f92-1ccd-40ee-af72-0684f0895898", "comment": "Malware payload", "value": "058a9059592e2de526df33f2b0d953d9f89c60d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705163515, "uuid": "c4f7d640-8715-4302-995a-0efccf8b925b", "comment": "Malware payload", "value": "035152ddbe3846df9050174a8f0acfc19054f9367dc65107505579e246d37165c1d2647379c5ef0c8e57d826693797f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705163515, "uuid": "1c99906a-56ea-4044-b944-450d772683c4", "value": "T1C0136D2BA2E3B572D03554745A2DC378D43B2AF12DA63AA6937F5C3ACD8C5C2184C393", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705163515, "uuid": "7452b282-0edb-4518-9690-ad3541190c58", "value": "768:A8Unjqt2QkTJZwhcGZdyBLiYdAZqnkf52jFRzuH/4JK9rYk:A8ujqt2QkTLBZdlnCd/S0l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705163515, "uuid": "9472c2b5-f14d-42c9-8e63-79a4945cc385", "value": 41992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705163515, "uuid": "7c9982e7-6c74-413f-b155-57f5dc0c556e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705163515, "uuid": "51b65b64-8afe-4777-b354-18049617a6d8", "value": "SecuriteInfo.com.Worm.Win32.AutoRun.30796.24461", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f3d5a98-b1ca-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1705119216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705119216, "uuid": "4e426560-bdbb-4080-b581-547b5fb9ced2", "comment": "Malware payload (RiseProStealer)", "value": "a12f3a5ed6b288812a5a59aaac21e1a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705119216, "uuid": "eb40d9b1-d53d-4847-8fb9-5b7b6c03cbf8", "comment": "Malware payload (RiseProStealer)", "value": "b295ee54cb4ad0bcd612bf98803cc8dcba46138893acef774873d06b954ebecd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705119216, "uuid": "9f409ecd-0cf2-4bd1-8eee-efc3c2de28f4", "comment": "Malware payload (RiseProStealer)", "value": "8a3adb501f8ebb464644d9143d16fd00c2651563", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705119216, "uuid": "66bf820f-6b93-49da-9011-179bf7cead5c", "comment": "Malware payload (RiseProStealer)", "value": "596c6bb92959aaa0e6c5d753d48fba37061898a052e7a19e30ecb5c8e7d15954443041909c7675aef49734d186e7668d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705119216, "uuid": "6cebb37f-6740-4771-b2b3-9e0deae8d466", "value": "T1DD9522F676F4455EE4C583F823B1E66502E8AED5DF026EE7C0F716A6378B2D00A0605B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705119216, "uuid": "16ca400a-29b3-4eaa-885a-a9304e2b6e3e", "value": "1e453fd81736fddb1b5f5ce807c79734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705119216, "uuid": "c2c07084-a194-4011-9177-eb6f56646f76", "value": "49152:Oq2I9J7e0LRhUIOYGOAfYBiEi05wQ1M97QkiNco4q:Oq2IbeoI3fYUwb1MmP4q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705119216, "uuid": "7e931ca0-a18e-4b86-a897-3078ea7f8ec7", "value": 1887744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705119216, "uuid": "95c11eda-461e-4002-b9df-d524b2a52924", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705119216, "uuid": "037383c8-c283-42da-bc21-2a818ad4390d", "value": "SecuriteInfo.com.Win32.TrojanX-gen.26180.17890", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "005eb7fc-b1d3-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705123029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705123029, "uuid": "9e0d9934-c334-4fd1-befa-05c2acb951c7", "comment": "Malware payload", "value": "64da79bd667b0d6fdef99227cdc716dc", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705123029, "uuid": "4d86d0ef-4017-4ab8-9bbb-323e7eac92db", "comment": "Malware payload", "value": "b337198c50cf693cdd461744f175e5796ae80a5967b12940e42af5e28cb28c86", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705123029, "uuid": "7b2195bd-f035-42f2-83c2-e229f5a16421", "comment": "Malware payload", "value": "212eb8cc6403eb596f1cf846de5ff048394e16cd", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705123029, "uuid": "46674cbf-5b00-453b-b003-8e5cfc89f492", "comment": "Malware payload", "value": "23eaaf400b814fdeb5f80d7d3a97ef68cf65d05174d789061783bd4484adb67a51367ff222f17a8f652fe688bb39d26c", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705123029, "uuid": "987f41d3-c1e2-4cac-8731-b4b9cda19c2d", "value": "T16FD02B5CF102D1BA035233DAB2665F3591127C59B1B0CF2C014CCC8C4803165B04C6C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705123029, "uuid": "5aa82c2a-7933-4c9d-94ac-fb9edce0dbfa", "value": "6:jS4PD8HBDLM0HsDLOUWJJsN6WLnX8YX4PdAtcKgFjAhe0G39l5WRaCrveb:ZDMBDLnHGLHWHULn5I3tAhYtl5WVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705123029, "uuid": "e975feb7-e01f-4406-b260-385e87978687", "value": 285, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705123029, "uuid": "e28c4cf5-6171-4e2e-add4-ab1791d6c0d9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705123029, "uuid": "5ae02e79-bfa4-44c8-93dc-038fb88ef644", "value": "d1.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16ca2ad7-b1d0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705121778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705121778, "uuid": "82f7c46b-9259-4c51-8ec7-9c57126580bc", "comment": "Malware payload (Mirai)", "value": "054d9d6969d3c9a6c2473c3dd069d808", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705121778, "uuid": "ffd27b24-7a60-477d-ac6a-4bfee5432a50", "comment": "Malware payload (Mirai)", "value": "b485b325e6d45ff786b99b73806532b0dea95b265f837ef3d91eca7254aa5ae7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705121778, "uuid": "e29c78fc-e5da-4952-ad2c-260ea7b9f449", "comment": "Malware payload (Mirai)", "value": "3b40d7394406dc2f5c604a8bd477899ef39bfb34", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705121778, "uuid": "d12d95ba-de21-4586-b38e-e39c3faae2a1", "comment": "Malware payload (Mirai)", "value": "0d8a9989c81ffb825d1dc3f8833816127313fee14af16ba5acda8aef653cf163645f77be81c56c8324ead809ac1c9320", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705121778, "uuid": "1409e383-b517-4898-aa41-e45003c0b938", "value": "T1CF63B61ABE228FBDF759823507B78E11A79923C637D1D641E26CD6002F6134E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705121778, "uuid": "4537d52f-86fd-443a-aed6-1e8a050ec112", "value": "768:TLGl3o5UaqLQqeuuBLvDn9N1FdVtlb/T3edCj/zGxcLso+kwnl2CC76t16v219/P:TD5bRwnk77yd5Lehk0o6AH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705121778, "uuid": "9c0b088e-e3d7-4396-8f32-dcb3ee0684f9", "value": 72808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705121778, "uuid": "8c7388af-356a-4757-8078-205fd6fb4dbd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705121778, "uuid": "193f86ee-912b-4535-8c05-417804f66f5b", "value": "ms.nn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a627cec-b1aa-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AZORult)", "timestamp": 1705105517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705105517, "uuid": "83da9e78-17f1-42c0-a906-c8a8a54ea478", "comment": "Malware payload (AZORult)", "value": "9352bb54fb680c197ef32e2ebe10e6a5", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705105517, "uuid": "030c9d74-d131-4c57-b61a-f57525144e81", "comment": "Malware payload (AZORult)", "value": "b7ff86b6da28a06ee0de3032320ebb3989eb61467e6d40740cfd082444ed9c06", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705105517, "uuid": "e663efd4-06a5-4e7b-b91f-5e05fdaeb1e7", "comment": "Malware payload (AZORult)", "value": "34745e30c5435a715a7ca3b81f78883f72bfb90f", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705105517, "uuid": "4fa4c729-36a9-4b3d-8c84-9046c5243536", "comment": "Malware payload (AZORult)", "value": "c6f1192cb772feae565c0f26641933be196ad4330c074a3b61c87932b749a86e7d6e56035d8688c1344f000be05e444c", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705105517, "uuid": "ddd2b94f-839c-4944-8567-97261ec32f14", "value": "T1E5A4232153378472FE074A729A6446628AFBD42811408EAF77A5CFEC3739905CA0FBD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705105517, "uuid": "b628dad5-a871-4992-a723-0f002b3ab104", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705105517, "uuid": "74d6a31f-8408-4dc1-ba29-2b7d8579ae6e", "value": "12288:xiMZHMlRkB3d9eQNjfDypk8D8lK+3pvGxuqTypR6snVWvHSM:xiMZsrkZnHdbyC8olyuqKRnVWL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705105517, "uuid": "94372595-ada0-4c7d-8353-f9400ad80057", "value": 455608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705105517, "uuid": "80b643a9-558a-4568-a319-ef144604efed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705105517, "uuid": "709371f3-bdc7-46fb-b096-3cd449cf377f", "value": "PYMT SUCESSFUL AVIS CREDIT 12012024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69ea9ec7-b1ad-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705106885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705106885, "uuid": "3c098fe6-6c25-4562-b943-9e2c2a0609be", "comment": "Malware payload", "value": "4dfd2eddf1d5d5271a371c754e6bed18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705106885, "uuid": "8063a30e-caf4-4844-ad16-5d430bfb2dbb", "comment": "Malware payload", "value": "b9cf02081d06c962e8fdf78a103f8778a4dcb306f70e167a6962497a7bf8265d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705106885, "uuid": "effcc896-2cc4-4088-9252-ccb880216e13", "comment": "Malware payload", "value": "d116ebfaec0adcd029edb4de52fc59f030529493", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705106885, "uuid": "8f3c3d40-eb0f-44b4-8cfc-54748825d0ca", "comment": "Malware payload", "value": "7aa73aa5c100418200185d456c22017ad84362552799111ab514ba117bc1224cf394ffb45bcf40aef0c8e96723cd4aca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705106885, "uuid": "c7c44cb7-b8a2-4d6b-97b6-eb210d083fc2", "value": "T149F5330BF6D48926DD1705B0AC13A572D7E772221827F70776E80888E76D3C9AE73693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705106885, "uuid": "1f52b0b5-f23e-41a7-be23-e86b3f4bd2ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705106885, "uuid": "6c034728-e542-42b3-8190-57c1bce3952f", "value": "49152:sHXY1n2+5ZB3E1m8UhIEr88f+ymc88HGOIdpPqNq/diFqDe+l4m3a:Kqp5H3em8UhLRft8ZxPqLFqDew4m3a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705106885, "uuid": "0048f6c8-9d8e-4b05-912e-5639734482ad", "value": 3401216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705106885, "uuid": "99510dcc-7e30-4b89-a272-17df53da6a86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705106885, "uuid": "5b8461db-eeab-478b-94d9-93b6f0358a5a", "value": "NBYS AH.NET.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f98834b7-b25d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GCleaner)", "timestamp": 1705182718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705182718, "uuid": "36e0acea-0c46-4629-8be6-04b57a1850a6", "comment": "Malware payload (GCleaner)", "value": "8a6150d9aeecaf24aa06b669096bb465", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705182718, "uuid": "fd6ab86e-2d22-4fe3-8932-952dbd1797cb", "comment": "Malware payload (GCleaner)", "value": "bbdbec4d910262daf43a4cea874173fd4c790cb3ec142e65de6c1a74520dc4d7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705182718, "uuid": "285676eb-0787-4bda-8ff2-d6e5732b1aa3", "comment": "Malware payload (GCleaner)", "value": "4f516bb16d3d8b241a38a4c22c58e4f4f5883cc4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705182718, "uuid": "73c49943-572d-4a40-a112-e430c0912037", "comment": "Malware payload (GCleaner)", "value": "6d1c76684ab554319041693290f869d1007bde1aff97569ddf7c49f5d5446075e92424ff57a49957d64e6fad0f827f97", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705182718, "uuid": "bb0ccf8e-ab95-41f9-8371-c45e7d40810e", "value": "T1E5045A1074D2C0B3D972153518F4EBB5897EF8350F619AFB67D80B3A0E342D29A35A7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705182718, "uuid": "78a9af0f-e6a5-4c3f-baa8-c236ffed41fb", "value": "7995552d5727ea28793352af716fab7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705182718, "uuid": "8166e68b-7840-4e64-9f6e-7b944a9bdfb9", "value": "3072:NHFNYj6kzi+NT2I+LUaXJNaggOTuSgBbqVb/8O/tOAg0Fuj0QtsIFsZa:NHFNY2PBIs5nuTBbWgAOnrFsZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705182718, "uuid": "92a22cda-b712-4e88-b485-01d37833135a", "value": 180224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705182718, "uuid": "e96d30f4-e910-4436-a91e-16cf90065dd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705182718, "uuid": "e1284b07-693b-4964-9ae8-34fc5a7523ca", "value": "8a6150d9aeecaf24aa06b669096bb465", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ad0055e-b207-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705145622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145622, "uuid": "18474fa9-50a8-4bba-b458-d897c9b672bf", "comment": "Malware payload", "value": "390257b01ba0b7880f2f5af0c742518b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145622, "uuid": "5751f72b-f627-4efb-bd40-e5da373c6a19", "comment": "Malware payload", "value": "bc8ebbeb0e6fa3fa6e74571fae281e430690e1ecb18e45a071603e3f0537c0e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145622, "uuid": "c72db644-ef78-4daf-9ac5-d9afdcde4f51", "comment": "Malware payload", "value": "3c8c483fcb862be5944ca30a73b51c22bf7a8b21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145622, "uuid": "37281e30-c0fb-4750-8578-8b7b6685be29", "comment": "Malware payload", "value": "3036823975a0d1ccf7c3bd1c239d11202a4993a02306c80f76640e60879851c5dd81f975bea24193e3ed3be1aad5ba1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145622, "uuid": "32a5e64b-7510-47b6-a6b4-952b92fd23ad", "value": "T1A2473353CEAB293DC8E09FF9243F3479086BFEF4B8213669735E46D7C66E601654210A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145622, "uuid": "371dff24-ce3e-45a6-b8b1-5a9a8cba2eb0", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145622, "uuid": "7b2df396-a4bf-466d-84ba-ae3a12f9d2f6", "value": "393216:9n31DMq1F7KVFcuymF06emN7YLfAxkQIRJdt2qGlujoHVQcwP8uTHslsLMtdT:V31DN0j06NkQI/TrGl0o1Qc2TM7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705145622, "uuid": "96ab583a-3274-45b1-a710-8ba5d0d5543d", "value": 26388552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705145622, "uuid": "dcb16fe2-b6fb-4995-8111-2e3df828df2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145622, "uuid": "f6c27519-f007-4ba8-a586-fd88e4a1b82e", "value": "SecuriteInfo.com.Application.Agent.KJT.21167.27183", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "330aca07-b1d9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1705125691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125691, "uuid": "b4675de1-c0ea-40c4-bfc8-ad2104e187f3", "comment": "Malware payload (Stealc)", "value": "ae0792e1f93f7682ce03c8f4f9e2906b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125691, "uuid": "bd11adf6-7068-45e9-84a2-b66984c5283d", "comment": "Malware payload (Stealc)", "value": "bd0619e369e9f557fa70e19f5447a08a625cec708e14459d53fdb338ecf30305", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125691, "uuid": "3da1aef3-f308-4c6f-8884-a81cf1411f0e", "comment": "Malware payload (Stealc)", "value": "7056ade37113830af70ae02fe06184374c06dc90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125691, "uuid": "a628dc95-1b70-466f-8844-c473fd151d7d", "comment": "Malware payload (Stealc)", "value": "65dae63f78e15f0c2c1d9f8b070e6003a971783a95828f8e12daa99eba881c1164dfb11166c370f7e571bc9377cf31c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125691, "uuid": "3788c28e-fb6d-403d-973b-a07898dba407", "value": "T194348C1135F0C032E2B36B7548B5C3B50A7BB8626BF9558F3AC41A7A1F25BD1CA2531B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125691, "uuid": "d608b726-0378-4e78-90ae-cbfea5fe2a1e", "value": "9a5a0ccd3ccd4b18623b778491d8a47c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125691, "uuid": "3494a2ce-25ff-4c02-97ed-15cf72db6a97", "value": "3072:fJOKSG+jJx3AdF7mSJief2m1KpEtbUT1nGBvUEtrSWe/qcRbP1XRQ9mtxxgwT:fJOKS/EF7kpGegrmfgIt4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705125691, "uuid": "fe07fe4e-d86a-4e8c-b39a-9ece2f918f2f", "value": 242688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705125691, "uuid": "fc4799f3-eafa-4047-ba09-b5b801a7086e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125691, "uuid": "d0226ee4-ba45-416b-a7f6-5dbfce130037", "value": "timeSync.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d7dfbc0-b1b1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mimikatz)", "timestamp": 1705108583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705108583, "uuid": "37169cd2-4501-4a3e-8ea6-cb5a6188a105", "comment": "Malware payload (Mimikatz)", "value": "470e404c0132733c3df4895672dbd282", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705108583, "uuid": "fa26e067-8dbe-460a-9374-aae326113852", "comment": "Malware payload (Mimikatz)", "value": "c03efa6ab0422798b5bf1be4dd4d56c813e060a110bdbdbbdd1820cd8c673232", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705108583, "uuid": "4122928a-dab1-4f21-aea2-9eaaedbb2753", "comment": "Malware payload (Mimikatz)", "value": "5f20ad47b17b5df08be370b6c7ae038af2f71ee2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705108583, "uuid": "a2eb9322-40fa-4689-84c1-289618b61321", "comment": "Malware payload (Mimikatz)", "value": "9dd05e561e61ed06f3dab0f7b9099f154e9131f5213c749121385b51332bb5a3ecab16b75a0afffaf24fbfef9823816a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705108583, "uuid": "6aef36b2-951c-4638-a55d-21bd1de5d1a1", "value": "T1C94633DF38A8047BD5698279C5DF61BAD3F330231A72D65F47A007A96E6B380DC1E291", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705108583, "uuid": "f0ff1f95-8dbf-41dc-bb8c-7dadadabb925", "value": "ae9bb001ca3ddbc8de1e83725c753daf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705108583, "uuid": "b20ee89c-0c13-442a-b08d-4e50a58478a1", "value": "98304:Pt6PB0pqcxVbMpn2u3S4VaAf9sOs5V0ioedhDmznjVAMx8+k29D6v2Y:PMB0YEQpnLSqf8+iP/DO+Mx8+k66V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705108583, "uuid": "99edd38d-45d4-42dd-8320-ff987c3efa25", "value": 5495808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705108583, "uuid": "1b0689fa-e318-4fe3-b67b-bfa0f17ee8ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705108583, "uuid": "67d35587-26a9-48a0-b179-aae0f44d451e", "value": "shell.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5fd9123-b1d1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LockBit)", "timestamp": 1705122529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705122529, "uuid": "6327c72e-193f-41a7-ad14-4bd0a4b7b7c1", "comment": "Malware payload (LockBit)", "value": "50c6ff50424b0288509c73f7b006252a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705122529, "uuid": "b23b65c7-e76a-49e6-8586-3a175255cab2", "comment": "Malware payload (LockBit)", "value": "c0869e7f1bb4914fa453db5eb9cafd6fea090f7c6c156b9f1a3479e0ce7f4df2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705122529, "uuid": "4a325a14-b569-407e-b2c2-605c04ffa9ce", "comment": "Malware payload (LockBit)", "value": "cf95904f4e521fbaae25e0983c2c896ab1e42d8e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705122529, "uuid": "dbab1d56-2b32-46ac-9775-e4e3348ded65", "comment": "Malware payload (LockBit)", "value": "72f842977d6ab5f9008dd759edde7c5df40a52e629cf42ea19e98b1848291afa8ab7d077b899a3a0ae296e294ef42c36", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705122529, "uuid": "e6921abb-71ac-48e6-8c18-4ca23b51864e", "value": "T1B2543B6BDC85E0FDC267997D41DED4B5F57039884316B97326C8A9732903B20BE88F92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705122529, "uuid": "40956fb9-e064-4463-aedc-16f782a119e4", "value": "6144:uXbWomoMxdTDQnRmQECxp9kHoplqqDzV50DEreXIJ6esjA:upp8gGopIqYD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705122529, "uuid": "3b97b06c-a970-4027-9353-3e81cfb14e68", "value": 298720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705122529, "uuid": "69001579-6d1a-485e-9962-6c82ed7c106c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705122529, "uuid": "95c743a6-e07d-4f25-834b-63f63910ae8c", "value": "c0869e7f1bb4914fa453db5eb9cafd6fea090f7c6c156b9f1a3479e0ce7f4df2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9020bc36-b207-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705145604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145604, "uuid": "1db08dad-8c47-4c22-9144-e663d94652b9", "comment": "Malware payload", "value": "90e5e85c6d14643d7fa6b9d6bc520b0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145604, "uuid": "3dba2dff-2bd1-444e-b3e4-589a0bf2715f", "comment": "Malware payload", "value": "c110e2629428c0a02ad06f9162ac38123473eca857fcc424ff837df4dd80eb1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145604, "uuid": "b11931e7-622f-40e2-8b50-a1191c9295b5", "comment": "Malware payload", "value": "4ad1c4ec0e35fad251d1fb0956353de9748db836", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145604, "uuid": "f5d41556-eeb8-480b-93c2-e3f7904558d6", "comment": "Malware payload", "value": "eb9310c6d58c4146a983a71169772945eea0faed2ba5844499f2e96c80b967a7918b21738a7c402c222af6a10a095567", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145604, "uuid": "d6dc77ae-f756-4526-b381-b24eabed8414", "value": "T148F4234374411D7AE61B3C7790B13FDF33B392FC535EB6160659EABEA01A482E1A21C8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145604, "uuid": "2d0527d2-1a4b-4a27-a7f8-2f3766ce1be7", "value": "0276613582a42c504fdc8c1ae1fd3342", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145604, "uuid": "a59fc7d8-376c-4fc6-93ca-24ba286e898d", "value": "12288:yIG63QsQbFoehPSlnP4tGL4klDquamXDtgSZFMehA5Q/CNfm1hyrLjp:pz3dehP4qhIDquamXD26hgQ/Kfm/y7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705145604, "uuid": "ab661a5f-c1b7-4cdf-9a52-8caf206f04a0", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705145604, "uuid": "8f8acabb-6556-40b9-bfd0-1dd75b87743c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145604, "uuid": "36e7dd1f-d5a9-453a-9f78-0ee84fb59bb5", "value": "SecuriteInfo.com.FileRepMalware.18450.637", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "885f4a74-b1d5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1705124116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705124116, "uuid": "883965db-cc42-4927-ae83-466406d8597b", "comment": "Malware payload (Smoke Loader)", "value": "9f5a98f982f89f7668905f4a26355978", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705124116, "uuid": "5b45d592-c668-4c34-8f40-c8292291664f", "comment": "Malware payload (Smoke Loader)", "value": "c386f2ddb7e75ae37a9ac8908a3cd4606164001901642b48b705ed0f7197470e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705124116, "uuid": "ba1fe29e-50b5-431f-8a38-268dca54ea28", "comment": "Malware payload (Smoke Loader)", "value": "06950b88bb2f45e75125cad01c674bb0d9291b19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705124116, "uuid": "cca348d8-a3ab-40ea-8020-0f88e67aa445", "comment": "Malware payload (Smoke Loader)", "value": "817426aaa38589856387ef681109c2176428490cf09e9e6b8ca100fc1acffe72b1562666cb5cb657035d5000d0dfee2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705124116, "uuid": "910dfd28-578f-44c3-a355-d2b529b87056", "value": "T177348C0176F0C036F2B369794839C3B40E7FB8B76A36998F6AC416794F256D1EA24317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705124116, "uuid": "5bb5e0ae-7433-4483-b827-fc0367421ca8", "value": "d77b02f65b7bb86e8f742226786b42db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705124116, "uuid": "11058ffd-23b8-4d21-9756-0fdb969b137b", "value": "3072:XRSrpGanOMAuJi4k1KjHPOv465nd2r+rvHYICl3ER/8A:XReRAXXd7Us8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705124116, "uuid": "9aabc645-caf5-42ed-9a68-8cc89a199b74", "value": 239616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705124116, "uuid": "a6b5edce-7c8f-4984-89a9-a2cded9b7833", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705124116, "uuid": "9236f90f-9c0f-401e-a6be-a52fe1907287", "value": "9f5a98f982f89f7668905f4a26355978.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8194701d-b207-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705145580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145580, "uuid": "ca58f423-6a41-4fba-9413-e0e83ca43df8", "comment": "Malware payload", "value": "b030c548dee7bcf9cf86837036571314", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145580, "uuid": "354e939e-c2e9-43ca-87e5-3be56c6b0edf", "comment": "Malware payload", "value": "c51647a198965b3e7bf8212286a4b28ac3a4aff96eb4d3da708ac27192b566fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145580, "uuid": "06afc8bb-a74c-42ac-ae7d-e73cf4fe030c", "comment": "Malware payload", "value": "d6c0a946cf3fd48289e0f865b21a71052c2118ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145580, "uuid": "199cdd84-a9aa-431a-8c5d-92c4c41efb8f", "comment": "Malware payload", "value": "802e36d4cb63995b59ce6f7489b4739af705cfd2a1be5b91b73979c48bbf84edfec069854750d3b2aba87ba08dea9ed2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145580, "uuid": "a50fb25b-2cb2-4c1d-9c1a-a0d31a995ed9", "value": "T1FD65330ACC75896CFEAFD232DC278A8454735F0E7A56D40BF39170A3A7B2C55E388946", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145580, "uuid": "cc750be1-68ed-4fc8-b71c-dccb1f492e76", "value": "bd888a6c2f39e020f01068d46b1a6f83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145580, "uuid": "09fedb65-3c02-45a4-b618-02a49fda82a1", "value": "24576:R6nMJWm7k39J9+Aoz7Jnfp/vF4J/+4cdl3qYMD4PZyeknhO6nmeeKQsuMTPr:EMAL9J9+AovJnB/vFdJqPrhO6nmeLQsb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705145580, "uuid": "80b85dae-1527-4b2a-b0a1-de1a13909d09", "value": 1521402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705145580, "uuid": "04955c67-57e5-46eb-b6fc-74995edc7f72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145580, "uuid": "ceb8b282-f8ab-42e4-b7a7-4fb6615960e5", "value": "SecuriteInfo.com.FileRepMalware.6695.21749", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "996ca7ba-b23d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705168813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705168813, "uuid": "c0077d7a-7133-43eb-9ac3-3f02ed407f8d", "comment": "Malware payload (Mirai)", "value": "4b10f44fbaa187d8eac5c94f5e45c94c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705168813, "uuid": "ab0a93c7-668a-4b4f-a76b-fab260c1a460", "comment": "Malware payload (Mirai)", "value": "c5bad8b529fa8dc402145a8a1ef580fb36271177bdf2d141918602a21cc5fe90", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705168813, "uuid": "64bbb774-a688-4fce-b4d2-6db3a80724a1", "comment": "Malware payload (Mirai)", "value": "a1da16ddc3648b90e425beb0a1a45486b4eb9369", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705168813, "uuid": "682fd574-7d75-4fb9-9d73-0872e7c9f996", "comment": "Malware payload (Mirai)", "value": "7b7e3cc0942bd01463fbbcb80f3360a08c8e1aa2862092dc7fc9d5ab2cc74815baef2f3c1cdc55102fb45f18005afe53", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705168813, "uuid": "a4a3b246-07ac-4cdb-afbb-31001f268e76", "value": "T160E34A17B5C184FDC4DAC1B44BAFB636DD32B0AC1238B16B37D4AA261E5DE205F5EA40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705168813, "uuid": "51bb94de-4328-45e1-9ee9-27b4c20b56c3", "value": "3072:3cNhovYB3ouQWPqVcdpXaxxTtzJw9PrEaWKF57DRaN1Na:3cNhovYB3ouATHAhANa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705168813, "uuid": "3d2ec147-17f3-4f12-8807-79f6d74ed02b", "value": 155960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705168813, "uuid": "d6a2ea1c-6527-4175-b5b8-b0030852619a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705168813, "uuid": "59317bdb-21ba-4e34-b707-37dc915a1a72", "value": "skyljne.x86_64-20240113-1800", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bcee85a-b1d8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Tofsee)", "timestamp": 1705125357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125357, "uuid": "0be3dc88-274a-4723-aab7-5c15714a020c", "comment": "Malware payload (Tofsee)", "value": "9f72ad79bba9d398a150be4b676c624b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125357, "uuid": "513aa02b-e0ae-4a25-9d03-ad74c1f2b65e", "comment": "Malware payload (Tofsee)", "value": "c5fe1e625c87aa811d76f20079f286f5b9f3b5c971d5ba86350c37327c509981", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125357, "uuid": "ffc1be1e-cc3a-4855-9a27-70e5537d4ed1", "comment": "Malware payload (Tofsee)", "value": "f06218c9fb624ba6a8040846c1a888e6dacc6fb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125357, "uuid": "b36d4c3f-964c-4819-94ec-2c8fd7cfdd8e", "comment": "Malware payload (Tofsee)", "value": "12d63d27d7a0fa25d747da9df254b6f3e2be36be19c1eebccb3a13f5dd848d1ae72f649b8c3f74b6d58aabc177fae9c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125357, "uuid": "febb6e78-e13b-4c8e-b5f6-55067ea9c08e", "value": "T17C347C1136E1C032E2B36B3648B5C3B45E7BB9666BF5958F3AC41A791F357D18A2030B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125357, "uuid": "7cc36ec5-0b5c-4a5e-8e14-dcc9f3bbbdd3", "value": "d77b02f65b7bb86e8f742226786b42db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125357, "uuid": "30377604-6d96-4f7d-b0b6-73a0a4b96fc4", "value": "3072:1oCTZcw8fGJiR21K9Np5Y4xL1JTp0C2bhUQiGkRo8DegwT:1ob/vFF2bhd8l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705125357, "uuid": "2eb1f4fe-82df-4bf9-9576-89cc08984a5e", "value": 239104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705125357, "uuid": "0b4a102c-d238-4f27-af53-50c3be0c1f37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125357, "uuid": "49efb3c3-ddda-476a-961e-b88e712a46b5", "value": "9f72ad79bba9d398a150be4b676c624b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "268bf12a-b1d9-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705125670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125670, "uuid": "c8c53aee-6b55-4b16-980d-d609d37693a4", "comment": "Malware payload", "value": "35ba2d692bda59c07ce3b31ae17caaab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125670, "uuid": "bace9463-9bb9-48f7-9a51-bc794a8cf50c", "comment": "Malware payload", "value": "c6c3362a3e7bd23d7f1e937ed99adfc23fb0168a25e5c7321239dd237b37e706", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125670, "uuid": "9dd18836-2230-4419-9312-3aea083aff76", "comment": "Malware payload", "value": "88ccf36bd8d6af1841e9015ca63af225679030b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125670, "uuid": "d7024da0-348d-4693-91e3-1b2b89319e59", "comment": "Malware payload", "value": "d2159c7a445bbbf5618e206eb971a2453f41858e9e03ec90271844cf3cb5cc9eb7b40689ffac2368627286157d582145", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125670, "uuid": "28f7eb24-2aa2-4758-8f10-e8a6991d6f1f", "value": "T110B5231272E64C71D2A315371D6487611A3CBCB12F660ADB63E0399EEFB08D1AD357A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125670, "uuid": "02cfdf58-535a-44b6-80d9-459df83bd2ac", "value": "10b73c5f7fc148e21f974da703236659", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125670, "uuid": "bdbb483e-89fe-406e-8bf6-c40d22a4daa4", "value": "49152:1monDw5RLpCw93dRwVw92WzXD9A7vJA5vL/fo4ymnA9LwbtGi:1mok5JfZEwPXfvrQT98btGi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705125670, "uuid": "26ae9a3e-e679-4854-8ebc-b7747e3f25ec", "value": 2456978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705125670, "uuid": "45f362a0-626a-4e20-9b15-80830de5f5ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125670, "uuid": "612755e9-70f0-4308-bfbb-96aeb703a467", "value": "35ba2d692bda59c07ce3b31ae17caaab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9684346e-b1d5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705124140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705124140, "uuid": "f91a5146-43ae-4d65-8982-ad85436dd620", "comment": "Malware payload", "value": "692bac1c97fd47601625f3b91d0aafa7", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705124140, "uuid": "8f84c3f0-5b4f-491a-8a9e-38157d12de39", "comment": "Malware payload", "value": "c8e82e5e495cb74f451268f7dba45132c3944bd3296f9336934863a7526448dd", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705124140, "uuid": "95c62b95-99b8-439a-af43-1f5921ce0921", "comment": "Malware payload", "value": "a563e9791877083dc15f21cf848ad218cf1d7ff6", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705124140, "uuid": "17bc77e4-9d35-43d6-90c8-c51f0d733981", "comment": "Malware payload", "value": "8a725f13d6aa05ebf81a6f1ebf8e1f4502ff66f2db3bdc323155b5a06275b5a9b208807d20f25046e52fb6ed20937f10", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705124140, "uuid": "f4b487ba-202d-4ad3-a8c5-85738249cc9b", "value": "T149841212B62EE2BBD01343700ED441CA1A1AFD61EFE8926B3436F3DC2439F55AD25B59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705124140, "uuid": "d9f712d1-2f49-4f5c-9924-57433e81a0da", "value": "6144:+acBC6QREcis2JS5JABg1gG30q4SXR1c8X0Bn/RPJ9Eo7xuT5W7YsabJXTspw:+VBC6uEHsu8JAB4g0d88X0FChw7YsBi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705124140, "uuid": "64c0132c-6dde-4d62-be95-9f91cc09fce7", "value": 371712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705124140, "uuid": "7d32ae94-8bc7-4711-b10b-242b68599172", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705124140, "uuid": "763ff69e-06ea-4687-85dc-2b0a2f5445ac", "value": "orden de compra T7416vbs.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0ab43c8-b232-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705164181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705164181, "uuid": "4b6d69d5-0735-4ecb-b339-519e0081703f", "comment": "Malware payload", "value": "2a4f6dfe74db1271f4e6df7ac1e74c7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705164181, "uuid": "e0277c4b-9ec1-4693-b5c9-1de0ae10dcf8", "comment": "Malware payload", "value": "c9f4d41307cf7592c810173f37f1e6efccbb56acc25e6e8d44f50525bc30d7fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705164181, "uuid": "c90030ef-e65a-4d92-85c4-b6f7492c635f", "comment": "Malware payload", "value": "4e804f1fc9459f36a83072a9258afe2ae29e4e04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705164181, "uuid": "7c666375-cc11-449f-b11c-2ce4aa53e13c", "comment": "Malware payload", "value": "6f97dc65afe2c9a78863961eedde81634e8ad3f55175b9574c227c3dbebde812602ce6f0dabf44a037108a740867c7f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705164181, "uuid": "83a90923-0d3e-47ed-809c-5401cb72f3fd", "value": "T121D4BF0AA2A400F8E07BD138C8434545EAB2BC555721DBDF13A8E77A6F732E15E3EB51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705164181, "uuid": "9fda89e0-ea6c-4433-9e44-5469ff7f1040", "value": "887b5328c38e797e11c156ce8702788b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705164181, "uuid": "8ca45ddd-8262-4019-a853-40c1197b66b7", "value": "12288:RLJXWYgeWYg955/155/jhs/BhO7dVkWl22lbAGoXfMIYjBNByG1232:RLshW8kWcmbef+jZy2232", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705164181, "uuid": "dec495be-eafb-4e93-8525-9a5bf590eb63", "value": 638904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705164181, "uuid": "bead179a-14d6-4887-8e08-40e666228778", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705164181, "uuid": "26caf418-5fd1-4052-9b50-356c3d3fb98c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "666815f7-b1d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (ExelaStealer)", "timestamp": 1705124918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705124918, "uuid": "20345db2-5a1f-4175-bbee-fbc065b04449", "comment": "Malware payload (ExelaStealer)", "value": "4d70f444794dedf45c2a6562d4eaed19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ExelaStealer", "colour": "#4DB216", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705124918, "uuid": "ddf9c931-3c7e-437b-97f7-750d8c2fa6ed", "comment": "Malware payload (ExelaStealer)", "value": "ca120c365ddd0e24311e36e1ec5d4af6db21b0f2ebd6f7dfd0d6a3a730621367", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ExelaStealer", "colour": "#4DB216", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705124918, "uuid": "05be1b6b-3841-4284-9969-1d9c7611aabc", "comment": "Malware payload (ExelaStealer)", "value": "337a7a9be709b1a3f848256c9e4a421911c265be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ExelaStealer", "colour": "#4DB216", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705124918, "uuid": "2e60d088-f281-4dad-a976-c352204e9414", "comment": "Malware payload (ExelaStealer)", "value": "f3c2b4b7fcc246b62d9eab3415168d1ad37d256c8ea8b7ea14b91b8ce81dc758f6f652e0934281479edb51b6d14f3e69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ExelaStealer", "colour": "#4DB216", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705124918, "uuid": "fb6ea0af-1fc5-4189-8317-e26a4ab6bfae", "value": "T16FF63328B3E11EF6F8A71A75D0D2D821E372FC510B68CB8B436456B90F1B9605D2FB58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705124918, "uuid": "0b68b70b-7b36-4e0b-bcf4-5a7fdeef7d10", "value": "1af6c885af093afc55142c2f1761dbe8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705124918, "uuid": "b49bc40a-bb6d-4a36-8953-eac8038a5dba", "value": "196608:ZqqMPAEuton3dDTeeNy+wfm/pf+xfdkRuBnfXWK6tSDrIWOIWsDaqkH:lDtet5y+9/pWFGREnfXBPDrIW1TaDH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705124918, "uuid": "96fd5292-968f-4855-952d-08cc9a9af307", "value": 16417517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705124918, "uuid": "5ced96c3-28e4-439e-b2fe-8cec40f48127", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705124918, "uuid": "9a4343aa-82d4-45ad-9d05-684e609832ad", "value": "ca120c365ddd0e24311e36e1ec5d4af6db21b0f2ebd6f7dfd0d6a3a730621367", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f6c946b-b207-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705145603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145603, "uuid": "6b78450c-1f10-4c35-be54-49cfa00efa4b", "comment": "Malware payload", "value": "f76b0f76284ea694d4ea1a745de5edf6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145603, "uuid": "3f38aa01-cc53-456b-8250-95d47e24847c", "comment": "Malware payload", "value": "ca335996d1e2bf6456f54cd3ea38208c22ae8e463268fbc0bab7525bb377ef6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145603, "uuid": "e24934f5-b7e3-480e-90ec-95c342193c09", "comment": "Malware payload", "value": "a5560a7e40d4c069b90af7d3b6ffb466f24fb6da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145603, "uuid": "c55f00b1-f0e4-4ae4-9c4e-e5ccc96f5ebc", "comment": "Malware payload", "value": "61b3880dd8b333d1b5aad7724aa07016f0739ea5207ba37e02a672f7b7a09fffc9d5222c756c157307dd72e02af2590b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145603, "uuid": "57452699-29ec-42e1-9d21-abf00ad3677b", "value": "T1F0957D0BF29288A1D1DBA3727477973C9E358F56ED728EA71E90FC341EB27508527212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145603, "uuid": "a41d5d15-bbc0-44d1-89e9-ca39f80c8628", "value": "12288:MNueTHXAV00LCW00ZE//F+YrgdXaK9GbAiOEf5pu0wtn5/LrjuGQQXA0KGG3lC:MNueTmLJO/9+Y8paK9GbXfXu/pOGG3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705145603, "uuid": "45c00e74-950b-4232-a604-d0ef4a4648bd", "value": 1974272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705145603, "uuid": "2ca4e0c8-55e2-4e2a-8e56-cc2384db1fcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145603, "uuid": "b8476383-60d3-433b-acba-07c8efc9ac0d", "value": "SecuriteInfo.com.Win32.Trojan.PSE.1XPQGU6.6046.10234", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14b8f336-b1af-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1705107602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705107602, "uuid": "4fe6a9ac-0e83-47dd-8406-a089eb92f9b9", "comment": "Malware payload (CoinMiner)", "value": "edbbe60d5fc43c859be7363de9eb5798", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705107602, "uuid": "4e9d35e0-a843-4f8f-b4a9-c00eb62cc762", "comment": "Malware payload (CoinMiner)", "value": "cbc0c90dfd9f0a4c60d50b18802a3b62724706d819a6cb7940c73f4f6cb7b319", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705107602, "uuid": "a2e90e2e-e5d3-4e48-aee6-ee25278f67d7", "comment": "Malware payload (CoinMiner)", "value": "7234f3293e278fea274d64e7872bd7b6aaf3a0ee", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705107602, "uuid": "dabf145a-1d15-43d4-8b9d-483684ec36ea", "comment": "Malware payload (CoinMiner)", "value": "c478b06610c4d3beb28e6813711a741f1f3fde8eb830246f18f801074ad336604b1c7e3355ad50fcca34427fe3f2f579", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705107602, "uuid": "e4e1b13c-f48a-4358-b6f3-e076986f4dee", "value": "T1ADE59E66A3A800E8D9B7C17CC9529613E7F2B8551370ABDB17B45B7A0F236E51E3E700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705107602, "uuid": "535a974d-d586-4771-8c64-83fac780c9f3", "value": "84c9afe62381050c8e60fdde0555e7e2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705107602, "uuid": "1e05ddc7-a757-4391-b2af-dc99c43dd572", "value": "49152:UI3SAT1kBuJ+ybYpqYOBFOpTqj9l2WjGoWjymlhvCjPyFkbyPFLFZWZ:PMybY6QymlhGPyKeLFZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705107602, "uuid": "b24e9230-c139-4be7-8d6c-d7a760a96027", "value": 3026944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705107602, "uuid": "c4430b3d-b90a-4d1e-a4f7-a5b89dc4dd7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705107602, "uuid": "0b1b31c2-917d-4859-b879-0721819ae6fe", "value": "xmrig.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a53effb4-b23d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705168833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705168833, "uuid": "e9cbb67b-b877-4981-ab5b-fa63230d7733", "comment": "Malware payload (Mirai)", "value": "97b78dd587988b272e224dbc2bd638ec", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705168833, "uuid": "766cc542-8319-4f48-b88e-410b71c7e327", "comment": "Malware payload (Mirai)", "value": "ccd2f22c48c5aa69ebc7739b14d625889acd660c7d77caae2da40ee6c07ef804", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705168833, "uuid": "c6d6fbbc-0ff7-4353-b00f-7d54c41bbc6c", "comment": "Malware payload (Mirai)", "value": "923683c2e4044265814c2abdf9bfe5585c4d9f7f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705168833, "uuid": "cbb418bc-7533-44d6-8def-e5db530de511", "comment": "Malware payload (Mirai)", "value": "6620bc72c4c853956e8db4457103fca4425dbfc3c998c86ecf46a6a1f3d7c559e6464d15c58fc3d2642bca0c0a702e59", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705168833, "uuid": "3a07a79d-7657-400a-8b3f-24820be560ed", "value": "T15BE31845F8408F27C6D212BBFB5E428D372A17E8D2EE72039D256F60378A95B0E37546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705168833, "uuid": "d8ec9dd6-ae8a-4688-91ac-e6c535610591", "value": "3072:+RKoOfW2WxDGocFMDF4lcbg/DhyKJBGjhGE:+RKs4CJ4lmg/DVJBGjh1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705168833, "uuid": "196ef46c-05af-4286-baf1-40af6b249bd2", "value": 146208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705168833, "uuid": "d297d711-c8f5-435f-b82e-9c8ca45eaf0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705168833, "uuid": "2f8e9f5d-7792-4ae6-b2bb-c9d19dd300dd", "value": "skyljne.arm-20240113-1800", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b8b3cf3-b207-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705145623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145623, "uuid": "55cb738d-d978-4c0e-8f6e-3073328079e5", "comment": "Malware payload", "value": "e603bf78a4b347843de65245b2d5a77f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145623, "uuid": "af0a3f8d-7af7-415c-9f49-91e805c0e39f", "comment": "Malware payload", "value": "ce8250691a678cfca0e40035ea064a03d1ea4da8cf4fb35b4acec9608673d0f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145623, "uuid": "254a5464-23c7-45a1-ad6b-4015e44a184e", "comment": "Malware payload", "value": "dd98be3949a357ba2b5d46664f5cb7a811a2fcc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145623, "uuid": "dd21eb69-881d-4c2b-8e57-8651ae3a88b3", "comment": "Malware payload", "value": "dab793086ed7f0da0c8884b21c6a496341177a662555a94fc046ec3b0bc9662ec12714bfbb5a1336d61ba2d6a928d9fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145623, "uuid": "ddd0b57c-4e1a-470f-988f-68c88b52b5f0", "value": "T10115AF53B5E380E5C3311BF30CA677325AB6E6C54B04EBD39644CE1EA9329916D3B1E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145623, "uuid": "d83edf38-a3cb-4494-aff4-1dc11655934b", "value": "12288:zzjJ7M8RUS6OPx5+jrL58zcbCEoqH5WJX7tQNJs0pLu0j:zpJ5mrL58zcbCEnHXpi0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705145623, "uuid": "1d997983-3a4d-4a9b-acc7-c36603ae0671", "value": 921600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705145623, "uuid": "1ba92150-4367-43a5-ae5b-494ee7d39c94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145623, "uuid": "c330db5a-0036-48a5-8346-377af5912fde", "value": "SecuriteInfo.com.Win32.Trojan.PSE.15IBL0F.30067.16080", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afbdb038-b1be-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RisePro)", "timestamp": 1705114304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705114304, "uuid": "da8219b4-4b64-4ed1-ada0-5a3b2227f98b", "comment": "Malware payload (RisePro)", "value": "b7d857756cb4fe584aff5972336c5b91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705114304, "uuid": "cffc830f-4e16-4441-82f0-189e6b88db25", "comment": "Malware payload (RisePro)", "value": "ce8d2e2881229050811cba64026a497637bebe32ae946749374eb1409e3b9bbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705114304, "uuid": "331a3634-37f5-4df1-b4b2-df7d7e75c4f1", "comment": "Malware payload (RisePro)", "value": "699e62699a4704775a9c9709c0d7eb96d9af61df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705114304, "uuid": "8968679f-8131-484d-b006-2c1b1f0cdb18", "comment": "Malware payload (RisePro)", "value": "5536dd528e755359771a48de842a8a07a79c22a836c6d18750b8f474ba408f4ac6898948a6a2ce4152e9d42be02d0219", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705114304, "uuid": "896060e0-8a0c-4742-93ba-93bb4fe6dc9e", "value": "T1AE856C31A741B462F86314B5725E57E611A235302B92C8D7F7C16FAEB2A2BD39334E13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705114304, "uuid": "005ec35b-21f2-473e-88f9-724f38f80ba3", "value": "a391c991ba6330d6ddb5beaa15ef064c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705114304, "uuid": "967da56f-5e87-42d9-9250-b24db39474af", "value": "49152:80ceOGgUYYEmluRKYoFh4kGWusbQnIyDi1E1uFnTKi/OjCCNG:1XOGgUYC4RKXFhrusbaDkE1u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705114304, "uuid": "d637a568-268c-44a7-9680-760b5ba05c19", "value": 1711670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705114304, "uuid": "7a6133bd-6cec-4394-ac0b-ba64f23ae1ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705114304, "uuid": "44c4a17f-1e7f-49e8-9e39-34b25c6fd9d9", "value": "rise.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "622ac528-b24c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705175162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705175162, "uuid": "2e64322f-5dfa-4bc5-8bfd-69ba5bc1ee41", "comment": "Malware payload", "value": "7fcc1dc3ce97bee84af0aa37369f1da1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705175162, "uuid": "f82015ee-ba60-4aac-bbdf-8231d2950508", "comment": "Malware payload", "value": "cef6ac9db0b924e1099909d7b640152cec535e8b1ac050fa0083609ee6d59d5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705175162, "uuid": "6f740b30-e596-443a-8739-6c2f4fe360f2", "comment": "Malware payload", "value": "0e587dc4dd234db858257da4300b41d3affa98d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705175162, "uuid": "1af79936-9e93-4d42-ac52-8304e1de347a", "comment": "Malware payload", "value": "ca1fa52361772cc4804855a08eeafee1d2b5ffdced5edffa2b2c078375931e807d47258b3e081c2742c9c0fc44bdc52e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705175162, "uuid": "e649b63f-1337-4d3d-8fc5-9ae27a4aff2f", "value": "T14FD44A16E5B3F060CD2F207A1669F32AF75A4CC7435198B682909BB62C315BB5DB8C37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705175162, "uuid": "73121b11-fb53-4d4c-89e5-21111218963a", "value": "41482c048643282f0fa54f6385f74814", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705175162, "uuid": "dc72451f-d42a-4a73-827b-b4823f3fcb60", "value": "12288:T6PqwuMqxv7S2aCAaxUJWWbwz/1Kvoch5Q7HNTRRt6qKAddHz:T6PqfECAaGJWq0jFRbPK8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705175162, "uuid": "5272f8d8-e940-43fa-8132-b92bc2f1045b", "value": 605184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705175162, "uuid": "c9d5f320-a4eb-44dd-9ad6-935137bf1671", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705175162, "uuid": "02aa5c61-de53-424c-bafe-b4e46b62afed", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d99d4a1-b207-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705145627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145627, "uuid": "77746271-3861-462d-96c3-c3447efd0c83", "comment": "Malware payload", "value": "b561a6dfb930d4b30c86f73b7a08f0f1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145627, "uuid": "af53435f-c2a8-4510-b863-9aa7c8a76d14", "comment": "Malware payload", "value": "cfc699b86000434581151d38fb3e66154956b10a518356ea578889ed03ee330e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145627, "uuid": "9950b73e-2332-41c5-b348-bb7afea34e81", "comment": "Malware payload", "value": "14ca356154f6a0852600457b756f9d12ae2ed3dc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145627, "uuid": "36768669-46af-462e-8dfb-137a6e127275", "comment": "Malware payload", "value": "9f84a9d300c7bae6e10e832598c76d21de11fcd43e452671c262fd82701251dd79d78787eb6b8511a2751b38d998111e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145627, "uuid": "3569da94-fd0e-41da-a78e-6103eee2bbd3", "value": "T16034C68BB6F3CD12C04C4D306876CF98DA62DE164D63838B75F67A4D9C32A415F2A46B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145627, "uuid": "97e2dc1c-3a5f-4c06-81b1-45f649199438", "value": "abd2cbf5614cc4e9858a82e77a6de82e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145627, "uuid": "82372367-0098-4656-bc6a-a05a0c2a3922", "value": "3072:9HRSmeiWtMKq/YrQNkQfLmeBoc7noMyttmJ:9cPuKq/hNkQff9ot", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705145627, "uuid": "dab78790-59f5-4904-b215-ca2063b5af67", "value": 251017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705145627, "uuid": "cd56f59c-9c26-4f61-bdfa-ddcb43d6e68a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145627, "uuid": "8735e975-3894-43db-8c58-90100d8ed5d6", "value": "SecuriteInfo.com.TScope.Malware-Cryptor.SB.24611.30958", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c996fde-b25c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705182025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705182025, "uuid": "cdb3598e-acc1-4481-9de8-bc9104def239", "comment": "Malware payload", "value": "3b153f7628bf050edaa9f97ed9bb6a98", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705182025, "uuid": "6ae80c3f-8897-4871-a6a6-9583cb02ccd4", "comment": "Malware payload", "value": "cfd2d6578d6b4de113cb84f2fd9786cbaf6d65c4624fe87d69541225be37c9ba", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705182025, "uuid": "4731aa8a-d841-4802-8041-07ef694d730b", "comment": "Malware payload", "value": "5f34a714c42c68f7982d596455c49b0a1913d9d3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705182025, "uuid": "e243e823-c300-4f58-b10e-2892e9a38beb", "comment": "Malware payload", "value": "0d0939db9899b80a171f0e681fbd89f58d4b97c390ea79095b5336aec862fd9027adcd41cae636df3c648223b97e4fd8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705182025, "uuid": "8c7cf88b-e7e9-4743-81d9-f5c1df83817f", "value": "T1D933280BA58181FCC559C17443FBB53AC876787E0239B1DA7BC8FF176D85E601E28889", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705182025, "uuid": "b77bb993-7fb7-4573-ac95-578d9a4f03cd", "value": "768:j7s093tGOHn2PAe6nCAQiGWexrecbwXg4ubt7We0E1rjWb57Vn7jOngg:M0937QAe6CAQ/WexKq1BZ1rs7Vn7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705182025, "uuid": "2aa1fd41-003e-4a9e-a432-5d5214139703", "value": 54528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705182025, "uuid": "d0c6c9f2-e26e-41ba-aa0d-98a68b1cb0ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705182025, "uuid": "b18876ab-ee78-41a9-bd69-a83d0789b177", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a53bbf9-b1d6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CobaltStrike)", "timestamp": 1705124469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705124469, "uuid": "7d67cde7-6ff0-499c-bb8a-33953f6e932a", "comment": "Malware payload (CobaltStrike)", "value": "f70f6b8dbb0e01e58c2475ab9a2fb2a9", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705124469, "uuid": "2f29cfb4-490b-433a-ab61-eeef9b347b05", "comment": "Malware payload (CobaltStrike)", "value": "d01571dfc95d39ebc3befdf691d2ce2183c84b82fc7d46904efe63c41222fc0f", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705124469, "uuid": "97ce4074-459e-43ad-af8f-87807deb8757", "comment": "Malware payload (CobaltStrike)", "value": "522443de101ac9aa44fadc344cd72af800f874bf", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705124469, "uuid": "c2afce92-184d-47e8-b5af-387aad9c9734", "comment": "Malware payload (CobaltStrike)", "value": "fa5931ce859ebed0031359cc00d94e6e3f5ff49d4faefc6b4b903f4b2b276cf7d7ad855194a34760cd00f66a4e9079e6", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705124469, "uuid": "e1076009-5472-4a27-9482-ef07f485b2e7", "value": "T1A2771232E4C56832F27A8233A5625452BC3FC08CE08B61AA35BC57DBF8B2D594F93755", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705124469, "uuid": "8a526d26-506a-4c88-bb97-1989bc98aadd", "value": "786432:Gf8UxAvKRxFr33w4PnwzHUWLfLdamgBeVR:ymCRxlw8wz0Cj8mgUVR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705124469, "uuid": "eeb9ac57-cad8-4567-b473-a852ef5a3b70", "value": 34503724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705124469, "uuid": "f72cbb32-54e4-46e7-836b-6a4f292e7d68", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705124469, "uuid": "c9fc7f66-8260-41a9-9358-a299f584517f", "value": "cobaltstrike-client.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2ef8901-b1bf-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705114712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705114712, "uuid": "0bfddc61-b73d-4185-81ca-30dd90999688", "comment": "Malware payload", "value": "b41541e6a56a4b091855938cefc8b0f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705114712, "uuid": "d65e96b2-eaa0-4bfe-a689-4397208f62eb", "comment": "Malware payload", "value": "d4c48762f128436fed18b9c714e55bf7360802127efb233ad31ec4b0f7f649b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705114712, "uuid": "66887742-ed4a-417e-ae17-60d96f73e6df", "comment": "Malware payload", "value": "8006b2728d05eab4c5d6dc0bb3b115ddc1e2eaa7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705114712, "uuid": "1cbf6fcf-9d46-4623-a083-6015de926b0f", "comment": "Malware payload", "value": "6a249ceaccca5137547de2cef567a633c1a3b671dde969ae6c5264ea69e446c81daef9fd614c867d1e6aac75a50a7df2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705114712, "uuid": "756fd774-3b34-4092-87ca-e32829090723", "value": "T1BAE23B07BF870D51E960AD38136FBA768776785B29129B97CB14DE6C043B381C53A38E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705114712, "uuid": "85d7f80a-94cc-49b5-b25c-60d3d9842081", "value": "4c85b38e2bed0a92c42939c0edada45e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705114712, "uuid": "b7ed96cb-c544-4d67-8251-a425cc1be4a5", "value": "384:ph8qCjcowiUJTIWIC0pc36+6rD5uH3XGJH3R1Dn/EMkudSGqoVU:fMw1JTYhCXXIXvr/JjAGx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705114712, "uuid": "15ffc23a-cf47-4ee1-b214-260e47ae3749", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705114712, "uuid": "81f74641-1570-49c9-b52e-8698d3b86107", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705114712, "uuid": "a792aaae-422b-4ee4-816f-bcd20d51357d", "value": "PCclear_Eng_mini.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88fdac4e-b1dc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1705127124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705127124, "uuid": "c80fcb8c-ba6c-47ea-8182-a067f0f37a92", "comment": "Malware payload (DCRat)", "value": "70fb9f7cfd496e8e0a18da0aa6a04be7", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705127124, "uuid": "224da987-179b-4c67-97c4-c05613f95f27", "comment": "Malware payload (DCRat)", "value": "d6334bcb9a937663f0c92b964d72f7d4febb01be11816c6140b211f8bc3df077", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705127124, "uuid": "a75dcd2b-6c9c-48a9-957a-4dc8c6d4c376", "comment": "Malware payload (DCRat)", "value": "89cb8ff7510233548e5bdc6b468b53ae52aba8b3", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705127124, "uuid": "7f2a4078-8098-4e33-b819-b4a75d498dbe", "comment": "Malware payload (DCRat)", "value": "7e9226a06b2e4addba14e95dd56614fb9deb8dd5bce9a46d428ca230e3c0bf15cda540db0682ad1de07b3cc2a9e21aad", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705127124, "uuid": "c2a9db67-4069-4ed2-a11f-04eb302e1cfd", "value": "T12995AE06A6A25E33D6583F7084D7002D62B1D6637512FF4B769F30A9BD076708F272BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705127124, "uuid": "510b141f-afb5-4798-9c0d-646c75ea365b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705127124, "uuid": "32c390f6-bd16-44e3-a4e9-08baca1e3936", "value": "24576:uk/LglG4uYiwwlr6bUX0CHs9ExpG6fX3ZXb1X9nLbdy0Pih4b6CLNkEGRWyJ7eU3:ukQ0KCOEhfPX9Fynh4eCLNVoBZxd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705127124, "uuid": "2d0c5c4c-bb84-4ebc-a38e-e89ffe80147d", "value": 1928192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705127124, "uuid": "a285a419-f7da-4e6f-8f82-48287bc4c8b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705127124, "uuid": "aed0ad54-5d12-44da-9ae2-2e592a928da1", "value": "70FB9F7CFD496E8E0A18DA0AA6A04BE7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7880a1e2-b1ee-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1705134827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705134827, "uuid": "e84f5795-fe23-4d72-bd77-a7820eb16576", "comment": "Malware payload (RiseProStealer)", "value": "4ced536bed38e5603cfd226990faf817", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705134827, "uuid": "c181b41e-b5a5-4336-bb99-dc70d678a715", "comment": "Malware payload (RiseProStealer)", "value": "d6af882c4e8a2f27eaf6f677d0baee6d79d6e5ae7243dbd37f601cd6a8bd20d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705134827, "uuid": "71dc45b6-4ed1-4269-9115-50d59a270d5e", "comment": "Malware payload (RiseProStealer)", "value": "70fff875549bc13630cf04d3f235ee104c9ca4d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705134827, "uuid": "0fdaa7c6-6156-415b-8a87-3e64b0e15421", "comment": "Malware payload (RiseProStealer)", "value": "27fca441056d0ace7260dab5a8dd92e60c176352d33b7668c30a7c01cfc0495c769aaafd6dd242acca8a456abbeb3d98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705134827, "uuid": "d4520772-d727-45e2-aa1e-47c0349d8d91", "value": "T1D66633506ED90848C38E9FB44A12FE2D35B37B762976841F79AC27CAD6FB6409235381", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705134827, "uuid": "8f99e70d-47a5-4ce2-bb03-8dd0500897f0", "value": "87ce1e59cdae5bab4f9695f88ee41664", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705134827, "uuid": "d5a42b60-41e7-4f6e-bb4a-bd7f0feb9965", "value": "98304:WtQfphduVdMOzlw0mWkCIoaZRQCO64bBEPicPEa75X0J8SGLn56XKjpOZP7Gf8oZ:cHVyqP2REKPicPn58GLnkXKlSPaF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705134827, "uuid": "b4da4ba4-940a-40b2-822b-dc3099b2b3fe", "value": 7075928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705134827, "uuid": "bbbbed72-6a91-4a8c-bcac-69e82b3b811e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705134827, "uuid": "94aed7f0-0fbd-4b86-bf73-563e50beb154", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7658066e-b1f5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (zgRAT)", "timestamp": 1705137830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705137830, "uuid": "67295e05-46bf-43f0-b020-0c5ebd957a45", "comment": "Malware payload (zgRAT)", "value": "8380e35dc946f11ed19253e553d60c0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705137830, "uuid": "80e13d96-0f31-45f8-925f-4c14006c2229", "comment": "Malware payload (zgRAT)", "value": "d730da5b598ffcddda0362bd012e675d26b4e30d7ff00501d02f6d76195641b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705137830, "uuid": "7c90709d-b5d7-46d6-a649-45857b7e8f02", "comment": "Malware payload (zgRAT)", "value": "4e9dd3015208a25183865cd1c0d7bdc8db8b737e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705137830, "uuid": "8d7048df-46f6-4fa3-9e11-6c928e7b4733", "comment": "Malware payload (zgRAT)", "value": "8382350d3d3575aa4fa86c586abf132f10f0f2587be5fc740f31efe559543489015ba3b5d22934e5da4730540a29de17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705137830, "uuid": "41ee3a94-2e9f-4980-9b51-9f617bfa3cd1", "value": "T1EF06D0423B984C62D5BF7335D1B3501983B5B0A3A363FB0F2D9981D85AA3BE14DC6693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705137830, "uuid": "08bb7e83-b779-4208-a984-e1d56c11bd6f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705137830, "uuid": "0d24ce2f-4c78-41fd-b8fc-cd85b1c9edbc", "value": "98304:xoF+TcBaf4d2bU5SHwVOjsxqvItGrkpiXAlpVD4//fSKILO/0jHNaqp+DiGHMwij:xoF+TcBaf4d2bU5SHwVOjsxqvItGrkpT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705137830, "uuid": "a9c97624-fbea-4544-a381-f7571cfdcd1a", "value": 3991672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705137830, "uuid": "33cc4b6b-eab2-4d94-af09-2576e743ed65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705137830, "uuid": "7369bb7f-f5a9-48a4-b63f-587f16eb61da", "value": "8380e35dc946f11ed19253e553d60c0f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43099a9b-b231-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705163514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705163514, "uuid": "8512f9b4-a70b-4397-9988-3b64326f21eb", "comment": "Malware payload", "value": "4b97365761a9dc3f40eb5514cb5fbbae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705163514, "uuid": "ff912349-a04f-4521-ac9a-b496cde821ee", "comment": "Malware payload", "value": "d76fb25db2209cf141b8d5ad864fa2456f0bc4825e6033ebb70f09a811ef095d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705163514, "uuid": "b3183ebf-7fa0-472b-a67d-5e775299d679", "comment": "Malware payload", "value": "79ab5d9f4a7dc43a2ddd76498aadf734d6d2315e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705163514, "uuid": "882a2985-0c28-4666-b15d-7bbbd4e49d5c", "comment": "Malware payload", "value": "9b46cd1b277c336932fb5cc5b239781555f2525adb3305a77ae3447ef84559537afd135577fa766b730e51702fd4c37d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705163514, "uuid": "65deac4c-a734-496a-b6c4-e8d02733a93c", "value": "T1D1836B33F1D27473C1711AB89D1DD266D42BBAE23D292A4AB7FF5E29CA5C2C1644C093", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705163514, "uuid": "cb3a48d9-523d-48af-9fdb-9b871cf3ea3d", "value": "1536:A8ujqt2QkTLBZdlnCd/S0piDukJj/6JGe3gMVw7MJ8Wh:Fv2zTLZlCBSqiKujiJGeQMVww8Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705163514, "uuid": "b87d3c2a-eb73-48ba-93a4-5968764fd59e", "value": 83984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705163514, "uuid": "3099b769-7730-4188-a0e0-9e2941444765", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705163514, "uuid": "c5f46204-2747-42a6-9a7b-71c0aad748cb", "value": "SecuriteInfo.com.Virus.Win32.Delf.9806.3427", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1b8b3ca-b255-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GCleaner)", "timestamp": 1705179215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705179215, "uuid": "96f1dce0-7e02-45b8-bf4c-472ae90cccd0", "comment": "Malware payload (GCleaner)", "value": "16215f850cc6407971327f3b474e6346", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705179215, "uuid": "cb6ee9e8-c99c-47ce-a346-be842e912a80", "comment": "Malware payload (GCleaner)", "value": "daa04918303463f10846507f938cc4f288de4119b710fad9dd894ddc3b383b0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705179215, "uuid": "112e3a98-ac4f-43cc-8d06-08c4699cf9b8", "comment": "Malware payload (GCleaner)", "value": "4cebc11dd5ca4a789b3a11dfdf9acd9c1f7253da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705179215, "uuid": "230bf81f-9624-4af9-8116-d1f73ff80bde", "comment": "Malware payload (GCleaner)", "value": "6ab4e6958aa38b614671d107f15c5861eabce31b5d58ec59c95d4128424ed9710320d294317e70cfef39ce94601cc5dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705179215, "uuid": "2fe95004-62dc-4d66-bf67-c191b6b3cfd6", "value": "T174549E1135F1C176F2B369768831C7A94ABBB8722E329A8F3AC4467D4F256D1CE25307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705179215, "uuid": "5ec85bbf-c3c3-4641-808c-43b40ec52494", "value": "5ed00a86888d3bcd71c89e026f9d181b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705179215, "uuid": "37b6c0be-28e8-4edd-8cc1-9e2700f582a0", "value": "6144:33CJZUAx/vg7vOvItwiXeEpcDLzYqY3UReILY:33CJZR/WvVN1c7Y7e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705179215, "uuid": "9586598e-50be-4b97-bc38-e3a72d4cdd15", "value": 292352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705179215, "uuid": "3a176170-b5f7-471b-a98d-555fb27f8624", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705179215, "uuid": "a4009438-1f29-471b-af6a-ee63721409df", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b221c67-b219-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705153273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705153273, "uuid": "b7ed643d-a90d-496c-822e-f24f79bf51b3", "comment": "Malware payload", "value": "15b260d5f735e72a738a1571a4a96b4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705153273, "uuid": "594babeb-aa57-4f6a-9459-1d54e50d557c", "comment": "Malware payload", "value": "dd0ec27b0b9352127440ef5fd3f4a497a064c6dcd444fae15ca20f7cbaca2d43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705153273, "uuid": "8041ae74-7287-4b20-875a-cd988357b3c9", "comment": "Malware payload", "value": "ec4aba797a50e669a9ec503d1dfc5a15a9bbe57a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705153273, "uuid": "38985577-2526-45de-b1e5-3ac58a86c08f", "comment": "Malware payload", "value": "e1e3517e9bbd93857b4abb37dd1feae2bc826415c0616cc845987d131dcaac73257955a92f1701b1338b99ed783b498f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705153273, "uuid": "3c839b74-09b9-4f78-a082-2c3692dcd0d3", "value": "T1295633761F001832C5CDB4F2C8899DA6366384C9E921BC4CFAE79A18DDDD8F565783AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705153273, "uuid": "a61729c1-d1ac-48a6-a8fd-be60847501e0", "value": "f9e4e52991070df47f71115af20a8652", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705153273, "uuid": "d521cdba-7b6e-48e9-b425-57504f75efa5", "value": "98304:5s4aXzeiPlTQ3PmTqlzdsZl5TGiPFsV7bvDdpEPnBg:5lOImGFd0THPSDDdsS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705153273, "uuid": "2c7b1d8b-1c0a-422a-869e-a6cd41ae4c2b", "value": 6055424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705153273, "uuid": "22d43b6e-b474-4de6-8dd3-8c1f35a650fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705153273, "uuid": "1d2324fb-2dab-473c-a8f9-2ba304b524ce", "value": "SecuriteInfo.com.Win64.Evo-gen.18134.1739", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d651e0f9-b1f3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (zgRAT)", "timestamp": 1705137132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705137132, "uuid": "984d47ec-10ce-42ce-a184-c1f27e3f3b43", "comment": "Malware payload (zgRAT)", "value": "b025fb2414e1ab51da37d339f6fe97ea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705137132, "uuid": "ca816d18-cb6a-40c1-8653-48d53c3872a0", "comment": "Malware payload (zgRAT)", "value": "ddc09112cfcb451a91dd29055de95c05fbb3a8c9f8d1160ca4d8383922d7e1cd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705137132, "uuid": "771d33a1-1864-4fbf-812f-9d8a28aa1ab3", "comment": "Malware payload (zgRAT)", "value": "b7974fb732c2e6450779f7b799e291160af4bce6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705137132, "uuid": "a25b4e50-8163-4c82-a5c6-dff264ade19c", "comment": "Malware payload (zgRAT)", "value": "e2de6eb2002aecbf48d1d881744f340553d224505a312cda74f4dafd6168307bb982feb37f5fc998bcf9d21c3b28c176", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705137132, "uuid": "c7ea85c5-c80b-4be1-88c6-871f7aeb1d2f", "value": "T10AD523285B68C97AC5DC5735A0D4650247FB860B9043FB8EBEC812F1895F768E7138BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705137132, "uuid": "446ed05e-d936-489d-8d0c-3ac7725bbe90", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705137132, "uuid": "1f034340-6c79-4869-b471-d63af96c418f", "value": "49152:fvYIGfewv7yCM0JWdbT2Nm68xvqRG3pBATVwaF7duoI4btwy63fs:fgIZy7yvPdbTl68xv4RV97EoI4F63f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705137132, "uuid": "25195a7a-eb84-4431-a920-142cee2acd56", "value": 2920448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705137132, "uuid": "71f74dd1-c192-43d8-8192-219a6dd5f7ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705137132, "uuid": "27128f30-89e0-405c-baa9-340ea25749ad", "value": "b025fb2414e1ab51da37d339f6fe97ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2138aa1d-b213-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705150572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705150572, "uuid": "e4b4a562-a593-4e7d-b35b-6b88b6454cc6", "comment": "Malware payload", "value": "d0b4588a2c2ac678b96fe4d08df57811", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705150572, "uuid": "42465f5e-9a68-4e24-9f71-c17cd9c12dbc", "comment": "Malware payload", "value": "de6542fa74721a47a4a04866b604b6633544427c66930c049b76bf5d5c786146", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705150572, "uuid": "d7531ef9-d662-4a0f-b862-f67a14720583", "comment": "Malware payload", "value": "2ab03a51d3c659e22de2b5bdb1cea1237b6e9a39", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705150572, "uuid": "df3eed13-9999-47df-8c96-663ef961a2c1", "comment": "Malware payload", "value": "0c95aea99478f69e2d6d90e6c4c26b7d7d1f787618812e6c944cead5928ee33dfc00539ac900a6a597dab2833babe5e8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705150572, "uuid": "a13352dd-37c3-4a50-a55a-decb6384d200", "value": "T178B52211E1C5A0F2C046447C11D2FB73392F7592CB65AD8B3BCA41BC8675EB53AAA34B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705150572, "uuid": "840ed55f-989d-45f7-8036-0fdb3d17f93a", "value": "bc7e59ca22c2d776ec736b2e5691ca67", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705150572, "uuid": "274d9215-e57a-4fbb-9636-9c626e6569c3", "value": "49152:DfIVu7fSss37iZOKlyyDiK+5M6qeUqiy4Ha:D+u7fSsseZxbr+XqeUqX4Ha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705150572, "uuid": "bf50d286-3f3e-4354-9614-db8d08be2204", "value": 2281472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705150572, "uuid": "483db6e4-276f-493a-b14e-1e803bb6356d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705150572, "uuid": "38f050b0-2716-4872-8114-9980dc3d5280", "value": "d0b4588a2c2ac678b96fe4d08df57811.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f231f18-b23d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705168822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705168822, "uuid": "75e4deea-ac1d-48d4-bfa1-0b49fc2269a8", "comment": "Malware payload (Mirai)", "value": "9163a74fa8161275eee4bf6ac89e75da", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705168822, "uuid": "c2c93353-43d6-4a7e-89e8-614acc2e42d1", "comment": "Malware payload (Mirai)", "value": "e219e89d603fe90c561dae8ad0ab7204ce49a96b00775c124378b20d79f67495", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705168822, "uuid": "0cd8fcd9-2c09-461c-87c1-7278dd0c606c", "comment": "Malware payload (Mirai)", "value": "cde40c5f79a257b7dbd6ac2795c2751fc0bec767", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705168822, "uuid": "0ac505f9-39bf-4861-8bdb-9828a5f57951", "comment": "Malware payload (Mirai)", "value": "942703f2aeb71d75e7f0561a501f97aea2c10f2caa7c6f4db8121b8d4b64d612920cb963cfdaa2a9165616bc3255e936", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705168822, "uuid": "be30d492-1ede-409d-8e6f-5d2e4301efda", "value": "T10C14D816AB610FBBDCAFDD3706E90B1239CC944722A83B353674D928F54A54B49E3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705168822, "uuid": "3f7716f6-3069-48d6-9d44-34de3326c479", "value": "3072:Nkj3SlGiQjifiI2UIkgYpsWySZflMjBuwHGV0:emlDiIxgYps7SZ9s9s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705168822, "uuid": "749ec4c8-0d15-4a08-9a07-2c5566fe2d99", "value": 194348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705168822, "uuid": "a77827ae-b4b5-4fcc-bdd7-7ac5aa91add6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705168822, "uuid": "597fc29f-2cf9-4fa5-b99a-ba489e3612e3", "value": "skyljne.mpsl-20240113-1800", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afbca8fd-b246-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1705172716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705172716, "uuid": "d99475d4-1b7b-47bb-af64-b714eb6d6274", "comment": "Malware payload (DCRat)", "value": "bf62a87bf418aec6aa6a3a1eca8119ee", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705172716, "uuid": "31681bc7-f630-4601-883f-29e93c239572", "comment": "Malware payload (DCRat)", "value": "e21eb4119978ec76259ccdffe25f75dfbcdf0ba17b350fd036e9bd0998cb6c1c", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705172716, "uuid": "3ee66cfc-e77f-4cc7-90f0-aa93b5f6b7d2", "comment": "Malware payload (DCRat)", "value": "4f194d696009f6b083b8bb0ab5e29a52d4f74c26", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705172716, "uuid": "faa93b54-2eda-4456-af6e-290be96b416a", "comment": "Malware payload (DCRat)", "value": "d680e69fa09f73eb36b006801b698ecb8212beed6277ff67609584e5d57c4d2f88d5259e297ad8d348555df5dc461706", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705172716, "uuid": "a533d5ad-5b75-40ec-a273-6718a34ce948", "value": "T15976122A528E15DFE79C48F34C9A8E4DB4B9F8C3658373893F0917729527E2B49D848C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705172716, "uuid": "4fa808f1-4112-426d-a4bd-299f986c9fbb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705172716, "uuid": "ed987a19-d4dd-4075-a842-7f4e7a403435", "value": "196608:s8jD9GeDVI5DKBWZlkgJedYs6LtYdEhqTgKD:s8jDkYVI5DK2NNs6LtYdEhSp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705172716, "uuid": "a038ac14-ab3c-4c31-8327-9b7022dce628", "value": 7149056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705172716, "uuid": "72f864db-9c7e-4ec1-bd2e-3874c4f9bd26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705172716, "uuid": "e62c1f1d-eb93-42fa-b8d7-e8907e84bcb2", "value": "bf62a87bf418aec6aa6a3a1eca8119ee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d82c1b4-b25c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705182027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705182027, "uuid": "7069c0d0-77dd-4064-b0f8-2b1d9e7babdb", "comment": "Malware payload", "value": "a950fff134ac5dbc78c354ba10646567", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705182027, "uuid": "abb0197a-d312-48b3-bbee-7bb2ce87b08b", "comment": "Malware payload", "value": "e31d2bf6ffd6b0a56648ae57ec82947d9a84c24e1129fa21ffbb61a24a75335d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705182027, "uuid": "6f404703-9cc6-47dd-88da-e070ab97745a", "comment": "Malware payload", "value": "5d1467ac72287ac066829b974d1360482bcd3a81", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705182027, "uuid": "c895e29b-6d26-47e4-a7b6-4396f129d1e4", "comment": "Malware payload", "value": "9c3a3a86e7cdceec06ecf43488cefc443e51a958ec75da4ef34a6d15b7af4bd866e7f349188bd47059e8c1d106fcee63", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705182027, "uuid": "768ab175-2333-491b-b2c8-7748429bd194", "value": "T1606371197F650FF7ECAFDD374AE9174620CC641A21A87B397A34D818B20B64B05E3879", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705182027, "uuid": "532ba745-b81c-4124-8047-44a2ec9c9e91", "value": "1536:EJ7dZCypJ9KoNPsOQJpLSeAwdsWWj4MLZLd6s:4ZZCypJ9BsOyc4u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705182027, "uuid": "4a5252d2-77d0-4ea0-9b21-1c9dea1cce8a", "value": 69116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705182027, "uuid": "65f68628-5ba9-4532-868d-ca500aabb6e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705182027, "uuid": "53401c83-4265-4fba-81fe-ece115ab9f28", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e044fd62-b205-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705144880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705144880, "uuid": "fd973a1a-1289-4213-b124-ed1f2b631d9a", "comment": "Malware payload", "value": "b2adc97fb13e3d468bdc85e5570f015d", "object_relation": "md5", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "EpsilonSpaceworld", "colour": "#39C295", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705144880, "uuid": "228f0bfa-2add-4f5a-8c16-c7bf2dd7367a", "comment": "Malware payload", "value": "e426e96b82e3944c65f2d5af55e4cbcea75d5724443a582c09d14d6af6958ee3", "object_relation": "sha256", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "EpsilonSpaceworld", "colour": "#39C295", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705144880, "uuid": "783aa442-bed8-4587-92ce-11208e6b0a36", "comment": "Malware payload", "value": "9aa3104407abc44aa2c626876decfe86a41fa63a", "object_relation": "sha1", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "EpsilonSpaceworld", "colour": "#39C295", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705144880, "uuid": "47e0968a-0a32-42c0-ba6a-e7f6c554d1fe", "comment": "Malware payload", "value": "4d41c79c16939fe33847fef78d0269b7ca050edaf231b2879c3b9a9892027fad138f811cc1c280905bc3aca0ed9edca7", "object_relation": "sha3-384", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "EpsilonSpaceworld", "colour": "#39C295", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705144880, "uuid": "e6889cec-461e-4e92-a92f-207c2c2e22b9", "value": "T1F6E73386F141E637EAC32A33691427DCED9999C32F29FB436F11D3980A10B4B56B417E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705144880, "uuid": "bb6acfd5-355a-4365-bb55-cd3a86efda7a", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705144880, "uuid": "73509bc1-fd83-4d7f-ae06-b5c65f45568a", "value": "1572864:tm6SWfMKGuiksPxiMQJl+FdL69vYN7XO7P0hiz:g6SyGuirxiMQwdYA7X4P0Iz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705144880, "uuid": "b761d1e5-528e-4a6e-824c-b4a01727b05e", "value": 65511107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705144880, "uuid": "adcaaaaa-f910-4fc4-b15b-bf8c51ef6a63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705144880, "uuid": "1fd1843e-887c-48ab-8da0-2438088d1274", "value": "EpsilonBeta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b72d87e-b1b1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1705108579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705108579, "uuid": "24657230-4692-46ed-bb23-ffa1f78f447d", "comment": "Malware payload (RiseProStealer)", "value": "54eb094ed9ba8301403f707773f2f852", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705108579, "uuid": "e3924f02-c388-46bf-b5ab-c1d6e68e8f98", "comment": "Malware payload (RiseProStealer)", "value": "e69443a557cf565a4fc7481158c76a057543a045f3ac40061d08f42583517df5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705108579, "uuid": "e7aa1af0-b262-496f-a51a-6a043b301899", "comment": "Malware payload (RiseProStealer)", "value": "8791ae6ade56fe600ea6ff88d4755a17d4051c5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705108579, "uuid": "2a864796-8f4d-4f32-b720-82cbc0fecb82", "comment": "Malware payload (RiseProStealer)", "value": "df11599e8e6e149f7e39087d7002a500f028533f960f70e1ddfb9f124e0e4ffdf1f335c0a15f8bd32e7455a3a4f18049", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705108579, "uuid": "f90cd5d6-ae28-4f3c-a035-cb7e96dc4e44", "value": "T17A9523F636F806ADC1D423F50B7296B111E26CD5DF1AAED9E1D3AA2273139C10F92187", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705108579, "uuid": "4af6d2e7-cb80-45e6-9d00-1d60d2b5473f", "value": "1e453fd81736fddb1b5f5ce807c79734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705108579, "uuid": "78b9ef6c-741d-44da-a866-02a0c0ae03fb", "value": "24576:/ek1LwsKEyI86Aj1YwZ2jhKi4wjO9jtt4fjVhCOJ5mSy4Aw56GlQDH2reRIB:bp3KLUAjJ2jZOdtOdJIav15CRI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705108579, "uuid": "05d6f4ea-4b92-4da4-a677-77d10b25cb30", "value": 1875968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705108579, "uuid": "88214ebc-d6ed-4c28-ac37-20a3772c5016", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705108579, "uuid": "89de2636-b7e0-4dc5-85f1-89c03242e081", "value": "SecuriteInfo.com.Win32.TrojanX-gen.4619.10524", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "425eea9b-b231-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705163513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705163513, "uuid": "c2b00cd1-877d-455a-b7aa-83727e6b39d9", "comment": "Malware payload", "value": "2579352a5eafd3ed716b81c6be2228fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705163513, "uuid": "8f1cef15-5989-4688-a0c4-fa5e30697553", "comment": "Malware payload", "value": "e6de80bcf0f31583488ee04873c76c6a14386c937f81b5ad586d5dc0f5f262b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705163513, "uuid": "a7a02b48-8ea2-4b43-be2e-6e8b27cf88c7", "comment": "Malware payload", "value": "fec743d1e766d614c851d3d1fc3ea191c0e15b01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705163513, "uuid": "986735bd-a01a-4c0b-87fd-e37a161146cd", "comment": "Malware payload", "value": "43c16ceb02b3b49ef234c922456c550e23ae07c6fcb4c09f44e983af7b80e79385b53de1403777b429fd80f7829659cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705163513, "uuid": "982f68a0-c9a6-4103-855e-51d0867c114b", "value": "T1C9A2D5137A5B4EB1D95263F029A69376833BB9712F1063C3E3C6E56C0E251D5BD3390A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705163513, "uuid": "24db521f-bc4e-41ee-983c-6256d2199ddf", "value": "9a54687f9a5b39af8944d1cdf0863f3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705163513, "uuid": "3db78460-1dff-4f0a-9c95-9ab17484d7a3", "value": "384:EPUntRqbKOHPZDu6rdcFmrgkUKbEDSX1jIVL6kM7NsH:mIrqVSmwKbED3V2kM7Nm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705163513, "uuid": "ac9e3226-fe5e-4bb8-9494-6936d4cd9a09", "value": 21720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705163513, "uuid": "e2b813cf-6d9f-4b38-a497-5422beb5b1a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705163513, "uuid": "9c1a8639-d279-47e3-ada3-d97569786bd0", "value": "SecuriteInfo.com.Variant.Jaik.51938.15696.5698", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "951c55fd-b207-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705145613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145613, "uuid": "34766c3c-63cc-493d-b1ae-5979629f9cb0", "comment": "Malware payload", "value": "8a7d70eb9f40c74111993d5018b85ee3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145613, "uuid": "42856735-3d34-49b3-b2b5-b90a8da84239", "comment": "Malware payload", "value": "e793e811ed02dea2e88038d2dec27201f2754f6f9e3b21aeb3878acf8037fbbf", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145613, "uuid": "b9de703d-d652-4917-8c6a-1ff8ab380953", "comment": "Malware payload", "value": "7fa097fb6ae7b25ca21b0200b668f89eadc52391", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145613, "uuid": "721a3e38-4167-4ab2-8402-c4f28c0ec900", "comment": "Malware payload", "value": "fdd46afbcb484467b70c3df1a52c790173635949ea81bca59ed0c8882f46c54517a69ef9fc37dad76c04c9933db2329b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145613, "uuid": "c1377215-d47a-47a4-8e9a-ce69a53b67f6", "value": "T149A5BEC533D8C962C2F912300C522DC64E6D8E62FE9B556A7E4E721B9F779E02732D60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145613, "uuid": "8118c069-3158-4fe0-999b-adac22491c0c", "value": "b19af940941f5bd7a48cba6e7b0baf97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145613, "uuid": "94006d79-36ac-46ba-b208-ac9ee56f9244", "value": "24576:O6l9c4ly6I8obGV4UyDQtbXL7Pf9jgqFORKCdzRw//ejunoKCSghZfGu:Oc5lUXYrL7PFnsR/hK3qKPCS0v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705145613, "uuid": "0202c48d-9d03-4c76-88d7-4f97bef56954", "value": 2085348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705145613, "uuid": "e83c53a1-1a23-4d2e-b26f-6690b14817a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145613, "uuid": "04090332-9ee2-48d1-9378-a49491db5fed", "value": "SecuriteInfo.com.Win32.Malware-gen.1665.10087", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "188dd41b-b1d0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705121781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705121781, "uuid": "a33ccd50-f645-4f8d-b1ce-8a9ad0a440d1", "comment": "Malware payload (Mirai)", "value": "eaf0c255fcecda6fd54ea528401f3e18", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705121781, "uuid": "8e66f90b-1f96-4882-aa16-39a2e930150b", "comment": "Malware payload (Mirai)", "value": "e8252eb5cc52a2544b58fcecfbeff98f1f3995943bee4ed1e1369efbd7b3b269", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705121781, "uuid": "3d2725ef-feb0-433e-847a-ef861ecc29b9", "comment": "Malware payload (Mirai)", "value": "d2a84934a278be00c29266180820e23922b98f25", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705121781, "uuid": "c2850f6d-835c-4544-8181-bdb7e1aa6060", "comment": "Malware payload (Mirai)", "value": "a3a6dccd578d452f31e66dcb4a3b4783c8486427daf00ebced616548e9e762278e8d10e8f3ba7f93df00c3face957ea9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705121781, "uuid": "ecf9c8c3-b1b8-4dbe-b64d-ea3f9fcb9d53", "value": "T1B5F2E891B8855637C2E413BAB6AE4A8E373077ECD2CFB61BD9214B247A8151F0D63F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705121781, "uuid": "a90d1ce1-b817-46e2-8bfc-b768a272b664", "value": "768:wfF9lqm9G5sFIbB5tsKSp3iOpUVfaS9uku9I3Pj4bWVvoeXwo:0qQG5sAvtshQRX8VCVao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705121781, "uuid": "ce7d89a8-5de8-4320-8bf9-87e84995be63", "value": 35060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705121781, "uuid": "65727e6a-8b7c-497e-ae53-9a9024dd1127", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705121781, "uuid": "e523fe25-2fa0-4f49-b6a9-035ca894045d", "value": "a5.nn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4167b950-b1d3-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705123138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705123138, "uuid": "5ccc0beb-319f-4268-b8a3-f12dcd1e515a", "comment": "Malware payload", "value": "4b1d264d674d573b5495a4d54b884e48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705123138, "uuid": "08dd7c38-29c8-497e-952d-bb9aa5e939f1", "comment": "Malware payload", "value": "e8c8a3a8191aae5aba2939ffa4a0f6e63074a70dff705aeed8fd3f680416a5ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705123138, "uuid": "d9d388bc-8860-4b9f-a1d3-f1cc37c68f3a", "comment": "Malware payload", "value": "20c46ddf91a3e9400dbbc24ec51e2b9865e751ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705123138, "uuid": "1eeabd1c-4999-4316-b48a-431edec7dd3a", "comment": "Malware payload", "value": "18a697dece81b3d00cee14f4c93c120bc5568430570c942b6b326a6e3bed36f4f71db1fb26d9688be2663782f24dab77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705123138, "uuid": "b99c1598-866c-4d69-901b-dd59021f84f0", "value": "T16A562B43F86691E9C5AED1348636D2A2BA703C858B3023D76B50F7752F76BD0AE79310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705123138, "uuid": "ccc9ce96-52b2-44a1-bb51-d872adb561b3", "value": "f8e2c713d81010b110101bb31c01aa56", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705123138, "uuid": "003b3424-cfe6-4166-8baf-8c608e7e69fb", "value": "49152:varY/qsJigYn4SBjLUlUjfiqbaLOD2Jp8WHLN1EYc5aXSiwuYn9Q778z/mfUVNNh:xqsJ7LOoo5a07+1XzOqseEgnto2Lz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705123138, "uuid": "46fb265a-2f4c-4778-98f4-a33f23eb052b", "value": 6063104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705123138, "uuid": "1ca39025-c2dc-41dd-983f-11b24846498f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705123138, "uuid": "4110fad7-b622-492e-8e85-fa6c523f41af", "value": "httpdownload_s.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c40fd072-b1c0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1705115197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705115197, "uuid": "4806f150-433e-4176-a9ed-4ef139511be3", "comment": "Malware payload (Stealc)", "value": "2a9cdb1afd55681d8e2d5911d7e395cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705115197, "uuid": "8a2e8b96-d0ff-4a6b-8fb7-4be189e2aadf", "comment": "Malware payload (Stealc)", "value": "eacc93b234973aaaf3424812107fe56a1986be3a929cff5bf2bba67a045077fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705115197, "uuid": "2c2aaf1f-7e9a-4b61-9fa5-bd2b1c978d7f", "comment": "Malware payload (Stealc)", "value": "5161f665ecfcea2a3a71b910ff388b6b7041cc4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705115197, "uuid": "574f0f0b-d97c-4577-9eea-76c3ad2f21d4", "comment": "Malware payload (Stealc)", "value": "8aa55b7caa77662611f00d25f7ea95e5bffb9ac46fad52fa46b256a752c1470bf58ab6f3db3973d2da245a9ba374ec13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705115197, "uuid": "2e12472c-8601-43bc-8109-ac85a286d161", "value": "T1DAB5335249C24C62F5A21D70183A70E64BA11EB7A5C5E493D3C2FC985EF3741A38F6BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705115197, "uuid": "cf03e200-822f-448b-90ec-63d2b72b21e4", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705115197, "uuid": "4a6728b4-d67f-4da4-805c-21ca3dff41a9", "value": "49152:vp2s5FXQ4EmojLjCRELVf7Avil+dHIsLp1thIikN+6u2hsh:vvzX71oDCRAZUviAHImDqia7hsh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705115197, "uuid": "902b953b-f1c5-4026-a42e-fb6550674efd", "value": 2467258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705115197, "uuid": "827999c8-7434-414c-a357-8314c7c65c06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705115197, "uuid": "df7720b4-84bc-44f5-a361-17ec0ab0a41a", "value": "InstallSetup5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab84297b-b1c0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1705115156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705115156, "uuid": "e1c635d5-3464-492b-9bf4-b553720e35e6", "comment": "Malware payload (Stealc)", "value": "929309bfd9b22eeddc2bc4eb5f705bba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705115156, "uuid": "c970bc61-80a4-49a8-812a-2675fbbfcdd1", "comment": "Malware payload (Stealc)", "value": "eb8daa3bbd914c5356559929d7fd7e1132c9b0f7196fc12c779256bd4412c71d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705115156, "uuid": "534994b2-5cc9-4676-8162-fdac78b3b4c1", "comment": "Malware payload (Stealc)", "value": "623af0224270e4be9b7dbffc33defa47c8437041", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705115156, "uuid": "3ff2b595-f966-4777-a81c-f085a46000d9", "comment": "Malware payload (Stealc)", "value": "33f1e2eeb1113bee53a3865c923275b8bdb6df63b9367122d51f2ca78245680dbf4e27c917024b5538c75686e345195d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705115156, "uuid": "bfea81f6-c9e6-48b9-a5cd-fd7e3cd3973f", "value": "T1FEB5335149C24C62F5A21D70183A70D64BA11EB7A5C5E493D3C2FC985EF3741A38FABE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705115156, "uuid": "b81dd2af-c92a-41ec-8c1d-0a60c3a89f6e", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705115156, "uuid": "637ad932-ade5-4d14-95be-3f75a549774e", "value": "49152:vV2s5FXQ4EmojLjCRELVf7Avil+dHIsLp1thIikN+6u2hsP:vDzX71oDCRAZUviAHImDqia7hsP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705115156, "uuid": "2d952c48-ed68-40ce-87c9-a5d41723ce72", "value": 2467258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705115156, "uuid": "e302c6b3-19f4-4724-b9ad-753b4e66a27d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705115156, "uuid": "eee2483c-b5a9-48fd-877b-43fcf2138a21", "value": "InstallSetup9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ee8ddb4-b1c1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mimikatz)", "timestamp": 1705115564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705115564, "uuid": "a09ddc0d-2eb4-4e6e-94b9-a10dbcb45752", "comment": "Malware payload (Mimikatz)", "value": "db979c04a99b96d370988325bb5a8b21", "object_relation": "md5", "Tag": [ { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705115564, "uuid": "34153c3b-0842-4b44-aa4d-ad260c9be7f7", "comment": "Malware payload (Mimikatz)", "value": "ebf54f745dc81e1958f75e4ca91dd0ab989fc9787bb6b0bf993e2f51d9a2a5bb", "object_relation": "sha256", "Tag": [ { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705115564, "uuid": "16988db8-c742-4ffa-9b15-59f701beca13", "comment": "Malware payload (Mimikatz)", "value": "3da065e07b990034e9db78421672f70b63aa5329", "object_relation": "sha1", "Tag": [ { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705115564, "uuid": "26cc9e00-c64c-4f99-ace0-654cc81545f4", "comment": "Malware payload (Mimikatz)", "value": "d4efb6ae95aefce975deacb1a9e766851546a100ec7de5a2b6e11918e92fe8137ed5028720c9ec5526c630fea8b303f8", "object_relation": "sha3-384", "Tag": [ { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705115564, "uuid": "8e3bff96-0935-4abc-a82a-8947d894b384", "value": "T179A58D3ACE67FCE9176C3980A4143E5A1D6C265347B4665DFCC908B73EE4604CF2E6A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705115564, "uuid": "a53894c6-5be6-4a38-b2ce-19fa4a41784b", "value": "24576:1YQX2Q3g+GP+61ItrfKlOJySj2z4egGnRqWCUpmkFL4TLm:1YQXD3g7VuyNRIKH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705115564, "uuid": "a31d87a9-5d0b-4857-a790-9ff89f121b47", "value": 2204117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705115564, "uuid": "8dbbbad4-6ad7-461e-a170-46f6786d2f5a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705115564, "uuid": "8f028f19-51fd-49c9-8b16-9bfd90c678b9", "value": "m.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1dcd324-b1d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1705125126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125126, "uuid": "f364c445-fd15-4e71-b3c8-a5eaa2f5124b", "comment": "Malware payload (RiseProStealer)", "value": "2a87592968ce4e92eb8f5e4947889a03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125126, "uuid": "8471b690-1fbe-437e-9632-b00990bd73e2", "comment": "Malware payload (RiseProStealer)", "value": "ed13efbf4813b78569ee8f3d867b87f8de858ff0c66a816dcdd6be4197d36073", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125126, "uuid": "5c9fc007-f459-4fb1-a7fe-5e8c41bb43e2", "comment": "Malware payload (RiseProStealer)", "value": "41b809216dbe8f9b89fd71431a2ccf9ff0fd04b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125126, "uuid": "ff159c80-fe03-420e-8b4a-28a522fd5a36", "comment": "Malware payload (RiseProStealer)", "value": "583eddcfad2b1b7c0d2102a1b1a3d15436f0e4a65193d4312a2a7959995770e2661a9c3369380956071bb88e9a5e8c97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125126, "uuid": "f9130437-ae69-4412-bb71-b506b8f39ae8", "value": "T1D29522F232F8464DD9C067F10B318228A2E1BDD0DF056EE3E4D76686BB0B6D09B56427", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125126, "uuid": "589f0eb6-6979-408e-b8f8-a2c071ab9f5c", "value": "1e453fd81736fddb1b5f5ce807c79734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125126, "uuid": "e4531308-189b-4f40-87b7-36030ccf16e3", "value": "49152:H/3N+Risq59lkkcV8MUXNFbiaor8da9y2betn5/61K:f3uq59l/K8HrhLa9y2atnY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705125126, "uuid": "738ca500-46e6-4613-8ba4-76d55b996f2a", "value": 1875968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705125126, "uuid": "108b644a-238a-4897-abfb-5ba3a829ea94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125126, "uuid": "031cfdb1-f7a8-4a59-8e51-20edb4377aed", "value": "2a87592968ce4e92eb8f5e4947889a03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c94b93a-b23d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705168818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705168818, "uuid": "38354fa0-663a-41c3-96e2-e56b2be89353", "comment": "Malware payload (Mirai)", "value": "d978a3684ecbb3343d5db2963217464b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705168818, "uuid": "e1453f8b-269c-48ef-9e31-a4097629837a", "comment": "Malware payload (Mirai)", "value": "edc00a0d58a53623cf9b7c66ead810251ad3df8c2d26f88e2fb18da97654634d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705168818, "uuid": "45d2846c-48fd-4af4-8483-70b8a7526700", "comment": "Malware payload (Mirai)", "value": "ac208d67aa111d5383318d385672d2f7032c4975", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705168818, "uuid": "8c706110-6be9-44fb-8981-1a5e3bc836f6", "comment": "Malware payload (Mirai)", "value": "c403c78d3e408081c9dafb0e6aa55e3c29e1ef876ab374e682b0bbe258e45b1cb52b1e5ff9c0d08d15224574c6c96933", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705168818, "uuid": "8df2e757-df00-4c38-bbf4-448db554de17", "value": "T1FCA37CC0F783D5F5E84305B5607BEB338B32E4B9212AEA42D3B95D32AC51451DA1BB9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705168818, "uuid": "77347fb7-5497-44c3-bc7f-60004fd29bdf", "value": "3072:0S1GIt7wDRWt2+YrhVJtcbbO/njYoYMM:0oBcDR3k2nrrM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705168818, "uuid": "c2208006-510a-4f1b-a1b5-e492dda3729e", "value": 103080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705168818, "uuid": "56e4393e-03c8-45df-a17f-8d04d9a5023f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705168818, "uuid": "b00e0572-ef2b-434c-aa4c-d92637ae1db1", "value": "skyljne.x86-20240113-1800", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e605195a-b1d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RisePro)", "timestamp": 1705125133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125133, "uuid": "ffc7f518-89e2-4e76-87cd-b700fec2e192", "comment": "Malware payload (RisePro)", "value": "d8c8a6f9bd5063d123ea3d172d3e78f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125133, "uuid": "077c090f-72c6-48fd-afb0-2b977bf2e6cb", "comment": "Malware payload (RisePro)", "value": "ee1351675c5763a3cb520b9f220ace814b0c5b2ba43810d682f4f3c6c8e90080", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125133, "uuid": "53ee2fcc-4525-4016-aa9c-b0d6278f1095", "comment": "Malware payload (RisePro)", "value": "a9e2e942f4738171e53d5749402f8102e3311945", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125133, "uuid": "dbdf605d-a411-4d8d-a7cd-801ad97fb276", "comment": "Malware payload (RisePro)", "value": "cc4490707c7cd17f243431ed1b0dfc760bca96c0ba67826c7eb29ea29fbd9993c25ce3196bb69f9db83313ba37f094ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125133, "uuid": "f6992a94-337a-44a7-997c-7c3c6600b9af", "value": "T136856C31A741B462F86314B5725E57E611A235302B92C8D7F7C16FAEB2A2BD39334E13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125133, "uuid": "d2072e37-e893-41cd-a5fe-e80669d1de2c", "value": "a391c991ba6330d6ddb5beaa15ef064c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125133, "uuid": "df1a4160-2883-4105-bde4-9803bf212137", "value": "49152:80ceOGgUYYEmluRKYoFh4kGWusbQnIyDi1E1uFnTKi/OjCCNG:1XOGgUYC4RKXFhrusbaDkE1u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705125133, "uuid": "de8463eb-2160-4f07-b2f6-078ab73ee767", "value": 1711550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705125133, "uuid": "c33be506-6ff5-4b80-8380-ca9bf24cf6e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125133, "uuid": "d3aab9b1-5253-43ac-abd0-91a14a5b9daf", "value": "d8c8a6f9bd5063d123ea3d172d3e78f5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa110456-b23d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705168841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705168841, "uuid": "9a653370-e663-48c4-8a6a-b11721169db5", "comment": "Malware payload (Mirai)", "value": "2801f0bed404c8d330ac6a1df06e23e3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705168841, "uuid": "30307b6c-c6ba-47bc-8e9d-14397587ae86", "comment": "Malware payload (Mirai)", "value": "eef72d3a76062adc7c59d05d8c3c9df020df0cdf861403314615d78656e3111c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705168841, "uuid": "c14004b0-873a-4dbc-94ef-7bed73dcfeef", "comment": "Malware payload (Mirai)", "value": "2063059f3f4944c3a35f2f9212f19fb3159b31e6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705168841, "uuid": "7e472d8c-7f7f-42f5-8985-305c0fc8db30", "comment": "Malware payload (Mirai)", "value": "d21cab5717a86e3bdbb42982838aa942d71ee3f022d9d9e322fc8de59ec7f8493abe9982d14f85e5720ca433d3ca0b1d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705168841, "uuid": "713fbd42-a9b8-4604-9539-6a6230be49e7", "value": "T1C6F31A46F8819B11C5D111BAFE1E128E37131BBCE2DE72029D246F747B8A97B0E3B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705168841, "uuid": "e8b37e3c-7b48-4622-bf1e-2a89853dd1d3", "value": "3072:vlV/nbEFoUgBMjiXD+AmY/alRA2hNHoMCPl7iN4B:j/wyzqiXSAm6aTAqpul7iNm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705168841, "uuid": "1212202e-9cfb-4f34-8073-cecbf2870979", "value": 157724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705168841, "uuid": "cb5a4508-ae84-4399-af05-37904eb1649d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705168841, "uuid": "aad86707-2af5-425e-9832-53e05f48c90c", "value": "skyljne.arm6-20240113-1800", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f1859a3-b207-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705145629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145629, "uuid": "28d0d72d-66d3-4644-bc8f-39b0101c9ac8", "comment": "Malware payload", "value": "9f3390b50ee2a24a28717b3b507ce0ec", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145629, "uuid": "3566e08a-d9b2-4715-9244-df94e5531cd4", "comment": "Malware payload", "value": "f05e42c6ae657ed66ea3df9c20a9a2d44d523983261fc5ed9153acc8aa5faa4e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145629, "uuid": "ba95abdc-270d-4fab-9a38-443976a3b763", "comment": "Malware payload", "value": "73269fd261eef07c57e4775425a47cb927276956", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145629, "uuid": "d0340b0b-1b0b-4e06-a39c-ac3a5547eabb", "comment": "Malware payload", "value": "385736985cbe0d3f2191935a2c1defdc32e3507e744f7d9b725e2dcb4e5b5fa7f96fa398c943d7d6a22ab14ea7e32c4a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145629, "uuid": "62d2c3f9-d48d-46b4-a31b-4524ea1896aa", "value": "T1E3A5F140F9644B33D02B95B00876416CEF7A1AE03978D05A13E66F8A39362F9BF77359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145629, "uuid": "63e44879-0112-4ff2-906d-4b09324c768a", "value": "4ddf1159fe3a3135958852e6e0a7cbf2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145629, "uuid": "26aacb88-a639-4baa-b2cb-9ce8d0f824c3", "value": "49152:FRYdFQFziRBRQ7gGhDEMuetHmsjtPIG+RSntSFKamyDe6MMMvMMM:sMBy8D/uetHm61kSn0KaD/MMMvMMM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705145629, "uuid": "9bf73210-cd39-4e49-964e-5ae9d86f9078", "value": 2074482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705145629, "uuid": "6e149160-2ae7-408d-b8cd-a45e5816b3d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145629, "uuid": "76ca160e-1d21-42a2-8de8-41b7783a3416", "value": "SecuriteInfo.com.Win32.Packed.NoobyProtect.B.8734.27854", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c9d82cb-b1f5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705137867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705137867, "uuid": "582353dc-cba6-4dde-8177-403d6db1ded4", "comment": "Malware payload", "value": "75fa50a1aa79a6f5c0c7e197f20f4ce6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705137867, "uuid": "c9259bd6-eb86-47fd-ac03-6711df065e76", "comment": "Malware payload", "value": "f170855983aedcfbfbe7e174ecb08506b98ec4de7c8a9c1a7285d69fab52042b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705137867, "uuid": "f5fd1515-c85a-498a-8819-39f3a1deff76", "comment": "Malware payload", "value": "b5559766314d61e7743b6ba72d887ddd85490037", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705137867, "uuid": "514bcc6b-fce1-48a1-a639-4485d763f618", "comment": "Malware payload", "value": "ed72e567e07ed5802cd78d1df10cb23862f7a751af486d937551b88a61dacd10c87ff5cd8c9086ae448c85c4dd63a75b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705137867, "uuid": "6329dbe0-3c85-4e9f-8ee0-b4aac2553d01", "value": "T1BC85AE13B3819061EEDA8933DA46E3720A3B1D754123751F93D63E3A7BB0962573B623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705137867, "uuid": "8d3c4afa-3646-464a-b53f-4b0ed407205d", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705137867, "uuid": "2711ed98-1c56-4028-8f84-12b34e4686ea", "value": "24576:uqDEvCTbMWu7rQYlBQcBiT6rprG8aEIwVsrPpK3UJBmv3eKdNSx:uTvC/MTQYxsWR7aEIus7RM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705137867, "uuid": "f46121fd-d4d7-43ac-8271-555d89e55df7", "value": 1705472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705137867, "uuid": "43da9ce3-9b5b-4037-a1f2-520ecac3407f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705137867, "uuid": "a0e51c5f-fdf7-485d-a2f9-05a3a53fdd22", "value": "dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17ab4740-b1d0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705121780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705121780, "uuid": "0f6f877a-8f55-483e-bfdf-df419a0cbb2a", "comment": "Malware payload (Mirai)", "value": "8f8fcce0bda0d714d47515041f8758ad", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705121780, "uuid": "31904b70-30b6-45c0-9dac-b08641632ef9", "comment": "Malware payload (Mirai)", "value": "f24989340e5825fb5847a2ff0e7614bb829c41c45d831eac727b7ebb4229c030", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705121780, "uuid": "1f040c9e-a2a0-45c2-a8e9-bf86abc0427b", "comment": "Malware payload (Mirai)", "value": "d243ad0b855bf16998dc1ef790d7a6ba064c648c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705121780, "uuid": "69efbe86-c658-4b75-a98a-eb89824c7ab0", "comment": "Malware payload (Mirai)", "value": "bf5adb56f79797c30614bfe27abffbf6fa3eda99c42e519ee7d91b9714a281c1a417f785c41774a76224c8669b70fba6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705121780, "uuid": "c480da06-74f2-4339-85cf-6b645a1af4e8", "value": "T12E434A50F8819623C6D1127BF66E468D3B2213E8E2DFB3079D229F2137C686B0D67E55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705121780, "uuid": "5664ad62-26cf-4a6d-b62a-3728cc2a465b", "value": "1536:LH19uzlA/NeDAqH2ZppDg5hnRWkK0rf3PvRo+:LH1RJIXRnKGPRo+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705121780, "uuid": "ca64c83c-ea39-413e-a083-3a009e000cc0", "value": 59780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705121780, "uuid": "bbfebe63-a189-4863-8907-9e2296a94176", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705121780, "uuid": "1cd6ef59-c305-413a-95c4-db4bbbe46f4d", "value": "a.nn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e037a3b2-b1ac-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1705106654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705106654, "uuid": "4844fa85-4e59-4fcc-abc4-f671f291cf02", "comment": "Malware payload (Socks5Systemz)", "value": "ac6972985a05984237badc3664546f9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705106654, "uuid": "81d85c13-3dd4-4b34-afa2-92a73c237c83", "comment": "Malware payload (Socks5Systemz)", "value": "f28218b246e48139b99a1df852566ecb46c10a9c7484c83b780c36b8d11d2642", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705106654, "uuid": "10539e57-ce2c-42b5-b5b5-58a0b9adcf10", "comment": "Malware payload (Socks5Systemz)", "value": "e4902aae96c26848539d7216e631420c033e73ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705106654, "uuid": "dcbbe871-4d0a-4653-b4b1-18e9f1d6bc5c", "comment": "Malware payload (Socks5Systemz)", "value": "c7c06dea031c8136ed534a069c24cab251c378dd12a37c821886a62c2fa3f9b15ffb079397ef6a98ad2bdbc3153b8c57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705106654, "uuid": "a4ef02b7-a79d-494e-be49-951f7e84f273", "value": "T1D83633C3B552883EE01624723D3E64B9F683B9A22D7F704B199C0B8DCF6795521897CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705106654, "uuid": "a94688fe-bc17-49e7-a9b2-86a4555c48bb", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705106654, "uuid": "0ad70655-3e48-47ae-8e4f-899fa114c1ca", "value": "98304:QfGY3gJBerG5bOtumfy4kGGeabuuMTTzQteqW5zVaHi:yRfCtNcxabu975BQi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705106654, "uuid": "b56022a2-62cf-4f0a-86f1-1344a19dfcd2", "value": 4932980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705106654, "uuid": "8b66ed06-07b2-4fa0-a6cc-0fab281389ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705106654, "uuid": "ca1a7d77-25e4-4782-9e77-a15cd5dd7f23", "value": "tuc4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df733bc9-b1d3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PowerSploit)", "timestamp": 1705123404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705123404, "uuid": "4a2081d2-a192-43fe-b628-1ea8eaca8745", "comment": "Malware payload (PowerSploit)", "value": "af17a2c4c38621b78d2714dc18dae5e2", "object_relation": "md5", "Tag": [ { "name": "PowerSploit", "colour": "#4AC80E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705123404, "uuid": "22c80b26-8d5e-4969-bf4a-45d761ce4f33", "comment": "Malware payload (PowerSploit)", "value": "f2bc373ee9715d1d912b833393cf2eff89e9906133b2ff393a3a6f226e5279b0", "object_relation": "sha256", "Tag": [ { "name": "PowerSploit", "colour": "#4AC80E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705123404, "uuid": "b186aebe-49c6-45bb-a470-8f64b0cfbafb", "comment": "Malware payload (PowerSploit)", "value": "ee5ea8b0bc01150f10f89153a2671e468ec613b4", "object_relation": "sha1", "Tag": [ { "name": "PowerSploit", "colour": "#4AC80E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705123404, "uuid": "8d6498b6-6877-4235-a5b9-b9676d20ac26", "comment": "Malware payload (PowerSploit)", "value": "60131a21cec4afe393c07d645fa19239c8dce52f0dfe71253fcbce5ca4e3dfa6e612601723a0a397b51ae06fcc72efc0", "object_relation": "sha3-384", "Tag": [ { "name": "PowerSploit", "colour": "#4AC80E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705123404, "uuid": "049f9e0f-c7e0-4670-9026-7f2a35af445b", "value": "T19BE2C6403718A35D22C796B6798A94A2D62CC12790AC2C10F9DCC69C7FAFE79D47D3C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705123404, "uuid": "cc03d296-1130-40cc-b693-496b580ff633", "value": "384:2y9UvSw+vtCyVx+yFYXjaSb0gJuvPA7R1EqzevQFKPzBw8y5GlkWOr0I7:2y9Uvj+vMyVAh7HEhIKFw8YyLO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705123404, "uuid": "ea9e4289-27b9-4d78-9372-92e533f516f7", "value": 32635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705123404, "uuid": "7a43de37-615f-443c-b441-727397671415", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705123404, "uuid": "410eba6c-af70-4cdd-9118-670763cbb393", "value": "Invoke-Shellcode(1).ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31c9e747-b1ee-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705134709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705134709, "uuid": "1d35a942-025e-406a-a499-d84342a6e5c1", "comment": "Malware payload", "value": "384b2ac18cddb969833a02c55e429b40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705134709, "uuid": "3f25cfaa-d46e-46d5-8a64-d1abf547834d", "comment": "Malware payload", "value": "f416f82cbcdc80b86f31e6da7f2345a7ce8286a95926ff74997b5f3d5e7b4612", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705134709, "uuid": "9c1ec8c7-1ed3-44a0-8024-ff28162175cd", "comment": "Malware payload", "value": "b5ff4273e9b594fb905f49c42075f38da8c281ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705134709, "uuid": "5c83c6ca-a13f-416e-9893-dd26e5de2d9f", "comment": "Malware payload", "value": "40a508da129654d9df1d381dc757e8e3e422008e443dcf9730fe10dab33ed61accc1dd91b9219a7fc247a56ec13bec65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705134709, "uuid": "11ab8fdf-9e21-4707-b9d4-7bc9786b1c0e", "value": "T137B36B37F1D26973C1751A789D1ED3A9D42BBAD23D29299EB7FE1D19CA2C2C1640C083", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705134709, "uuid": "b0ce40c5-f6dd-48b9-a17f-a3025cdedde4", "value": "3072:Fv2zTLZlCBSqiKujiJGeQMVww8b2mcwcsncgtGFV3/:FviLZMSAuuJGRQYGj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705134709, "uuid": "7deddcf1-89ca-43b5-ad31-95876fc64a90", "value": 111496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705134709, "uuid": "2d8eafcd-f99c-4f1e-b789-fa8130ae5e8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705134709, "uuid": "0cba177a-4c91-4909-850a-2de72de6d000", "value": "SecuriteInfo.com.Virus.Win32.Delf.8750.1920", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15dd43c5-b1d0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705121777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705121777, "uuid": "ad5dfa3f-93d9-4e1a-b923-0841e207ca24", "comment": "Malware payload (Mirai)", "value": "bb5efa797ce2cff4e8fcf276b3c690ce", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705121777, "uuid": "179d4e8b-a4b6-4d79-a133-5e896d97d61c", "comment": "Malware payload (Mirai)", "value": "f44f36062bd39e8e6a230e718fc17469da15463f3c6805452e10e284b1ba1dfe", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705121777, "uuid": "e901d585-b178-4482-b647-8348575d9c48", "comment": "Malware payload (Mirai)", "value": "f79d3bf5c8a30bd7e46142803a9326f71e847ecc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705121777, "uuid": "d76c0261-22a9-402d-a7a4-414d8491ce6f", "comment": "Malware payload (Mirai)", "value": "784c420749f8720b71149c226e4be28ce6e7f22f114a02cafee9284f836e5b70c24b6026cdc0abc4bfb683fbb81689a2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705121777, "uuid": "2ddddae2-3358-40ca-a8a8-86f7f18fe3f2", "value": "T1FA73F516FB610FB7DCABCD3305A91B0139CC654A22E97B363534D828F65B24B59E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705121777, "uuid": "0ea9fe35-a5ac-489e-8574-87575536af05", "value": "768:+3AJ4ozidM3Ep2rlypnteJte/cejiWFROwru/yiZfs3XizI5Qkc0XcJtwoOIQ:+3AJ4oIt0tmcEiQGDZfsrQkc0foOp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705121777, "uuid": "190cdc67-8b11-440d-88e1-f140f03e6752", "value": 76392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705121777, "uuid": "d8c87d87-524a-4fe2-90e8-c4075583b59f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705121777, "uuid": "cc6cc67f-de5a-486a-a366-2fc5750217a9", "value": "mpl.nn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f03a3454-b1d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1705125150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125150, "uuid": "060d9ea8-026f-4e5f-841d-eb2bfbaabae6", "comment": "Malware payload (Smoke Loader)", "value": "8c5cc4977d8c7b04325681e440a339c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125150, "uuid": "c52a67d0-c35a-4516-a47d-b7cd22bbdceb", "comment": "Malware payload (Smoke Loader)", "value": "f484734dad45f045ff73d243147ae4fdf353553df6b1976392650630473b0b58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125150, "uuid": "b3623410-78cc-4c7b-abf3-485a961f93cb", "comment": "Malware payload (Smoke Loader)", "value": "cdc0f2d2c4288866df93a18cec972b6ea4944b23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705125150, "uuid": "1aa5c95d-8dd2-4724-aed3-cd1011c2845b", "comment": "Malware payload (Smoke Loader)", "value": "c53ecfd96d434f95121378d5e61852b55c8da96dd2be8439f44c04dbe0fedd39c047ee2ad5314a5dc26c65284813d769", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125150, "uuid": "789d72c6-533e-4adf-a798-53a43c34e60f", "value": "T18F447C1131E1C036F3F3657A5831C7B44E7BB8A67A76968F2AC81B7A5F216D1CA20317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125150, "uuid": "7f1cddc3-6856-40f0-89c0-1597591a82e8", "value": "d8dcb51c50d0ca58adf96a087830e3b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125150, "uuid": "687a2802-3ee7-4007-a816-f7d0fe898d28", "value": "3072:CBp0+j2liTED5ID9bJiJn1K2DxjnEI7o/ezRGMcealDZN3DRqpRvE:CBp0ODWJgeVU3lFN8E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705125150, "uuid": "c44a185d-2082-4823-b44b-8aaa650b84a9", "value": 270848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705125150, "uuid": "2073710d-2513-4fe6-9425-c32c1f7676c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705125150, "uuid": "d00be429-f701-4e2f-831b-2c72ef44d970", "value": "8c5cc4977d8c7b04325681e440a339c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b45f6a1c-b1d2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1705122902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705122902, "uuid": "44464e8e-6c75-4ee4-896f-5aa616a2b69d", "comment": "Malware payload (RiseProStealer)", "value": "632483faaa0a6d957f8b963479e3b630", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705122902, "uuid": "4c6bad22-e1e5-45ac-b927-bb640252d312", "comment": "Malware payload (RiseProStealer)", "value": "f4a2cf4251f3053edc1ebc3f53da8b2749c9c1a260d251ce00421b6db966fe02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705122902, "uuid": "315a44f0-ddba-4248-bbcb-8cffc1f0ad63", "comment": "Malware payload (RiseProStealer)", "value": "d643f78870aedb5d263d3033af1860e6686df49f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705122902, "uuid": "11c7c7e5-9db0-4533-b7e6-7cb762027b55", "comment": "Malware payload (RiseProStealer)", "value": "3d91539e87e8860ecf749c4fab9c0b832c4156a7c1dc45dbecec99339794baa971a2154205533915778edda9df1a9117", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705122902, "uuid": "8f7b79dd-7014-46c4-a722-2d3d669e7e8a", "value": "T1E39523F17BF9194EC5C20BF45B34A86456E4ADE0CF948ED6E0E32D2A770B5D08B2245B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705122902, "uuid": "0853dd2a-5366-4f3d-a7ae-e22f26b2c193", "value": "1e453fd81736fddb1b5f5ce807c79734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705122902, "uuid": "3fbaf7fa-1a9f-417d-a6c9-22b70f59b916", "value": "49152:o7eo0IQCBEiWCOaiNY09MjeUnpC/IEv17libK9YxXH:o7eXgiEOZNj9t2wT970bcO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705122902, "uuid": "437a719d-759f-4a1b-8ad3-1d277cb88ce0", "value": 1877504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705122902, "uuid": "a66e5c3a-4885-4ce6-9d60-a55f8a00166b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705122902, "uuid": "eb40aba6-83b1-4f32-bd3f-62983c679bf4", "value": "SecuriteInfo.com.Win32.TrojanX-gen.9214.17660", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8a9fd68-b238-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705166744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705166744, "uuid": "fa495910-b856-4068-91d6-aefc7b4565b8", "comment": "Malware payload", "value": "253a03bcc1cc33b7e8fb57ad66f6fdd1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705166744, "uuid": "5a3cf393-f1d4-492b-ae75-5851037734c1", "comment": "Malware payload", "value": "f5149cde57620a15116f2012dc026561953c94e521b622421f046edf202d1bb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705166744, "uuid": "29e7af99-bb1d-4b68-8d84-9e96462374b1", "comment": "Malware payload", "value": "aa6155744fd2bf047f3a6845ba6598c442c9dd46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705166744, "uuid": "4d4a659e-1235-40dc-a3ed-c94ea1fd60c9", "comment": "Malware payload", "value": "6041561b1e027f91c8c2e639ed62a89c1a02e15efa7b354ca3edb9bece3774663e7c00754d9cc1d66ea7f4b79fc30e10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705166744, "uuid": "c14b4a7f-3bbc-45a3-b88a-ecf97d44b4de", "value": "T1F8142D6A2118A008E7E97675AFB0EE330395FD9E5B24D1B275FCAE9337DE1772004225", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705166744, "uuid": "11202dfd-7ce1-4586-b50a-50c4a3417766", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705166744, "uuid": "c2aa8d85-db18-45bb-99a1-c8a2a2dab408", "value": "1536:w9FyxW1Z3IEQ2fTeFFEJ4EkCjX0BS4A/rg:w5DbzajEkCIBsg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705166744, "uuid": "c2cbc5a7-4671-4757-a57b-1244779ef7cf", "value": 204800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705166744, "uuid": "e42d65f8-4acf-4828-b65a-a6c1fdc92a67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705166744, "uuid": "493b9ff9-7322-48a9-ade8-7c7a491798d5", "value": "SecuriteInfo.com.FileRepMalware.6248.6174", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e55193f-b1ca-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1705119214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705119214, "uuid": "619f1873-54d4-4157-8e24-54241194b00a", "comment": "Malware payload (RedLineStealer)", "value": "43dbb23cc102ad60226a40a2e1ab5f13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705119214, "uuid": "cc1019ef-9836-4827-981c-23cdf06b4e2c", "comment": "Malware payload (RedLineStealer)", "value": "f5346e37264ae1e52d2633716853392999e4161ad4e5d6c05a709613199ac05b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705119214, "uuid": "74967aad-25c9-49b4-88e2-dc2d1e7f5d6d", "comment": "Malware payload (RedLineStealer)", "value": "55e9b9f8c56197c4a30c89a412aa2b37326213f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705119214, "uuid": "bb009d61-bb7f-41b1-8ae5-8be22a2e0fd7", "comment": "Malware payload (RedLineStealer)", "value": "c39768794a65dc7ca8edc4a113274d438137defdc3750bb57d7a5efeb4f05e50803f6f0c2b67287217a35bef2bbe1f4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705119214, "uuid": "ce465d2c-b805-4b63-bfd5-1325ea1d3384", "value": "T16794DF684B2DC67BE2AD8734E086568243F5860BD413FB9ABEB454F44C4B341AB135BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705119214, "uuid": "f08a3517-cab0-48ee-9f61-6729355ec7cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705119214, "uuid": "6d7ec1eb-856a-426b-aa0b-8a546f69811c", "value": "6144:6Or7esd+jSjMopFqBHZFf+4P5AbhmONniP5a4mbxYLpxz/VORrjcfePEF5cr:XVdPqBHZvybRniP5aRlY1hVurSe83c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705119214, "uuid": "fefbd09c-5709-4770-b69a-0a505fb76572", "value": 445440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705119214, "uuid": "88d28960-c049-4bee-a1c9-ce4c3c379598", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705119214, "uuid": "f9aca388-1fdf-4eb4-81e7-fc0597b9a3fb", "value": "SecuriteInfo.com.Win32.PWSX-gen.30340.23979", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87e809c3-b207-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705145590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145590, "uuid": "3f00b17b-2ab9-4547-a20c-63733b19b505", "comment": "Malware payload", "value": "4b0d18264f2838e7ae12d2d70f981df9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145590, "uuid": "117cde59-dc43-480b-a89c-96b3d78beda1", "comment": "Malware payload", "value": "f78cf61cbf4f90ef27eeb621f425486bddf294cda9b965d054fb6a4123f594cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145590, "uuid": "33cb0d3d-d6b9-4a81-8145-e828244a3d98", "comment": "Malware payload", "value": "eb8109aa1fe89cddf0e2806a9190d897e12cd932", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145590, "uuid": "a2120093-3194-4199-a0a8-bcf1e325cea6", "comment": "Malware payload", "value": "02721e95f5dc492a800992276b90a961b14e6ecaa82c5f5adbcaecafe65ebc176711171fc286aa9bd7fe99d0b80f46e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145590, "uuid": "4fd89290-5a1a-48a7-b5b1-d631f910c829", "value": "T181369E03EAD39552F6511A7108B367750D3C9F9A4B3381533B9CFBAE9F715328A1BA02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145590, "uuid": "0d1d1ef3-f35e-4e13-afc6-47f899019b5b", "value": "49152:c8TPAw1GTc9PdeJygaCJEh+Nvq7SpQ8WFokwiOq+s8KuqGaX0ToIBAUZLYdj:TeJyYENJFkJBAUZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705145590, "uuid": "f9c9e2a8-bdd8-4776-b1bd-6ca03e52fe68", "value": 5009408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705145590, "uuid": "cf6ffc16-0e3c-4931-a074-3c0551bfebe8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145590, "uuid": "1e89057e-a8c5-4735-9632-7ec17a7e01c3", "value": "SecuriteInfo.com.Win32.Trojan.PSE.1S437JY.332.27096", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96f46f4e-b207-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705145616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145616, "uuid": "ca722165-728d-49a4-9db6-4dcc11fc8cf8", "comment": "Malware payload", "value": "6d9a845cfabbd1b01c25de19086e013f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145616, "uuid": "ce298b42-7510-4e3f-ae49-296814d97b08", "comment": "Malware payload", "value": "f7e6444c42e1c6c40ccbaa088f886002cab822b39bc75daac30ce48b50726247", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145616, "uuid": "c7e0524c-4c94-4aac-aa24-ed6349741b7b", "comment": "Malware payload", "value": "21bd5160154ae7d16bac6fde17086596c21dcac6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145616, "uuid": "7e4fff16-252c-44ac-8cd0-dac31e13245a", "comment": "Malware payload", "value": "9a2b2b41d288e22341002eadd998ae638920120f6e4c7281f2b792503993bb487b9bc3683aeadf6dbf64184a3e480637", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145616, "uuid": "f1e85d9d-f34f-4898-808f-7a2a3949c071", "value": "T136C49E157D80C473D228273B84C29BB26B6AAD617E00C68367643F9D7D732995E2327F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145616, "uuid": "0de8335d-fb8e-4f85-8a7f-30b1ada6026d", "value": "8993d476b2080c54468f99bd1fb566ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145616, "uuid": "98a53219-99e3-4d6d-bfc1-b328fd49d32b", "value": "6144:G/k08+0V0BUl0vJF4mFSduql1QDA4X4SQCj+7mCQIxaaQJyJJcWpr7uql1QDA4XG:G7g0BUGJqfTCyxUJyzTCyR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705145616, "uuid": "f6a9088f-81f7-4f43-925d-e41dbc0eddf2", "value": 576317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705145616, "uuid": "ddf51092-0b1e-464c-b35b-6cff55d17c5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145616, "uuid": "b8c519c4-b816-47a7-9761-9adad00c61ff", "value": "SecuriteInfo.com.Trojan.Win32.Agent.11522.11566", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e5799b0-b1ad-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1705106759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705106759, "uuid": "271e70cf-3a02-4870-b4c7-95a43335f560", "comment": "Malware payload (Stealc)", "value": "008d1475b7ce694e3e9572002d20c4d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705106759, "uuid": "cf7279e0-29e9-4981-ba3c-08ae33ddd996", "comment": "Malware payload (Stealc)", "value": "f7f59e244cfca65e5a95831792366bbc2fb5c495d17546b768fb9c68ce3219fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705106759, "uuid": "783fdab2-f59d-476d-afbd-bb1e1dd407b7", "comment": "Malware payload (Stealc)", "value": "08b8b12302da01b25b84503728e139d66a42ea0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705106759, "uuid": "92cdef3e-bb7a-45e1-8776-1da3b60623a9", "comment": "Malware payload (Stealc)", "value": "9e9d11020cbaa67e7f9c2b9d1d495f385e95aacf5bfc294167c6d0690fe4bea512f5224629a5bfd00f91e84202293e68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705106759, "uuid": "d37ef9d7-08c1-4d31-bb44-c8dbccb3f4a0", "value": "T1A7748D5172E2C433DAE315358534C7B70A7BB8325929554FAAE42F7A7F303E1A621F0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705106759, "uuid": "d46a2b9b-d4ab-47a4-b7f0-0b9fdf2dc44a", "value": "827724b96058b90997eb88175402450d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705106759, "uuid": "29c72ae9-ee2e-40bc-955d-c935eb25ce57", "value": "6144:VT7fMxZHZLYQ/Zr2HQX5GLVGSmrofcKEA7I7z3hf3prKXqW:R7fa5se6QXRNWcKEA7I7Dov", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705106759, "uuid": "a988a646-ccd8-4f37-9a7f-990c0d92bae1", "value": 370688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705106759, "uuid": "50fa8c0e-c493-4825-92ea-3350305e4353", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705106759, "uuid": "63b4a283-17be-4f83-a418-6b1bbb159a1d", "value": "updHost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f2b128d-b210-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705149361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705149361, "uuid": "d23d59dd-d614-4204-99df-f4a4b676b202", "comment": "Malware payload (AgentTesla)", "value": "9fcfd49cab037d685a5237f4a8987132", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705149361, "uuid": "e612ee42-2cda-4bca-b53a-183520fc6529", "comment": "Malware payload (AgentTesla)", "value": "f94d06ef8ca2b0ba82d7b87527ff277b534c80e96fe8d7bff5fb0b8ebe4e65b8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705149361, "uuid": "a25d77dd-3751-4b1a-b200-cd2420fa8b4c", "comment": "Malware payload (AgentTesla)", "value": "556b109fdfa4e2d61504b34f6ffc9f45ad92f3a1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705149361, "uuid": "c5a0d123-1a3a-4f54-8dfa-5701f030eb8e", "comment": "Malware payload (AgentTesla)", "value": "24041f5340e67b70dbb0727ddda2f22858c25e52100db8ac7f55edfd163f50e519464e315e9d34ded9737b221b5d270b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705149361, "uuid": "a42f59a9-d262-420b-8e4c-372812a6b568", "value": "T134558C8377928011FEB691338AAAE51246786DF50123953E02DCB9ED7B781B2453BF73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705149361, "uuid": "9d5e6ca5-ef5d-4927-a644-0113c27006d7", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705149361, "uuid": "f16bbfae-4042-4967-af15-daf181733978", "value": "24576:FqDEvCTbMWu7rQYlBQcBiT6rprG8aZaxzcFe+vuapMrF8n:FTvC/MTQYxsWR7a4xuewuaq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705149361, "uuid": "89b6daa8-cff2-435d-8426-77aea0aa81ee", "value": 1318400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705149361, "uuid": "125daa24-a098-4bb3-bf42-43f8d450e10e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705149361, "uuid": "c4e941b4-cb55-4549-a99c-b3157872d0c8", "value": "z22C-2227450002.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "236764cf-b210-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705149287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705149287, "uuid": "e217fcec-3263-40c0-9ecd-94784db0da1e", "comment": "Malware payload", "value": "49846b0dd355b528ddc69f83fd9aea74", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705149287, "uuid": "47a3fead-41b3-422a-8144-7c447baac74a", "comment": "Malware payload", "value": "f95a62c40516626889628574eaf92d2754e1c926529a91f2b1a731b42fa45d03", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705149287, "uuid": "fe876b7e-a28c-4e53-bd6d-109921b7564d", "comment": "Malware payload", "value": "b54041ee2e8f67a8ad41a18232151071f570ba0e", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705149287, "uuid": "a4434a53-c716-45fa-87f4-d51424c98329", "comment": "Malware payload", "value": "45bebf1253af5fdf4919bf205a090d5ca4f10ba73f9805b93bf51d016c007c9f100b70a64ce510e070ca432f71c1c07b", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705149287, "uuid": "6ea70a3a-58f2-41e0-afac-6ac7d02c981b", "value": "T113C39543AA18526CC86EBA35AC2676C05A139DF1A5A2C3C67CDDF21D07BB6175C12FC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705149287, "uuid": "ffab81e1-b31e-4196-aa98-a3349dbfd562", "value": "384:dTjnbtRPNVHT535J7P1DXsq0EosoEt2foH+qtJAz0WY/OjITPkG0O1q3+MJvbDlY:dfbtBzDJzJ8q0EosoEkgk7uH0cMJvbI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705149287, "uuid": "d04a7d5a-6f40-4ae3-a4b8-838e6b1a6371", "value": 129024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705149287, "uuid": "3741ec61-cbf9-4dc4-b929-b47073c9fe4b", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705149287, "uuid": "e56d9517-6922-451b-b65b-a71ab27794fa", "value": "nxF3wienie ZZ2200439_pdf .img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83155d38-b207-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705145582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145582, "uuid": "ee80ae54-fc60-4cec-a7e2-691eee014e09", "comment": "Malware payload", "value": "340f048c5ecf9f1595503b75781181fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145582, "uuid": "b3da399f-2d95-4fa2-af4d-08375d0a140d", "comment": "Malware payload", "value": "fafb8fbec7a59dacf4300b96108032365bd5ea37b4a6906c386bebfc630f89b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145582, "uuid": "61b0cf4d-6aef-4160-8e3e-522271207898", "comment": "Malware payload", "value": "ef849a52d37457d28f6271de89ba3898457fdb3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145582, "uuid": "b628e5dd-5169-4620-95b4-839d46b41197", "comment": "Malware payload", "value": "5ceb3e1faa7e2bee97f0ff6ef86f1c332b380d386c391099877a04a43d0d3e4aa97d6eb29b54e2a461cafaf791ef102c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145582, "uuid": "e3871aef-112e-41f4-bf14-9ad83ded9cba", "value": "T143C46D16B9E390F6CE25F5F00CAA6776AE758A050A19CFC35354DD1C5D322809AFF22E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145582, "uuid": "0b084f9b-6749-425e-b1c9-df23f34d64d9", "value": "7db3826f27dc539ad97688047445f29d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145582, "uuid": "c88b02df-776b-4c34-b088-31404115547f", "value": "6144:uLlJi0cN0aWHi/YbHtD7qItOGRAi5Loku4SKn4cpPN4yA+vQH78s6Pzy6i:KSND/q17qItOefzS+j4y/Yb8G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705145582, "uuid": "acfbc7fe-e3cd-4778-8d89-edd3dcfb9966", "value": 577536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705145582, "uuid": "58880354-6345-4575-bf4b-8967c9d81e42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145582, "uuid": "1eee79f5-51ad-452f-bc55-bc8f024168a4", "value": "SecuriteInfo.com.BackDoor.BlackHole.15583.6530.15501", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "786f6c08-b1fa-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GCleaner)", "timestamp": 1705139981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705139981, "uuid": "91bfa99b-4254-474d-b53a-e724b3146fa0", "comment": "Malware payload (GCleaner)", "value": "623e41eaeb69f117691080e4ac4cd1bc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705139981, "uuid": "536b23c3-32d6-4ce6-b09a-6f903c9799d7", "comment": "Malware payload (GCleaner)", "value": "fdcf2c12cd0e232689188a7826c6a29e1604a5b98a77cb82690b581c049cd983", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705139981, "uuid": "68d96661-4899-4c79-8768-002f281c138a", "comment": "Malware payload (GCleaner)", "value": "dd330ae575e184f8955324a9d7c1e572306ae175", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705139981, "uuid": "ca1deba0-4504-4bc4-97d9-ab10114a3189", "comment": "Malware payload (GCleaner)", "value": "50615c44c73e91c703f690a0d61a6664c64a2269ef7e7434858c1334b55a4cddb7600ab569683b86b60521c3f0ba26eb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705139981, "uuid": "591c32af-da74-46c5-a924-178205159c7d", "value": "T19866229D683D85A3DD40F6E5BEE06C67E93813236B1BCD2D2E6CB2974A0D6C9170124F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705139981, "uuid": "730c011d-9ffd-460c-bc58-04ceaa6ad391", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705139981, "uuid": "a2d09b89-27f5-4c7a-82cd-801f211dda9d", "value": "196608:jBoKvFpMWN59w86tAWGmKCJWd4IZ82mb5p5xsxu+lpf:jBNvF6WN5i86SWGmpsnZMYu+T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705139981, "uuid": "4d0b954a-5abe-4002-a35c-ff7e5c911599", "value": 6947328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705139981, "uuid": "b06dd004-fbb6-4d9f-8a7d-12ac46ed7a45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705139981, "uuid": "16caf3cf-15b6-41d7-933b-30cc12c8ccce", "value": "623e41eaeb69f117691080e4ac4cd1bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12899b3d-b210-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1705149259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705149259, "uuid": "92a9c767-784b-4cbe-a6f6-8ab54f9da42c", "comment": "Malware payload (RemcosRAT)", "value": "5daa7319b2aaa040d63ba9075ce08d72", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705149259, "uuid": "db38444e-412f-4c13-8557-4ccaead9e293", "comment": "Malware payload (RemcosRAT)", "value": "fdf9b8a9bb4b5c3c05290c2687a22b05c3f3ce41800194ffc0a9485fdad307bc", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705149259, "uuid": "101ad7cb-e6b9-4823-93b8-0267e8ac22f3", "comment": "Malware payload (RemcosRAT)", "value": "410df93e347a277922528daf4aacd09dc301dd59", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705149259, "uuid": "10e00966-c6de-4b3f-9b04-47c8b8331b00", "comment": "Malware payload (RemcosRAT)", "value": "622f9b4889db7ce8a03a8804dfe8a7b361f38b579ba96cfe18671c65913fe899e658e0ad27e711a3ea407ff60efab04f", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705149259, "uuid": "6f0dc5e5-ef8b-4aa3-a49c-9309d64406d9", "value": "T1D375BF0333808065FFAB91B35B17E25067BD997A8117E61E13D82A76BEF05B1063E763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705149259, "uuid": "0fb0490d-5fd4-4713-819c-200be91aab92", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705149259, "uuid": "59db1328-84db-4fff-b580-389df3712d1c", "value": "49152:oTvC/MTQYxsWR7aKHgqKs31lHJ7MLdNXAcvYVzl04s8Z:gjTQYxsWRNHgqKs31lHJ7MBlxYzeI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705149259, "uuid": "e99506ba-a231-4663-aee6-6c1f11e6c57c", "value": 1664000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705149259, "uuid": "9a8465ed-ccc6-4bd0-9598-65376eb5e27c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705149259, "uuid": "30a03d2f-f137-49c9-88db-48f222edc2b5", "value": "z43FAC98656700.CMD", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9288ecb5-b207-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705145608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145608, "uuid": "9a69eff0-fa6c-4630-8728-6c44b10eccbe", "comment": "Malware payload", "value": "4a89934435a27fcd0dc0dc0d1716ea51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145608, "uuid": "4323f35d-d699-41dd-9dd5-b2702cf40a05", "comment": "Malware payload", "value": "febbb5ac05345f78674313438a23a8d38a14f9d0b887f36b24ec03805dacf4a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145608, "uuid": "54b1ffa2-330a-4a47-b51a-346af3315a3d", "comment": "Malware payload", "value": "8f0305d5be9c954bcd0fb4fc48232100f5443123", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705145608, "uuid": "8f4d6789-dfc2-4076-9449-26cd98ef1bd0", "comment": "Malware payload", "value": "86c672fba91997fddaf246b20fb21a3e4bb8849249d51e36c1e361893fa21d81be87a5036723c288004bc4fcdd92a4d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145608, "uuid": "16b515d1-840f-4525-af9b-2ed5f39e10c9", "value": "T1B4457D63E15280D2D247117219B357397F789B860E718BFF6297EEA81D631B2BE73120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145608, "uuid": "afbdd789-9864-42d3-8c49-3e57ab775679", "value": "12288:5el0N3WJf7B+iFHVjIL976sVurEQ92AMtkUGxrxK:5el05cIeHVjo97HVKEQ92A5hxr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705145608, "uuid": "16876bbf-c948-494d-9035-1c689c489668", "value": 1220608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705145608, "uuid": "23b41ead-0790-42d8-b407-443b676180ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705145608, "uuid": "455028b2-de5a-4506-814f-62ba37738614", "value": "SecuriteInfo.com.Win32.Trojan.PSE.1TYMTF4.21862.20113", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55b4c53b-b1fd-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705141211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705141211, "uuid": "0839d5b9-2b13-4223-b045-ada44d708b26", "comment": "Malware payload", "value": "190fd949242ee6bdcdc91d4dbeeb5e52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705141211, "uuid": "dc653d2e-cad1-4576-8f6d-7fab49548900", "comment": "Malware payload", "value": "fecd9038a0d707ca0406aab080cf73169e429397f1be9ee19b88b7d037230fe4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705141211, "uuid": "f4cece50-9acc-4a12-a953-f120756f6da0", "comment": "Malware payload", "value": "81be813c9552ce52980c48f28b0155aa62c6ae64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705141211, "uuid": "e77d0566-380c-4344-aafa-4d1f5ccc5ac7", "comment": "Malware payload", "value": "59ea66841f205993be686f5db777f42fe513576d98b73793c538febcb14c31182f6636176a921ad9f6d97aba18295714", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705141211, "uuid": "ed953586-3342-426d-a24a-1b045dda7f5e", "value": "T1BC749E9BE2B440B8D5AFD155CE45875BEBF2780A1224934F56F18BE61F23B33621E312", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705141211, "uuid": "ed929eed-e576-43df-8aba-931b0e82e7b3", "value": "6144:AXlRBVytvEVULkqL5WW0kpIB9kWo8UpRBCQeHVvlC10Uy3ofLx:APnOLHovk7WfaB8HVvle0Uy3ofLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705141211, "uuid": "1232b07a-af54-4333-bb87-72252934c274", "value": 366344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705141211, "uuid": "a72d8689-6d6d-43da-93d8-f80bae20e0a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705141211, "uuid": "9bbe5c0a-245b-4580-9268-6cf0bd7ea3fe", "value": "SecuriteInfo.com.PUA.Tool.Mimikatz.1166.30592.4902", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04eb1071-b210-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1705149236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705149236, "uuid": "cf2234b8-5824-4056-8d1c-afe328c5decb", "comment": "Malware payload (RedLineStealer)", "value": "3b0d2cceaf587b5f1b1f22039c58c0d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705149236, "uuid": "25a9b669-019e-492d-8e05-ea582db1edad", "comment": "Malware payload (RedLineStealer)", "value": "ff135242e85af66cecc8c8b7edada3d4c8abca12461a62465ee376e3ce3512e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705149236, "uuid": "039c2b5d-04f4-4d81-9922-e61501a453ec", "comment": "Malware payload (RedLineStealer)", "value": "a58808af8ebc59b1a41bd4d63dcecfc856462474", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705149236, "uuid": "a7241ee5-a1e1-4f48-b77b-56447d0914d0", "comment": "Malware payload (RedLineStealer)", "value": "df41f2040bd77f4b2ea4e1e473371fc84c4cb0c38b1eb61089b7b683aa6f8942346f4df1ea049b180847d161edc7a57e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705149236, "uuid": "728e8817-e695-4181-9c70-121eeb4c5257", "value": "T179B4F108E3A65F01C34832BC91AB095523B3924AB2B3F74B79BA21752D537ED5F923C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705149236, "uuid": "299daf25-cea4-420f-bd2b-b3084491cbb9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705149236, "uuid": "d24de9c0-6f97-4d5d-a8f4-b146739c4846", "value": "12288:jSk1ulPlXMDLBk1okWqjzwazUJM9H8cWyHGP:jSjJ1cizbB9Hi6GP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705149236, "uuid": "20bd6255-735e-49cb-8b55-c95db906f1d7", "value": 519168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705149236, "uuid": "1595c392-3977-48cf-94ab-dde161a03dfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705149236, "uuid": "e6761153-ffb6-46be-92b8-cc1e9d85b195", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f197a82d-b1f5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705138037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705138037, "uuid": "cd06c78b-d4a3-413d-a9cf-b39f4fe5553f", "comment": "Malware payload", "value": "6be3e8b51f47ae0b17f18c2978170c07", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705138037, "uuid": "c00e530c-2d77-4a19-9ad9-db4a783119c1", "comment": "Malware payload", "value": "ff1655bfc07b1d408aaf18728d64b3d1a57488e2219cc1848f1d33e80716d19b", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705138037, "uuid": "cfd596a6-b7ab-457f-84f9-328fd92402af", "comment": "Malware payload", "value": "c52d9ccd9448327419b5639b5c20d3dff082e506", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705138037, "uuid": "91b6f0d8-2a0e-447b-94d0-739da4cba72d", "comment": "Malware payload", "value": "9529e7d1d91e7171a79673945c53a4c6b4ee9d2a944815169148816e90c7e81d3e22101e86047dffe5518f2cf532364d", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705138037, "uuid": "6a6b7ed3-91fc-47fd-862c-7af5d0526c9c", "value": "T110627EB3E31EC09BE5814DD2D2B6500AF934F612D8E9631AF350ED46EEFD59AE848710", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705138037, "uuid": "bb80a26b-cc06-4006-b9de-190389f49577", "value": "384:r42j7XBXB8VpxV0fnflQnErFw1grdvtzibLQ:r4k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705138037, "uuid": "e1282376-0e0b-4801-870a-bcbeb798cfe0", "value": 15133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705138037, "uuid": "2db225bb-89fe-454d-8f02-89150d2cbfa3", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705138037, "uuid": "43c9e56c-4c94-465d-9b68-69f8d4eb6af8", "value": "6be3e8b51f47ae0b17f18c2978170c07.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }