{ "Event": { "published": true, "date": "2023-08-16", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-08-16", "timestamp": 1692230581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "b8d7f162-0b4e-4502-b584-8cb05270c755", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d18461a-3c38-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692192327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692192327, "uuid": "a29264cc-15c4-49b3-8b43-1e2477ddc61f", "comment": "Malware payload (Formbook)", "value": "fd1bbdea9f557c96761790c1077f598b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692192327, "uuid": "ac6c14c8-f39b-40ed-80ee-6909dfb6cf67", "comment": "Malware payload (Formbook)", "value": "032948bc1f91de998ac96af702ec58223c3b15d653b9fa7778163dd5b120b5d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692192327, "uuid": "1499feb5-8119-46ac-a014-91aa0b4fc0a4", "comment": "Malware payload (Formbook)", "value": "88a53b0f7ff699b17537bcd15e7c80077bf74120", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692192327, "uuid": "25fead46-9277-40af-9a04-8e365d310169", "comment": "Malware payload (Formbook)", "value": "0c6b7dcc3bb21ecb7777ffbcdd00d839b4221864c0b996e02f922fafc72bc5a28624d6a77d91b3fd90338cba087d5a31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692192327, "uuid": "cc5d7df8-897d-4ad1-96fc-52bc6698f0e8", "value": "T1F86423493695D2B3F1B542358F761ABB66A2E52C04B5371EA740CF4CF636261CF0E362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692192327, "uuid": "b12d942e-28b3-4cd3-8215-2d92b36c9ba0", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692192327, "uuid": "c08cd742-5d7c-4746-8ab8-f042dc20ad30", "value": "6144:/Ya69R/KbgtMrh9wWxe2wAoN3733u2mwD+7875yh+lP:/YHR/7tMtBxe25Iju25D+78FBp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692192327, "uuid": "9e78c364-814f-4f41-9711-aca5e49a6a1b", "value": 320291, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692192327, "uuid": "15cf6d44-e7fa-46e9-b3d3-398d93fd4b65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692192327, "uuid": "6a467e32-d90d-46e2-a6ef-300680f1041b", "value": "Account Statement JULY 2023_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8796861-3c0b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692173233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692173233, "uuid": "5ec3e00c-19f9-4b79-a8d0-5463c6265e84", "comment": "Malware payload (Formbook)", "value": "8e3a39f9dbdbc9515850756a6ccd3295", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692173233, "uuid": "3e338c58-b18b-4e22-8fc7-25245a991a20", "comment": "Malware payload (Formbook)", "value": "0461d361012179b4ea0e520718e3c18613398d440f73f0d555a92b1e98bb6df7", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692173233, "uuid": "c2b2e110-1bcd-497d-961d-26b814d09790", "comment": "Malware payload (Formbook)", "value": "90457e2ce8c60b66d646d3866af3bf5bc18e86f0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692173233, "uuid": "64359e6e-903c-43b6-819c-328d7653dd25", "comment": "Malware payload (Formbook)", "value": "66409babc3779bfb6ef8b7dfadf43e955373551c7042c547544e91926633fd2cc60c2fbe463fd5542cac6db05df5edd4", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692173233, "uuid": "a378baf4-591c-47a7-9ec2-46c192e6ba09", "value": "T1604523A62305629DD4B457B18C53625523B0A34FA1F0FB97FF8C2064632DEA91F52F8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692173233, "uuid": "0095ea27-f78f-4346-9713-5433469b3422", "value": "12288:DmL87+24UJeNdz2d6BNvurMkCp5bUoYQe9YX0/Gjb+99u7fL8:Sg7+2deHKdTw5bzYlKE+8cfg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692173233, "uuid": "9a2e44bb-f3ea-411e-8afb-71eca018e176", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692173233, "uuid": "2fb64a74-c9c3-486f-8263-6130fd9ff65c", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692173233, "uuid": "1a3df1d3-b127-4b36-babc-631d9e343dad", "value": "New Office Address.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "271c0887-3c3b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692193525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692193525, "uuid": "c35d6ae7-8818-487c-b87f-f1e465c5ca63", "comment": "Malware payload (AgentTesla)", "value": "aa8f56aa04ac6ca243004989f2da4b0e", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692193525, "uuid": "d3b5edb0-b107-42b4-adff-a9a8bec4c71f", "comment": "Malware payload (AgentTesla)", "value": "046b9b48f6913dae033d7edfe57a127fe2d35bbe2a6b20118d969b7367940b55", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692193525, "uuid": "12d14ff3-a37d-47b5-b65b-73976ae6c83b", "comment": "Malware payload (AgentTesla)", "value": "83501d1b8e5f31e703c21e3cfef7b0bb9f9708d0", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692193525, "uuid": "4676de1e-b78e-4442-92f8-12c3c854a33e", "comment": "Malware payload (AgentTesla)", "value": "e33df613cd50e3bcd23d368870e26f6864abd1a8784d358dbaa56c5b01caab6752363288059bbe0267bf813de84f41f1", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692193525, "uuid": "210fb1c6-aeb8-475c-8d4e-9bf1642cafc9", "value": "T1C2A4233757D916F613F664E769343C46E4B2C6A5C24C794343EBAEBC302A819E881CB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692193525, "uuid": "1480cdb8-89e7-4b7f-8723-6ed2b580a2cd", "value": "12288:sfHlGZfjWkoJFNNlFLxARRVVhFtaMc7R9vd6a4c0l8J:PjWjFlFSRRPD69H4Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692193525, "uuid": "83d01834-7cce-4373-bf8c-654d9dbe01c7", "value": 487340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692193525, "uuid": "361787f0-a7bd-4102-8ae7-50f1ded60c3f", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692193525, "uuid": "37186d66-f24c-4824-85e1-96d052b7edbd", "value": "Bill Of Lading-SZVB57987[2].pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f3a9f21-3c20-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692182022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692182022, "uuid": "df63c0f8-e956-44dd-a1e8-c34d72a16f4f", "comment": "Malware payload (RedLineStealer)", "value": "89d0f2333461140be663bdd62933f176", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692182022, "uuid": "4dc71360-62c1-4ef9-a764-e4d5c74aebf8", "comment": "Malware payload (RedLineStealer)", "value": "0488a72cc86b59cda7359ddbd9820ddd3863adb4de3be431d99f73b9debf2167", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692182022, "uuid": "3492e0d1-544b-42d1-9e6a-ec31d20b6ac2", "comment": "Malware payload (RedLineStealer)", "value": "9edf3e914b13744ba9e6e75a096ac5c92c84970a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692182022, "uuid": "2dbe84f8-1388-4589-b313-a8b1a30051de", "comment": "Malware payload (RedLineStealer)", "value": "f6e88bca24900878278ebd09c7297756d50faef06688688316a84124bd60f72b8d0a371ec4e494f07f9d0dd9a4a61c33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692182022, "uuid": "b22c99b8-3efd-49e7-83d1-7f5eca33230d", "value": "T18EB59E5638B4812FFCD520B972ACA42CD96C91B2072ECEDFB5E056DE8A244C1673C5E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692182022, "uuid": "a14eea75-35d6-49cb-bf9d-5db770e92e34", "value": "b1baadc7cd565683e6ca39782aebf267", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692182022, "uuid": "f6d1b71d-34aa-4fde-9d11-16f594639b0d", "value": "12288:pBVEc+MVqpMvp36SNjoo6WjK3W/Ii2DP6W4h4Lb1u/DjrxG/hWkcdZMLtz/U7ksK:yc+MIpMvpKpogDP6WccboM/FcdZMxkr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692182022, "uuid": "6428ca40-b0e6-4679-bae6-a7ef330cd215", "value": 2440704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692182022, "uuid": "decb5878-b591-4084-b22c-c34f57dee2bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692182022, "uuid": "9ef5af16-8f11-402e-9db8-dce9778682ab", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d16fc1e0-3c4f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692202400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692202400, "uuid": "2c313a22-c288-40a9-9d8b-7a30df80ab12", "comment": "Malware payload (Mirai)", "value": "8fac8ce6e898a87d223c9d9607953bae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692202400, "uuid": "0af4d2b8-60ef-40e2-9f9f-8d1da6c7df2b", "comment": "Malware payload (Mirai)", "value": "0554b88baa52d123a53008adb40515ddde53429a40507746893923900ca7c2af", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692202400, "uuid": "52bfd0c5-bf82-4b7c-827f-8a8d194a0501", "comment": "Malware payload (Mirai)", "value": "b8f662e64d696277a73ebda8e67b2a658a599d66", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692202400, "uuid": "82dce418-601c-4453-83a5-a6b35d504104", "comment": "Malware payload (Mirai)", "value": "62f0bf7ce981ba9a2021a40e5c984d55b26ea5ea40f4d9b3cad609a48ba84ce19a283bcaca275a6f8de405443a38846f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692202400, "uuid": "578baaab-5c83-45f9-847d-5c3a89f97bad", "value": "T174A2D00931CDE932D1B0D03AE23CC34BAEDB47A652FE317A1E18479DA48191AD3BE545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692202400, "uuid": "10de21e8-ff65-477a-a348-1bb4e486a790", "value": "384:Yamog4c6L5i4+stIW01vhQIE2TQKMpI8QwxZVFjfPnSbbhymdGUop5hXI:YToh/DxCvhdR4IjWVFbSfs3UozJI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692202400, "uuid": "ca9d9cfd-644d-45fc-b83e-f177acc8e286", "value": 22132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692202400, "uuid": "218955cc-72bc-4a68-a5e4-a37290ad0471", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692202400, "uuid": "1e4c4c78-d7f5-4910-9f3d-921dabff43a5", "value": "8fac8ce6e898a87d223c9d9607953bae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "766fda20-3c2c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692187215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692187215, "uuid": "cc5c74dd-fe79-45ab-bc6f-f352936ca6ee", "comment": "Malware payload (Mirai)", "value": "93af72fc78aea35182f29423c3b555fd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692187215, "uuid": "bc8ea348-3d61-4140-bddf-be480afc88ae", "comment": "Malware payload (Mirai)", "value": "057e91c066ed6968f76d0bc196c7a80c72877d19b44c6a3dc6d443aa76f4225e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692187215, "uuid": "512f9a5d-9b79-4217-befd-e32926d228ec", "comment": "Malware payload (Mirai)", "value": "55de600430e1d195e45e9318371c7ca281dc712e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692187215, "uuid": "484d2307-67d8-4b1d-bfc6-a808a8432041", "comment": "Malware payload (Mirai)", "value": "92008f2d4a04c5ea67fa56dc93ceb3b8932446f2c418a3a32368df68f5a627f22ef8bf3dc8e7faaa8388a4d05178932b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692187215, "uuid": "469a1169-ce05-490e-85ee-b754b099b9ed", "value": "T1FDF3A85A2E228F7EF678873447B79925975833DA23E1D684D2ACC1105F2039E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692187215, "uuid": "17695489-f422-42c0-b852-afcdea744108", "value": "1536:W72EWOR9EbQ5Cj93OFwX2WKtHlGv8TzzLFFBeoodNsmAAT2Hf5HkUK0RPg:W7hp9DQZpX2WKJFTr9odkBxHG0RY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692187215, "uuid": "5e1feafe-2907-4a72-ad8a-aa9e3c913536", "value": 165172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692187215, "uuid": "e8bf4862-4b49-4366-af0b-af6c4602c2a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692187215, "uuid": "68d4fc46-f8bf-453b-ab01-c0adca875fdc", "value": "most-mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84c75611-3c0e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692174354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174354, "uuid": "2d8520d2-6e65-4b68-81fd-e046ba865e27", "comment": "Malware payload (Mirai)", "value": "b77a641b966fb5ea8a6dccabaf258c0f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174354, "uuid": "450fd9e7-1845-4908-8afa-89d2077920ea", "comment": "Malware payload (Mirai)", "value": "05c13ff41730c65b5d57ef6877f4c84af60f2b416597eb95fdbb702c7e611c71", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174354, "uuid": "5b4ba456-dc82-43c5-9d85-1190215de7af", "comment": "Malware payload (Mirai)", "value": "47396693755f18a32f2ebc0ccc40891ec0cb05e7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174354, "uuid": "cc1dc1b4-a4d5-4ffc-9f09-6c0c1d89c828", "comment": "Malware payload (Mirai)", "value": "13a52afd79c5d64ad9a29eb8bb73df1fd732108421bd08754f4b436935712ba233fb52fb8db8858984ff499e76fc7d30", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692174354, "uuid": "6c3b956e-fcc3-41e9-b648-9ac0049d040d", "value": "T1A1439E66EA069D54C089417071B88EF93F52A1C483931EBB1AB6D676C007EDEF449FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692174354, "uuid": "59e205cc-8042-4d2c-99d3-2e0af931cfa2", "value": "1536:DaM69YRE1AR+lxkBwysKq8//JIiFTC9aEKiKwbZnN:Dl69YR9R+2rzqulFTylKwbZnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692174354, "uuid": "90ddf3a0-9501-41e1-bf48-ef71cd997cc4", "value": 58940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692174354, "uuid": "b6f39b0c-98e3-4663-af3d-583f264d7785", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692174354, "uuid": "ee499ce0-f470-40b9-acb8-3a6e4b76958c", "value": "b77a641b966fb5ea8a6dccabaf258c0f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38423a1f-3bde-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LummaStealer)", "timestamp": 1692153610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692153610, "uuid": "cb5a5a59-ffb8-4674-9864-514685c49405", "comment": "Malware payload (LummaStealer)", "value": "47699e23b8a46230799ae564517d7519", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692153610, "uuid": "37cd2881-1789-4195-b703-df5ba9adf1b4", "comment": "Malware payload (LummaStealer)", "value": "06810a7d576fc02e44a135364d1b17014081be39675bdb4b48f87799dbacf471", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692153610, "uuid": "270748bf-5c13-4729-ade4-673a64ca50e1", "comment": "Malware payload (LummaStealer)", "value": "ae3b67fd6908257d022d108da46d3017c090d8a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692153610, "uuid": "62679355-10b6-4cd4-8da8-4a5c73f8b140", "comment": "Malware payload (LummaStealer)", "value": "eb83e7a09eef1e34d643d11ef268baa4417f2f811e033f47b6fe99f542ce5dcc7929f230001ade09e401c9a42c70d155", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692153610, "uuid": "c52033ca-cc99-4ba3-822d-ce5d661486e0", "value": "T10C3537427EAEFCFBD07444306737A2E25B3CEC216991D14E72A37B1A653D193B508B62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692153610, "uuid": "751a009c-b89a-4bbc-bda1-63d98d48d8ad", "value": "4606eb005053033cc92ba026c87eee38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692153610, "uuid": "09ab7031-a036-4ad8-947d-94ccc803b606", "value": "24576:gb0yb8Bx4tSVuUXG4fM+hGiDucrhlS4e5ilD8Qj:gbT5O7U+h5FqiV8Qj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692153610, "uuid": "0a9abcd5-8539-4374-886b-75676e57094c", "value": 1091496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692153610, "uuid": "5067ff19-0015-49be-8ec9-0682915c5bd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692153610, "uuid": "1fc70c19-7f81-4e5b-a1d1-0a2459a3a5c3", "value": "SecuriteInfo.com.Trojan.GenericKD.67787843.30148.624", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb485ea2-3c06-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692171037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692171037, "uuid": "3ded6a05-8ff6-4998-a9d1-20004f5e22ab", "comment": "Malware payload (AgentTesla)", "value": "18e4acc95f088de4d64d6cae28178ee0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692171037, "uuid": "993341d3-1522-4935-b2ab-cc3143ae939a", "comment": "Malware payload (AgentTesla)", "value": "0877cf7e80ee477427ba3266b977b79d7fd61075473bdff7543ea2e8a3b13792", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692171037, "uuid": "c1b0d5ad-99f3-48e3-a337-ec5fa803a72e", "comment": "Malware payload (AgentTesla)", "value": "9847676546dfc21008a8e3ed62933b43e50be271", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692171037, "uuid": "d12313b0-7960-4bbc-9c8e-b91975d21f1f", "comment": "Malware payload (AgentTesla)", "value": "4756c5074fa07de8765f3d59bf6ff945b5f5c51c8a724da4363ae052ec670df49421c0e056a26b4ceca4f4998eff3ccd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692171037, "uuid": "911015be-2df0-4e98-b122-960032ee2535", "value": "T1BBD42216B2BD1722F17EE7FE04520A5943F5A0B79A62C34ECDA760E40E15F502BA1F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692171037, "uuid": "9fa52e69-734f-4729-b56b-f6bb4ab6f4bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692171037, "uuid": "1e405260-64ee-4bbf-bd43-9877228df146", "value": "12288:4ydV/OEZcquVce5RjjYl3hHHJLRV//kChTK4+9zaTquVF1Srzx:4yKEqqkcJhHHNb+zwf1SZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692171037, "uuid": "387e41df-cf55-42fe-afba-5a2c8ac4a05e", "value": 614400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692171037, "uuid": "00763539-ed54-4ce5-b634-567b0e011292", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692171037, "uuid": "28d293bf-983b-4545-a0a7-a3d1a66ffc6a", "value": "SecuriteInfo.com.Trojan.PackedNET.2273.10588.11727", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b1d0c0b-3bed-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1692160192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692160192, "uuid": "3d4f365f-7042-4b9c-86bf-5175079ddc04", "comment": "Malware payload (Gafgyt)", "value": "ed857c2fff1d1d02fe7041af742e89bc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692160192, "uuid": "ca42644e-7ce7-450e-9cf3-7ff0b866b93b", "comment": "Malware payload (Gafgyt)", "value": "08865b157a5e35a6f67904e41c80bf099463a5285474e4fda9ccdd2325907fd8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692160192, "uuid": "9d49eb08-3ab3-4775-a1ce-02bd75a5a523", "comment": "Malware payload (Gafgyt)", "value": "34614f10f633675026df81bd64c2419a2ba2fc4d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692160192, "uuid": "46b4ffe4-8e8d-482a-a21f-b3515984b9e7", "comment": "Malware payload (Gafgyt)", "value": "78a93aaae19c3d974d82b53ab8764192ffbd0f0ea168e266329a1eac709300bffc50dc64f2a3676d25d7932ae75aa06e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692160192, "uuid": "b6d78b1e-dcd2-4633-aff6-735674477f73", "value": "T1DBE3C972544CC6C7C02652B9A0DC9F3ACF7E72C7274A8D22BCD551354A83EAF790AE85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692160192, "uuid": "cc5989b9-4fa7-4484-8b57-2f98a0ff48b8", "value": "1536:UxjyJNRWftRibBNNKi9qfk7OPC2/Cf7bTlK+pK7DKrtwp+Vp+wEi5sz:ejy/Ryt6UiR7OPmbTk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692160192, "uuid": "0a7f1102-49d8-4ad8-8faf-bd88e364d78e", "value": 145504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692160192, "uuid": "3081e330-1c9c-4175-9221-c2703866d7fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692160192, "uuid": "d4f52f5e-2612-4c81-8199-54a3b80c8421", "value": "ed857c2fff1d1d02fe7041af742e89bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfd6eb07-3c1b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692180064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692180064, "uuid": "87a487bd-8a64-43ec-97a4-89f8a3066003", "comment": "Malware payload (AgentTesla)", "value": "75284e3895b268b75878277a934c92a6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692180064, "uuid": "4670615d-b387-4b16-b8b3-b4bbe264f2de", "comment": "Malware payload (AgentTesla)", "value": "08c72d5b6662812cdf075d5f112685478d2dc3bdd4334cec4302b90bfb3c8499", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692180064, "uuid": "fbf4d167-7546-4bd7-bccc-25b1497de387", "comment": "Malware payload (AgentTesla)", "value": "cd57d00269bf48e57916cbbaa2a73aaebebe1e81", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692180064, "uuid": "365887a2-4462-48e5-aa1a-365cda3b8515", "comment": "Malware payload (AgentTesla)", "value": "aa390f640e56b2c2f1ac35f08790194fb33bab5417bd664014a05aac4e30e8519b8a3dc6f13521b4c8c734448319c52a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692180064, "uuid": "0a33537e-1727-4bc6-883b-b344795b11fb", "value": "T1A9C423D4BDE78F6D787AE5724339B99423CB3B94A9601D6F4C530B841C48B02566FD38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692180064, "uuid": "525ae545-48b2-4773-a6f9-5e0ef0a8ebfe", "value": "12288:bLkFXGPYgFWnLF7x6tsCwvprDOYzsbRMPEVyJEFKX:bAV0FKF7x6tsCwvASs1MsVAX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692180064, "uuid": "6dd4c7d3-1d2d-48d1-a10a-c82d670604cc", "value": 543668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692180064, "uuid": "610b169f-e69a-40b9-9156-61db164a48b5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692180064, "uuid": "2820db7a-2eaa-4193-86ba-35c7703f7a89", "value": "SWIFT COPY.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3f7d57b-3c5a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692207102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692207102, "uuid": "4b73d339-7b19-4fca-9d8e-c2c44d98040c", "comment": "Malware payload", "value": "0ef3b323c2bcfa76a7bfe5df3ae116f4", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692207102, "uuid": "c44da702-5274-42c0-a232-cfbb5476c2a7", "comment": "Malware payload", "value": "09308b272fe4af5ede7423132d8a88c17308c5b6bf9106bba334a78e3f596bf5", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692207102, "uuid": "15273271-bfdf-4781-a917-f9de0274a47c", "comment": "Malware payload", "value": "759c7b0e04bdee0bf40f28c6e50db24d4c9e6dd3", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692207102, "uuid": "88a2145d-9908-4c4c-8a49-04c6a5e844f2", "comment": "Malware payload", "value": "fd0de14ce99c85a6e4a36ea0f2b4a2dcf490426d441e96128245b8b61ea528851aced2b30940bdceea9b33035b6ce1f2", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692207102, "uuid": "a50c599c-32f1-4177-b626-8884dfc2aea1", "value": "T18175BFF879047DE6266F536BDA96ACDC03B616639ACBA4CD8064B7C305A3375FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692207102, "uuid": "8f108226-f5a4-40c0-ac82-d64c7e1e308b", "value": "24576:+V7FPjmSbXifEpd2KJb7XKW0n8nxZqoMaBHXSapFfC7ZKJ7Dw97c0lpw5Md8NAms:R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692207102, "uuid": "da174621-8349-4943-bc96-9c7cae3d9c28", "value": 1607110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692207102, "uuid": "05a04dfd-81d3-4432-90bf-8366c50ec11a", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692207102, "uuid": "7333f80c-d6d4-4823-91d0-afd42d4f5da0", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.25086.22408", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d93d121b-3c18-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692178791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692178791, "uuid": "07f997be-74af-4b93-8840-02c425c9cf4c", "comment": "Malware payload (AgentTesla)", "value": "5366ae40d9c3310740d18e2f26fcc2a6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692178791, "uuid": "17c72305-c608-4d8e-a489-749316bcf84a", "comment": "Malware payload (AgentTesla)", "value": "0ba8b0616ca5557b8757e20eb42437aa439606de5ca3598c6a9bb7e48fddc915", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692178791, "uuid": "76143964-14a2-4d9e-a90f-64eaac54d5b1", "comment": "Malware payload (AgentTesla)", "value": "1d91ecb8668a2908292d7d0b2a837ca42c049ada", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692178791, "uuid": "9a8183ac-8835-4e6d-8930-ad93bc86f3f0", "comment": "Malware payload (AgentTesla)", "value": "da5fcf9b666d0b99ace2e0974399d350e78ffd053ea0c80093700823c8dcda1cce04cbc8c028e7ec415231793aad1094", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692178791, "uuid": "763cec27-260a-43ce-9c53-4b490ec90bda", "value": "T1B305D0A672F847A7E13A40B656246143DF73A5BB6066E5C5BCCE12F58F86F800A03F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692178791, "uuid": "6d2e4307-eac6-4866-a135-788f0ac64723", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692178791, "uuid": "d353a0f7-1c6c-49ea-a5da-2b689c711ce0", "value": "12288:1ZnDetz99A6bt12BoJC7pK2UzhxlIjbmBDZ3ajL5uJNWh3/HIkhDB:1gtJ9Aut15JC7I2qnlIjbuajL5CWh3f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692178791, "uuid": "8c488c3b-c8de-48b4-a4a6-87b262d312c1", "value": 811008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692178791, "uuid": "685fe459-e784-4c4e-b53f-ac11675f8a8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692178791, "uuid": "95e58286-41a5-4881-a69b-efc7226c6ff2", "value": "SecuriteInfo.com.Win32.PWSX-gen.13550.9985", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bf5b282-3c39-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1692192728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692192728, "uuid": "03105480-d216-4498-b26a-e3de6e026fe6", "comment": "Malware payload (AveMariaRAT)", "value": "5de4490597cf7afaf4ffff5348903e98", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692192728, "uuid": "931b11e4-fdab-4783-85f0-406bffedbab3", "comment": "Malware payload (AveMariaRAT)", "value": "0c5288180fae6a952dacb16e61d6fea611501a4b444d4db80e7f2f4be102da04", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692192728, "uuid": "b2d0dbcf-02be-4d42-8d17-8a84b5aa722a", "comment": "Malware payload (AveMariaRAT)", "value": "9d0297adef0ab2624fb43a4471da3db4118f3fd9", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692192728, "uuid": "bc7f224b-114b-4ec0-92da-f0fa7f81f190", "comment": "Malware payload (AveMariaRAT)", "value": "42f879406780705ce80660f74199eace83d8d9fff3b6d7d66c3a1f65a0d06b68af04f80251521a28732cd701e4df81f6", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692192728, "uuid": "8b36a4db-8353-4eb4-8620-e705dff91acc", "value": "T12884DF2B6AD251B8C1A48C74B7F961EE1AB6932F65016BEB609843F5CF1570E31031FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692192728, "uuid": "a6c88047-3d81-430c-a44f-c952edbea757", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692192728, "uuid": "ea503baf-28ee-4b40-991e-5e0ab3a3280c", "value": "6144:Ume7WPpL6mbNWo3lYMFWUZp+X4SE9zHt:U1WPpL6+WoiMFlZcX4S8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692192728, "uuid": "6b4f8406-0258-4592-8478-b7d1149b43df", "value": 373760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692192728, "uuid": "7be8bc47-d677-4779-8859-31823ca2ef4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692192728, "uuid": "577e2afc-7153-42be-9ebc-3dfb88a9db70", "value": "RFQ_No.8964502.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "763a7969-3c0e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692174330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174330, "uuid": "971b21f4-184d-475b-9beb-cb34f894a032", "comment": "Malware payload (Mirai)", "value": "22c16a8c4845c7fd819e1b458a82265a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174330, "uuid": "bc354f58-be6b-4459-b390-99e9f20a6c4e", "comment": "Malware payload (Mirai)", "value": "0d211e5f5a74ee0d3e9af005cf03bfca2914d54dd86271c2c2b5a5cdb8039095", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174330, "uuid": "beee6238-13f6-42ae-912c-89108c4155b9", "comment": "Malware payload (Mirai)", "value": "8fdba7639cb0aa51fda89a68083d7c71ccf30bf2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174330, "uuid": "ec4e7bba-5779-4033-85c3-0ab56b884ec1", "comment": "Malware payload (Mirai)", "value": "7b72d9f47f4a56f035afd5bc5a8f6a6bcb0869eeff0cadb7351cfb8aea3b5009e358e5c231ff188595c11c2b01071386", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692174330, "uuid": "512d1714-0421-407b-89d4-80327306654d", "value": "T13CF2E0813613E935EBE19838BDF3064497ED72A8E1D271153A005F92F4B7BD290F9C12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692174330, "uuid": "44c29f0f-0bc6-4d90-8283-cfe752512495", "value": "768:voQSQlBKEGEnHa1yIdZQ/GO83k/iDq3UIGk:nlBBGEHaTnQ/GO8U/ikD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692174330, "uuid": "2257bc93-30eb-4e82-a8b9-712e3db07414", "value": 35100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692174330, "uuid": "7d2e35b5-f315-4fca-bd30-3cfc54a92358", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692174330, "uuid": "13a957ba-13cb-4d48-9b96-e81728299f60", "value": "22c16a8c4845c7fd819e1b458a82265a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b4d04f3-3c05-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692170419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692170419, "uuid": "b09dafe2-5959-49fa-81fa-b7ebd0245b61", "comment": "Malware payload", "value": "6b2f3036a2fc5755058f96c59d2b7e9c", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692170419, "uuid": "1e32c42f-d19c-429e-b544-88686159f77e", "comment": "Malware payload", "value": "0d66e864ce967024678fdc919570f02fb3453f9589a6aaf407a2c9ae2db2bb6b", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692170419, "uuid": "a42ecdd6-ac27-4c8b-bb7b-d947ce5f2cde", "comment": "Malware payload", "value": "77cd59ab13304b5a98d727df790cb67d768d480e", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692170419, "uuid": "3a405465-4a06-4510-adcc-ab4c2d27e72a", "comment": "Malware payload", "value": "606e1810e15b202b69701ba5c89052de2f2e882cf4e47350c077ad7ad14e8898620812ee3e9ce48d2dca332d86b41901", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692170419, "uuid": "adfa9684-b4a4-4b3f-92b9-30df381f9fe0", "value": "T1E9D4238889E3AC89E2A7CD57FF7E06E1344871B005B7E05F5AF9D4961B3623EA030D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692170419, "uuid": "06312caa-b3b2-4492-8912-a743c3df7870", "value": "12288:8kpjDbmhaMN3YeoLBI/rn7rRa1p+o9Ko38HrDgvFxTeyYHKx5vmNYE3UKkj:9lXkDj/TRayokosLk7eOH+M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692170419, "uuid": "67025921-4322-498b-b9fb-709ddda740fe", "value": 617268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692170419, "uuid": "47655efd-7392-4f97-ad2b-1ddafcd60512", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692170419, "uuid": "c9653e34-c168-4fb8-ba5f-fa68de17c4b2", "value": "\u9493\u9c7c\u90ae\u4ef6.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d521bed2-3c2e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692188233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188233, "uuid": "1e3e483f-e0d5-412c-a69e-761d4881ebec", "comment": "Malware payload (Mirai)", "value": "6a1735a390745d137c57b5baf548d7db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188233, "uuid": "1e65d58d-112f-4b51-91f7-2065c05fead4", "comment": "Malware payload (Mirai)", "value": "0dd738a5e42c9d15ed475dce02bd2a1b336bfd50aefd955072b7a5c829aa67a1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188233, "uuid": "2f843a67-2b1a-4d39-8662-df9231e2a22c", "comment": "Malware payload (Mirai)", "value": "1a75b37463fd7894232587bbae0f914ca5bc697f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188233, "uuid": "87062c67-fc2b-402c-be56-c886a5657c64", "comment": "Malware payload (Mirai)", "value": "2db824cafd179a3a5fbc928ac0f89372f4dbd4229e0742384a2e92e599c039a6641c0fef84668f4bd1d67d609ddd2b4d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692188233, "uuid": "24ec9d7d-7662-41da-934d-c13afdefa212", "value": "T1C9B2C0CD61443184CA8D7C7C17CD4A674E6CA190BAED9B26E364CD9473BEA4F345D078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692188233, "uuid": "b47cd624-cb97-4b93-a921-ef877f9fdf18", "value": "768:obrQlS07dEv0UXqUhvQE+CXQKMQKCXBpbZqSWvJ:4QlS07FUXqIYSXQKqu9qR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692188233, "uuid": "612730af-1749-434c-9363-036a2d35bb6e", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692188233, "uuid": "5f7d6e5d-60df-4e6f-bc31-c3cd8fac3aa3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692188233, "uuid": "3235d5f9-4ba2-4fc1-8aa3-cc5b38869929", "value": "6a1735a390745d137c57b5baf548d7db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f0f0c27-3c0e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692174318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174318, "uuid": "4b646954-e3b6-41b5-9a74-defc015d5af1", "comment": "Malware payload (AgentTesla)", "value": "969d6eebf02a84227997d479c4e2793a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174318, "uuid": "45295628-7146-4802-ba55-bdc97cdddc31", "comment": "Malware payload (AgentTesla)", "value": "0de2922e18da3008988ee7d8b41ec2cbf8bce8f4429fdd21c51dfd5a2d23e11d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174318, "uuid": "6a93863d-2938-4502-9853-8875a6eb3fa4", "comment": "Malware payload (AgentTesla)", "value": "985b875c33140f531cb09ffb7ebb8b1f52afe4ad", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174318, "uuid": "25eec871-a0d6-47f4-90b1-7a19921b6c77", "comment": "Malware payload (AgentTesla)", "value": "44c7b93f8cd6bbddcdd208b3c0050d2229f2e7411970d2a51f6bed8af567fee23648239741c7e6957064a4ddb7e2cca8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692174318, "uuid": "8330085a-931f-4381-b349-96d2366755fc", "value": "T15C6423065A91E263F9F359B11F7A4A8637F1E9330290C62713602F9A7677E00ED0E767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692174318, "uuid": "1430692c-6e21-4284-a3b4-d8ce15d339af", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692174318, "uuid": "e7d6bb3b-b9b1-45f7-909f-2cd79415ed10", "value": "6144:PYa6Dt+c/7tKytUrsIOCIats3FUcxVZgOWMn1DBYuqXRzdyweWQ6e+jAu6/i3jm0:PYpt+c/7tztgrOxTgxM1V+XKS1NNm0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692174318, "uuid": "9e016673-1738-41ea-9d55-f66c7c0ab26f", "value": 333531, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692174318, "uuid": "45c8ff57-c95b-4f62-a643-8ec134473b80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692174318, "uuid": "b38c2f06-10d0-4925-b564-d160f6a9e491", "value": "Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbf4913d-3c1e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1692181373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692181373, "uuid": "9e5b6ded-b551-4f54-8932-6dc7f22d8b72", "comment": "Malware payload (Amadey)", "value": "2b0d27f3a0c2cc1cf6575e27e8ceea06", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692181373, "uuid": "30d54e8b-b1bf-4227-86ab-8b947dcebd8a", "comment": "Malware payload (Amadey)", "value": "0dfc65d1747e97aa8f387bac127f1839359352cefc169e008f58de2ff06dc49b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692181373, "uuid": "21f53f47-61aa-414b-bc88-9d5fc1d75707", "comment": "Malware payload (Amadey)", "value": "5a10e0523966fa052bce121f6914e419f1a93070", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692181373, "uuid": "3d1f35bd-3787-428e-a38a-99f170b0f7fd", "comment": "Malware payload (Amadey)", "value": "9c9a64c1843190563d5670fee958852a69a5039c7ed838653a4629e1e73e99db16070de231c91a31d0b03808fe218d52", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692181373, "uuid": "95d20c01-4e01-4257-b2e7-6390757e0cd0", "value": "T1D5152246FBE88027EDF5077099FA078306367CB28DB492972785BDA70973285263573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692181373, "uuid": "fa2b8f20-809b-48c1-b2b1-e668df1638dc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692181373, "uuid": "4fa83429-0157-4106-9c84-b9054c64c275", "value": "12288:sMr0y90cNXWmqLZ/89QQD5PmB7FKnxxeUiTL8OYkK+AuJVuL6dHTbE:oyLne89QSWRKxEzL81XEsL6dHTg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692181373, "uuid": "a20313ff-383e-4eb1-9c6c-710e5264926a", "value": 876032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692181373, "uuid": "e1031ed4-b32e-4bb9-83ab-453e895ec01b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692181373, "uuid": "f0319653-d07f-4e61-b075-651e701edf17", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "209c7ad4-3c35-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1692190937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692190937, "uuid": "f983d8b2-2ed4-474b-bee7-31e1aee4b1a0", "comment": "Malware payload (GuLoader)", "value": "8d5332901cb81f3bc447fd81324e06fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692190937, "uuid": "b06d2f15-7e8a-4163-978a-2e5ac219df61", "comment": "Malware payload (GuLoader)", "value": "0e2a143cde6a844347dc3dd88a9b8d1a88c928bf05e04ac1dc24746356b99956", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692190937, "uuid": "28390a0a-c51d-4b84-8e5f-ba2012095625", "comment": "Malware payload (GuLoader)", "value": "b9cd0544a70e3357a2f4f77525e73304531d1f43", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692190937, "uuid": "9f4792a5-6cdb-45c8-82ec-280a864ce270", "comment": "Malware payload (GuLoader)", "value": "f1e6045f5c8bf37517108e7ec5b8b20502f6b276db341d575e3424aef4ddbc83d13a1ec45401a68997d18191efc5f971", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692190937, "uuid": "f1505432-d3a8-48ee-9fd9-e83fbb74e61a", "value": "T176B49DA238D975AFDC2F5574035FEAB22AB55DD0738248AE4F80720D5C3664A80EEDC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692190937, "uuid": "430e03ed-3e8f-4f6e-b2ee-1eaeea3b4c6a", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692190937, "uuid": "ccee1dde-042e-4b30-9dc5-bd41293df56c", "value": "6144:sqjIGPZVheNA+ff0TU/hFMuBggOWwQVY9E+qxtJ5t01yvwyQjXELL6IVwbmyGdzP:phnhe2eIU/hFF9pRnJ5qA+j0Omjzyk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692190937, "uuid": "efa447cf-0ace-4e0c-8463-dabd79282d78", "value": 528472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692190937, "uuid": "1bb789a7-8e02-45ed-8774-fec75855fd0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692190937, "uuid": "ec8622fe-7095-487a-877f-2415d6c2fe98", "value": "8986-55-269-30_16-08-2033.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6cb889a-3c63-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692211026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211026, "uuid": "c32bc369-4050-4d95-8ef4-e21ecfea1c1b", "comment": "Malware payload (Mirai)", "value": "b3427f16d5f593a6cfc16335b123cd7e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211026, "uuid": "d63fcc76-324f-4424-90bf-d717a24116d8", "comment": "Malware payload (Mirai)", "value": "0e5f2dfddf0d18a79288c4906252b2496184d255d0298330da8283d2c49d85da", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211026, "uuid": "b12ebab5-3925-490a-888a-72deb0f62ac8", "comment": "Malware payload (Mirai)", "value": "013af8cf09c0c6018fa04ae9f53c36b7047c0347", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211026, "uuid": "064cac8e-3784-4eb1-86df-68d02487f842", "comment": "Malware payload (Mirai)", "value": "3693b43773c1c4ab24f2d6958158c5c397ca7b8046c57c240c73587acd6d76c93bc133a074ac7ab9084332f4010a65db", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211026, "uuid": "4bc9d1e1-cc02-4be6-a6cd-af16a748fafa", "value": "T17FB2D034D0A6A4F0CD32503CEA6AC642D7DBC2FDC0F9BB33115914B96A8294A656D547", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211026, "uuid": "f4f418d7-f891-46ca-a486-018e4bda1e90", "value": "384:AoBE5aNSS75BOI+ypZ5vTlYIwcvsdTf5MF1imRRf1usmx4S+BjPqrUzTYYhymdGs:waNSq5sOHpTqncvsdDePimRMxVUjzPxf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692211026, "uuid": "e52e2c32-9982-4afe-bf01-00d262690b10", "value": 23728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692211026, "uuid": "c476fa47-006b-44b0-bd28-767fbfa09227", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211026, "uuid": "25b1bca9-4a02-45d0-8c68-ebea5bbf57e1", "value": "b3427f16d5f593a6cfc16335b123cd7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "766cd6f6-3c5d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692208261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692208261, "uuid": "2830ec03-70c6-4aba-a2a0-1928d34ec8d7", "comment": "Malware payload (Mirai)", "value": "3143d24e18874c59805bd491de00e942", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692208261, "uuid": "3040ec30-820e-4b1f-8b16-6eb4c94bb695", "comment": "Malware payload (Mirai)", "value": "0fe2d78cc1df46281fc9cf96cbd079309916fa4fd5f8989c21309f403d154962", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692208261, "uuid": "a3ce1541-657c-4ce4-9eff-00f4ae37b5f4", "comment": "Malware payload (Mirai)", "value": "2859f40a04efba9e5d6372bd94c2735b37e3be2e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692208261, "uuid": "a985bc84-c009-4f6f-a5f5-8a75aa98e9d4", "comment": "Malware payload (Mirai)", "value": "49f36e8176c1dd4fe75d88cd493452ac0ca6544a11d0df52aad8d79f7a3e103426d46b9cc69a9e50663f6a7e33d1f540", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692208261, "uuid": "8651bcd2-a84b-48b5-8f15-b5def822efa0", "value": "T197735D24A97D2E26C0D4A17B61FB8361F2F6230E25B0965D7C760F8FFF2464468162B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692208261, "uuid": "e0717619-c3c8-4fc3-8310-5fc8a692523b", "value": "1536:5ms+geQfvznpCR8ee84cNsAUiAvFI7IlNnws8h:YwfdNu4cmZvFqI3w7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692208261, "uuid": "2ea6eec0-b43c-4444-b57a-761472d8b4df", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692208261, "uuid": "a1b05d1a-340e-44d3-951f-074e925b974f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692208261, "uuid": "815bea6c-8397-4d94-8349-162c98848b42", "value": "3143d24e18874c59805bd491de00e942", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca6eac07-3c14-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692177048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692177048, "uuid": "472c546d-d6e3-4f4f-b94f-b3ba7ee0b96a", "comment": "Malware payload (AgentTesla)", "value": "38e0831cafe5504bcf237ea071ec196d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692177048, "uuid": "86164548-dd81-47e5-af2d-39f0b5c88755", "comment": "Malware payload (AgentTesla)", "value": "0ff131e35b42225236282bfcdc95d71fca740716eb28e51ece7245e5db6c55b1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692177048, "uuid": "b26b7686-f33c-438f-9bbb-4c7fc3b35b43", "comment": "Malware payload (AgentTesla)", "value": "6229479198180f6d0e03ae597e7d56467b7e6af2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692177048, "uuid": "5d95b1cc-1fee-4d9e-8836-48eb7338270a", "comment": "Malware payload (AgentTesla)", "value": "a3332f3016e0b8da37e90b6bf187cbd19e187765d298e75b71aae9e227b1ae99d9f0526487a4d521ea44e0dd1fe1b7b8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692177048, "uuid": "c09c3181-ec00-4f7c-b49e-07e371fd9cba", "value": "T1DC34D743B64789B1C24617B7F59B23040B7AD681B693D70A798E12E64B43FF69D08F07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692177048, "uuid": "31fc9f1f-edf6-4e17-9c47-2a9a6f55fb31", "value": "3072:M+iIr3j1KrqXbrMFp6xcXY0NekB16/QOhBKDnKXkB4cqFeHE3vmqzG:uIr3NSptI9kuPhBKDnKXkB4c4v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692177048, "uuid": "7031b125-6a2b-4b3e-84af-6bfa23626915", "value": 231424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692177048, "uuid": "2c1b8eb4-ae3e-4c3b-9c07-7c3707215a25", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692177048, "uuid": "56bac661-6502-4f2d-98fe-92898095ecd9", "value": "ORDER-SUNNY 10005916.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5e8dd19-3c5a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692207106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692207106, "uuid": "400ee568-da4f-46c8-80cf-d87b947fb5bf", "comment": "Malware payload", "value": "6451f157286b809efdc8fde8b608b816", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692207106, "uuid": "2b1f94c0-a525-4f12-b126-00bebf3a6eca", "comment": "Malware payload", "value": "11529b059a6b83814963a623623b9d096d9a217716548736771221facaa0e584", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692207106, "uuid": "f811cb40-ded4-452d-b4ff-5e0a4632c763", "comment": "Malware payload", "value": "a8e3b0e25a33f63aa5db48669bd772075b210737", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692207106, "uuid": "c6a0db59-b144-4b29-8c99-c5456d786a64", "comment": "Malware payload", "value": "f25fb25d4b17276b988ee94aa9eaac085f7be56a31a66a661a35cda6ca38203353bb2b45ef1473893e50cf3b84ef644a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692207106, "uuid": "d686075b-1e98-46c9-9aeb-367c8a8464cb", "value": "T179E41250FBD39E32C45F6772C89A49020331A78E5697EB0A606C3B0D8F27BD05656BF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692207106, "uuid": "48a3f075-320e-485c-8ac6-8445bfb90d5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692207106, "uuid": "987755e4-d80b-46f2-8a35-df3d2d076f84", "value": "12288:oDUe2xpDl+COwmOGtsK8J+ZdGgp9por6SJUOrQ+t/DNdypzpxtzNs/YJOdR7MZwm:oDCVKeYUgp9peH7Q4apzpxtzNsQ0dxMY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692207106, "uuid": "9f5a96af-310d-4c51-9d00-05395efdbcbd", "value": 687104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692207106, "uuid": "4bdba1c3-4111-4624-94eb-ae55a53e9b6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692207106, "uuid": "24d2b785-586e-4b8b-95ad-ddbf1097418e", "value": "SecuriteInfo.com.Win32.PWSX-gen.25819.25034", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "984a9723-3c7d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692222061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692222061, "uuid": "d272c755-1ac3-4cbf-b44d-119f167984f5", "comment": "Malware payload", "value": "5347b2baa3800a790f7da5035c98cec1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692222061, "uuid": "5f813004-d134-4097-b2b7-7f2b05deb6e0", "comment": "Malware payload", "value": "118ac8c1ed08d0950a6337f931f1afac101480b7e11b1f3f50bb4a44f6506b66", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692222061, "uuid": "c8e52d55-4309-4815-867c-2728bf6f634f", "comment": "Malware payload", "value": "30b26d664d998aa1b22438009bab279feb822a2e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692222061, "uuid": "b352476c-086b-4735-8700-6557421c6373", "comment": "Malware payload", "value": "7d21c68f42dd5d3aa14384f74a443017f5b884dfda458ad67766e4ced1ba389706cdd7a2c47046b46279abee3fd8b00c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692222061, "uuid": "1dd8bca9-99cb-4a64-9328-a0a6486b13a8", "value": "T1A38332412EE8DF29DEBB1F397BB544221FF27E576520C66D0DE4258D08F2A40CA22676", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692222061, "uuid": "00672165-65fc-4428-a8b8-dadcbeb549ca", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692222061, "uuid": "77917905-4a86-4bd7-ac83-2e84e61dff2a", "value": "192:ZJN4ArmnkWGawSzKlUq7B7t6JN4ArmnkWGawSzKlUq7B7t:ZUArQkWW8KlF7t6UArQkWW8KlF7t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692222061, "uuid": "d3673c2d-9487-435e-8423-5522a6246764", "value": 81920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692222061, "uuid": "da1da677-9260-48a9-a8d2-959496aa7fd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692222061, "uuid": "ccad2a82-5369-4962-810b-38ee3a4225b4", "value": "unpacked_49c881793fed91c23b132bf7f3e009c550949d3e3ba915477d2b6bd9c20cd88e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6909bea7-3c08-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692171731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692171731, "uuid": "f60af06b-7a99-485b-a78a-a541de51a5ba", "comment": "Malware payload (AgentTesla)", "value": "6faafdaff8e678b5877a0416e36597dc", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692171731, "uuid": "c8b82e45-d178-4d70-a9ac-ff7e6e863f2a", "comment": "Malware payload (AgentTesla)", "value": "122dbcb8e39475edad6e92efbd1fa3a2e2d7af8721f47bec9bd16b456ef4d76a", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692171731, "uuid": "3ed17b6f-0340-47f1-a056-62217d5d241d", "comment": "Malware payload (AgentTesla)", "value": "f97a6946a562f68f26b38f9d5b229af413cb6056", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692171731, "uuid": "c1942e68-d1e6-423d-b1a0-c0d1f011a990", "comment": "Malware payload (AgentTesla)", "value": "e13d88ed6c521f46914611890d4c1ee7f55354b6f9c61e0b993c6034cf47689a27d388e32c0203d63a6244f199dffc2c", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692171731, "uuid": "a1ce5cfd-58d7-4771-9e5e-b293b9a2c058", "value": "T156542340AB3F083974E45A1BE57A4375CAA480E271CC706DE2F0AC1D8A6AFF9591DDF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692171731, "uuid": "d68f2aa7-3aeb-4218-9570-625339879fbf", "value": "6144:XyWnHsV7G0h+egU/3lCH539fJO272sXV4kbQE5P8OEgBCT2NZ:XyIsV8egU/3lCZNfH2sOkbQWr1iiZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692171731, "uuid": "60ecb9f6-1fe1-4cd8-9ed3-42bfbdf0918b", "value": 281069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692171731, "uuid": "7c722418-0993-4cd6-ab0f-1b83bf7b67c9", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692171731, "uuid": "8d41e3ee-8cfa-4715-a3f6-cdac89236897", "value": "Order_UAE0823.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f29fd287-3c54-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692204604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692204604, "uuid": "71f142f7-9fb7-4572-b900-27c8745b560a", "comment": "Malware payload (Mirai)", "value": "7ae8fa481d2f6e3faeacbe23386e91fd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692204604, "uuid": "2864200d-9b3b-4406-a5ba-80f138a7f9e9", "comment": "Malware payload (Mirai)", "value": "1261a511c75e8cc1caef404537381edc476d0fa18466ce7d0b9a021f14004952", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692204604, "uuid": "374f5003-da39-4ecd-8455-ad88f0350fc5", "comment": "Malware payload (Mirai)", "value": "cd789e4aedd2c288a1ecef6adf23f263728d7d00", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692204604, "uuid": "191b1dae-44d2-4ba5-b1db-57aa29a03eb3", "comment": "Malware payload (Mirai)", "value": "7d3939c69562eaf5d0b2ec43019c8863ec973486ef4cdf7a5ed12efe050a60476171eb631920787c6be06bb15d60fce8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692204604, "uuid": "b8759220-f863-49e5-90f7-a3663e47b19e", "value": "T10FC2E1F63E773DA7DA350139349CDD3382B5E022D3AEA653A240824820131BCB7329DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692204604, "uuid": "5a64705d-1cc9-45b3-8e6d-da58db669178", "value": "768:0MwoDZLFbBy6HQHRYfeAxdd8jx5weH0Nw:0olcYfe6K2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692204604, "uuid": "d10396a6-33c8-4aab-977e-2a844ccbdfe7", "value": 28048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692204604, "uuid": "9265fa6b-56bb-4465-af32-e3211f083af5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692204604, "uuid": "94c54dfa-5ca8-4114-8e69-264ba12f216a", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f483708c-3c35-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1692191292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692191292, "uuid": "ece2b59f-1a8c-406f-9a35-25c8e5cf6588", "comment": "Malware payload (GuLoader)", "value": "e2b6b68494a8efe3dcc6eb711bc7a2e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692191292, "uuid": "0e0240b1-4850-40ed-98fb-a0bac8b0c308", "comment": "Malware payload (GuLoader)", "value": "14384560101a2899411222cff1fc0dc0cd3afdfc1cc57e810c0adadd415157dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692191292, "uuid": "a57f2350-785c-484b-89c1-3d795cd11bc1", "comment": "Malware payload (GuLoader)", "value": "ed38516bd865835abf0b07479494a2b1723d41e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692191292, "uuid": "2a190d72-cca9-4aaa-a786-130262c71bfc", "comment": "Malware payload (GuLoader)", "value": "419c62f9f8a3211642aa9414316cd2e6e0de6a00e9c9a6deb5629c2ecc9cc9c6ecfdbb91d78a64105094cba77a22dad7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692191292, "uuid": "5dbf0d55-77b0-4964-b5d3-372b0eec3af3", "value": "T1F5C402C13CA0DE2AEF52BE747896C2D296A16C180D14360B764EF7FE2B7091365EE315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692191292, "uuid": "109617b5-e491-4d35-96a1-cf4054fed405", "value": "d4b94e8ee3f620a89d114b9da4b31873", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692191292, "uuid": "f869b22f-fef6-4f93-b50e-2228ef28aee0", "value": "12288:+BXPB4M54WaGqJ1YWXgsAgKDkvj90h79mi03O4fGgPO:s4MBaQWQsA/ovpuRm7O3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692191292, "uuid": "76492f48-ab2a-4723-8b63-e672a952ca11", "value": 577520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692191292, "uuid": "9ce2d031-294b-46af-b191-cbf47ad6cff8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692191292, "uuid": "9330c2fa-a9a2-49bf-8a0d-f73b4333d354", "value": "Ecesises.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a51e921-3c15-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692177236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692177236, "uuid": "aea7175b-3088-45fa-99eb-e107bac9a093", "comment": "Malware payload (AgentTesla)", "value": "57e908db6de4bc0aa043f772576e6b4e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692177236, "uuid": "4b404767-4638-4606-8ff8-728126531516", "comment": "Malware payload (AgentTesla)", "value": "1520e3aac22234e1618a340dd4fd8015b661e07f43376291f86f4e59fe00a86a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692177236, "uuid": "3e419bbd-7ba9-47ca-8fff-dad3060a3636", "comment": "Malware payload (AgentTesla)", "value": "45e02d1ec0d78a0980d9fc1fd55d5d90d0cc9733", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692177236, "uuid": "2563508a-5d11-44bb-8f91-5b5cf9ed5472", "comment": "Malware payload (AgentTesla)", "value": "7bc2c445836e47c49c5d2a40b3bd1a68a3686acbbce9926fe9d455486c7d908c241d9dc9ab9076d72bd635d7a8912ba6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692177236, "uuid": "fc15f6d6-ef10-44a0-a8b8-09aa59aab396", "value": "T195F4D060EE39CE82E54F4B78504FD70E8671495A3626C13A69BF50C6D0977C202DFBAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692177236, "uuid": "569095c7-2456-4ed4-919e-ec1f1805fa72", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692177236, "uuid": "fbf3dbcc-0ed5-46fa-912c-090beaeffb38", "value": "12288:rm9SqyB4QakWhoJVd+cbSAh3YrH2q4L7ijo1MDJLjtyVEmkLwWwGxq5FlqTj:MSqyauJ6c2AhQWqo7ijLDvU/kOGg5GTj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692177236, "uuid": "7998bdd5-54de-47a2-b850-8a86710a4c5e", "value": 751104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692177236, "uuid": "646a6650-246e-4adf-aef6-9769b3d96722", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692177236, "uuid": "6604f18d-d39e-43a4-b0d9-0179a9515d7c", "value": "New order 500384851.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1e1932e-3c7d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1692222131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692222131, "uuid": "46c10d44-4ef4-4d21-a025-7c522d653857", "comment": "Malware payload (GuLoader)", "value": "b560ea8e1a79f625759175b3be840ac4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692222131, "uuid": "683d197d-59cc-4766-ac8a-920909c4cf25", "comment": "Malware payload (GuLoader)", "value": "158137eb6f88fe67b4fe29d337a30f672247245ac77cb00941de91d06ab8de6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692222131, "uuid": "92c5c91f-5414-4e68-9da5-1f4711d8cd48", "comment": "Malware payload (GuLoader)", "value": "f65d5c58404ee5d90d66d615e3d38dd9e98f67ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692222131, "uuid": "6034ecc7-cc0f-451f-be1d-08edf1c79b9a", "comment": "Malware payload (GuLoader)", "value": "63f7dfea7b63e15366d3fcba937246bb0091b7625259f1110b84ee3428af702479c6318730883ce606ba90c43223f257", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692222131, "uuid": "2a5b09b3-04c5-409a-aab7-c93a6eebd854", "value": "T1E584F1F87704906BCABD02B2F81BED9DEBA55EE090D89B047320BD592D236D54C3E746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692222131, "uuid": "8e9b6822-e327-4192-8219-d06eab95247e", "value": "d4b94e8ee3f620a89d114b9da4b31873", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692222131, "uuid": "d060cd43-620d-4358-81ea-71e0ac086740", "value": "12288:B50VefbM42LHWSWqAl6S1w3NaLXej6UqH8jK:cVefQ42LHW5v1mIej6UqH0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692222131, "uuid": "b14c6b32-72ef-4432-8af5-28a9a8a5deb1", "value": 399024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692222131, "uuid": "5b9bd2e6-8dfc-4b46-9933-638683ca6297", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692222131, "uuid": "8a0c5479-9410-4ab1-9749-271fd8afe661", "value": "flinkt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4080c19d-3c2f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1692188413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188413, "uuid": "59998657-5140-4f48-97e9-8e0d5ccf208b", "comment": "Malware payload (Loki)", "value": "6071a81951ae74c6429290e7c8479978", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188413, "uuid": "75af155c-7cf5-4571-8889-1fa3578d4141", "comment": "Malware payload (Loki)", "value": "185d432c3c9b729316ff6463d04e0f00dce87659b7cbb62b9bcb9d9b47b2cfb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188413, "uuid": "a31252e5-bff2-4a45-a2ad-c5fd4a35700a", "comment": "Malware payload (Loki)", "value": "93f45a59dfb782239a312bf5151a250a0f844174", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188413, "uuid": "9d68b27f-5c35-428c-80fc-94aea0ec1af5", "comment": "Malware payload (Loki)", "value": "82d96951897d49a00b92628ef2847bf5bda9232a3dbab4f68b19e453f2f2849b4d8f8d0e82ac46b05573785544a0db9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692188413, "uuid": "c0e871e9-4187-4106-8fbe-80a4d25cbf75", "value": "T13F3512427E41F3E8E45A4CF15877DC18B6EE2DFE2C112D977666BB4A78B1202630F50A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692188413, "uuid": "e7418e5f-cdbb-48b3-916c-2f800e381f9e", "value": "b40f29cd171eb54c01b1dd2683c9c26b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692188413, "uuid": "6c6bdf62-f118-4293-b205-5d8bb30792f4", "value": "24576:Pz2Gri+YEEDTyk1o19XqLAl0N0rvO3WmTbR3:Pz2Gri+YX3ab6LAa0S3DF3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692188413, "uuid": "fec56f40-58e7-4789-8492-65ab48e1c41f", "value": 1093896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692188413, "uuid": "d73faa90-704e-44f4-ba2a-d6a72ea9d886", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692188413, "uuid": "1d9f3c9e-8a46-46b9-a999-0c200ee3788b", "value": "Afviklingsjournaler.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3185fce-3c3a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692193437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692193437, "uuid": "491be04f-257f-49e5-9b1a-ac4b8639598a", "comment": "Malware payload", "value": "267ec14523d9fda264f9fbee934eebe0", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692193437, "uuid": "69db4769-66e4-4441-b168-fa7694454041", "comment": "Malware payload", "value": "19a3ad194ce6897b529e09a60beb959520e5fc70930d95393d304a42a70a7119", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692193437, "uuid": "6f9ea184-db85-42e9-9c5e-e0c8868eea22", "comment": "Malware payload", "value": "e19bfb59009da3d192f024222070e01a9a1bb258", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692193437, "uuid": "f96b403e-a28a-4f1a-8fea-edf734cd2db9", "comment": "Malware payload", "value": "203a957615ada534feb65c8a124ddb7b4c32a2927ea25f35e51daa9c41fa1e42dd4c32c5c29d9869e6dbb14f548f839e", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692193437, "uuid": "f1850279-860a-4bc2-bcb7-30d2f912de21", "value": "T1040248613F73FC4305A4D2BF45081B4936EB16D7E932F6CDC697490740260AA8B15EEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692193437, "uuid": "06272018-31db-4c78-a0fb-1e60d2a71c85", "value": "24:vOOOOOOamMMM9Mk4wMUMbwMRMUMqMMMBeMZMTMoMVnnLecYMSQxH:6mKywV8V9nDW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692193437, "uuid": "a47e09e4-fee4-4982-9fa1-5cea640f9061", "value": 8275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692193437, "uuid": "88f72c4b-6c17-4966-9495-7d448b31ba9a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692193437, "uuid": "c6fabdac-1795-4839-abdb-fae454939430", "value": "lnvoice #72993 pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "407eb913-3c35-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692190990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692190990, "uuid": "fe007663-5f50-471f-8c43-efecdb374568", "comment": "Malware payload (AgentTesla)", "value": "aee190ea6ad88af827f61dacb7b42688", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692190990, "uuid": "4b9491fe-6f8d-4eba-abbf-48a5288b7b90", "comment": "Malware payload (AgentTesla)", "value": "19b07ad1358ca7e9452f28c5cc933feed409a368b7c26466e7e90084acc18784", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692190990, "uuid": "006c1cb7-5263-4129-b386-4ea595d2dd4e", "comment": "Malware payload (AgentTesla)", "value": "a13fa95f8a633f1a2790b20470e33197f409a001", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692190990, "uuid": "4b12a213-0bf7-41b7-95f9-dc438de131b9", "comment": "Malware payload (AgentTesla)", "value": "d250430d40202214bf56024dbc4a5d3dc3b68d0212d0973deb0b5c806737803608bd484a4a17bcf6809e01be7fd83742", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692190990, "uuid": "885fe81b-92d3-416d-93ca-9b8234bc15a4", "value": "T13CF42308BAEADBFDC50BF42915D02DB8E6A0E58BC1C7DFE5F1C29DE9429282C45CE411", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692190990, "uuid": "a32a6688-52b1-4403-b033-90c3766ee7ba", "value": "12288:uP0WIek3sDRGhuL0G53vOPJnDEVUlNri45Jo+2xEx+u35Af2oz05R50Paoy6z0Yk:uPWP3GRGhuL0MS1wVUOiqaAdz0350yNF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692190990, "uuid": "71c9b1fd-f3a9-4658-9faf-2cb5a2b2efea", "value": 740702, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692190990, "uuid": "f94339ca-1214-440b-8f72-5db014468627", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692190990, "uuid": "08ca34af-6af0-4995-870c-9cd53e50515f", "value": "Purchase Order PO15082023.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de79cf5e-3c07-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692171499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692171499, "uuid": "12647de9-daeb-4550-a4d7-c9001c13f5f8", "comment": "Malware payload (AgentTesla)", "value": "921a3dc46c64499b85e3aa7f37a1b9c8", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692171499, "uuid": "19410732-deaf-4619-b49f-4b806114584b", "comment": "Malware payload (AgentTesla)", "value": "1a59654720f45d883775208c20b6face72f5d4e65712554669d57461e1186ed3", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692171499, "uuid": "1f44e81c-dfee-4818-8081-1882c3531f4e", "comment": "Malware payload (AgentTesla)", "value": "74ebda2eda8386ceffdb92451f79f1a52360aeb7", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692171499, "uuid": "e48792d1-83d8-42b0-b326-b649e0aa3a26", "comment": "Malware payload (AgentTesla)", "value": "7a97804d6d18b1428df91019ed1673886d2d64a49849e6fdb7e83423ccf463a3e08090fc94cfe1e3c029d28543fb7dff", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692171499, "uuid": "f5450e74-c16b-4ba9-a9db-e04502e9badc", "value": "T16BB4234275197BD45F0264EAAC3EB490355373406B8B0183DF7068B7AAE92FE1EE718D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692171499, "uuid": "8eff2636-6553-404e-aedf-c027fcf56ccd", "value": "12288:jhAfq1rcC8uOMHvO9UKTTk37QK4F3mhmnAqY4tagyQvJ9lg0:jhCqF+uOMWBTK7HGxAqD191", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692171499, "uuid": "eff0f9e3-426d-4a72-a238-7d5b6601f205", "value": 501032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692171499, "uuid": "aded53f8-3c71-4768-9fee-73a179b843ab", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692171499, "uuid": "3350100b-9875-4f8e-856d-8b46a0ee7cd1", "value": "PO-02603_FINAL.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "298fb635-3c03-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692169477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692169477, "uuid": "8d05b50e-cf37-40b2-9b28-ee559b3d7816", "comment": "Malware payload (Formbook)", "value": "b347be502cbf3a5616ac25f20d03630f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692169477, "uuid": "4d59c24d-6f05-4f59-b16f-b83a16ba507f", "comment": "Malware payload (Formbook)", "value": "1b7d0e37b2c2465020c57cb6ca8b3d15546b862cef6a06fb2d4c6aa5d94263b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692169477, "uuid": "9599ad40-aed7-4200-bb19-256a6adf8a31", "comment": "Malware payload (Formbook)", "value": "96021016c5a1470fb474412cfba5dc9817292f40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692169477, "uuid": "2e5de71c-3183-4e12-86e6-834ad176aa15", "comment": "Malware payload (Formbook)", "value": "8bb119dd45845546d73075ffb614e18de6d6e9406c4bf59e04c39f20a8255725bc734c7ed66e420d475dd214fa23ab65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692169477, "uuid": "49c02936-4004-4bd3-b766-c13dec310c0e", "value": "T10654125AE7A4C423EC6249B04A7916A25FFDED03A0E8860F2F509F6BB777241470E3D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692169477, "uuid": "35abb8d3-50be-435d-850a-cb46981a7821", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692169477, "uuid": "683394bd-5049-4ff7-ac8c-9381117b620e", "value": "6144:/Ya632u+LOG/obF3jpoeBz6GsR9k4/iSPRlwB6Xl:/Y12u13bx9DsVDDPRM6Xl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692169477, "uuid": "fd164e6a-6368-40b2-87a8-5fc1daa8a130", "value": 282207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692169477, "uuid": "bb623e5d-e3ad-4c59-b01e-8848c40f26d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692169477, "uuid": "f47eaff7-f844-47c0-aecf-237858a60453", "value": "GWS SEPCIFICATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "679880fe-3c1d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1692180748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692180748, "uuid": "19b500e6-4c7f-4e0a-89b0-eda526bdafa2", "comment": "Malware payload (Fabookie)", "value": "952376173fb58a82cf31292f05bd6671", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692180748, "uuid": "36faa617-9c16-4c1f-a61d-955376739e45", "comment": "Malware payload (Fabookie)", "value": "1b8c18d4a44f25540f66bc669ca2ad0131c9ee6ce011ff62a1b41eff2d418ad5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692180748, "uuid": "733dc9b7-4fec-48f6-a013-6de517e4d723", "comment": "Malware payload (Fabookie)", "value": "5494df6bc862691e85fe43340edc644ccb1276a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692180748, "uuid": "ef687657-a812-4532-b62a-a3e1986904c2", "comment": "Malware payload (Fabookie)", "value": "f7edc76ba3d5dd65e28d3a43b75e5b41653c63b6ab1bd224a23c21d291c3d77b22f262c2912b6d928a1b0a22f244b75c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692180748, "uuid": "2ac9caf6-068a-445a-9bb3-e3a3601bfec8", "value": "T121C4BE12AB15DFB8F0C7C876BD70410218E8B409A758B57E96CDDC700A3BC56ADB5AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692180748, "uuid": "733f70b4-9d45-4e0e-8fc8-394d5f8f1f3b", "value": "5f7cc0f5167c2e87d5d2573013f2660f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692180748, "uuid": "f0231c5f-ff36-4b61-851b-c7bcd2193315", "value": "6144:kXMPxMBUQCE2kWCZ3j9Z0CIBiNmpxyN90vEfjx+yOxRU3RaMDYgJBbrasGi3+EXC:MMPxMoEVBkCIKWy90XnMaEt+i3+dZaU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692180748, "uuid": "8000bbac-b02b-404f-bf12-70eee00ffda7", "value": 591355, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692180748, "uuid": "92fc2095-6297-41c3-9cdd-6b1b55fe7c43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692180748, "uuid": "b11ddd9f-09f4-4811-828e-5201e1a0eea8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "513de29a-3c0a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692172550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692172550, "uuid": "89d69064-0688-42f2-9411-338cfeef1423", "comment": "Malware payload (AgentTesla)", "value": "4e216b237690da56300ae11de67c1b2e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692172550, "uuid": "c21ae040-effd-4bfa-ac06-cfc4119b2b32", "comment": "Malware payload (AgentTesla)", "value": "1cbdc981fe38ba6177264a413b0ea0cae2dfc8b8169ea9991d73344792c207c8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692172550, "uuid": "08b1c769-db87-4881-ae01-dbdd3fe1d22d", "comment": "Malware payload (AgentTesla)", "value": "21d552d492c27afc97e59916fe7172f04284bf43", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692172550, "uuid": "e36740f9-122d-488e-aeee-026d6ed3a65d", "comment": "Malware payload (AgentTesla)", "value": "595e5d460712aef679923c60444d20e6863e1ff35aff73150c88d47738efa30b892622c8208e604bb7545770547c21ad", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692172550, "uuid": "50f48c15-a380-41d5-98f6-6d1944beeb56", "value": "T1B2C4236AAE4362461A3911B345D5B6BFB1AC4081D8CAF85833F0DDE0947DDAE7E704BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692172550, "uuid": "ce5253ba-9e74-4f57-bf60-dc9740f13ab1", "value": "12288:gAmDdw1sZNN1uqYwEd2qRqwNS+cOrxUbtAXXXWvTP5xjRI+:DmRfNse0NS+cOlkKuV3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692172550, "uuid": "58d3fee4-881d-4f76-b5ff-364b44c70a73", "value": 557683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692172550, "uuid": "79c98e8e-f99c-4123-ba75-b875f00de9fb", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692172550, "uuid": "62523a6d-4919-4dff-998b-0b56907167d4", "value": "QUOTE R2100131410.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaa40bb4-3c35-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1692191276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692191276, "uuid": "fec6ab44-f0a5-4b0e-a603-dada55040088", "comment": "Malware payload (RemcosRAT)", "value": "38e1a4aca9a4b22a0f06fbb01a2f4fe4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692191276, "uuid": "797a1469-d653-4de5-a706-744818779833", "comment": "Malware payload (RemcosRAT)", "value": "1e7b6ee93140421cfbc6750ced921909d8b7c72888b9582d3b380e3e4f4fb4eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692191276, "uuid": "0f860682-750c-408d-8880-4d219cc1304d", "comment": "Malware payload (RemcosRAT)", "value": "50c4847b50196296f6243fc2ad8d9773dfbf1668", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692191276, "uuid": "124646b3-b508-465d-8a42-e185891c24f6", "comment": "Malware payload (RemcosRAT)", "value": "a0e3ea99a42e4dace1f069029417551563182e6db3f6806bc1f8322af0c8a98ce14411c7fd796059ecab1f06a70f7359", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692191276, "uuid": "c5ceba5c-6375-424a-9663-e05d7b8a4c2d", "value": "T11A64F1E4B71890ABC9BE01B2B01BAEAEDBB10DE544D49E0633703E592D537C49C39F56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692191276, "uuid": "0f9457ca-353d-4ec2-8432-4986e308dcc0", "value": "d4b94e8ee3f620a89d114b9da4b31873", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692191276, "uuid": "2379edce-a9f7-48e8-9e84-d131d8f0c4b8", "value": "6144:pqaFH+9jMuVefsvnUmwxQdTwsn3zbv+XRh8JGHwGDwTvvNA94fjEBK+MZpMNz:b50Vef6jwWTwMzCXRh8JGdDwTi6jEBKY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692191276, "uuid": "b2f812fc-f1ab-427e-a776-26450232f023", "value": 311912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692191276, "uuid": "bd2643fe-097c-4fdd-b806-408f4fe6c129", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692191276, "uuid": "cd826216-1e8a-4856-9210-c2f107fb6835", "value": "Telefonopr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4b75e78-3bf8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1692165013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692165013, "uuid": "27ca83c3-993f-4d75-890f-d2087e3c4d28", "comment": "Malware payload (AsyncRAT)", "value": "a8598ad336d2aa19b8b32bf90d518ba2", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692165013, "uuid": "aed3d723-9793-4bc7-b462-a5e27d472ce6", "comment": "Malware payload (AsyncRAT)", "value": "1ee507d6272609c749d3d8fb349cf401b5b8cb4b5da1495b4f0dd809bb0e3f0b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692165013, "uuid": "9ddcc482-a2b6-4ae2-8c78-3dfb36289ba7", "comment": "Malware payload (AsyncRAT)", "value": "de080709a2916b94dfcb2064cb4e89b895d81267", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692165013, "uuid": "0ddcb5c8-c48f-4923-97a4-5ac3637305a4", "comment": "Malware payload (AsyncRAT)", "value": "6e090989a71590ad05982e7ece21fa038275392d91b27d162bb6a99625dcbbe5e4dcc505d6672f594c1f6b1ff2f4fa30", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692165013, "uuid": "aefda8b8-b6e0-4a2e-b629-e1130be49673", "value": "T1CC530A053FE9802AF3BE8FB469F2668546F5F5BF2D12D54D1CC8008A1532BC69941BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692165013, "uuid": "b3915f0d-8ec0-4c14-8114-a7aff69f372e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692165013, "uuid": "ae428c62-b63a-4260-8a7d-0d5bfe43a733", "value": "1536:EmfBSqHdw8bkP3ouFgWrtWdNSSsfnp/uID/vbFdYFd46ISLWZx:Em5SqHdwpSsfnpmIDHbFdY5tSx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692165013, "uuid": "10bf6a78-034d-473f-8892-17e53ad44d7f", "value": 66560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692165013, "uuid": "56968fe2-5d2c-40e9-be94-ec99a42ef74e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692165013, "uuid": "49b2ccec-45d3-447e-a6b4-f7ec09cb53b4", "value": "a8598ad336d2aa19b8b32bf90d518ba2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91ca00d2-3c4c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692201005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692201005, "uuid": "45feed92-5061-412e-ac39-34a3647cb7c8", "comment": "Malware payload (Mirai)", "value": "576395f80ca5546fc0a4fb911588ecdc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692201005, "uuid": "57bbc5a1-c1df-4a54-a44a-2b4e42a1afe9", "comment": "Malware payload (Mirai)", "value": "205844a902c6e9833e92d8d16fc5fac90dcc639635f021bd26cf97e09e0dd256", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692201005, "uuid": "ab6caebc-f351-4c34-833c-2021c63fd2b0", "comment": "Malware payload (Mirai)", "value": "536ee44df85f9efdb07481b246ed92649499b62a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692201005, "uuid": "d4d8afc5-df1c-4675-8c85-b4baa375b95b", "comment": "Malware payload (Mirai)", "value": "3ce079401f2de73aceabb9f94a916271cfb22425a9efc7e57ae56195d6dfa89422a8e950b638f8a976c93902aa5fae88", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692201005, "uuid": "d89dd97f-bef0-4889-adfb-d4ba640df80c", "value": "T11823024320D3BA03E03058FA45628CCEB65AA6BDB1BF7B6725454E254C35D93FCB18AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692201005, "uuid": "4226636b-643d-4c58-b937-35e3e3e38421", "value": "768:aK7y1XGO1LCNgukEkvwtqPnH7u83nc0iFc69q3UELWt/iw+kvBGg6+fYtrBHZ:E12O1LCNguovDPH7TcrELWhiw+kvBGgA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692201005, "uuid": "a197eabf-e9cc-46f9-8136-51c5d6c94a63", "value": 48696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692201005, "uuid": "70804af1-3a40-4169-b099-8e55a89fa604", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692201005, "uuid": "39b625a1-3c1a-42dc-ace8-61993adc7a4d", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46ccdfc3-3c13-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692176398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692176398, "uuid": "09d88f69-8447-4c84-9e84-7013d8275760", "comment": "Malware payload (AgentTesla)", "value": "c524ee0ee98af1bc4efa607b9f5b0093", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692176398, "uuid": "38c96da0-d34f-43ec-907e-53eb39a9bb28", "comment": "Malware payload (AgentTesla)", "value": "205fc2ba6dfd9b2260a279469f06a4f25912c352afeab99a0a70a9b31e2db149", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692176398, "uuid": "c311f664-9813-4836-8f33-922837e386c0", "comment": "Malware payload (AgentTesla)", "value": "eb9f03991c229f10ae4d6ac729c6d77a566a3d55", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692176398, "uuid": "cc969b44-008b-4cc4-83e9-2cb57c4d7063", "comment": "Malware payload (AgentTesla)", "value": "357dd3d3909dbc1a171c80c35f70b36dd844ddce29638dfdc445203f516ced92da70ba609acd119be518217787bb5193", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692176398, "uuid": "88652ab7-5995-4760-9c91-8ba27191802c", "value": "T1244312E2E056D7D6A58438DF2D3168F0128B73C4976C46970729BFAB0344AB5F07BA53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692176398, "uuid": "c0437238-9e1e-4ed8-a069-2ae106b1ee49", "value": "768:3LrXnTA5NObZEt5qmBRgN9/JW/qUBeA8lXSD88Mzck1LBbGA4koxO0dpaMNTCo+D:vDA5NObZEt5zBKmH6XmMzcO1bcLM+GR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692176398, "uuid": "d10f6286-8058-48b2-97b3-9c1540df0833", "value": 60614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692176398, "uuid": "3832d3fa-afbb-4a40-b299-eb6e5fc541be", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692176398, "uuid": "36975cbf-f2ae-4389-ac10-38b770a56e88", "value": "Oonup.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a567ac16-3c36-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1692191589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692191589, "uuid": "38261384-556a-4ac4-bb9a-a8b711dc8e18", "comment": "Malware payload (DarkCloud)", "value": "02061468867d1c6ccc322bef11eff812", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692191589, "uuid": "dce48f64-d508-429b-828c-e23cda3b394b", "comment": "Malware payload (DarkCloud)", "value": "2226d275fd8186f1b0c51908cdc8c75a374339f9515d950c6c73aabbe9127108", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692191589, "uuid": "bd17277f-c5b3-43c1-a2b2-637bf229287c", "comment": "Malware payload (DarkCloud)", "value": "4e97c1259406c04ad37364eaa8664f5343ead8b8", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692191589, "uuid": "e7dd9221-cd27-4bee-9267-7efbfd366cd3", "comment": "Malware payload (DarkCloud)", "value": "09da5cf307df502c2de376e8a0f221f3fe4bc4a5d2ff25b7380d0c065fb4829266dab76d769b7c26f7a2ce7946c76b2d", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692191589, "uuid": "c89cb163-42a8-416e-902e-966d18619dd6", "value": "T1DB25E1A272FC47A7E02F80B656247113AFB2A5BB5166E5C57CCE11E58F86F811A03F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692191589, "uuid": "a046c85b-8e34-4595-85de-ed1211a08a7b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692191589, "uuid": "cc30e603-a8ba-4df0-a446-7c3daaf915c7", "value": "12288:aZnDrtz9dmtT7r6K2SmuBZ7y9wkrwWBoCGQfw1EGi2mmcma/nh/hk8g/XLBC3f80:aZtJdmZWhHBBo626nNuXYP4E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692191589, "uuid": "2fcc92f3-a86b-4b31-adf0-8ee729369149", "value": 966656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692191589, "uuid": "122c56e4-5fbd-4b64-97d7-ede52dcae7c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692191589, "uuid": "555e3c86-6def-4c0c-be18-507c8cfedff6", "value": "08162023.eml.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeb3fe57-3bff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692167982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692167982, "uuid": "ea99cb5e-05c3-4170-a4bc-c5116c025ef8", "comment": "Malware payload (AgentTesla)", "value": "185c598a82e03cbc71e8cea64a0b4a0c", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692167982, "uuid": "ad0a71d0-9d8d-4196-becd-c16fe87fd1a8", "comment": "Malware payload (AgentTesla)", "value": "22a08d1e95e050440ced4d6f0cc118a7fb21717567820dd2409f290051e723e1", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692167982, "uuid": "9856fcdb-8beb-4ea3-a16d-cce2473e7f47", "comment": "Malware payload (AgentTesla)", "value": "9587bc8dc1085893a844191f2890ed11fe9b62f0", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692167982, "uuid": "8de4c10c-cd89-496e-8d4d-1d9cccd3e2b9", "comment": "Malware payload (AgentTesla)", "value": "3b65b6fb78fd4d4027335b9b17a1606301376d66c53f9ff6611ff82b3b21f0db12e4961bd3a9db2cbaecdc2757207f9c", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692167982, "uuid": "273604a3-7067-4cda-a31d-2e61775df77c", "value": "T1EE4302DAF22C00D4E95717648F61C547768E58CDA17DC7A42B3BCE284465D9E9C21F0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692167982, "uuid": "7bfdfe78-12f0-4046-9294-2f94dd027676", "value": "768:AL8cUSmWVqD0VtIFwIOP7/9nVBCMGKzUOmAv8RJqaNGeP+/JCWol1w4:qTUGV+GXP7sMG8zhUHqaNGB/JdUh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692167982, "uuid": "116c8ca9-0014-45f1-9fcf-75e539f8d73d", "value": 60036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692167982, "uuid": "a15f567a-12d2-4457-bd04-27b98f5259bd", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692167982, "uuid": "116b47ff-8b97-4afb-9a01-b82704b9dd2d", "value": "anfrage2309401.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1cf179f-3c63-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692211018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211018, "uuid": "c7a5479e-86ca-45fb-a10b-2a983cfe814b", "comment": "Malware payload (Mirai)", "value": "cdb3d2077cabd1db45eb7c2d031ea553", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211018, "uuid": "2fa70a09-ed46-47bb-a4d5-0747b339770f", "comment": "Malware payload (Mirai)", "value": "23661070ca42fa314e6159a1e95e097806f79ee47cb300f2bd54cfa62c7363f0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211018, "uuid": "7e3b0412-e7cf-4af2-aebc-a5f0dbf8c23d", "comment": "Malware payload (Mirai)", "value": "f5824531eea670c2a11da599f59d33abd6246008", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211018, "uuid": "67ee39ce-c713-4f98-88aa-3940f5433f86", "comment": "Malware payload (Mirai)", "value": "4e69f7ed84e42087f4e4b0e72da9abfe1a71cb43e1321d43c0b37d8c07b994771c49fa6186e186e400d3d733e7916348", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211018, "uuid": "36df066b-5d0e-46c6-95f0-e80abc194711", "value": "T109C2E071A9AF8F0BC042C27F5E2E29263228BC39C70DD469262E0FDA45AD4F94479D42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211018, "uuid": "5cab1e18-093e-42df-9b74-4250ded907d7", "value": "768:u5+Kcrb9VDJeruXXu/XjN7xy3tOtLjZ3m:hlrb9veaXXu/Tpxy3GZ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692211018, "uuid": "37bb6fb1-bbf5-4306-b6b8-a8a56609436d", "value": 27712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692211018, "uuid": "1fb6e0ea-61ad-49d8-8c8e-b726ec4c0ea6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211018, "uuid": "ce2a8b27-cc4e-4228-8c5d-5ac1cf4724f6", "value": "cdb3d2077cabd1db45eb7c2d031ea553", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ead554c4-3c38-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692192565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692192565, "uuid": "14900660-4f1a-40af-90ad-d41a185ee971", "comment": "Malware payload (AgentTesla)", "value": "8d3fa18b18e2ba9176f4c298658e25cf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692192565, "uuid": "1f8bf667-381d-4d68-bab4-4da2f3f60b93", "comment": "Malware payload (AgentTesla)", "value": "23abc888951142813a7bb5bf072979238c51ad5cae059ef89303322371f8497f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692192565, "uuid": "effc52b9-d945-405f-b926-6199c3705a7b", "comment": "Malware payload (AgentTesla)", "value": "760277171499e5450c28d13c961c68ec5624afbb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692192565, "uuid": "ef361f36-4be1-4979-ac67-fed132cdc034", "comment": "Malware payload (AgentTesla)", "value": "d846bc5fa507eec344816e57476917338a77bb059e8eaa1792cbb79c27c3c30b93304fdad75769fc561107b2fbd08aea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692192565, "uuid": "110e9764-2faa-4ad7-b5ae-8a227aac110d", "value": "T111E4231551A85BB6C8DEAFBE9585206107B2E2B3B312E39C5FC878CBC563B07874075B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692192565, "uuid": "bdb51715-e3e4-4d91-bfaa-b6c2d99d3ffb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692192565, "uuid": "c7a163b0-2f60-40bb-832e-3a58247ba3c9", "value": "12288:D44lrrWwuWNh+Ds0boF2pYLQ5zvv4yOyn+cNh4mUVOZVI4:D44lXWX4Fmo9L+TZOS3lU4u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692192565, "uuid": "62cf3600-236c-4a19-93e4-071586755ddb", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692192565, "uuid": "ba7e2afb-a277-4197-99c8-e3b575ab94ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692192565, "uuid": "77649fd4-fda0-4d20-97fa-83c2960da916", "value": "INVOICE.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1923846-3c3b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (StormKitty)", "timestamp": 1692193730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692193730, "uuid": "510d1737-efe7-415e-b40a-6dff6913bb5c", "comment": "Malware payload (StormKitty)", "value": "67c418ee40a4edb8a5b232298234f4be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692193730, "uuid": "c2de716c-340d-4f9a-85a2-245e08cf235b", "comment": "Malware payload (StormKitty)", "value": "24b53b38f7f87c5b7353d7a98b803b90447d75e3d187c605830bc2ee7ac3c2f1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692193730, "uuid": "41299f87-670e-4238-839f-bc700623570c", "comment": "Malware payload (StormKitty)", "value": "1b0f3c83711debfdb62b0b466c3a59aebe74caed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692193730, "uuid": "4f7e39c7-8909-4aff-a4c5-0a579945616e", "comment": "Malware payload (StormKitty)", "value": "79d52ead7a8fb52d9bf34c77e77b24b0543cc2c38d03b771e3d628d086dfa818cf9caa13c382cddc346ac67e8266f05b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692193730, "uuid": "245a2019-3fa3-435d-8cb7-61bbbaacf70c", "value": "T178045B5837D80A15F3BE5FB8F4B012118B75B477AA1AE75F08E920EE0D62351E911FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692193730, "uuid": "1b24ebaa-10c1-45f0-a4ec-76c550f932fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692193730, "uuid": "4958c5e1-e7a8-4718-937f-a31ed2552509", "value": "3072:Me8p6ewdOIwQx76vK/bvTv0cU+lL/dMlZZUZ0b2gThwARE+WpCc:o6ewwIwQJ6vKX0c5MlYZ0b2K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692193730, "uuid": "1bbc4026-47a2-457f-8892-9dbde4dc6945", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692193730, "uuid": "26240212-3978-4e6f-ad37-cd0e8c585580", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692193730, "uuid": "a3a2358c-e5e7-480e-896b-9ec0012f77f5", "value": "67c418ee40a4edb8a5b232298234f4be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95131258-3c1b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692179965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692179965, "uuid": "b1715793-c8b3-46fa-9a74-9c0d392ae9af", "comment": "Malware payload", "value": "19e15e0514d4837c6b8354f71788f94f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692179965, "uuid": "1f447955-0507-4ba3-9c9c-8ac7089b90cd", "comment": "Malware payload", "value": "2504752b964f0cca95803fab3e9af22d99639ec199a1d5f58618eec156d4f69a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692179965, "uuid": "49918773-46e7-487d-9da5-d7e52ce78140", "comment": "Malware payload", "value": "dcafc2511109c57135d62f7b6e44e7f02cb48274", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692179965, "uuid": "3e6a067c-7553-4a54-af04-33d4ed677b43", "comment": "Malware payload", "value": "45517de1c4d1df926387426b15eef6e0f039d352c071db88675b13999a9bec02b49b3854639d7be86e8b97c2fc0745f0", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692179965, "uuid": "9979b198-6426-4ce9-bf9c-935d6d723d3e", "value": "T10AF313DB4438E1DA0B30DF253EA10AE6D861AAE25F973541E877CDEDA1057B308D34A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692179965, "uuid": "576b7a0e-a46b-4da3-8e74-e90c8cd79bcb", "value": "3072:jN114nPDQv6ZRDI3El/tZrBJoZNZd6+C8NIWAZ5eG7vSTyKrsCVlYZ2zIwYanku5:jr1oQARwEl/jVJoZNZnC8iqG7vSuklVT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692179965, "uuid": "9be6917f-3ab3-4916-b95e-341ad663b7d3", "value": 164341, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692179965, "uuid": "9d9c6706-669e-4ad0-8e5c-3bfceb3317fd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692179965, "uuid": "5c215fb6-2587-495f-9b20-23429245f56f", "value": "19e15e0514d4837c6b8354f71788f94f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa73883d-3c4c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692201046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692201046, "uuid": "a04b1db0-e67f-456b-8fd4-1be8408a0b1f", "comment": "Malware payload (AgentTesla)", "value": "ae0360043628a1b689420ab9f3f1cbbc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692201046, "uuid": "16f43db1-3b7f-4829-9093-c948a1f3ac64", "comment": "Malware payload (AgentTesla)", "value": "25bee31eda4859c5264cc757168bf142c4ca6fbda261a674f1b787f3d8dfa9ac", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692201046, "uuid": "771449e2-2d66-41a9-b5d9-f87bb1ac40af", "comment": "Malware payload (AgentTesla)", "value": "e2dfd82ca607362544b71101a61f548c1ebe0f6b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692201046, "uuid": "69c52b99-f7eb-48ac-b56a-084ae379a6cf", "comment": "Malware payload (AgentTesla)", "value": "e6e156bf806cd41102b1874a3dab4c54140386a164a1c731e032e3711c4466d94c35f9506a14f71a055dbe587d68eca2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692201046, "uuid": "11d88158-7122-4000-8755-a990d3a79148", "value": "T14D15F60059750096EF3E267E1A63573DB8BC1D53A1F2C5E56B2726D38DC3012CEA8BE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692201046, "uuid": "03b7fabd-ace9-42be-9c64-830bd947510e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692201046, "uuid": "32d0654f-5e02-4766-8c41-8a6cc4c61623", "value": "24576:lj4m9wPIIpppXpppppCOopppXpppppCO6wGw3sHUwjCDC3iopXyxqv:27IfO/O3rwjCm3Lr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692201046, "uuid": "590f1cbc-cd6b-4f58-a3c8-9c22764a8a80", "value": 932352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692201046, "uuid": "c291e68d-fb61-4a68-835f-af6f8c4063fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692201046, "uuid": "c13408f6-24f4-4d43-9499-fec8d6020c3e", "value": "PI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "927d66d7-3c18-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692178672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692178672, "uuid": "c9cd9d10-d382-4952-b3af-e4ddb28a0b32", "comment": "Malware payload (Formbook)", "value": "7d8416ae272d1538307d210ff10b6730", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692178672, "uuid": "aa100bc2-da24-4178-868b-58a52358269c", "comment": "Malware payload (Formbook)", "value": "26036184ce14e8689c2d63489ea2a29da55bdb4f9d7514e7509bf116c55a9312", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692178672, "uuid": "90e30578-01bb-49ec-8ff8-9f97e0df4805", "comment": "Malware payload (Formbook)", "value": "42c3c48716318c5d2ee59aacb0ee5d2a0eb6e10c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692178672, "uuid": "6c20f2e0-21f3-4c7e-a7af-cada22f47d01", "comment": "Malware payload (Formbook)", "value": "54e837328406ce9729ba4b7f8849336cc3a4090cf76577480095e83695bfcf31976364ab4361119ead12626d02ad7df7", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692178672, "uuid": "287d4aad-952e-4192-ba9a-beb3dc7931fe", "value": "T1077423506624DC3D820C460C3AB512DBBC80A0AA5D5677BE9AF69F631BB9F436F431CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692178672, "uuid": "844ab228-ca5e-4227-b219-0187ee631af9", "value": "6144:GrQ/wWdgKy4Aww0FTOzosDi5A+tDHKQBs4z6WidcIp3vUu/gHdfFAJJkcGNB6pOy:GrQ5dE4AB48o6oDHpBnzxNI5Mu/g9OiY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692178672, "uuid": "6e5a32ad-10ad-40f8-9f62-1b150f3ec204", "value": 350279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692178672, "uuid": "23be53bd-e6ff-4d91-92e7-db31ae0502e3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692178672, "uuid": "06295949-b9dc-4488-b990-b79a0c67573b", "value": "Motox del Ecuador Enquiry NO_901132.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "564b754c-3c0f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692174706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174706, "uuid": "7c677196-b0ff-47ed-a610-80300d16812e", "comment": "Malware payload (AgentTesla)", "value": "44ec18fd0dbbf9ec7be4811b30cf9340", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174706, "uuid": "0ca75cb2-05a6-4e36-9016-827b04c9b2d9", "comment": "Malware payload (AgentTesla)", "value": "285cb2ac2bf63ab1df97cc9bcc9c53df7089ba9ca2462e58c9241487e9101165", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174706, "uuid": "84663118-cc92-4f53-8fe7-b59da45428b9", "comment": "Malware payload (AgentTesla)", "value": "e9d556d388cd39a0214ad0352a8154442b1b5676", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174706, "uuid": "3d9e1d2f-1c82-4561-aa3f-b69678a9c008", "comment": "Malware payload (AgentTesla)", "value": "1f97ed6bcbe338e222df7caa112a9692610fe1c6a5dc50c4a0d952f0f0efdf739ac2f999eb60461c344041db65fd561d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692174706, "uuid": "421c8ed5-c48d-45c6-9bc6-13418e375040", "value": "T12215CF60ED7DBA42F59F4678008FD74E827398862136C33A566F50C1D7D32C216DEBAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692174706, "uuid": "b8ef7117-39a8-4862-805b-de9c4c6c0223", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692174706, "uuid": "d6d47eab-a33f-438b-a4e3-852ca5933942", "value": "12288:HO62iN+ZWrlkeiyj1HVZdk1mYjTp5kyQLP8y8oqM+Hydv/sGx9qkQXSRlqTjc:u61QHk1qcUJGpdqOdvtxqiyTj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692174706, "uuid": "b79d400f-d2ad-49ab-9682-91abec0f7adb", "value": 934400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692174706, "uuid": "35997c6c-bfe4-4714-8dc9-64bfe90bfa09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692174706, "uuid": "49d365b0-5a66-4114-b386-ed0642bd4449", "value": "SWIFT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a886ef6-3c4d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692201315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692201315, "uuid": "644c682e-71b4-44c2-903a-0f98ab8402f5", "comment": "Malware payload", "value": "c9f401380de778b9fbe6f5b4d4aec9f1", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692201315, "uuid": "2f6592b7-ee7f-47f2-b988-18dbb6e11e5f", "comment": "Malware payload", "value": "28727ef1f505b0d694e8ffab59a2160af979ce7434d5fb48bba0a2843bdb39f0", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692201315, "uuid": "022e0bbb-c3f7-455c-b575-bb757d64424e", "comment": "Malware payload", "value": "588275dbd46b18b5163abd08d0c3643255fdd3d7", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692201315, "uuid": "cee635c8-742d-457e-ab3d-72a8a0100474", "comment": "Malware payload", "value": "579a47bbb5971eabc22b7f2d4708c7dcf7713bb20f035ba83a73c8e7838e4c2b9707e836196b14a244fc8fc7bceb9ba6", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692201315, "uuid": "3e3b87ea-d62c-4cc8-a5b4-af9f7de1f8f0", "value": "T182A433A1476E1F02E747613004610FEFA9600D9770ACB769DECAD0B593AF4A6624B7F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692201315, "uuid": "07d75c1e-c21d-45ac-bac5-47e2640f41ac", "value": "12288:OwlxSGR448OASWwsVFRlL2t9qZF3Z9bzfB:OARfzeFRNf737J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692201315, "uuid": "798cab8d-c183-488b-b8ac-2b83c31b31f8", "value": 467995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692201315, "uuid": "8a3adbcc-b769-4d95-b17e-79d1fd04f01a", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692201315, "uuid": "60cbb297-1ef1-49e9-a6f9-a75d2a033372", "value": "Order availaible to ship-TWO USA-8.14.xlsl.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24225cdc-3c1a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1692179346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692179346, "uuid": "3884e9d6-430e-46aa-aef4-5dd37f1b66ed", "comment": "Malware payload (GuLoader)", "value": "7bdb4d9209113738f10c79fa088cbac5", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692179346, "uuid": "2eb237c0-0a1c-4f01-8780-5f9784224b84", "comment": "Malware payload (GuLoader)", "value": "28f6fde580719721acae23ecf4094bb3a9848234d1741b63db173ee93b950933", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692179346, "uuid": "76a4da0a-1edc-46a6-acc0-0988bb8fd69a", "comment": "Malware payload (GuLoader)", "value": "09a1a76d882ff0743eb89f7a942de149c4d2ad4c", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692179346, "uuid": "23e75eb9-fac0-4741-868f-88fff429b504", "comment": "Malware payload (GuLoader)", "value": "c801820c9269c5798bb6df99600776e27c4d64d58a2a22367283b37e6e85d0992ebfea7e003e91e25f58f395e1216756", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692179346, "uuid": "b8701b98-7b96-476d-a847-33ea298618a9", "value": "T1B745D062D694B92FD163407E609691F1B927BC11B6139D7B378C3B3F9ABE080C61724B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692179346, "uuid": "e0598f77-ca4e-44f8-bbca-877295b84f89", "value": "6144:8mGIhJFHs4wfO1AJcmmCAmP+vYjL27rbc4Zk/4Rd5Dj0ID:rvSJPmUPoYjLerg4egRdt0I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692179346, "uuid": "347cf521-f01f-4669-ad39-2f259d559c64", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692179346, "uuid": "317e1bc1-33d2-40a7-9230-16dcf863f6a1", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692179346, "uuid": "982fa7b9-8f22-4ed6-8ccd-e396f78778e7", "value": "aaaa.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca9e9ca3-3c06-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692171036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692171036, "uuid": "39ca31d5-3c4e-4385-b5f5-28d9a753aaba", "comment": "Malware payload", "value": "2b78b8d4e6201e03a165a83aef558ed7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692171036, "uuid": "758e41f0-259f-426b-9f42-ef6fac0b6fdd", "comment": "Malware payload", "value": "290538f26668edcb88c85e02ee5302f6cfc32ad808016d1a39b4775cab376a8b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692171036, "uuid": "914e7255-ad60-4896-a917-043a43fa492e", "comment": "Malware payload", "value": "fdfbe52987e59e49a3360fa84a22c67b63331676", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692171036, "uuid": "92845991-7e71-49ec-af7c-9dfdf39921ad", "comment": "Malware payload", "value": "505124a0e7523733ad4319378ffe4c075e17629ced0321621cb4a034bb109fcb9e119cd1fea16cf93986ae15751618ce", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692171036, "uuid": "86d810f7-cdea-4022-b57f-08dc8ac61698", "value": "T12D325B37D74578E3DB290FF359B7481D1279B551222626C363B440252FAA3C3B923AB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692171036, "uuid": "60a809b7-aa52-451b-860f-49d3aaa66490", "value": "52c90c6741354aad00af85840dd1c9c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692171036, "uuid": "9ac07fb9-9660-45db-89db-d97d56231cb4", "value": "192:lTdoFSrxLurGrTvMkrBFnowz+bq3/vXT+z:lTmFSfrbMkV5z+be3T+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692171036, "uuid": "b9913f95-0dae-4f0a-bafb-441fdd0a06f1", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692171036, "uuid": "fd90d23c-5935-4c58-852d-b3ea72711f54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692171036, "uuid": "faf9a620-c898-447d-9c93-fc19706a8d1d", "value": "SecuriteInfo.com.Win32.PWSX-gen.20451.3420", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a55444f-3c0e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692174310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174310, "uuid": "f60a1e0c-6081-4dfe-9c33-04f33344ce8f", "comment": "Malware payload (AgentTesla)", "value": "c2a1baa3e3409f7bbbd818fd0fd9c5e9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174310, "uuid": "13f3e7d6-895d-47a6-bf82-7e779148f1fd", "comment": "Malware payload (AgentTesla)", "value": "2a9bd52184deba4be57376ff1fbc75e757747b36cd74ac197fea0e0162938f12", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174310, "uuid": "82dc3166-ee43-4f6e-bb4e-de8d16f3b74e", "comment": "Malware payload (AgentTesla)", "value": "d0b8c47e8be7b1e40a0dee763520ab0be6d7e9a2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174310, "uuid": "0c7b3623-a60c-48b1-9270-63a87eff2160", "comment": "Malware payload (AgentTesla)", "value": "a5289c66c319f4877a0b0206c9344ef1b49b0b988be6fc902d2c459dbd13e430d465a5e626766c07099675e71bcd12a1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692174310, "uuid": "d8ee5d97-e051-4ad0-a924-58526d5e6028", "value": "T1E564237CFC26DCCD6F1ABA00638B3EE3A94BB4871042607B91D9EE4D5075A5CA07A5C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692174310, "uuid": "c44e5e10-27a0-4190-92bb-79f021be3f92", "value": "6144:vIagKMuSFunfSyPIW9Kmb2ju+ubn27QU+2R4/HBZV3JuQurA6vJzg:vIueQPHKG2K+tnzGvBZVJuPRU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692174310, "uuid": "12e87e2b-0f00-47ea-bc14-b6157a158ba3", "value": 317686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692174310, "uuid": "acc8e387-7a90-48bc-8396-c8aa16a0aad7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692174310, "uuid": "c705cd69-0578-40ae-a7dc-ca2989b4fa58", "value": "Quotation.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef651bdb-3c68-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692213188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692213188, "uuid": "24c1939c-1845-4222-8ed8-5ff3b28ed14f", "comment": "Malware payload (AgentTesla)", "value": "ee10542c4433c466c1842e412610aa26", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692213188, "uuid": "d529433b-41c4-4258-a5ba-de64e5aff913", "comment": "Malware payload (AgentTesla)", "value": "2c2dd8836392bcec5f9326faf7c7f222cd2e5ca5538e8f147122f7d405b489d8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692213188, "uuid": "893ed80b-b2fe-4274-8bde-124110795035", "comment": "Malware payload (AgentTesla)", "value": "1f39a791b40b96a8202dc174087374615969b242", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692213188, "uuid": "ef70ae4a-e6d8-43a0-9593-2ec9d7fa0779", "comment": "Malware payload (AgentTesla)", "value": "a58b161498b0a5c93e0ced2c574ace50fc52eb036c3834852e491a7b6f91545371e6cfd449c48511f910c69fbb2f549c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692213188, "uuid": "bf2322c3-76df-4011-929e-41bfba70d8c7", "value": "T1F2F4BDF960A5C7E6C3B9A3FF551350300BA37C5A2571D2993ABD31D62EA9B831901E33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692213188, "uuid": "41854c8a-72f1-4b1a-ae37-2a6a47562688", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692213188, "uuid": "fa05fba9-53cd-4ac8-ab7c-552da90d4c2d", "value": "12288:ZFcdtV/OyxbhdRrDf+kTiGJgTuxaqKm18hvctX3tlXxlV4aPMlNn19GG:kd6yxfRvmkTVJgT8aqF+ctX3tleaPkTG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692213188, "uuid": "f4e16db0-9437-48da-b66a-3677b0a66ea5", "value": 724992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692213188, "uuid": "53ba9df9-1497-4c1c-82c3-98f3f38bfc79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692213188, "uuid": "aa906ca6-a751-4bde-8a8f-b5033c855860", "value": "z57RsUW7c9DZIFMAqA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9851ee8-3c33-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692190442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692190442, "uuid": "f698fad6-f9c0-4b4c-a345-e90bf693e9c5", "comment": "Malware payload", "value": "d44edc4c4252de5ab501eac14fda8d4f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692190442, "uuid": "3f8996f8-535b-4ba8-a1c1-e84aaac6fdaa", "comment": "Malware payload", "value": "2c4e4e65361689c1acd392f52a7d33ed8797e80d4b542c636edae7dcb3456cf4", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692190442, "uuid": "1d75a1e1-3d6c-435e-bbbc-04b1363ed65f", "comment": "Malware payload", "value": "6083fdf904276b4c93c0fd825861293c7a97cb17", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692190442, "uuid": "78c138c2-47db-4927-9271-9d2db442722d", "comment": "Malware payload", "value": "df97547a34afbbb7e6f7c0bbe3c603d9c0d6802f6390b1b596b420d40e70a3006477a978618e373402943a3399239092", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692190442, "uuid": "188f2541-dd06-447a-b993-9702dfa120b9", "value": "T1A362BFB6D725F815D01280FEC90A85BDE6989006B672857F2ACCBDCFC9705732B1B11E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692190442, "uuid": "a78c9392-35b7-4254-a979-e86417cd3eba", "value": "384:aCop2JS/93dNxt/ZtNNhzf2H+30OLnGMnW:0r9vxllNRfG+3FnQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692190442, "uuid": "61b3a54b-47de-4974-93d9-25085a9af6d9", "value": 15650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692190442, "uuid": "d47a002a-346f-419d-a61b-3b04196e60ea", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692190442, "uuid": "2dbc28a3-07b0-4f14-8914-708a4a0471ee", "value": "2023 Annual CEO letter to%0D%0A Board.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13e75445-3c39-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692192633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692192633, "uuid": "842807b9-98b9-40ad-85e3-8aafa7566cef", "comment": "Malware payload (Formbook)", "value": "dab5e5810afc1db3c160c7415ddb836a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692192633, "uuid": "e3804054-19eb-4ec4-8e6e-c310e8c2c502", "comment": "Malware payload (Formbook)", "value": "2c6b67cc0adc1f6ca39dbffcce72276296faae3feffecee9051846ab5fc34b05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692192633, "uuid": "415e16c3-eff4-4500-8ea8-14d933fadab1", "comment": "Malware payload (Formbook)", "value": "5da9fd15cd28b117bed283a079ad34b482214bbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692192633, "uuid": "83290eec-673b-4922-aa9c-127783ef358a", "comment": "Malware payload (Formbook)", "value": "1983dae824f2c712853ef4c2e7e351f7665c33871874096f11e395ae3281bbfc0f2bfc5b3cce18c548991181405324d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692192633, "uuid": "2014d729-9d96-4de7-80b9-16e3a26dc126", "value": "T1E3642300B3F0C476E8B64A7199323EE38FE5722A3A11954F27E04F9C7B114D95D6DBA8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692192633, "uuid": "b8815ff7-8165-40ea-adfc-77dcc49dbb5a", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692192633, "uuid": "7a37527b-0892-4c68-8d30-11d455494281", "value": "6144:/Ya61gHodAM9zrkVl33OvX7vYCjjYMoWXzoOTqkRFUALEK0OsWte:/YfgHwC+vTZjYMDj1lYAYrOq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692192633, "uuid": "5ea41504-c630-4f1f-aa5a-26ad6715a02c", "value": 319987, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692192633, "uuid": "cfb2f324-4133-4827-a7d9-e4df6bc3b613", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692192633, "uuid": "2a369312-3375-4239-a05f-b1235360f0d4", "value": "Account Statement For Month End July.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76dd73f0-3c01-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692168748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692168748, "uuid": "0f168afc-4059-476c-b111-fde64f62bf77", "comment": "Malware payload (Formbook)", "value": "351c3b6cc7fb8acc6923efa5a05ab293", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692168748, "uuid": "3d43343e-ffc4-442e-9afd-53da0683ebc2", "comment": "Malware payload (Formbook)", "value": "2ccd304a2e07eb51ce493e1ae56d5c8520bc93757780d22f0b06599c1f51957f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692168748, "uuid": "775846df-b14f-4b3f-a5a1-65d3d9c914db", "comment": "Malware payload (Formbook)", "value": "270bf46dfbff274cdd82d1432ec6eef9fa0284ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692168748, "uuid": "ec266289-7538-45ae-8567-bef3011a2ffd", "comment": "Malware payload (Formbook)", "value": "b4444ef35fa345fc7bd761bb4aae4d21b424113ed9953081f7f3baef720821d7d177e44185d479ba33164e1486bf987e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692168748, "uuid": "907eb607-e911-427d-b224-e0287f990a35", "value": "T1CF3412B433C5C867ED5322316DBE1A10EEBAA61521AD5B1F1B306B567C07642CE0F723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692168748, "uuid": "4ec18f0a-3440-4138-98d8-b8b617367f87", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692168748, "uuid": "14586d01-ea8e-42d6-aa55-2ab006d9bf0a", "value": "6144:/Ya6+z+RVjoVaNPDo9spyNL0LSyvnQH2QsP2clu3Ab:/Yoz+36a1IdyvQvsj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692168748, "uuid": "2abc9bc6-ea1f-4571-933e-55e3c506d229", "value": 247609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692168748, "uuid": "d3b7533e-3301-4e28-87fb-8dc0269131a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692168748, "uuid": "4081c115-2efd-47ec-8a69-39c49a10ac1d", "value": "Inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce721874-3c31-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692189510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692189510, "uuid": "3846d8e6-cebf-476d-920d-909442854642", "comment": "Malware payload", "value": "e51e014b8fbf18c006e5bb7fccbbb544", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692189510, "uuid": "233dcfe6-22f9-4fda-b233-b9c1387cf555", "comment": "Malware payload", "value": "2cfc440437912967432b4ba2448071b441b40e44fe5ccf5614b3f4a4be7d58b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692189510, "uuid": "af4d7d81-404d-4af8-b4c1-cd775233480c", "comment": "Malware payload", "value": "d4af093944cf4b8687f419b7479e6060f99ce458", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692189510, "uuid": "2ea24038-e7a9-4539-a3b1-075b6181d62b", "comment": "Malware payload", "value": "cbaa258ccbd3deecba2f889f1b8f0b2eb0a00658a409babda18590ce789a1582bc7c9ba36fd39ccdd108affc8dadf54e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692189510, "uuid": "e1e9d182-a75b-4b4d-9ec9-553b5e514e28", "value": "T1D7A6339162711DF9D8B3523AC6858A509A62BC2747A0EE8F5370339B0F737E26D7DB01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692189510, "uuid": "42885802-209d-4363-af28-cc3f2fffcbe5", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692189510, "uuid": "32b2987f-631b-4c79-b2c6-1e5995a605d2", "value": "196608:/k7+XM8K/OY3acuuDfyGKB21X5Sp6GemDMPwuW0EYd2kUw1YPGAfhzAJK:87AML/OY3aADfDKcpfaMPiYd2R4Eth", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692189510, "uuid": "aecb5267-1f49-4a6a-aeee-b007d1a1ee9d", "value": 9854901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692189510, "uuid": "fe0c09ae-8cc1-448d-82dc-017c7a792992", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692189510, "uuid": "9422a0ad-6326-4534-b71a-c51304932c6c", "value": "e51e014b8fbf18c006e5bb7fccbbb544.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95900fe1-3c13-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Neshta)", "timestamp": 1692176530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692176530, "uuid": "84d0c52b-c59a-44ff-929a-8c12d4c00b5a", "comment": "Malware payload (Neshta)", "value": "4d853b7099bf46687b45faa000bb0c86", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692176530, "uuid": "55dd42d3-9adf-4d81-8cf0-6e9e7473be0f", "comment": "Malware payload (Neshta)", "value": "2e2240fa8e34b4caeba27b0749fc6ea5143a77b38539bbf98644a1d6cb9b7763", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692176530, "uuid": "1972be0c-e9ee-41d9-a835-96e81d5e5cab", "comment": "Malware payload (Neshta)", "value": "c0d692f65bf16f95cd811e72e4b29a62a05255d6", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692176530, "uuid": "9958cfc0-fb6b-493d-b2be-09fd1b1eaeeb", "comment": "Malware payload (Neshta)", "value": "8328f45441b4404193fe228731a9da395160173e430632ffbcdd0c2f234fc37aaf98daef9771c564dc469abaa91ef2d4", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692176530, "uuid": "5dcf9ff4-422b-4fef-b00d-b40d05583fbc", "value": "T1D165D051EE78CF42E56B4BB8008EC34E87725C593137C23A69AA51C6D5933C106DFBAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692176530, "uuid": "03ff90cb-e71f-430e-9ac9-7d931b4c524f", "value": "12288:M1PDog3ov8mSqpJVybQaxwqt9LszzdFy+oAfednonBJJfcWVVxtFKNCH/glqTjb:Vrv8mSWbybRt9ofdFKAfeIcWXV7Tj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692176530, "uuid": "3bf11941-c923-4938-b526-77b5fee2f646", "value": 1507328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692176530, "uuid": "7bb1f53c-13c5-49b0-9206-4faf253219d3", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692176530, "uuid": "25629be3-9ff8-4a5a-a4de-3d1c04d2b828", "value": "SAMPLE PICTURE VIEW.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99127a12-3c24-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692183837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692183837, "uuid": "9dc0cfff-ee04-4764-b3f3-64e7a67796f0", "comment": "Malware payload (RedLineStealer)", "value": "f7c7cc569b6a617633d9f7f6f200bad0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692183837, "uuid": "8c98713e-1f12-4b87-84f5-642959ea5792", "comment": "Malware payload (RedLineStealer)", "value": "2e2d33e8525c89a48e87802cc4b75e99ce40797826cd8b03bff1dbcbbb344072", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692183837, "uuid": "e9b0ebfc-5e11-42f4-bf1f-b4b50509ed9c", "comment": "Malware payload (RedLineStealer)", "value": "e9b0caebba45181b36353123585ce78cd6ae8d00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692183837, "uuid": "3a2a8c11-6de5-4679-9266-279d576c4fef", "comment": "Malware payload (RedLineStealer)", "value": "5477d3ede4288fb322494090c5bb7c30fa86cb448256da05edbeafec60033c12fe0241337ad22d8de5872dc5b22a7280", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692183837, "uuid": "81c669ea-cc33-4dfd-b432-42eefad74d44", "value": "T152A58C6239C18161DCFA20F546ECB924837DD0B00B674AD706C95FEBE661DF1EB32986", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692183837, "uuid": "11c31685-ce4f-49f0-aa22-c6904004af34", "value": "b1baadc7cd565683e6ca39782aebf267", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692183837, "uuid": "736e8404-ff2e-4763-a182-1528c6182bc4", "value": "24576:ic+MJpMvpKijQDP6H5lIHV2uC4nXJYgqw:1pMvpKifH7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692183837, "uuid": "dacc514f-03d8-44cf-82a1-fa31e56dff8a", "value": 2234880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692183837, "uuid": "b2085fae-3e0d-4259-b6b4-0e16cde33e1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692183837, "uuid": "cc903e94-4742-47e1-8cb5-c7a3269bd7eb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a963141-3c17-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1692178095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692178095, "uuid": "4b6b26b5-95cc-4c74-a4a9-17c8dfebc27d", "comment": "Malware payload (Loki)", "value": "a1bee18c82eaf97122737ee0fb1e2202", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692178095, "uuid": "237a2ffe-2ae2-42b0-ac22-650045174b66", "comment": "Malware payload (Loki)", "value": "2f19a13d5de4a03152094890cb3c61b1d01ab5ff758a4d457a5df670f1cb3d75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692178095, "uuid": "29517041-4dec-423e-a187-ab3959b8d11f", "comment": "Malware payload (Loki)", "value": "3ab614dccd7173f42e16404138ef9809aec20060", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692178095, "uuid": "03e1126c-bc84-4797-8926-c6b90f5c21f6", "comment": "Malware payload (Loki)", "value": "cda19b399150a58b351aebe214e21260c10b372c0a3ff828357e2b21320a7805b0665a4358da1ddc2399b3f64e2cdf0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692178095, "uuid": "b9470bb7-d768-4b43-8f20-1d382d7eb433", "value": "T1C183F9EF620C891BC64996BF63D5B28147F0DB2E64C1F78B84F965E936F23A50911383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692178095, "uuid": "de02645a-fab5-4db4-8685-29a7092288e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692178095, "uuid": "477adc22-41a1-44bc-88dc-f2990322be73", "value": "1536:3CMv7TbXyqQJvHyn60ugjYPvHNeF/eReinV4+LCMGMjcLeOYLM3UfLUzjC+:3CMv7TbXyqQJvHywPvC/eReinVLLChMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692178095, "uuid": "703e6f6f-0071-4f5a-a0a6-e9602f5e1056", "value": 83968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692178095, "uuid": "7d125123-2ffd-4748-8ec0-44f20ed20bbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692178095, "uuid": "e4b698ba-66c3-4207-b1fc-3aa0b4875541", "value": "RFQ_Q10865.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc7c5247-3bff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ModiLoader)", "timestamp": 1692168032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692168032, "uuid": "392728b4-cba4-4f18-b497-40326ba6f58e", "comment": "Malware payload (ModiLoader)", "value": "e6c56d3e3c9b0472ee6e890ba6ac29b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692168032, "uuid": "83f36e71-1644-4a49-8d8c-4ed903535c11", "comment": "Malware payload (ModiLoader)", "value": "2fe9bc1096b9cc12a5f2eb7db53fae2d396b870008b7283c35c87b84626ab509", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692168032, "uuid": "0b88a578-0ad2-4378-8750-47e9d808cf07", "comment": "Malware payload (ModiLoader)", "value": "2861b57183cd7e597d38b2b909abc6868a925e51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692168032, "uuid": "7eb9d03d-8311-4c33-8694-6f22ff978327", "comment": "Malware payload (ModiLoader)", "value": "6315da13eadadadc87a90f679d9fca64ad22ee7e8b29127c649df601961215fad55d17fd8e5d0353d30dd7d682e25470", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692168032, "uuid": "957217f2-afee-4569-abb2-1c1d2dd07b4c", "value": "T136E4BF72B2F16136D122ABB9AC8EDE54D926FD202C5C684726FE1E8D2735D807C3464F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692168032, "uuid": "34ce8569-07e5-4bfd-b358-b283c39a64ce", "value": "d674711caf6b20067455c4ec9f6d708e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692168032, "uuid": "bf599bb9-9f65-400c-92c9-1546e9ababf1", "value": "12288:IHvcLtcc+LtcDzSPGSkK1mWqXt1H4UeP0wAz7J2qEO8m:IPoccPSwFz3H4UeP0j7oqEO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692168032, "uuid": "1b4db584-b1ac-4bde-a461-b9d0439bf6a2", "value": 709632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692168032, "uuid": "30a7a5ba-5ef4-4a75-b14a-558afb4f2323", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692168032, "uuid": "a5502992-57a5-4839-abd4-af05d9a8c564", "value": "Vhlvkjghlfjsmz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faa931a7-3c0b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692173264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692173264, "uuid": "c6debce1-4257-436c-9e4e-6735889f9f96", "comment": "Malware payload (AgentTesla)", "value": "8f7fb65314ec1cc8e4e3ee82fb02951e", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692173264, "uuid": "9c659b12-2fdb-4558-a59f-f092f5701a4b", "comment": "Malware payload (AgentTesla)", "value": "309ca3f36a9ced96d07ae6c8a96158daa121072da6bb49cd0f08e93d0ee7abea", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692173264, "uuid": "98b36703-5793-4b18-a6af-0e967c68cb3d", "comment": "Malware payload (AgentTesla)", "value": "b871cec8891c9fbb4649517bdb56edb662ff22c8", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692173264, "uuid": "70c44e19-0677-4077-b497-6f5cba9b8b88", "comment": "Malware payload (AgentTesla)", "value": "ed05950bd9804f2bdb3048ed87d05f1737499e3cbdbcb754ac887b5f8c5a10e9389680e90db7bdd2cc2e3425b73c129b", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692173264, "uuid": "fdc65d1b-6838-4dfc-96c5-c2517135ad21", "value": "T1D8B4232CB5A39A23634F25D204B84E339D17FBFF0C6769FABBD95E04350ED998911428", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692173264, "uuid": "8d4f25ca-34eb-4454-8ad2-c922e86b65e0", "value": "12288:A3c2YU1o14ckF+u2eY7s/QWqO9VAVNen4f0MDny:icyo1SF+u2L7s/QWqO9Vafxy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692173264, "uuid": "689d9e34-8684-4622-ae26-eecd6bbcc0cd", "value": 501977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692173264, "uuid": "5473e18c-2ed3-41a0-8c57-3840da4a77f5", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692173264, "uuid": "f114acec-bff4-470f-adcc-0cb2c5a40cde", "value": "Delivery Note Ningbo.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c42144b-3c4d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1692201345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692201345, "uuid": "12af6c36-aae8-408c-adff-537489e14ed2", "comment": "Malware payload (Loki)", "value": "bc1e488a7c0bd7e90d670caf1e7223a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692201345, "uuid": "354bf603-f4fb-413f-86bd-e9dcf279b67e", "comment": "Malware payload (Loki)", "value": "3135f6f44c9ee5cb1b2d585c3477484bc2b95c53ceb97f43d98fa341df6b4bc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692201345, "uuid": "3ecefbfd-f7c8-49eb-b0f0-c3add212282e", "comment": "Malware payload (Loki)", "value": "0eb0403430b3cb15c0e4fdcec9fa82a489ada56f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692201345, "uuid": "a43d7b45-f8b2-496f-ab23-043015b15469", "comment": "Malware payload (Loki)", "value": "3fcfcf2278ef1e5b25938c1b2e6831bcb24af6ed0535442e25b7f6b02bb95c025724c28bb88b22aa273ef44f8d3c97be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692201345, "uuid": "f78ca200-d487-4c0e-b390-e69708807894", "value": "T1AE04024872F4C4E3D8A20E710E7943416DBBFA1B08A45B5F6B21492DBE77642BD1E723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692201345, "uuid": "c78b0489-2a66-43ae-b470-61ec151c7b16", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692201345, "uuid": "91e985b0-2524-4620-a3c3-cf0ed38cc7b5", "value": "3072:HfY/TU9fE9PEtu3bF8MOxWmPysiHKVu44Pchyi7biDz6e+cEdz+uD6dW/ZY2:/Ya6BFLOwmJiHK/Usyi/iDzIdwdW/ZY2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692201345, "uuid": "7ba4acdd-eaa0-4404-a02f-70dcae3bfda3", "value": 188543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692201345, "uuid": "5e2bfe1e-7bce-4ccc-8587-75d4a777fd5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692201345, "uuid": "2d015a6e-5309-4478-94e7-d48b8ba628aa", "value": "WM_11505138.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fec6af1d-3c78-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692220086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692220086, "uuid": "1bf4bfd8-cd86-43de-a29e-f3e8c769eaef", "comment": "Malware payload", "value": "9a7450c9efb51ebf625765d207dfca44", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692220086, "uuid": "5315af0a-b213-493e-85cd-350d800d9bfe", "comment": "Malware payload", "value": "327a0f062cdf2fb3b2ae74926197b0dece7fa547cb9a18b85c4d4afd2caa6a45", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692220086, "uuid": "fedc7f6d-ea8f-4fef-99fe-2b52e88bdb11", "comment": "Malware payload", "value": "52c6f45e395b66aa575a2a21bdf9c181c44b9e2d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692220086, "uuid": "d7ed295e-8262-4549-b730-ae7db74881fd", "comment": "Malware payload", "value": "b84001d9f5aa8edaa5a5cade37ef5f718151457d3170deb0bddcb0e62a7714e187b2564ff1b2ed58d56604e637d6934d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692220086, "uuid": "40a8e379-0fbc-4a1b-bb5e-5af382f81467", "value": "T14CD0232594590543F85E03F1D1810B39A074DB9B974725D62D5410DCFF915F12F531CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692220086, "uuid": "7a1cd8cc-9a98-413f-bca7-b34380af5c65", "value": "6:5jLqERMzB3UoLYqBmM2ME/Vc5ylVA/OERFylf3Uo4PqnJG:5jLqEcB3UoLrBmx3dc5yLAmEHyB3Uo45", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692220086, "uuid": "d6d9a713-e7ba-4e59-9418-0dd7f69cb0ec", "value": 275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692220086, "uuid": "15851100-f122-4659-a167-6dd7bd2a2231", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692220086, "uuid": "843c690d-3b22-4697-adfc-99c71edcce29", "value": "odt0fta4.dll.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8ebd07a-3c1b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1692180106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692180106, "uuid": "6848f763-1f05-4cd8-883b-6634a3157604", "comment": "Malware payload (Loki)", "value": "e6c554b153c6fc0b32eb099b433e62bb", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692180106, "uuid": "e62e791f-c18a-4e66-a09a-a2c4d7db07d5", "comment": "Malware payload (Loki)", "value": "32c1ccb6d7fe1e4d25e5dc632c0b556af088812a8c1b305b93701426289d9896", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692180106, "uuid": "b60fc55c-a825-4a4c-bb30-ce0abcb16575", "comment": "Malware payload (Loki)", "value": "df2f81b1241ceeef648bdc0fbe65ff1e50da926a", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692180106, "uuid": "9c66cf8a-f1cd-4043-a7fd-cac3b31fa6ed", "comment": "Malware payload (Loki)", "value": "82b0b366f07643ff13388a8c09ef81c03ecf6a9c49ef3b9dc43434708c8dd82a32bbf4dec73e0aa4b716697f87304f50", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692180106, "uuid": "ccabf898-c923-4226-bb39-27bd153694c8", "value": "T16B03F2638D558C258C7FAFFB168095FF12B471F1E296206447BA0DC8CDD0D0DB5A2A91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692180106, "uuid": "3d633993-7c18-4289-8d8d-3d4a292744a1", "value": "768:0fT64VFo9wjA1WvvFqyFitPGGNWs1aUcX4tn9/CeL1OIPUd:w24VFiwjY4V0HNWQPqepHP0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692180106, "uuid": "eb8f33b2-18c3-4236-b36d-c8b5d3d5c15d", "value": 38176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692180106, "uuid": "f80f09b2-66d8-4fb5-85d6-796c6df1cced", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692180106, "uuid": "042d28e3-c199-434f-8a2a-3f74d06a1c97", "value": "Original 3 - (for Shipper) - 180-38985892.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bfc994e-3c4a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1692199922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692199922, "uuid": "70653e07-3488-4a9d-8361-40766e197206", "comment": "Malware payload (Loki)", "value": "a8fc0dd2433ac9843b08f335b263e46a", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Siemens", "colour": "#EADC3E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692199922, "uuid": "efa75ca0-dfa0-4c9d-a26f-dc0aaa81d8f4", "comment": "Malware payload (Loki)", "value": "32c30545de6ca57b878a5b56065058a13b83126d0777840966a129f1093ba5be", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Siemens", "colour": "#EADC3E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692199922, "uuid": "9686b9a6-2a46-4c36-94f9-8443870ff59f", "comment": "Malware payload (Loki)", "value": "b4d5142c5cd747a0796ba9049c0c1f60176cdade", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Siemens", "colour": "#EADC3E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692199922, "uuid": "012324f4-e75d-467f-b996-547ab92ca3fc", "comment": "Malware payload (Loki)", "value": "2d8a1a14faca5a64b86253e7657f842fa1f7f96042d8deecd6cd3bb684a8ddf2de8024f6fbe18bc812232beb226235ea", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Siemens", "colour": "#EADC3E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692199922, "uuid": "f2754d82-1974-4a67-83ad-9c139e00108e", "value": "T1338423C0CB81812573E1443ACD2BDBA245E3D74FC21BC954ED8B268729ABB89D64B5F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692199922, "uuid": "dc4b31c5-19d5-4978-ac79-4bd10cdbbebe", "value": "6144:iZ4mdD8Ij5zJCYA4chaZBADDVF602BwDo6mhUx9jRtYEELZEJzJURKp5iHQbI:iZXdQyzMYqa3m6tWRmmzpEGuRKKwbI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692199922, "uuid": "aef6157a-7917-461c-84fb-62ccb6a82071", "value": 377752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692199922, "uuid": "558e2665-009a-4ff4-a777-0ec349bfe8ef", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692199922, "uuid": "3ea37969-359e-4048-abda-3483fca30d59", "value": "KIEFEL Packaging GmbH Purchase Order.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0692aeb1-3c0c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692173284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692173284, "uuid": "69bdec2d-c230-40fa-8ab3-91d62cc8e37f", "comment": "Malware payload (AgentTesla)", "value": "ea4484372aad013457c26eca399a9845", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692173284, "uuid": "9e059f1b-aab8-4fdb-a2f6-0f68ccc2bf2d", "comment": "Malware payload (AgentTesla)", "value": "337e42e39d8612056eb0bc81526909d75f3582b4d9a1315e6dd82e71ac217666", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692173284, "uuid": "f9e93645-ff98-4ee0-b371-7d215083df10", "comment": "Malware payload (AgentTesla)", "value": "9040fc60cd27b34fa54e78bb02d62718f1ab6bf6", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692173284, "uuid": "126ef17c-c870-4fc4-be67-fc9c691c1e5a", "comment": "Malware payload (AgentTesla)", "value": "771468b7858eb72fe85e29c930e2bcb60b709f92f4884789b4489d5e4a268f14606aa7ca3e031d10dc74ff9c1f721387", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692173284, "uuid": "9528b14e-166a-4245-9396-584010719a4a", "value": "T117B4231CB5A39A23634F26D204B84E339D17FBFF0C6769FABBD91E04350ED998915428", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692173284, "uuid": "2894c9c9-7167-4948-935b-0f7a1bbcf0d6", "value": "12288:m3c2YU1o14ckF+u2eY7s/QWqO9VAVNen4f0MDnB:gcyo1SF+u2L7s/QWqO9VafxB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692173284, "uuid": "d2b2f42d-0ef1-485b-83b9-dfac556250ec", "value": 501969, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692173284, "uuid": "8ce7e0c6-3752-4f19-bbc1-838f4a4d558e", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692173284, "uuid": "1325ff22-78cb-48fe-b0b1-79647b3da57c", "value": "Invoice Ningbo.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cbd5b6f-3c05-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1692170449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692170449, "uuid": "71682785-d01e-4912-ab80-d8224a41965f", "comment": "Malware payload (Loki)", "value": "27fbcba8f2fc45d36a95dfab30803fe7", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692170449, "uuid": "81b3b777-ac21-409e-95ac-54fe83255cb3", "comment": "Malware payload (Loki)", "value": "35d8c2b890bc90b5e73217c3b8ee27c658eaf09be3ffa8c51627f6b6aa24ba67", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692170449, "uuid": "cd6d9a0b-dda2-43e4-861c-877be54b4664", "comment": "Malware payload (Loki)", "value": "487481e464963efb2997ff88c842b784c660ce42", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692170449, "uuid": "887ea23a-2149-4594-a9e9-91667c465a0d", "comment": "Malware payload (Loki)", "value": "045ef0c8cb3d961aa09e426632a7aa12e9ff044564b039e9a768fdfffe664b1ef0268b1e1513abb6817850e157309659", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692170449, "uuid": "ebbbb0db-a7f4-4848-9d3e-2fcbc3efa652", "value": "T1A8D312AADD8E9486D0B64230FF781FA1103D7D97A569980BF9A1E81778D4F72076C3C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692170449, "uuid": "d11df911-1084-4646-b0fa-d07a9e3059e0", "value": "3072:wpOz8IaLfe9Y8r1qZZXI+TlBpbdx76y+fuNFTsFB69fGjQGctlev+sS:wpU8PLfnYK4Gl7dxD+fgFTSBu7GeT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692170449, "uuid": "2df1ad97-618b-4c7d-98a6-057441ca0dd2", "value": 140070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692170449, "uuid": "a1e4dd79-3755-480f-9d9f-2445e1963937", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692170449, "uuid": "e0c2e644-7f18-4e9e-be9d-e08e768c23ee", "value": "PO011948.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d57a9968-3c1b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692180073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692180073, "uuid": "8717b8bd-e2e2-470b-a951-c39214058199", "comment": "Malware payload (AgentTesla)", "value": "44a4ce0a686c212723708f7e0e357786", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692180073, "uuid": "e9142a26-6d63-4d7e-9f12-cde215746fc4", "comment": "Malware payload (AgentTesla)", "value": "35f5c0d5c6c9d40fa748cb0e4cc8df4991c29611da1d15ef58e1bc4088f36ff2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692180073, "uuid": "fbe3ad95-aa7a-4495-a89a-cf319b43dd24", "comment": "Malware payload (AgentTesla)", "value": "19225da570be22f5ca0c67c32ac2d9a16ed41818", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692180073, "uuid": "15e41671-9cb9-43b1-86fe-587c372274d9", "comment": "Malware payload (AgentTesla)", "value": "bad9535a574e7cc54dcf52539b2d3be4a3b0f3c5768a71aae9e342795360c92b26a95e8eb58a0b82817dabb83040e6e6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692180073, "uuid": "fe6ce68b-4fa7-4cfe-92fa-5c116eb247a0", "value": "T14D150821E77B255AEF29A1F84E2F447239D6DCC0F1B1C598A7E7280385C23514E39BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692180073, "uuid": "1b1a26ff-a970-4abb-811c-d33d90c195d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692180073, "uuid": "f3449020-e106-49ed-a6cd-0b75731e6a44", "value": "24576:a7pRs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUOLUFLx6t4EA9+8QlMoVMl:a1Rs6CE3jLbO9Rs6CE3jLbOLkEt4E2KI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692180073, "uuid": "a53f91c7-b24b-48c1-b0bf-5b4e0646dd4b", "value": 900096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692180073, "uuid": "2621798c-1497-49c0-af59-efc2b09e09aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692180073, "uuid": "824f9034-8c44-4412-8af7-c87f66c01ffd", "value": "ELIBE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ace3a9e-3c49-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1692199517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692199517, "uuid": "c2d00789-b942-4814-b2c7-0368f637f6ee", "comment": "Malware payload (njrat)", "value": "3ff70159c7366a46caddf974a3906e0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692199517, "uuid": "3d96e5d1-7ea7-4867-b3e5-79f370c2ad20", "comment": "Malware payload (njrat)", "value": "361a301e646a4d89fafb956e3c666e1626b96daed8db9b71def59350ac9d0a73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692199517, "uuid": "93e1aebd-854e-4b54-a419-7f756ea5af1d", "comment": "Malware payload (njrat)", "value": "95e16ebdf61d4220ea872a9bc0bda3f3246b9230", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692199517, "uuid": "0c40903b-91ef-4c93-8630-7fef994fc743", "comment": "Malware payload (njrat)", "value": "68e36cde78f8ea51a51978f164bb66e8ce9351d167bd9d451ed1ff04fbbffb0d99e7757d12c53506b5fdb9235e5bef8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692199517, "uuid": "26fa8430-abf0-4c7c-88e4-e1ab1436e858", "value": "T15FC2F86C37B68232D2EE067E4562EE5043B4D44BE263FB0E1CD958D94B5B38A0B41FE1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692199517, "uuid": "54916e5e-854e-4519-b866-b008cb5df66e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692199517, "uuid": "d2ce2d75-1d82-43d1-922d-ed2adf20a828", "value": "384:oLf7+aLz+oYDaBcbQMCpPsN9xMRAQk93vmhm7UMKmIEecKdbXTzm9bVhcaElr6eR:WD+wawWkRA/vMHTi9bD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692199517, "uuid": "0e020ffa-c0ab-48e9-872a-8668bdc82656", "value": 27648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692199517, "uuid": "82c0785a-71aa-46ad-b19c-d92a2240cb42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692199517, "uuid": "a6a6acd6-0681-4955-9b05-fbbdfbed3f09", "value": "361A301E646A4D89FAFB956E3C666E1626B96DAED8DB9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a001b644-3c10-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1692175259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692175259, "uuid": "4020266a-8c51-4ed7-9293-c1a9b227e803", "comment": "Malware payload (njrat)", "value": "69c83c2257735b538c756d3f741a80a7", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692175259, "uuid": "05361834-005e-4dde-9965-becabfb9ce78", "comment": "Malware payload (njrat)", "value": "362613cca115e113cdd6a90a306eeb851950a01dcd4df01fba15501456f1b839", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692175259, "uuid": "4088604d-b941-4963-81db-887d012e2251", "comment": "Malware payload (njrat)", "value": "cf94862dad419be8ae4fc634d540ec3efc7d4603", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692175259, "uuid": "4b1038ec-20d9-48f6-a652-6eb7ab0c46d1", "comment": "Malware payload (njrat)", "value": "966feedaab7c16b57a2b721966c66adc133a9280fcdbda3ebeffd12808887b139b7891fd0814010ac95b5865085985ef", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692175259, "uuid": "b607dbc4-7502-45c6-851c-0f8fd5b62658", "value": "T1F924EF1165EE2589F1737B9307DE69E88F2BB7E1063A606E614C030BDB9BD44CE19732", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692175259, "uuid": "59e5f84c-904d-4436-9ab1-1ed1d44ece49", "value": "6144:q5jLo5eaqOvQuVsDi2+Ci2iDmiiig4+iDi/2vQ8:q5jqvQuVsDi2+Ci2iDmiiig4+iDi/2vl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692175259, "uuid": "b69af51a-dcb4-4a85-871f-e462414a76a9", "value": 215500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692175259, "uuid": "8a50b612-42c5-44a6-a826-c23c5d3aeb6a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692175259, "uuid": "f4a0986d-2589-4bc6-a9c1-f2e924c9165e", "value": "Informe_Detallado_Reporte_Centrales_2023_08_015_PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53275f34-3c62-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692210349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692210349, "uuid": "96d7b786-fc67-446f-81d9-472c11e42d24", "comment": "Malware payload", "value": "ba4c4d0fdc6f757a923f2870976cafba", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692210349, "uuid": "dffccf2a-56ea-4b9a-b14a-54a31c2c85ea", "comment": "Malware payload", "value": "36cbcf791512b3ddeb2e577a8aef593552cb18d6bde49c9c595ac6333c6df868", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692210349, "uuid": "90670762-23d4-4281-b9c3-b2bf8b95d426", "comment": "Malware payload", "value": "b05bad5112778ea599111d174a550001959ce14a", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692210349, "uuid": "95bf6c52-e157-45ae-bfa9-ff23649c0a30", "comment": "Malware payload", "value": "5d9523697ec3d1eeaea759e6fbde949dc370b20387f43784f53bbd9047f9b72285a42cf720c393a37162090f68a7d2f7", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692210349, "uuid": "752525b8-f41d-4be6-9b20-c958fcd38e8a", "value": "T17245BA3439797C2443DBDA1334F14A962CED564FD1703A3B299AD8239A346C265B22FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692210349, "uuid": "92635919-8213-4d85-9abd-c6a6b205d492", "value": "3072:Iyc5cXfP5hFK9lxJebgrCyUkHWxCtx0AOxc:IefhmFJecrjHWx80zxc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692210349, "uuid": "dda59b2f-1d09-4d14-a420-ff6efe09d3a0", "value": 1261677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692210349, "uuid": "8083a784-da01-44f7-aa55-e1e2123798b7", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692210349, "uuid": "5020514f-6089-48b2-ba86-4128f02925a1", "value": "uuhhyyygggttfff(WINNNNN).hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35beafc4-3c4a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692199992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692199992, "uuid": "bf1d7917-582d-490a-9be5-41c1f57b67c1", "comment": "Malware payload", "value": "17d236d418e5277b86799fd7dd3d98e3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692199992, "uuid": "98d7972f-1a5f-4eb6-8aee-887aad103c83", "comment": "Malware payload", "value": "391c86759a14148b8aae958d656557ccee88cb4e415cea18f9272a16a7f5d551", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692199992, "uuid": "0821421a-3643-47fc-b973-79a32e7726c2", "comment": "Malware payload", "value": "92aca3958e5426189b150ddfab1bb0f2e0cf9dfa", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692199992, "uuid": "1b4002ae-ad2f-4a1c-ac38-b4822318f6c8", "comment": "Malware payload", "value": "ed66e2d4a96aa7b459100353d29d0fa2f3a4d589f9b952c14511c49b62cb5a6ca65dbfbdea96a7af6ab74590d66cf326", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692199992, "uuid": "797778b3-d896-4a3b-818b-bc2b373e49ad", "value": "T1DF937C11B2D1C071EA7E5A351464D6A14B3EBD10EEE09D6B3B8506798F702C2EE31E6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692199992, "uuid": "3b79c269-3781-4b88-8b4d-14445156da63", "value": "fb8a80b0fe085dc3c95842d94bc1ac66", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692199992, "uuid": "9128fa4f-6340-4634-ae3b-aa0cee7926d3", "value": "1536:hlHRGZPvU5tww+9uyads7t9qKgb5Y62ur7oPUmT8tYu8K698tsWrnwcdbBlitpg6:hRHfwdadsbqLbB7oPe56ybBliWzI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692199992, "uuid": "f3ea496a-5389-454d-8610-553801f74a60", "value": 92160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692199992, "uuid": "b4067370-1bc2-438a-87ab-df9f38321d9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692199992, "uuid": "8e51aaa7-bc4e-497a-9fd7-07b2ffeea75c", "value": "SecuriteInfo.com.Win32.TrojanX-gen.9298.28968", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f3cbe21-3c0e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692174345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174345, "uuid": "14f81677-8cc0-40da-92b0-72e7a4ae9f3f", "comment": "Malware payload (Mirai)", "value": "6c181456e512c70cdf5fe48f810ce614", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174345, "uuid": "4d0f34f9-c462-423f-b29f-cffd16166bf2", "comment": "Malware payload (Mirai)", "value": "396f358fa0265f9f9b3f147244dadfa0f22f68f36d6931629b78d90e9bc4de56", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174345, "uuid": "22e9de2e-780e-443b-b003-16bd04977044", "comment": "Malware payload (Mirai)", "value": "cd221c61efeba217f97805fcae04cc6297ef6943", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174345, "uuid": "8965e216-030b-40ac-b9b0-56419f90df79", "comment": "Malware payload (Mirai)", "value": "2d3de5f568e2cf7b399a4cd6dc3469c721e6ae2987e300062d287e5d0ba8d430141f832b5bc367cb3ce782428bd80862", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692174345, "uuid": "506b61e0-359b-4b2c-a84a-4b17acbe66dd", "value": "T19DE2D0CED5583A5CEC9C4CBC22FC27969826E4C1715957EC4B61CC409A3FE47B84B4AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692174345, "uuid": "34811210-f4a0-4da6-a309-021119dae5f0", "value": "384:T13wXXjTClbIICMIPwMwW1Eaerh96+eo8by9u/QQ+zRzW96wd1/NRqOcRWGVCzhr:GDeIItqWnrW7GA/CWUonH8WM4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692174345, "uuid": "708e7b87-6d95-47ec-96e5-5c65e73eb361", "value": 32672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692174345, "uuid": "a9740d7e-d3ff-4b9f-93d7-058a03055e5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692174345, "uuid": "bea16789-4f49-4a51-89ab-5780e29f38e3", "value": "6c181456e512c70cdf5fe48f810ce614", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "821513a2-3c0e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692174350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174350, "uuid": "cc28c102-e0fc-436e-a318-efa1cbe864e3", "comment": "Malware payload (Mirai)", "value": "688a5152e913813bb03e68c33a397ea9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174350, "uuid": "4bfbe000-54a4-4463-9a7d-f43898611c46", "comment": "Malware payload (Mirai)", "value": "39e0679ed17d21aa4ecaf8218c707f20f3f5d580495bc160a055fc4a06a431aa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174350, "uuid": "1556616c-47fd-4c19-87cb-c8f53a15f184", "comment": "Malware payload (Mirai)", "value": "e3e10b26d071eb2e7957fd0b46449b256751b54f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174350, "uuid": "2989e366-b787-4e2a-864c-aa3074d39a17", "comment": "Malware payload (Mirai)", "value": "19e1d69f71558ab78ad427a0951b410f6cf52f7d77874d96416de672cddc1be84714e95983a8e7dceccdfda1d0ed26f2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692174350, "uuid": "fc42a6c8-7bc8-4c8d-9919-8f97a03ff045", "value": "T1B24302C0D2040463CE00ED77587D9193F7BD2E9AF64DB67613C9072FF9969292A34A43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692174350, "uuid": "e5b6cb13-2279-463d-b11b-c009a82308a8", "value": "1536:FZAZsLF8cR8JyafwgeuaoqMcCT1LQUqS960PP7Wx:FZEyafbnabY1fPP0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692174350, "uuid": "3cd0a193-d39c-4238-b317-251b94fb7dd6", "value": 57052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692174350, "uuid": "6971c935-c4f9-4a7b-9b88-220a66409921", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692174350, "uuid": "f6711d84-c394-4e77-9962-0ff602174fb8", "value": "688a5152e913813bb03e68c33a397ea9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78dabb5f-3c2c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692187219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692187219, "uuid": "c7a179b0-eb95-4bce-98cf-a490fddb66a3", "comment": "Malware payload (Mirai)", "value": "54be2aaee1e0341b12735ee51a02840e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692187219, "uuid": "153459e8-fbab-4027-be55-104076407e1e", "comment": "Malware payload (Mirai)", "value": "3a628e157229d24c7140243d3705c38d5981526931e159353055eedafafdebee", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692187219, "uuid": "c2129372-8f2c-4643-8711-733717959afd", "comment": "Malware payload (Mirai)", "value": "6767cfedcc109353971412160191edd1bf38ce31", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692187219, "uuid": "cb8f3747-fa35-4a4a-8d5d-5a106d79131b", "comment": "Malware payload (Mirai)", "value": "4c132bf38738065592d6a1a2c21c8623c0b91d0c23c767d927c02ce30efdaaf26444dbd3867929120940519c3fbb6784", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692187219, "uuid": "a0675539-2f76-4f9b-8941-004778666b4e", "value": "T199D34B07B4D1C0FDC4D9C2B88FAAA53BD972B52D1138B26E27C8EA271E59E305F5D610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692187219, "uuid": "07b1381e-0c86-405e-b5f5-c080713d88a9", "value": "3072:1ZaCnmT1GxRpbsulpN8NhdFnflJ8ctNnd:1ZaCmkHQFfD8s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692187219, "uuid": "9e27647d-d4c7-4140-824e-80f80e7e653b", "value": 134840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692187219, "uuid": "675c83d9-bd32-47f1-80bb-719db3ff7ab7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692187219, "uuid": "a897e59b-5744-4c56-b4ef-ef838892aa3e", "value": "most-x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "516509d1-3c35-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692191019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692191019, "uuid": "22b079dc-7b2e-41e1-b137-7dec72d5c14e", "comment": "Malware payload (AgentTesla)", "value": "01ab5943426b36292f33646692ebcd92", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692191019, "uuid": "20f0f1ad-7fef-47b7-be5c-d33ef0d8d667", "comment": "Malware payload (AgentTesla)", "value": "3a6b50f884150806505bd1972ae11b09bce9f524e9ace0c3e8d8e91a0e5a16cf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692191019, "uuid": "72052a07-b958-4c5a-97e2-cde04054fd5f", "comment": "Malware payload (AgentTesla)", "value": "12b8266c5ed9f3958b13f47eb98c5d695ee3a3b0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692191019, "uuid": "019418ce-86ac-41ca-b81f-e6ed56f8ea81", "comment": "Malware payload (AgentTesla)", "value": "d73d7b068021993772f80b9a52739a22e4562b6b24797daa5e024ebdb9aae9781c91a497c135668db86803a84626e959", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692191019, "uuid": "74c5d4d7-6589-4706-b520-b5335192e2cf", "value": "T171E4235ECA639F88E21BC43586E339D624D215C2269AEE4C241BD924F03E9E37531F77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692191019, "uuid": "dd852556-be21-46b9-a1e9-5765ad3047c1", "value": "12288:DtxyLaYLJOaOlvNjhwPpxT9TDeaxWq87k5DWVST0JhR9nIJe/:D8FSTeBxT9RWqp5DtT0JhRKe/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692191019, "uuid": "1abc2582-ba00-41cf-9390-c6d6c4a4aefc", "value": 685322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692191019, "uuid": "bf5caeae-4b92-44bf-8003-99d6f14c9718", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692191019, "uuid": "e8dc4514-8bf9-42bf-9d8a-2bb6583e1f0a", "value": "neueva orden09788973.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db063906-3c52-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692203705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692203705, "uuid": "a65ae8a4-9b00-44de-ac40-63ed451e8d5f", "comment": "Malware payload", "value": "79c4c36735d3c657aebb38413b4d1983", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692203705, "uuid": "fe94d95d-ec0f-4331-879f-08be5c486661", "comment": "Malware payload", "value": "3a7e9e3acce7084d991834a07d48907876ac05bfff985d1aa856f218d33c3f75", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692203705, "uuid": "ad84248e-2db4-4512-9d51-02307e72a8b9", "comment": "Malware payload", "value": "06c8bd4fc23c4d932cb9efe3ee3cf28d906e8490", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692203705, "uuid": "35e9153a-ccab-4d5d-b8c0-0e4c703a9b04", "comment": "Malware payload", "value": "eb60c80c194a4aeea7977c39c1f33b11acb718528f8500a05bf0958abda867ced205e4b08a639bdf3218f2b5f04df0c5", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692203705, "uuid": "3ed9a241-6c52-4b05-abab-23d894bcb52f", "value": "T1E075AFBC75047DE6666F536BDA96ACDC13B61B229ACBA4CC80647BC305A3375FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692203705, "uuid": "a3061a76-e232-40a1-a5e1-84675734a6de", "value": "24576:rOKXMxJ1yZTr0b0LxqvkC/99AqCo/ElrKHLaHwLZURyYf3jYVkXmeKBuG66RnAbg:Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692203705, "uuid": "d37175db-71b1-4201-b8e2-71946b2c67c2", "value": 1593633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692203705, "uuid": "79541e41-328d-40eb-823f-021b75f6a590", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692203705, "uuid": "6fe16d21-6c1c-4d51-98fa-e0f879cb494c", "value": "RFQ-IND23072113.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeafe903-3c27-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692185270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692185270, "uuid": "43c2ec56-a6f1-4ae5-ae5e-af7f450a6189", "comment": "Malware payload (Mirai)", "value": "c3cef24ea6bac254b970aee4c3a0e471", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692185270, "uuid": "4c054a45-5c6a-4def-98fc-e1d085fd5b27", "comment": "Malware payload (Mirai)", "value": "3a85dab259579367c5befee6f6eb075e00554ce0ad0db62aaef2584d76d2edcc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692185270, "uuid": "13b9d3a7-bf41-4b49-8f13-e658d135e94a", "comment": "Malware payload (Mirai)", "value": "b0e4bafa9655d0c9e636b066cc69aac63480b2a9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692185270, "uuid": "35a871a6-7026-4d1c-b3d1-f1b432cffdc1", "comment": "Malware payload (Mirai)", "value": "31c10e80356bd4769589d72bf6a301bd51b12ae39ae975f0d210d5a664904d8a5b0b61c0cb96920c5e5cc89895b92bd0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692185270, "uuid": "440fc224-d337-475c-bc72-5c2e94cc9bea", "value": "T15C82E1F0B5AB99A6C2CDA9F623676E8C51A04690CF4DC312563E38B7FA473221C37191", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692185270, "uuid": "a2a0bcad-7825-42ec-b003-4eefa048bee4", "value": "384:M5HaFs02vX1JDk/11MVMP6iM/gkA0ywYPQyIkSX6459v1Rlg:5GBvX11k/1VPORzYIuSTDlg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692185270, "uuid": "0049b23d-432d-4b7a-a613-be3540bb329f", "value": 19056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692185270, "uuid": "cb2cdc65-f00f-421a-9b87-2a2c2f8b3c3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692185270, "uuid": "de66b1a0-05b4-424d-97b8-2ec1c441a447", "value": "c3cef24ea6bac254b970aee4c3a0e471", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c4715e6-3c41-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1692196218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692196218, "uuid": "301a4459-361b-41bc-ab5c-3f45c87849dc", "comment": "Malware payload (AsyncRAT)", "value": "7b06598763fb325a3879fc4acece48ee", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692196218, "uuid": "9fe23c50-b50b-4538-beb4-fde2981ab9f0", "comment": "Malware payload (AsyncRAT)", "value": "3b493666bcd9fc519f7190a993e3c2c9e7d2a910871c0be768d09f0f37035102", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692196218, "uuid": "88f09813-1d86-4068-8ad3-f9147c9607e7", "comment": "Malware payload (AsyncRAT)", "value": "f52511b1d85ce0c84391a9ee1442ba7163d98ba2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692196218, "uuid": "5729942f-551f-49c2-bf61-5a60435a926d", "comment": "Malware payload (AsyncRAT)", "value": "d59201e4d1ba03b09031d1b793e759d06d0319286331046248183526a1cde456d4e6bfa0ffc266ac0184b977d13f48da", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692196218, "uuid": "e82ed36d-0d6f-46f2-a7fd-bbf504aa4037", "value": "T1BA744B58B610B18FE945F1F1D4A8EFB95A713EB48A2B4007B477369DB63E643CD210AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692196218, "uuid": "7ae05f5e-0f56-4acb-bfe1-5e9925f01cdd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692196218, "uuid": "fd6f35b4-c541-46b7-b667-04f7b5b616d8", "value": "6144:dhCwETWFRTZaUVDwngXHd3rBFX7UCFVHxPIvnTUW49Eufvd9JkOuI:ewE+TZjVDZt3rBhUiVHxPsoW4Dfvd9JN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692196218, "uuid": "21b370d8-466e-4ec0-a870-83a20f5cd9c9", "value": 360448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692196218, "uuid": "207b63a8-eb32-4456-ae30-d30f41bf6245", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692196218, "uuid": "c9e9e4e3-c33b-44e0-bd2b-e1b72cc29d4f", "value": "7b06598763fb325a3879fc4acece48ee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd28fc2e-3c65-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692211869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211869, "uuid": "5e3d8871-ae00-424a-aa44-91990d48c0e0", "comment": "Malware payload", "value": "9402254fc292c4c14708330795b74e53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211869, "uuid": "be6c9de0-f7c4-43c7-a79b-821ce5bbd43d", "comment": "Malware payload", "value": "3c006750be4926e4383af81098b85cbb77906d3c7e7ce1052d9e47a163bd92ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211869, "uuid": "e483e773-3843-49b3-a362-b34ea8f05fb5", "comment": "Malware payload", "value": "9ac5acf374f074998a0c098f04eaecbd9ae5620d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211869, "uuid": "92217b4d-70a3-49bb-94fe-0b5568723e7c", "comment": "Malware payload", "value": "d37b2b41387942c9ff23017f87e2063b2b3c881c4f18eb2809ef3082f060b665d529a45efb87dc719d5e9a03485d5864", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211869, "uuid": "6591fd23-f1ab-4f0a-b92c-2b4e9d983249", "value": "T1E3B633200081083FE974E0F95AB56AD1C9AB5F30CB6AD281BF57D8BBCA755C8461773E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211869, "uuid": "b19fa8e7-746e-4c5a-b293-4b61b7ae8ce6", "value": "5e5ac8ab7be27ac2d1c548e5589378b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211869, "uuid": "86fcf835-6f9d-4c8a-9ac0-e456a88d64ba", "value": "196608:lKkrWWENy7aCStH7Bk1xyFF3dQJBnZncwhAw:MkrWWHP+H7S1AsVl9hA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692211869, "uuid": "0aeae8e9-1350-4cb6-9a1e-5aee6d9fbad6", "value": 10553856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692211869, "uuid": "232471f1-ffca-4ab0-b29f-96cea5377dc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211869, "uuid": "b9e424e9-a88a-46f7-be42-ac4932e60d07", "value": "GoogleCrashHandler.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "983d8f9c-3c64-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692211324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211324, "uuid": "ce95355a-28a9-4ffc-911f-a7be213c63f4", "comment": "Malware payload", "value": "28ce96fc407198cb3eea5bbbcff558fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211324, "uuid": "cbe68273-7d38-4fc4-a53d-d6012ad45e8d", "comment": "Malware payload", "value": "3c37f0bd658fddf5052676b7609c1e2331ed84d48a30d7b522652e535f72f7d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211324, "uuid": "a10565d0-d801-4fc3-abe6-4b98239d1e07", "comment": "Malware payload", "value": "b0190376cff3203a8ce7483d04eb948bbf78d3e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211324, "uuid": "d22542e9-68ce-4de8-b42f-aeda6df68a6d", "comment": "Malware payload", "value": "5d40c9c7398dd32b5727c8d9d8e32b5da8182edf3fab0301d3f1674eb550153c73558692e6114caf40aee1d7a74bb17b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211324, "uuid": "d1e04095-c68f-43cc-81c1-10fd4c96b5e5", "value": "T191D41206B27D6F72E07BE3F9012188294BF5766F5212D21C8EE171DA2E61F118991F37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211324, "uuid": "3431946f-40c2-4232-b6eb-3cb662680ed2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211324, "uuid": "721d0736-74e3-4eb6-a324-668c8de821f3", "value": "12288:qyDV/OUipLGVStOQDEfDQ+x9EIdH0XoQ+Fxm013TADO+Iq0SZb:qy8MV4/6Q+xf0oQCFTeHZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692211324, "uuid": "9b152217-6e6e-42a6-aac7-0cc46a54eb1d", "value": 614400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692211324, "uuid": "4554b1e3-9f67-4dd1-8a7f-4cd9e326595c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211324, "uuid": "13afbe83-54cf-4c05-b8ee-48f8a401246d", "value": "INVOICE.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9e1c19a-3c08-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692171840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692171840, "uuid": "f8245fa8-b38c-4649-a970-d79580e517a9", "comment": "Malware payload (AgentTesla)", "value": "807701f37303417e1e6fb9f63348a42f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692171840, "uuid": "df227c27-834e-40fd-a56e-58004bc2aa05", "comment": "Malware payload (AgentTesla)", "value": "3c7acf6dd8dffcefb3e286360ddda49bc70c96388bff742a55c6888443e2d7a7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692171840, "uuid": "cfcdfdb8-c2f2-4834-8fff-22bbe39fbdb4", "comment": "Malware payload (AgentTesla)", "value": "b9d70dc3cd4af06611759655ec91670a239c5f1b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692171840, "uuid": "b8ab8817-6838-4c9f-8dcc-faf63ae32ca0", "comment": "Malware payload (AgentTesla)", "value": "49018c0f7263a51c6cce8c4ee11d44fb79fd82dabab65643f82542da7b5d7a69200ef14526b0b4e0899821cbfcf64612", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692171840, "uuid": "3e65d599-6233-480b-99c6-87e0b172d776", "value": "T10C45F1057AB86132EE44C6B925F66E0082E3EE5927D1DA4914C8B6AD0F326FC4F177D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692171840, "uuid": "a7f9d286-9bfe-4e6f-a83a-30031ccf2654", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692171840, "uuid": "63c12dd4-f792-4b89-a1a2-6262fc58fde5", "value": "24576:pSRtYgz0l7oN8Rd/eCQsuIDsAqIpSYfPOCG2fcx:pSRugAa+/eCQNIDswpfPc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692171840, "uuid": "b41da59f-9309-4791-8fba-04bbcaab9664", "value": 1213864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692171840, "uuid": "89d9e1bf-c678-4580-865e-9b7ebf9d01a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692171840, "uuid": "0fdcddc1-dd1b-48d6-98cb-69861a36deac", "value": "Kxfuvhqzn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3e07430-3c14-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692177010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692177010, "uuid": "88d7603d-97c1-44ed-b502-764d8c44bb50", "comment": "Malware payload (RedLineStealer)", "value": "163e3220e1cd9f44373e7e394cf280e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692177010, "uuid": "72e5902a-32f3-4820-95d7-e7d006ecfc67", "comment": "Malware payload (RedLineStealer)", "value": "3d36e8854ff65a7e63207d69206e6a5abfc0963e6c7b13dcedd95730efc96350", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692177010, "uuid": "0cf4910e-704a-48cf-8b3a-492ea4f77a99", "comment": "Malware payload (RedLineStealer)", "value": "911af5c11db61c6bea8843f5b7512421a0432c7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692177010, "uuid": "cb866105-a027-4724-9f0b-274cbb720e9b", "comment": "Malware payload (RedLineStealer)", "value": "ebf58a64eebdbb21e0fb8d98f81b0abd081c7d2395e2bcad29b2720feaacd886016942770b2759ea183df65471a922f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692177010, "uuid": "0ec7c72f-6b80-4896-9348-945ce87f35c1", "value": "T12EA35D3067AC9F19EAFD1B74B4B2012043F0E48A9091FB4B4DC154E61FA7B866957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692177010, "uuid": "3997e651-258b-487f-9510-221759375eb7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692177010, "uuid": "e9c75abb-55d4-4751-8487-bfea9f698347", "value": "1536:9qs+XqrzWBlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed2W3tmulgS6pY:r0gzWHY3+zi0ZbYe1g0ujyzdsY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692177010, "uuid": "76b9a6d2-3862-44cd-bec6-dec02994b98f", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692177010, "uuid": "58392026-c490-4b40-aca9-44764fbd3246", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692177010, "uuid": "7f331e85-e2a6-4b94-84d3-415775b4a1d1", "value": "163e3220e1cd9f44373e7e394cf280e3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd320daf-3c23-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SpyNote)", "timestamp": 1692183522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692183522, "uuid": "87a13bf6-c48e-4406-98aa-d0363009398b", "comment": "Malware payload (SpyNote)", "value": "aacd9b0d9f45683edd359478def4e7da", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692183522, "uuid": "ad9da1f7-bb61-40d0-9bf0-8a8a2c82ac4e", "comment": "Malware payload (SpyNote)", "value": "3d9e96ef9aa731147c3c151e92bcb4a88b74b45472090bf2a3c7e96da61e6a67", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692183522, "uuid": "3cd3958a-03b3-435d-b1ad-c7790c959532", "comment": "Malware payload (SpyNote)", "value": "89297abc7ba3489948655dd47bf672a414e4cc51", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692183522, "uuid": "b8900f2b-245c-48e6-9eef-375d6048a474", "comment": "Malware payload (SpyNote)", "value": "869dda03b9d558996d7a2e02ea4ecb2f1e3a31ffaf9a3a33e763a355eb71d3cb235346f452fa261e016b9e0aff52db67", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692183522, "uuid": "8b675bf7-5cf8-4f43-8d35-f9950263db44", "value": "T18376CE17F905CBC2D46D83F96E230FA92A271F19D5452AEB00153AAF3E762D21ED64CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692183522, "uuid": "cc4155bd-8cf1-4f75-9721-3a1a37b6ea0e", "value": "49152:zx1hnolqNbvmzJzdGGsQTOymUqYqQ0cgwyML:zx1pJvmzJzBLTF0twyY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692183522, "uuid": "cfbdd04f-0e46-4225-89dd-95dd7075b390", "value": 7682965, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692183522, "uuid": "3dfc8322-e90c-4a71-acc1-a19aabe72002", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692183522, "uuid": "832c9ccb-11bb-4507-a9d8-2d3b106d5fd2", "value": "Chatplaza.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c904b7ff-3bff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ModiLoader)", "timestamp": 1692168027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692168027, "uuid": "dccd17ee-5e9a-455f-80c5-bbb67b4b3091", "comment": "Malware payload (ModiLoader)", "value": "e233a218368b609cb0d55cdc1aca565e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692168027, "uuid": "93986986-e620-40be-b1d3-161ad76c9f5c", "comment": "Malware payload (ModiLoader)", "value": "3dec0f077df087f3e1c0e2f49194c0362bf56c3fb3ba18fa60b499495e729f48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692168027, "uuid": "dc64dbcc-bfd0-4c84-952e-fa76f43f4291", "comment": "Malware payload (ModiLoader)", "value": "cd0a45d9e2ddc381addf1ac3cf845be7eb9cdcd3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692168027, "uuid": "9b65d2e5-ad4f-4fc2-ac2a-25c03fb97593", "comment": "Malware payload (ModiLoader)", "value": "f7d6db95cd4f71de1b45b4e03c5d9957c821332c7fd296bda736d8c0caddf1af1810c21926bbaec0597b03f2aa5aefeb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692168027, "uuid": "0790870f-8c0b-451f-99ba-a1a13d08aec8", "value": "T11125BF37EA929C37D172157C9F0A1BE47C2C7FA309286446AEE83D49AF3D650353C266", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692168027, "uuid": "bfdcad7d-053e-437f-99b7-f88a68b4acd7", "value": "bdf6349f4337edc78aae879092566618", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692168027, "uuid": "1f0cb7ef-5b26-410d-804d-84a07e0b827b", "value": "12288:q+V0OGY20hP4SpWD4XIiIlYqHrvd6FE3TNDJrYb0fZp0B0Yi7fLssVcgbbFWWRpj:qWAs6lD4XNVQrvd/DFR20fI0JzR/RYA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692168027, "uuid": "72b15f23-fc03-4107-ab90-a8841b26e588", "value": 1049088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692168027, "uuid": "deca09b5-89bd-4210-a0dc-89615dd2df17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692168027, "uuid": "f6d05a50-6091-43a9-bb55-5d0b73af05a0", "value": "Qdwqyhltorobof.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79b5d06e-3c32-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1692189798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692189798, "uuid": "34d02c40-60a6-4911-895a-3abd449cd98c", "comment": "Malware payload (Stealc)", "value": "59efef20771d5137913a9ac05b388483", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692189798, "uuid": "adc289b6-3496-486b-bb9f-19e29078cf11", "comment": "Malware payload (Stealc)", "value": "3e9ece9472658fb2356a05c70b898e739e8672c316ff1385d88646e9abb5cf23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692189798, "uuid": "014ac8cf-eb36-4f14-811b-edc1736c7e24", "comment": "Malware payload (Stealc)", "value": "c9d961fe4cc9c4108e4af89bb2e477990c303b7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692189798, "uuid": "81c05d92-26ec-4cd2-9ffa-0bea801d8d8d", "comment": "Malware payload (Stealc)", "value": "a93006ccf019bdaf4d6ee51fb81cd82b1d63cef281acc90766cb58a7bc88aa51081cc1a63373d31fd5d82627cc3aa860", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692189798, "uuid": "4979ab51-235c-4503-8e3b-b15144e386f1", "value": "T113663005EB4B12A5DF6BEEA76357F76FA2087960DCF2CC85D84D114023178A4604AFAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692189798, "uuid": "63335ede-2632-43bd-a776-ed65c3ea25ff", "value": "3d5f0c2b553e6b12cd13411897fa62f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692189798, "uuid": "0b3a744e-c862-4428-a907-fc10408a715b", "value": "49152:bNVDI7mB7m93cqFmDceAqeQvbqdkqI/ISuzThzemW:b969KD7AqBbq2qILuzdzS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692189798, "uuid": "576dbff4-c960-41ea-9de8-385fb905fd67", "value": 6931736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692189798, "uuid": "a762d1cd-9ae4-4ef6-92b8-0969495d4f27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692189798, "uuid": "458cb614-53f2-497b-ac61-3b07988951eb", "value": "soidog_and_ling.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6444df53-3c0f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692174729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174729, "uuid": "c20b511d-673a-4871-a9e5-8da37196894e", "comment": "Malware payload (Formbook)", "value": "c53cc128b195d2b18df1e1c043e4f79c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174729, "uuid": "e094a51d-0079-4116-a595-0ab0420ffc33", "comment": "Malware payload (Formbook)", "value": "3efd3c9612ac7a447872a5b318fbba2090dbf41678b4eb77f9242ad123fc69c5", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174729, "uuid": "bce21656-f241-426e-a673-aa17758bd3d8", "comment": "Malware payload (Formbook)", "value": "8d8088812c6fe1187d2302bd8beef654edcb7dff", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174729, "uuid": "f68ce35d-320b-43e4-ac06-ec1e12672ad7", "comment": "Malware payload (Formbook)", "value": "44c2bca9dd3a991bba5647f5c5a12db38444efae733d46bf86274e4663d707c97dc61a36225b6cb32dea2f455b09bb54", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692174729, "uuid": "9f342b44-8de0-4395-b9bd-a163add07c43", "value": "T1A04422D899F579027CAEB9F80D85D43BBC2D84A84B90B0B980EC7E1F54B65B53FC6412", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692174729, "uuid": "2b7474f2-5bef-449f-9625-27d097149846", "value": "6144:TdR2qM4G+xcdmyhtTqooFZFQJzBbGHICSoUTbTAw5YP+My8x:TdRfG+xclT2C/biLSJTd5YPN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692174729, "uuid": "feade135-92ba-4174-9a96-99ec8eec3761", "value": 268815, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692174729, "uuid": "bb2dec95-e838-4f00-a02d-6eab5319ed3d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692174729, "uuid": "34ea89a3-9313-4524-a83c-bc95c18a7d05", "value": "RFQ_8_10_23.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ae4dd72-3c65-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692211677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211677, "uuid": "e7e402a5-2ba6-4f88-8d6e-b1a7e6e16f74", "comment": "Malware payload", "value": "86cf81e87b56f308ce6f4c88a1066415", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211677, "uuid": "c7805ee8-a7de-4040-b7e6-22bbda3100af", "comment": "Malware payload", "value": "3f64540878afa068e4bc7de3af3d3b48c0aa767e6e7ec94f9179b3cdd9768ac5", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211677, "uuid": "9ee9a99b-4fbc-47b2-ae90-c4a949f9ed00", "comment": "Malware payload", "value": "d690c7e0067766162a9bb085ab510be2836d2074", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211677, "uuid": "5038ce00-b6b2-4c9e-a668-9dadbba78030", "comment": "Malware payload", "value": "7512cac44b58201e1be51a82d769545860fe9c41f69fc8f79c6449aa71e0e9a32b745805971b69c9d50bfc1635185e34", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211677, "uuid": "8af2fc57-94d2-48b6-a119-29d16cf27b72", "value": "T1BE328D2DADA161AEC30F41FD44612017EFB875EBE76C666E6D70AE9081E23CE5723314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211677, "uuid": "90ee0536-1148-42ce-af5c-cc6700680916", "value": "192:9Eya0NRfX9i7jWoj4N5eNA2A+EnVs+mg1SoB8NJY6TO36PvUwKzQaUCaY9pFcWex:SyXRfkPWku5+A2bkBdBGJYuOqPqQc9zE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692211677, "uuid": "d66a6ef1-12b6-4f95-a323-902df832c350", "value": 11493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692211677, "uuid": "bf7e250b-c319-4e1b-9004-211d60b35b0a", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211677, "uuid": "8540528a-3257-4304-98f9-319b49134bbd", "value": "INVOICE-9730015.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b05510eb-3c31-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692189460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692189460, "uuid": "7ffeb348-7a0c-42d9-8f7c-042c6b59538d", "comment": "Malware payload", "value": "dcafcecb670ee03c93e64b24fdc679ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692189460, "uuid": "4ffcee6e-a6c5-4b69-832a-fb1dae0dc59c", "comment": "Malware payload", "value": "3fd5574fc364c6129b1fad05b2104bb69b40de01161c705b1caeb7184a91297a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692189460, "uuid": "96f0e678-5b48-4751-bec6-6390b033ecf7", "comment": "Malware payload", "value": "2026697210f5e8f3238796521eeedab48b9daff9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692189460, "uuid": "020d28e8-5360-4889-a794-885819e94e14", "comment": "Malware payload", "value": "913548a8a44c2a2126a99f7fbd59e830d78fc243159fb93dc486a335fc4716098b4e72bf08f0071d637f1cef8ffb2923", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692189460, "uuid": "c33b3a19-446d-4272-a197-d0075847ef68", "value": "T1FAE3393BBF8A87F2D1841B76C69B62100374DA96B363C34B744D23251B037EA997964F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692189460, "uuid": "49046396-05e2-4258-87b0-25d7f6d0dd7d", "value": "3072:YVo8QrrObb3Y20+iKskKM9H6IlfhAP8t7:1DribbjiCKM9/AE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692189460, "uuid": "d77446f4-0171-4bd3-889b-9cfd9759f99e", "value": 155648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692189460, "uuid": "d858c05b-7035-40a4-a133-3c90b220c164", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692189460, "uuid": "c782263e-742a-4cd9-9029-1e4911b853ed", "value": "dcafcecb670ee03c93e64b24fdc679ea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8390ccd-3c0d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1692174011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174011, "uuid": "fdb0e529-72ba-4a0b-ac60-573b0616e510", "comment": "Malware payload (DCRat)", "value": "10a3bba4028f74fac392d91601ae6f72", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174011, "uuid": "93aee847-da4a-4974-a3be-66b88351e43c", "comment": "Malware payload (DCRat)", "value": "40969a1a9067a581d3d05dd0bc698a31592022f5d802a76bd62b3440591c98a6", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174011, "uuid": "79d011a1-5216-467c-84a8-fe6f4a9e8d32", "comment": "Malware payload (DCRat)", "value": "19bf073ac998fe6fa31a6e917fd9c8e992f35427", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174011, "uuid": "6b2f39bc-448f-47b2-93cd-0172d0f1f70d", "comment": "Malware payload (DCRat)", "value": "b29deb14ae2232a3112cc51c2da7fdfc5d694e1ad7ca1480a9bc1308716832344ba1516c2b2810262d605a528157dee5", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692174011, "uuid": "94012a04-da39-47c9-a6a7-b343994dbb27", "value": "T1F485010279B0B3B0C0A61E319DBF5A1C9DF8EDE12A2C4DCE5F04F5795BB21A15633A46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692174011, "uuid": "126de9b6-2437-4e49-8ef6-991097062f9b", "value": "0ae9e38912ff6bd742a1b9e5c003576a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692174011, "uuid": "a1988051-37d3-43c6-93a6-c65259c7779c", "value": "24576:VubsnafAPyziFVsEe/2rdkJEC4n7mM8RDa2Q9fq4kO9V64hNJGAv4bdXQTIjkE6k:JUiFVs1QdkS7mMSaf9fq4kOW4hJyxx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692174011, "uuid": "d0efb4cb-71e6-43db-9cc5-f1e8a2324b2c", "value": 1863558, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692174011, "uuid": "5ff60ccf-a6f8-42b4-a471-26c58c84bd11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692174011, "uuid": "3750b286-98e2-4200-9314-ebdd8fc9f715", "value": "10a3bba4028f74fac392d91601ae6f72.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df5f2247-3bf8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692165058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692165058, "uuid": "e90c7176-c6a0-4c09-8376-02a60b50aadf", "comment": "Malware payload (Formbook)", "value": "13a3f6521c13ba0c632db67c7041c977", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692165058, "uuid": "9d5beebc-dcc9-47d1-8ca0-d2d6a7173440", "comment": "Malware payload (Formbook)", "value": "409992d0436f5256bc7bf86bbe08d7c41d13103c59f1cfc35885d1608a3e7286", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692165058, "uuid": "7e854750-1131-4290-9848-b839f1801f73", "comment": "Malware payload (Formbook)", "value": "5dd8153d6daa7d000fbb5c9c9760bc2f57b27a1c", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692165058, "uuid": "c0d62acd-1849-4dea-9ca9-2ddc57c6f1ad", "comment": "Malware payload (Formbook)", "value": "60b796ae9b8be9733b58470228050142d2a7b213d760c468ea91c961e10d1fa189123b9bf7bac434263ba10c512a64b5", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692165058, "uuid": "e2012336-4e0f-4326-a6ab-4c44e48f0847", "value": "T1BBC3D06DC34F41A9CF12823B9B1A4A0902FCBB3EB34552B5346C53B533EE83D99651B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692165058, "uuid": "e5128d23-fbf9-4a43-84b5-d128f6ae50fb", "value": "768:vwAbZSibMX9gRWjzAvwVO4xNX027K0zNKiCzaYF4bwvvh1D6:vwAlRsAvH4fX023zv95wvvS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692165058, "uuid": "db0dd24f-9a52-4b8d-b790-63469771f54c", "value": 125951, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692165058, "uuid": "9da18ce2-0744-4822-832f-9dc090019a26", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692165058, "uuid": "211b985f-3fd0-4abb-a6cb-c5240af79aac", "value": "BID-758472938.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9faa878e-3c2d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692187714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692187714, "uuid": "62d4db02-2ad9-4a60-8307-7b739ef817c2", "comment": "Malware payload (AgentTesla)", "value": "7622e5003f18d8202d3d3fae58f425db", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692187714, "uuid": "389dc687-192b-44dd-9a89-d8654949620e", "comment": "Malware payload (AgentTesla)", "value": "40e26464a92f94b0e1f356f618326b4f3b3bdda7276f1392d8b8c65f4a04befe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692187714, "uuid": "12c1e40b-a0df-4a73-a2be-b0d1bf995086", "comment": "Malware payload (AgentTesla)", "value": "81fc4a0b67c5cd533b93d22ccb23015f8435811d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692187714, "uuid": "201031f6-02da-4ba2-ab93-53b4bee45e7a", "comment": "Malware payload (AgentTesla)", "value": "04fb205710e76993c088459e50ee4394c5d24b35fc10262eeb8b0b1d28ac9695f403d32b25223329c6c20e0f94cfcd2e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692187714, "uuid": "97531eba-d255-483e-866d-a3e800f0bb68", "value": "T165A42389640329A2E5ECCBBF81BC9436661363839C6B816F7E87FEB3779542C852141D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692187714, "uuid": "abe69eab-de65-43ea-874e-eaab46784f7c", "value": "12288:Jmyv6lUebz9LiXkjbM4z8tYpxJBm0rdTje6vv6BmrJ5Yl:JmDzli0j448tYpDBm0rdTjerB+H4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692187714, "uuid": "fd00f019-a561-4270-baf1-e5744b284119", "value": 483163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692187714, "uuid": "5ed6fb08-7404-40d7-bf62-a96789e25680", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692187714, "uuid": "c7b27ff3-7d28-4f2f-90f3-6df2b2b0a330", "value": "BL For 4704854 4665930.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f41bb3f4-3c77-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692219638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692219638, "uuid": "3f4cf08e-b88d-485c-8500-eb5adef1af5c", "comment": "Malware payload (Mirai)", "value": "336374e94942a02cda6c4fded9b136f9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692219638, "uuid": "bb3b1625-a139-46d2-afe0-1763aa3b9c3f", "comment": "Malware payload (Mirai)", "value": "4293a7bf796a50a9f83d894dc1643cdbc73edf88031c68516c2393712e72a511", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692219638, "uuid": "f8fd5821-78f8-4ab8-b586-3de842cec6e1", "comment": "Malware payload (Mirai)", "value": "f64e9d0c9218f439c3313e0a6f42b9891d37b110", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692219638, "uuid": "f5904228-2e18-4d13-8a2d-89e39f83bb20", "comment": "Malware payload (Mirai)", "value": "f32d3c180bbbe262f08e42357dfb7cb3a3bf80f9c3b7662c7d4a35eb8e5e8bf1bb8800cfc5a16e434fc6f39749efa7d4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692219638, "uuid": "86bc00fb-0c00-451a-ac1f-2599257f33e5", "value": "T124E38536B7619E77D81ECE7305A985121C8CD98702D92B6BB2B4E51CEB6BC4F08D3D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692219638, "uuid": "1db4bea0-d4f0-4b69-b77a-4829eac782e1", "value": "3072:dgZc9h1jlnLA2PiXYeyCc+VNMVGuo9mrThPaLEnvPrNb:dd7lnLA2PiIeyZ+VWDo9mrThPaLEnvP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692219638, "uuid": "342a9359-c0a0-4d26-abc7-f852c77e1ab9", "value": 155476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692219638, "uuid": "afe9285c-878d-4c58-9d6f-4c88609c95fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692219638, "uuid": "75d8baf0-aded-454f-9dd4-eb2d2af4c0e4", "value": "336374e94942a02cda6c4fded9b136f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6290b8f4-3bdc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692152822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692152822, "uuid": "e5d7378d-c7ef-471a-b975-9d6333079a59", "comment": "Malware payload", "value": "78ec9572e27fb945a866d117aa2f9926", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692152822, "uuid": "f479e0c5-2bee-4342-abdf-ee6c5c1f3ccd", "comment": "Malware payload", "value": "42c1c45f9596d94fd4d5b89da183ddfb4dbda8f9485cccffb880ddeec89868bd", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692152822, "uuid": "434a4823-4fd1-44e7-80c1-fe51f4cd297d", "comment": "Malware payload", "value": "15de77ef8e56987ad4215d02163681af3f15e9fd", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692152822, "uuid": "bb9735b4-4653-4be7-8191-d5c4ef276372", "comment": "Malware payload", "value": "2cc00582d936e7b41388f422f46cb326b11ab1eb271954a7ffc807bd20f6a00873c1ae601336bdc42c08181fa9187c01", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692152822, "uuid": "a5e7f6ee-5fa7-4ecf-8e98-c2b6ebe45610", "value": "T18C9533D358DC782CCC8E83B8918D96D6B2D1D6A7D806704F7F95611DA3FD3A2D1A6C02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692152822, "uuid": "88d799ac-5799-4015-919d-270a51459a76", "value": "49152:boELT4lR2N3Eq5M6AI5g4KbZDVxK9b/4s2xW3Lg93KeAG2LkAUspuv:LP1c6Ah4K1Dg/4sLCKzG2Lknspuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692152822, "uuid": "e2fb9d08-e2d0-4bb4-94cd-558726807d53", "value": 2026887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692152822, "uuid": "aefc10eb-0bc1-4e6d-afd9-5bbbeedef035", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692152822, "uuid": "3955b3f1-5071-412d-8f05-96f17338d574", "value": "Proxifier.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ef440fa-3c8f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692229803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692229803, "uuid": "8e928f8e-cc1e-4f06-8937-f473006b6e31", "comment": "Malware payload (Mirai)", "value": "85791a01e2f394906e07090b747a02f8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692229803, "uuid": "350cf2ca-50c8-4783-9def-e7c7cd108d1c", "comment": "Malware payload (Mirai)", "value": "43a6090257e2e2053535c531d3ab324d72771918e8295a35f1a47bbaec6dbd26", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692229803, "uuid": "a3736c82-3a0c-46e0-9fc8-e7cb641a2e3b", "comment": "Malware payload (Mirai)", "value": "59ee2fe98f78926bc6d61ba6ac8c94c2f2c5d8b0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692229803, "uuid": "9707f5c1-e1b8-470b-91e6-e7a8ec449c80", "comment": "Malware payload (Mirai)", "value": "90c05b4acaf36c803b934a2dad1fa035ae07770e2d2f907e5433599893f01d2d48a22e99b6ec442e77111218e0c2f17f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692229803, "uuid": "ad21f259-1203-46eb-85a4-4ca67341ccd7", "value": "T139D34B46EA808E13C4D5177ABAEF41493322E754E3DB730699185FB43F867AF0E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692229803, "uuid": "2014ca52-ba2d-44a4-ba08-cce0ad7649e9", "value": "3072:uw9Lg2RRhpRM54ya9kF230tuiC/gH5CEuqXH3l2M/9CIkYj:d9LgaRhpRMqz9+uiC/gZCkH3kM/9iYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692229803, "uuid": "f98a505d-7269-4bb7-9d5b-cf5fcb0cb601", "value": 131898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692229803, "uuid": "b4662bdf-1482-480e-a139-6b2ad62deec8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692229803, "uuid": "c8dc2845-9b3a-44a7-a779-a5f17e60df65", "value": "jew.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73d64c37-3c3a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692193224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692193224, "uuid": "3fcc5d3b-b092-4fe0-a7d2-f158459b0ba4", "comment": "Malware payload (RedLineStealer)", "value": "db31ac26d8102b251188f4616a2416ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692193224, "uuid": "1428d68d-69a6-4c3f-8681-a355fb7d81a2", "comment": "Malware payload (RedLineStealer)", "value": "43e4d06b7f480ab5b9491ae2f414a6d4cc6440a3156a3625f6949a67adff7c55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692193224, "uuid": "b4394693-286e-46ad-8df0-562d3e7f50bf", "comment": "Malware payload (RedLineStealer)", "value": "f4f4fade8d50183cfe177a4a55c56f0a34621171", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692193224, "uuid": "cd8d516f-1fa5-4751-acbc-ad055b17ee62", "comment": "Malware payload (RedLineStealer)", "value": "4080f98fa2664b775c7ffc73f224f04d2ee1ed37ca872cfd46e1df0480a0cdfb1a461f986ff46ed3756ee090136a15b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692193224, "uuid": "07e6719d-2a63-4d87-9bae-7de88c761042", "value": "T1B2359D20F8C19062DDE210B717DCFA72827FA0A1971595CB178896EEF6901C27F3D6A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692193224, "uuid": "68be489f-635c-4a90-80ca-51b5a90f1a32", "value": "2fa65fd0486d003d198825a742a530d7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692193224, "uuid": "beb54d73-5cbb-4e6d-9afa-9f16f2a491c1", "value": "12288:Jb489PUjYfKB/3XhYEdZNlKA7SNV+Jxg1h0gnuY5CP5mkdSvy4t3n5r:JbBMYfKB/3XhYwrQr+J+fkWht35r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692193224, "uuid": "69254bbf-ef0c-4d05-89f1-3351a4ea0737", "value": 1118328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692193224, "uuid": "8e8c1fbf-f4b6-4fde-a281-2c5025f061ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692193224, "uuid": "7f2532fe-f2ef-42d8-925b-159decce0fbc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e0f55e8-3c08-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692171578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692171578, "uuid": "ed6ff92c-c008-4c12-9af4-eec709e6f2b9", "comment": "Malware payload (AgentTesla)", "value": "1d263e6de18e3335eea88bb9c45e2251", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692171578, "uuid": "6b7188c8-ce64-4f04-9402-e265dba57b8c", "comment": "Malware payload (AgentTesla)", "value": "44cbd831919310f638f963c56c3d25c817b2c0e5e01a59d4c5d0b386e4a0b7eb", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692171578, "uuid": "6ed9eeb2-92d3-49f5-928c-5f90c2cf97cc", "comment": "Malware payload (AgentTesla)", "value": "eb1c20f05484e65a86ed75051a1da49a0e340bc9", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692171578, "uuid": "5a15468b-a0d0-40be-9294-99d200f9f251", "comment": "Malware payload (AgentTesla)", "value": "d586e440a83407b1388dab8e8f7dade18a27f7e121659763f6920dd87a69b118b02bbbc71eccf3bb5dd48b01a93cd828", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692171578, "uuid": "3509826e-9f6d-4373-b13d-fd937ec5ac64", "value": "T17AB4234275187BD45F0224EAAC3EB490355373416B8B0183DF7068B7AAE92FE1EE718D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692171578, "uuid": "dd03e6ef-0d58-4632-ab32-4180f2fddf97", "value": "12288:0hAfq1rcC8uOMHvO9UKTTk37QK4F3mhmnAqY4tagyQvJ9lgc:0hCqF+uOMWBTK7HGxAqD19p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692171578, "uuid": "847fb1c7-5a67-44bc-b5fd-9f082d464566", "value": 501032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692171578, "uuid": "cbc61193-65de-4875-94c9-51fe7d82017b", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692171578, "uuid": "dccaeacd-f11b-4391-b58a-fc48755bd903", "value": "New-CSID 270883.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "096a7205-3c2b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692186603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692186603, "uuid": "147b4c26-bc02-4ca0-8a9a-fb169a762d9c", "comment": "Malware payload (Mirai)", "value": "70624a87410442e0d1c7f694c560e87a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692186603, "uuid": "20f663a7-29c7-47ed-bc66-c8568c8063a1", "comment": "Malware payload (Mirai)", "value": "45a0e691aeb3184b16bbd5bcd9145a719b776328a52faeda39ab991021b35c84", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692186603, "uuid": "e5b970e0-97ab-4821-a640-121ee31b6e20", "comment": "Malware payload (Mirai)", "value": "c06a54ca410cfef836e8678527254d8e0cb34470", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692186603, "uuid": "edcdebd2-ae09-4b6c-9ded-54b894137caa", "comment": "Malware payload (Mirai)", "value": "8f4a86cbd5395c2ee4295cf8a28389d4ec6cf3b95ca9ac55f7c161a80ca45777dd046505ec95b756d52203e493a39f9c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692186603, "uuid": "20b118dd-8054-4b27-957a-135806a028a8", "value": "T1D3230271850E9DB164703C76EF95D39376E11AB1C6673023D5280A386F78B131E57E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692186603, "uuid": "dd5f448b-27d5-4efd-be26-876329a53ff0", "value": "768:D/TYCoIxdEk+AxoTZAZHFeq8b3Xv9q3UELbUXfi6nVMQHI4vcGpvV:DECFd+A6YHAxXeLRQZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692186603, "uuid": "f934f927-df41-4384-bc90-8f03b242a6e7", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692186603, "uuid": "0418a3da-923f-4ceb-9a0d-e7bfabdbc52d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692186603, "uuid": "0a09c985-a08c-4586-8fb9-fb319812bea3", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "360fc1d2-3c43-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692196986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692196986, "uuid": "7e3bc121-13d2-4f8c-ab64-96d874dbe687", "comment": "Malware payload (AgentTesla)", "value": "c1a11ffac56b93b9c43646e9d599d349", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692196986, "uuid": "0c765e97-0a1a-406f-b15b-c23152e5adcb", "comment": "Malware payload (AgentTesla)", "value": "460b3d8ffa0929ab9c02a94b11fe08737b1e8e3d0b9d44a8dbf7dbccc6a540c1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692196986, "uuid": "6b92623c-b685-4432-af08-b9eb00e04d94", "comment": "Malware payload (AgentTesla)", "value": "a6740c3a58a25da9bd195620a9525b92f0403b73", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692196986, "uuid": "16538943-6635-4d7c-bddc-7e071be8cd07", "comment": "Malware payload (AgentTesla)", "value": "71ae975ded670dc4535d10723f582d73e8b643a74e3ee3dc15a731335e1afc9111eb61e496976a8ea0533f088a6be6f3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692196986, "uuid": "2bca3838-b83a-4288-af36-a935ddd56e52", "value": "T1A3352C6CFA45DE3FD38C8C3950F9DB2B69B99BADD0E1A361C01051B548E6CAD0DB6063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692196986, "uuid": "5c781dd9-57ae-4498-8f2d-048c2a7340d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692196986, "uuid": "6b6c0faa-5939-4a20-8424-81d559262ced", "value": "12288:TH41ItaBXEaxfSWr8gl+b1knXHrLG6Gbalk0o8KQnEIW+WY99KsojWl0q:9F68gl+b+XHrqQT2BY99Ksx0q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692196986, "uuid": "68f8d502-6b93-4f31-a614-c2043fce7823", "value": 1063424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692196986, "uuid": "e987445e-6dc5-4814-95c1-aa01c74a144f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692196986, "uuid": "356537ce-2acb-47c5-8a8d-75cdb295cf8e", "value": "ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca26b6f1-3c34-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1692190792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692190792, "uuid": "422f9c5f-9839-4ea2-8100-c4a2a38171e7", "comment": "Malware payload (GuLoader)", "value": "fae74092b2a10a458ba8ed28c32b28c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692190792, "uuid": "9763113a-a181-4858-b769-4c9f8a97d9ae", "comment": "Malware payload (GuLoader)", "value": "467bc86bec7a597bf20e24aae9e0d36d943dbad1fa7a47e15f39a88f6e554ab8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692190792, "uuid": "cceca9a8-dc33-4be0-8fa7-17b887d2e461", "comment": "Malware payload (GuLoader)", "value": "c092e58eb6d285c1fbdcd4f063e8ac77cde8d763", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692190792, "uuid": "8f55dccd-dd83-438f-baf5-e7399a854667", "comment": "Malware payload (GuLoader)", "value": "2f3570417b6bb6db4176a1b95b0594f2641556004b83b6b7f98e365ec48d873ba4660c33965aa654cc6b4571c454a5c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692190792, "uuid": "ea833355-65e2-4dec-bd94-d6c3276007d5", "value": "T1C8A412016398C113D9C30E73053AEB3727ABAE4438E5A34B3769B9863F37387455EA46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692190792, "uuid": "b878cfe6-7492-4cee-a8fd-5476ef3da94d", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692190792, "uuid": "e4772de0-cfb3-4e42-9e17-ca17de36ea25", "value": "12288:tyoozBaovbaLZsO+CadPhfc+cKm3yOmxOt93OXQ1/tot:tyxAmOZaVdPhfc/Km3QxOtFcQ9tot", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692190792, "uuid": "2afff98f-a7c1-4c94-9d46-1536f7b5627c", "value": 457120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692190792, "uuid": "a72282fa-2bd5-4b9d-ba3a-c7fda3dcf168", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692190792, "uuid": "f9e06b60-13a6-4e13-973a-4f520b913b35", "value": "Storhedstider.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d87e2c1-3c18-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692178449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692178449, "uuid": "88288d98-134b-430d-b969-0ffc1d75f137", "comment": "Malware payload (Formbook)", "value": "03259d9526db29a3c8ce4c8b74d299e6", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692178449, "uuid": "888d7ced-0aea-47fa-9cf2-044cd98ba70c", "comment": "Malware payload (Formbook)", "value": "4706285f1bd858cb65da13c13a7a21f5ff91ee2842420fdc1fb186409e7ac515", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692178449, "uuid": "1766efd0-aba3-402a-8e7d-60f82d7a7672", "comment": "Malware payload (Formbook)", "value": "5ba96fb632145105e8f93fb3ba88d6a58e6d261f", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692178449, "uuid": "23a0be54-3cb7-412f-9411-c1f12cd7ce9b", "comment": "Malware payload (Formbook)", "value": "f64b53f8a869f2aaafe52988788a5f970db20b1def8df05526394508ea942abe1b4cd7e371cd9b26c5ec1cde2faf9f9f", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692178449, "uuid": "b8aaec72-672e-4932-bcb6-5a05f7d9a60e", "value": "T1767423506524DD3D820C420C3AB512DBBC80A0AA5D5677BE9AF69F631BB9F436F431CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692178449, "uuid": "ef577f79-4b9c-4e7b-a56e-f2d27fa7452e", "value": "6144:zrQ/wWdgKy4Aww0FTOzosDi5A+tDHKQBs4z6WidcIp3vUu/gHdfFAJJkcGNB6pOT:zrQ5dE4AB48o6oDHpBnzxNI5Mu/g9Oip", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692178449, "uuid": "54ff7e20-29f3-4d59-8e21-2826c5e4f4ab", "value": 350263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692178449, "uuid": "9ccb68ec-bfb7-4f36-ad12-7e9d01c20dc5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692178449, "uuid": "5e1e41af-04e1-428d-b478-03df84b2a1e3", "value": "Original Shipping Documents.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20ea4187-3c4b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692200386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692200386, "uuid": "e968dfd7-9009-4124-beeb-9b6ebf7a571b", "comment": "Malware payload", "value": "ad6c49fd5127cad6ea7c7ad71ec93225", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692200386, "uuid": "ac390ec7-2111-4295-9d26-7f2515ac0045", "comment": "Malware payload", "value": "476fc61aa532b9bf4cd2742d187c88c09ab72b46b456a732c358df004c8e0e68", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692200386, "uuid": "65f4218e-db1c-4663-85cb-3d0b0476c04f", "comment": "Malware payload", "value": "c3f12cacb055a63396a79a7affb15a1c8a0b36d3", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692200386, "uuid": "e68c1308-31ef-49d4-9d15-da1651a56f0d", "comment": "Malware payload", "value": "ee9fb3bb1b5026f55af56728fb37a188db035e478b8479d95c5aacef36919029b4fcc5cbd24a37c26819587b82fb6eab", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692200386, "uuid": "2aa5bbed-a1a1-48f3-a903-9df434c5bbb4", "value": "T104E533C994C62BB0D1FB9DB085B04F53E7E0CD2677B065432AB18F152CB5AD68A3E06D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692200386, "uuid": "2961a712-c4a4-49d9-9a18-37b0f4aa085f", "value": "49152:5zMCmcxv/7XjdElA5VnL1ZU7JZcE+H6DALkcAbieG2d/OgdsP3EWbDiT:5zAWdcA5DZUL+HEAJAWebW0Au", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692200386, "uuid": "5294b9d8-c121-415e-9fa6-8d1ee8b61f85", "value": 3117618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692200386, "uuid": "959f6b38-b7be-4d18-b2b3-9526925e170f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692200386, "uuid": "2582359c-d5c7-4414-af37-08787bbf3af1", "value": "ID-Fact_Arc_47062OOMYS09771-EJRVJ78477FIUCOuclbc.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9260f11d-3c01-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692168794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692168794, "uuid": "46e508c2-e88f-4ea9-8887-412b7d1ce67b", "comment": "Malware payload (AgentTesla)", "value": "97f8ad87b62f57fc2ed1c19eeeecad23", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692168794, "uuid": "4b23b276-a91a-4ac8-bf81-1da87552096d", "comment": "Malware payload (AgentTesla)", "value": "47f6279c12fdfe069c80911f6c22a2e1f13daa13b4595cf13b88d4e62f75b72a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692168794, "uuid": "7d58649f-f5fb-4e78-b13e-acb4c667d6bb", "comment": "Malware payload (AgentTesla)", "value": "92273f11e928fadbb31aec597616e2304621074e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692168794, "uuid": "1c30d22b-7183-485c-854e-cabe4c017eb2", "comment": "Malware payload (AgentTesla)", "value": "0bfa2cc85bbd10b154aad1629684757114b59d89a0e235860a4c7dd26ba3d0eb12bc963376c2ab46c3bfd21df9643a69", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692168794, "uuid": "7fdc759b-4ccb-439b-81e9-7debc8dc62b7", "value": "T1AB1512177B8E4CF2D2684776C29B91340365FA82FF73C63AB84E13520E537AA448597B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692168794, "uuid": "8843ad7a-e93c-4fc7-97d0-aedc27defad9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692168794, "uuid": "2b66368e-a0b0-4c5a-95ad-0daed85f897f", "value": "24576:zOxitEOFtvH3Kyc6CmtzCN9LHnYNbcyyK4y4hC+:HE2f6yc6CmxChnGyVy4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692168794, "uuid": "f962d7a3-0188-4447-aa2e-d2ca3091927f", "value": 939008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692168794, "uuid": "a8d1b273-b434-4884-ae5b-1d5eb07e5e90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692168794, "uuid": "090f4fe3-9738-44e0-9035-981d12dd7ff1", "value": "anfrage.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57544f7e-3c79-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692220234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692220234, "uuid": "a7667c58-2df5-4806-aa04-92ed4cbdd479", "comment": "Malware payload", "value": "fb6ac92357a61d19f9669db2bc6b229b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692220234, "uuid": "35cfd786-bdcd-47b3-aa7b-62365e8b11c8", "comment": "Malware payload", "value": "49c881793fed91c23b132bf7f3e009c550949d3e3ba915477d2b6bd9c20cd88e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692220234, "uuid": "c6314251-3138-4297-9bbb-326c105f1255", "comment": "Malware payload", "value": "2f9144c7d8b984ada09f3f24d69c35bfc4849d0b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692220234, "uuid": "d9dcaa85-f467-4d27-b074-22772aeabb33", "comment": "Malware payload", "value": "0a0d1cd9aa4014ee78415b58b4df7d24d3b34682dcce5e264797416b48dd0d6ef6c6b8ad5f182fa22cfc8ba70add8557", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692220234, "uuid": "13cbcdb6-e7c5-4407-bca2-7a6d37333a86", "value": "T1D30232412EE8DF29DEFF1F397AB144221FF27E576520C66D0DE4258D08F2A40CA22676", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692220234, "uuid": "f9bd6a02-4d9e-4139-a0c2-21762760bb96", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692220234, "uuid": "55b52bc0-6c87-44ec-941b-8ed55a9ceb10", "value": "96:buRbN4cG1ODNE0HmTE1rmn25lng7xDUzjamYVXmSzK6+labumvZQD+2+3WvuvZlW:CJN4ArmnkWGawSzKlUq7B7t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692220234, "uuid": "43ca08cf-0bc2-4f93-89bf-754b099cd13a", "value": 8704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692220234, "uuid": "4ce65b14-f164-4177-9358-fba56dccf6aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692220234, "uuid": "35f65d52-d57d-4198-872a-dd196574d3f5", "value": "iezkuonh.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b56f3994-3c65-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692211802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211802, "uuid": "0eabeb5f-dd9c-420d-8d3e-3a5f07827cad", "comment": "Malware payload (AgentTesla)", "value": "8b935374810ea4a031bdff93abc5e367", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211802, "uuid": "7d88df4f-0314-4dd9-b1d2-9841616dc67e", "comment": "Malware payload (AgentTesla)", "value": "49d4472a338ca137c33aeed9eb7fc2a61ec2e095c059bb9f777358e900e4037e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211802, "uuid": "2bc96f5b-5935-4728-859c-be995e6121c0", "comment": "Malware payload (AgentTesla)", "value": "352c96b1fc842431f2fc0367ea84a3c4cca08ef7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211802, "uuid": "946cbece-ca34-4bc2-9418-210b4cf145da", "comment": "Malware payload (AgentTesla)", "value": "afba5ba323e256e2c50cb189b6d820e319df78d2d9bcd2c3e9741a851ed062f18586dc67836af1207bbb2fd54bf6392d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211802, "uuid": "e618eef4-bab5-4586-9cc2-bf5bae7cdd2b", "value": "T1EBE3380BB74A86B3C1505B76C2BB531007A9DA96B733CBCF744DA3651B033E99A6530B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211802, "uuid": "8cf8596f-2488-4b84-bdcb-1a836de7edbc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211802, "uuid": "5b908df7-c0e2-4c70-b72d-092bfb096440", "value": "3072:67p1+JUW8z7XYCPL/+xqlNEC+0ASrZqCwbPsRTO/8EfhAP8tB:6117W8XDT/+xWNEh0VMbDAE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692211802, "uuid": "bfb3648f-122a-492b-b5c4-df5305fd2d10", "value": 157184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692211802, "uuid": "ff34b2bf-3a93-4ae4-b214-539a8f34e010", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211802, "uuid": "9a58ece3-1fed-4d90-9a82-4dbce2badbbc", "value": "Neworder.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cde3f91d-3c4f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692202394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692202394, "uuid": "1f4ac771-f43d-421a-8462-ff0afe71e5ee", "comment": "Malware payload (Mirai)", "value": "8eee206fbd99a67541881068657d66f4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692202394, "uuid": "65bbecfd-0899-4ebf-9982-24de198faccb", "comment": "Malware payload (Mirai)", "value": "4c90dfe68c0888402bcdc776abec07b268cbfa8a963f74d181b2ab7d727db111", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692202394, "uuid": "deb170f2-e246-4843-b106-2e46de34fa75", "comment": "Malware payload (Mirai)", "value": "5f39f8fd8607c1a13764e4f61b7286350f683586", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692202394, "uuid": "e9ec1bf2-c5f6-4233-8d93-968917b17d67", "comment": "Malware payload (Mirai)", "value": "b24015b19c4eda3e31208fc265017168cb3176a8cbd7c300bb16daa03b2d529835b1bb30c046b7471586b5598dc21533", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692202394, "uuid": "d21c7023-b579-4261-a06a-ccfe8057800a", "value": "T1B4C2D0DFB49A39C5C91C5CBC218D5AE11669A2C3234A9F0837603DCCA57645EB8AC8B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692202394, "uuid": "d4c8620b-c894-46f2-a07e-ad142fbe7945", "value": "768:MLCUFskb2JgIs/E2+OocrfJiHNjfmQ2q7IoqdBVhWM:oCrJgHiOJrfwmQrctd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692202394, "uuid": "6c74641a-b31f-495e-806d-6b41c033cb25", "value": 27244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692202394, "uuid": "0ceb465a-adde-41bc-a1d2-427b3cf22fef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692202394, "uuid": "fe8560fe-13c8-4e3a-aa6a-283e892af02d", "value": "8eee206fbd99a67541881068657d66f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb7a50f1-3c08-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692171950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692171950, "uuid": "fb32fa2c-bbbd-469f-939b-868b89a20fa2", "comment": "Malware payload (AgentTesla)", "value": "801c4c8b6f9de0882a138b6e99a73c93", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692171950, "uuid": "1c177875-b547-4119-b9e5-56798cd94898", "comment": "Malware payload (AgentTesla)", "value": "4cea0791a078f5ba6b74cbef37ca8ce201b603f9411d59c709a6386b644c7668", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692171950, "uuid": "013431f5-f1d9-44f4-b5ac-c389782be7a2", "comment": "Malware payload (AgentTesla)", "value": "1e3b3498718b42010d0e6bc0b4d0c25935e8c7b9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692171950, "uuid": "dcdda2bd-c442-4ad6-b124-4bd43490e440", "comment": "Malware payload (AgentTesla)", "value": "8b813e0f5e04ad5bfc8a6091c19a954968b71e0ae822fcd3c23418285c5904be70f4de0f8da885ab47bf773b5bf78c0d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692171950, "uuid": "44cc63ff-90c1-47bd-95ee-2fd092f58966", "value": "T19BA423D332DFEB7B44085065E947EF44E7B8386681E074A9D3D8BF26F0BE0896A4514B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692171950, "uuid": "325f8cea-aec0-48d1-820b-fd342f9859d9", "value": "6144:Guuxw1kMAulJcls7SJQAUKh9/LiGT/1L2E6MxAs6hbKgeMstRC3/pOjy5yE7E0SM:BGcl7SeHo9TH99xAbhbKUsC3R20STrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692171950, "uuid": "4645391d-716d-4658-ad26-580ffa14be9f", "value": 490403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692171950, "uuid": "aa4c7fd1-a268-4463-aafc-28325388011a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692171950, "uuid": "c0d800ba-5c4c-45e8-9f34-f3b615b79af3", "value": "SWIFT COPY.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d0d6852-3c08-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692171738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692171738, "uuid": "b5cca287-c4af-4adf-b9b1-95fdcf87cd8e", "comment": "Malware payload (AgentTesla)", "value": "58ee0dee9cf9474714abfeee4fa6b77a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692171738, "uuid": "6b3cccef-45e4-4d19-b672-eb3ea5f14b1d", "comment": "Malware payload (AgentTesla)", "value": "4d6df004bbeaac4c120deb9b02274e0083a39b52622966112ca4cfe7dbe2caa8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692171738, "uuid": "a1fa988e-cd88-4ab1-a893-0ab4c05318a3", "comment": "Malware payload (AgentTesla)", "value": "b764dcacf3516bd73802570ce200189661b0549c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692171738, "uuid": "b7ad5506-4bd0-48c2-9476-00f1827f887c", "comment": "Malware payload (AgentTesla)", "value": "0c58286ec3d6889669beceeb6f22208981172ca3ab6e3277c616cc498db1790b445d9175baf797b865ea5db3b47b61e7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692171738, "uuid": "9431ff8c-58ad-4194-b0db-99a52d6ec9c0", "value": "T1CC54121536A8C9A3EC7706702EF6037B5AB1E91130285B9F2730AAADFD14193E91F753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692171738, "uuid": "2a914eb6-6918-4545-89ad-b73a81d675e1", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692171738, "uuid": "5240d4fa-9b27-4587-8d0e-fa0a28de5e54", "value": "6144:/Ya60T4Bn36uYRVqvBnCLRw+8+RUDVQECGjlGCFdz:/YiT4B36L/qVQRw4GVQZ8G2dz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692171738, "uuid": "160dd9f5-0cc5-4111-a7cc-70b664d4dc29", "value": 296868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692171738, "uuid": "12031581-70ac-496f-bd46-6cc172c386ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692171738, "uuid": "66065a47-9c8d-451e-baf4-fd8163bf99b5", "value": "Order_UAE0823.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b808e2b2-3c76-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692219108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692219108, "uuid": "0c426cbf-8c23-473b-a445-bb3dc3b757fe", "comment": "Malware payload", "value": "3c3be58d9d278ce54efc76401c10ded4", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692219108, "uuid": "d24fe73c-e75d-4504-9a39-a5128a684811", "comment": "Malware payload", "value": "4f4cfd4a601f3d3800fd981e9e3516b208ec4d986276d61dbef46f8e72831816", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692219108, "uuid": "364a2374-c515-4d9b-aeb5-5b44195fca7e", "comment": "Malware payload", "value": "6ccd517b4f136032e0dc0f84947ae54f1f421dba", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692219108, "uuid": "a78f08f6-3a21-4aea-a692-bda85b6847fd", "comment": "Malware payload", "value": "8674d9af864ec09f003d29278f63fbf5f5a16edd1fd96d3172b65ceea16c21ff4132194755f4a739155253444a895eaf", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692219108, "uuid": "9dc1b8e6-ca8a-4427-9ae8-cad65d2be978", "value": "T19AF52317F2619466C8F2C33734762736547B8D28DB07AB9A3D4977B968BBCD84B806C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692219108, "uuid": "fa2a22ed-ab11-4f4a-bfee-51d515f7bc9e", "value": "98304:d05D6efffnRcj7jGPJqj5GuRwzeW+u3sePA8r0Kd:dEXcXgYRwzeX+A8r3d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692219108, "uuid": "79650abb-f784-4635-ae6c-038847e5ce38", "value": 3498917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692219108, "uuid": "4af2a320-7216-4cd8-8f86-bf7aba6d235d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692219108, "uuid": "53598782-f33c-4f50-8f7d-74f152697369", "value": "EDALAT.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36787601-3c15-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692177230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692177230, "uuid": "1f353265-a5df-4359-b0e8-6ad353aa1467", "comment": "Malware payload (AgentTesla)", "value": "2e213340620c52fa4e62d6705f13d03d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692177230, "uuid": "96b9f3d6-acf7-4cd8-857d-1db05e532931", "comment": "Malware payload (AgentTesla)", "value": "4f6cb29e8a02c3176273aa443173fc881e6678181ec1c9a1f163a02d313eb3dc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692177230, "uuid": "89ac1a5f-a2a9-446d-9636-26db8d876655", "comment": "Malware payload (AgentTesla)", "value": "6e6bf6f4e4699eec69ce01788f4fb4d0c181ad9c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692177230, "uuid": "936eb9ae-3c94-4b7a-b084-d24d76dd41ee", "comment": "Malware payload (AgentTesla)", "value": "b432fe3bdc84ceda20129bfc9539f2457fccbc22754d9a953bb8776fbbc0af75a8ce4202ab6a631ca3cc8c3db6b09825", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692177230, "uuid": "2db38b9f-f40f-4ff6-8f72-f4762725725a", "value": "T196D4237FC02AD3E5385F5E30C22EFB615D9522F816FAB0B4B64D928490D6EF35466630", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692177230, "uuid": "8f55c39a-4ad8-48a8-a6ae-dbd28e0f6b43", "value": "12288:Xz/U5ggxOKZnNnEOFj2q4vRijK1MDJL5tyVEmeLwWIPvEyfzYpSrt7eqG:Xz/uxFNnvF6q+RijtDJU/eCnEy7EAeqG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692177230, "uuid": "680c016b-eb02-46ce-9e82-710dbf09dcf6", "value": 612527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692177230, "uuid": "7f2f467d-dd07-4c4b-9fa6-ed6fc5336c82", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692177230, "uuid": "c0428edf-5e80-42c5-a23b-b1954833f611", "value": "New order 500384851.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc76eaed-3be7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692157805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692157805, "uuid": "1b0a015f-7ba1-4a27-ae1b-99c4e24a9b5d", "comment": "Malware payload", "value": "8f9e69ea7a36bc1dc8116635fd197665", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692157805, "uuid": "86739f1f-a270-45e8-a2ba-202ca596ccae", "comment": "Malware payload", "value": "4fa6333171722fe91a9b8597318156b76ff808ccad3aea39f712ef908f7044da", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692157805, "uuid": "51b3dce9-eaa6-4d9b-8dce-5b481e7b820c", "comment": "Malware payload", "value": "f2e4f54303b7cd1b40f424f49db650adb8ecb59c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692157805, "uuid": "e829f5bb-b313-4f9f-8759-e4d2c4c145eb", "comment": "Malware payload", "value": "6eed9b257c8d3399a1c6e119d5b55ef25e46ec39bca580eb2bb7dfb0590039456af9640a462d33c0a88376f426e82cd4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692157805, "uuid": "c232f029-5ead-44a5-b7db-efbc6699fdf0", "value": "T17A7302A0BD13DABF90B68F7CF57F4D433A4A0F4989263917DB850E6DB9C2502A0F445A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692157805, "uuid": "6a286964-c39e-4f71-94dc-8f69e7f3aa3a", "value": "1536:0ZaytO7AC7yG19kEosVP+qjGt+bq0YXWRfBncggicaBYYoabV7elP:0BtOhyGzzV98+bYyqg3cQbV6P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692157805, "uuid": "e87ed536-f371-4bc3-8644-a3e4b38467c1", "value": 77656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692157805, "uuid": "a2b54f88-7a8d-439c-8960-e5eb5997beb2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692157805, "uuid": "20b3a262-459c-4fea-b1fb-5cc121c13b09", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d025a4da-3c2a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692186507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692186507, "uuid": "53e1ecd1-5f10-453e-bbc8-2f689ccf01c4", "comment": "Malware payload (AgentTesla)", "value": "e2a33dd2884aad31cb56a8554b0f1481", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692186507, "uuid": "e9afcdfc-3bd2-443f-bbf6-3bccc4be5db1", "comment": "Malware payload (AgentTesla)", "value": "50671a5bf0d58b9a8aa7fd42a637c27d6db8f2e35a6a1faef249a7b6a779fcb1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692186507, "uuid": "76e8198f-9772-4589-a419-67e8105be7a2", "comment": "Malware payload (AgentTesla)", "value": "769939ef022a054b3fda4a920fbf4ed5ba13410a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692186507, "uuid": "49158687-1080-4253-aad6-523dfc7243ab", "comment": "Malware payload (AgentTesla)", "value": "cd4161dad24d79ac7774c9305e98a5d26c30964537104e7ab2ad65fc82efc37bd549275baeb3dce33125fbfb7da90452", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692186507, "uuid": "1fb21dc7-b223-4cae-a424-7ce1b9a7a5ba", "value": "T18605D06632F846A7E07F80BA56243102DF72A1BB9566E5C1BCCE12F58F82F811607F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692186507, "uuid": "f17ee063-223d-462a-a13a-e061bd227af5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692186507, "uuid": "d5a34db9-904d-46b5-b5d5-281ceb84c63b", "value": "12288:RZnDYtz9+2qdYC8jljdGxcAblMrTdAkWggOdRLuStoUbydRkft/9jLj+T:RWtJ+2qdYC89dGxcolG5oKydRkF/BLj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692186507, "uuid": "3b3178e3-d28e-4303-b663-e4474061c341", "value": 811008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692186507, "uuid": "7ac114d1-09e2-45cc-b9ad-340b5b26ee00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692186507, "uuid": "2b8b590e-1d1d-49d1-9e67-95e5e29b433c", "value": "SecuriteInfo.com.Trojan.DownloaderNET.316.18496.31879", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6f4bc48-3c87-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1692226515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692226515, "uuid": "7888a59f-e5fc-4028-bfa6-cbfaa5ebb001", "comment": "Malware payload (njrat)", "value": "23dfda571ef7281842436d32d5d0bd75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692226515, "uuid": "8a0cf0d1-1322-4907-a417-37ea8648ea70", "comment": "Malware payload (njrat)", "value": "52343205fe743b6a5c6d18a880a9b78402733cce0aaa4a29d9836abeea35a871", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692226515, "uuid": "9bd69758-b99f-4db9-9f5b-2521f9c9414c", "comment": "Malware payload (njrat)", "value": "5bcddee7144c2ec999343a7997ef7e7d14aa442a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692226515, "uuid": "b711396b-cc86-478c-8860-c064faf8abf0", "comment": "Malware payload (njrat)", "value": "26422c3e5c2862ceead7a44ddad9562a74a1f0cedb7dda6503a394175a6f0b4bb75955eed796ee3a9be782d9f6725831", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692226515, "uuid": "e0188f34-bde6-4607-94c7-789660ae92a9", "value": "T19D033A4D7FE18568C5FE0A7B06B2D012077BE04B6D23D90E8EE564AA37636C18F50AF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692226515, "uuid": "67344327-ef8a-449c-91f4-fa4f2e9b2d5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692226515, "uuid": "2b7eb0c6-b8d0-495d-bd94-c52433677898", "value": "768:N7rtsKADtOHiR4akrYBQWllykrM+rMRa8NuA2t:N7r8tVSkBQWlEH+gRJNn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692226515, "uuid": "c3280792-081c-48d5-a4b6-2ce9d41d8652", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692226515, "uuid": "071d2fc2-b5c0-4efc-8932-8ed73608c113", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692226515, "uuid": "d3424329-6fbb-4cdd-b9a9-211748b1d2f5", "value": "23dfda571ef7281842436d32d5d0bd75.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0ebf83b-3c39-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1692192897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692192897, "uuid": "b49c822e-943c-4ee7-ba3e-cf53bceee6cf", "comment": "Malware payload (GuLoader)", "value": "441f580a20127b9fc7b674209bfcea31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692192897, "uuid": "5d5fca6d-a3bf-4b2e-9c55-c6744d09b3d3", "comment": "Malware payload (GuLoader)", "value": "52424464d6caddf99763a3afff654a51604abf89ab0e4d8df656bc6e21528bf2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692192897, "uuid": "f75ff866-883d-4066-b22c-79e8749cf58f", "comment": "Malware payload (GuLoader)", "value": "48ee7b2e8265cdb7f9bd3fd3c62915d82e4494ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692192897, "uuid": "44c4ab79-930b-45d3-9fec-b6c060d1c743", "comment": "Malware payload (GuLoader)", "value": "130863cb75b6f3f23c70b9950e74a863d0397f30d677d2a362124e645d0f1c1672cef998d19aa92e37a8f9b37eba8314", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692192897, "uuid": "27192ea4-df69-4013-90fa-87c69c0f657a", "value": "T199C402D13DA1DE2ADF457E79389AC2605BF47C2C1A013807768EF7EE2B325075AE9241", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692192897, "uuid": "75082ffe-8c6f-4827-ad70-8cb913760b5d", "value": "d4b94e8ee3f620a89d114b9da4b31873", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692192897, "uuid": "442f6f49-3a82-45ba-b2c8-964476ceefa4", "value": "6144:dZ/qRr6PRb3dOEP2KtbRyu7tnWiEHyekMNpVlLwseBI5AUBExksKcDTUaEne0oj:dBXPB4M2KDyu8/FflL2IqboPaV0g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692192897, "uuid": "8637be89-70a9-4154-ae38-5a7a94adf9ae", "value": 582944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692192897, "uuid": "91c7bbfd-eb17-4633-9f11-526377894155", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692192897, "uuid": "23fb91fa-5315-4e93-b528-949cd977ea2a", "value": "Erstatningssprgsmaalene.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "517dae7d-3c62-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692210346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692210346, "uuid": "5374bf9b-b277-41d6-bade-3669236f77b0", "comment": "Malware payload", "value": "a212269f418f63982e341219f228fb76", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692210346, "uuid": "21b0b102-948a-4d5a-b43c-ba89e03094e7", "comment": "Malware payload", "value": "539c13654eea7b124ed946862bb1c98be81f454fac32ebf2589c4e08fd8e9fa2", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692210346, "uuid": "ee0e50cb-3eb3-43d2-9b2d-46e7802c56f8", "comment": "Malware payload", "value": "abecd2cef3237928e787e5e4ff951d8ea1ce2477", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692210346, "uuid": "06f7b1f2-92ab-4931-bb9a-be0b40be0fa9", "comment": "Malware payload", "value": "bb7571a720f546f7f0356eac491f2b550f014b5ae9dc7396dc2f5eb4a1690f4ac9da52ba48b33cda4ca740a6be57b6aa", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692210346, "uuid": "114d40e5-a7ff-4297-94af-cd86bb6f50fa", "value": "T14B31C03622E5065CD275DE3718F1BB27836BB40DDA0B4A9E32809A751C9819CF620B3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692210346, "uuid": "be2eb5ec-5347-4dba-96a7-f21d046a6e14", "value": "24:8NTZsxEaHqlS0sN7oKmaghW8ADA+W3ttta+/CW2AyFiXC9xl7pEQeyTppTpZab/6:8FakyjZkWfFFj7iQ9ab2j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692210346, "uuid": "ddc1cd0d-49b5-4589-97fd-40dcbb767c73", "value": 1677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692210346, "uuid": "4097d9c2-3930-4191-ab5d-d263d9aa06e4", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692210346, "uuid": "25c7cf16-c698-4efc-8810-dd19532341a0", "value": "S4eMEqKD2PNjBZB2.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4120de37-3bd8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692151048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692151048, "uuid": "cc3c44a4-1575-4cda-885f-f6bf4d89cd1f", "comment": "Malware payload", "value": "5d6f4a17539d84e07f978f808ceb877f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692151048, "uuid": "1d8a70d2-c3c7-448e-861b-7ab7830c8f85", "comment": "Malware payload", "value": "53b741a52f88d7e0f01dd4f5bcffac6882668922a45ecb1bc2e7275778afd599", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692151048, "uuid": "9de3acf6-89e0-4b54-9e7b-53c2bf23692a", "comment": "Malware payload", "value": "a186392695be394a1a81e4b8ed2046cfc3333077", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692151048, "uuid": "df73ba55-406c-4297-93bf-10b216079f21", "comment": "Malware payload", "value": "6446d89a67a2224a323c75b15c3f0154c76f1b7f6a616861bd266a7799553b260cf484a69204ba272c1a1810971cbc47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692151048, "uuid": "cfdd4ffc-66b8-443f-a398-9d939f0702de", "value": "T144652338B689F058EE55ED3E2D20D8242AA01C405CC5E1E77DD2F7EE99723C88EA5357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692151048, "uuid": "fa631c96-834d-44aa-b3da-92ce60fe54bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692151048, "uuid": "8ae915d1-2563-4ad1-8545-e1691cdae432", "value": "24576:8Z/4jDkyXlNpezDB93fHVqsdEd7N+GawXJEC8zX8bSMVAgVI8Hv:w/4syXlNQDjTe1a2Kh8+fg7H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692151048, "uuid": "8b8c3a21-b79b-430a-b50f-5724cda993c6", "value": 1457152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692151048, "uuid": "986ae19f-091e-480d-a673-902b71134491", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692151048, "uuid": "a5738156-0573-4948-861a-c06351850915", "value": "5d6f4a17539d84e07f978f808ceb877f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3516f144-3c0a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692172503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692172503, "uuid": "ad3ba992-2ed5-4d27-8dba-55a5d0b00305", "comment": "Malware payload (AgentTesla)", "value": "be64352caa8f6ab0cf64bfb592dd7e61", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692172503, "uuid": "3a3c3116-7d57-408e-a747-5836c5474842", "comment": "Malware payload (AgentTesla)", "value": "53fdd7eae0eec9231ee4be1bab8e3473737cb47ac665af6a9eea49152931be96", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692172503, "uuid": "b47f7bff-f9c9-4dbb-bdb7-e574da242c02", "comment": "Malware payload (AgentTesla)", "value": "fd5470250db0d40fdec317f02382f66a9e7a4e45", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692172503, "uuid": "7427a8f8-4442-4a20-9d1f-5a8bd8aba8b1", "comment": "Malware payload (AgentTesla)", "value": "880a835c275b565b4588b47f15f67c4271155b2b318e5db69a55559ce989b7c259affb9c5acd5b393fdeeb23a3a02a77", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692172503, "uuid": "9b3f2509-ad4b-447f-8b84-95f4651b6d5c", "value": "T146E423533BD0F767D9A06A5227164FFCAD84BFD1541D2A324F2DCA4A9DD02F4C8E482A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692172503, "uuid": "81243905-581b-42ed-b286-de24950f02ac", "value": "12288:4uwspN4fxP8+MG7N7TzC2+m+ye76qn3Np5+H8qjI8tNWQ2ilLg4IKzOrx:47spN4fV8+vlTzC27kk8qjzH2tld", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692172503, "uuid": "71e01f09-64de-447f-9e8f-3d6f7c3f5d1c", "value": 659831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692172503, "uuid": "26a0f2fb-420b-4a63-8894-c84298c7eef3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692172503, "uuid": "2efbd445-88b4-4c9d-bbe6-598a05c891b2", "value": "ORDER-SUNNY 10005916.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25aa2fd8-3c39-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1692192663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692192663, "uuid": "a3ec4688-50b4-4e99-beff-9547af3aed2e", "comment": "Malware payload (GuLoader)", "value": "7dfc8f73be4fdd80f642006d7eaf5616", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692192663, "uuid": "04246bb1-bd4a-49e4-880c-ac019c6565b8", "comment": "Malware payload (GuLoader)", "value": "541a56f2c929017c9400b550440fd0b8c8c2992a707a80e66292672de4d4e151", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692192663, "uuid": "8f27ac14-ab48-4ba7-a0fe-8931bb3a41eb", "comment": "Malware payload (GuLoader)", "value": "023df5ab3410fe35074bdc59c6305361370d0d5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692192663, "uuid": "bd246379-5a6f-4f27-8832-ae3f2ba6b56e", "comment": "Malware payload (GuLoader)", "value": "11aaf945729ad35879d7fbd47ca6dc1705cc7ec017d2bb0c9cad0a21b425f75346d7b6ea20e55653895e57f7971ced39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692192663, "uuid": "24db802b-b476-4ef7-908b-74b388d29bcf", "value": "T104D412C03D60DF2AEF42BE317566C2AA5BE46D2C0D0435473B4EF7ED2A71A0316EA255", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692192663, "uuid": "0cdd5419-edef-4cc3-9daa-e524036a1db8", "value": "d4b94e8ee3f620a89d114b9da4b31873", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692192663, "uuid": "e0a83c46-8bcd-425a-8fb1-367e5487f1ec", "value": "12288:xBXPB4M7oZQZPjYfRdP3qPUfW96VLnKrhpaMqEmOxx:p4M7TCzP3RflVLEmMqyxx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692192663, "uuid": "029b67de-032c-4e4f-9b76-9a18372f1c58", "value": 599432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692192663, "uuid": "2e58d984-b1cd-4a03-be47-5fd473b4b857", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692192663, "uuid": "055e3756-bca7-446a-8263-77916b056006", "value": "Aalende.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "318a2e0b-3c36-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692191395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692191395, "uuid": "3ec2e9d0-f2b1-4bc9-9f87-44110e178786", "comment": "Malware payload (AgentTesla)", "value": "353f19fe9afa23d8c05de16c145509b9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692191395, "uuid": "9ed0f47a-529f-473c-8c29-7e637d2160b3", "comment": "Malware payload (AgentTesla)", "value": "541c8dcab165161552625a29ea8b39d719da720043a48915ff52fef96a815fdc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692191395, "uuid": "cccf1e24-2b93-4070-b2db-aef4e6ed24a3", "comment": "Malware payload (AgentTesla)", "value": "d9138662349fce4ec4aa7bc988b9fc04e72c21df", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692191395, "uuid": "1dc56aa3-3eb4-4a28-835c-618076402a10", "comment": "Malware payload (AgentTesla)", "value": "5eb69f09197193d75003b7ed839e70df8cbb37c5695a4694d7fa17871e57cdb001a051aa7bbf3bbcda0f9e106fa2afe1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692191395, "uuid": "b640f1fe-ff3c-4bba-837d-42752a6423ac", "value": "T1B2252C6CFA45DE3FD38C8C3940F9DB2B69B99BADD0E1A361C01051B558E6CAD0DB6063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692191395, "uuid": "ba858d0f-c740-4a2f-8c3e-3210118b38e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692191395, "uuid": "b63acdf9-f51d-47f4-9cd1-69f959104272", "value": "12288:CH41ItaBXcux+SWrAQob+P59JsMQP7oZOak37+wchyrbUGJSnaFqwUAp:WI6AGTQPA9wchyrbnplUAp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692191395, "uuid": "bfa1772e-6591-4606-8006-e6ae8a739880", "value": 1041920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692191395, "uuid": "c2da900e-7268-4714-a529-af2462da4e48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692191395, "uuid": "81d034dd-963e-47b5-9bb8-70c2684ce748", "value": "PAYMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2648a7b1-3c21-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692182356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692182356, "uuid": "6e310c0c-c3dc-4660-8590-80489f92b572", "comment": "Malware payload", "value": "1787539b789ae4308a8d1b8daff78eb4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692182356, "uuid": "9ab310ff-458c-4048-9aed-bef88ff1513d", "comment": "Malware payload", "value": "547bc441c387afb6543c82744f4fe14f9100e644e037256a4109c4b2175c95f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692182356, "uuid": "e135ad76-75a2-4778-95a5-acd8802336a1", "comment": "Malware payload", "value": "1a06a8e69d7772941bfa8b48f3f9bf61489b2063", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692182356, "uuid": "f8a3d275-1efd-4389-b0d6-bc70cc86a2ac", "comment": "Malware payload", "value": "d6df49770e5932ae9a34c000854791f664220a0a4a86126b1bd71dddb284db02a94a8317716ea7357b460ac632e6eab4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692182356, "uuid": "ddc755ee-ddca-44b7-bfa6-3b1c61f12bfe", "value": "T1CCE2D07E42A69981F8298CFF426517801BF70FA3C24E4C07B71175218E5B1B6BE87DC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692182356, "uuid": "73015451-f782-475b-b772-8ded24f0f2de", "value": "768:YZsZEUrhnWCjhsBYLj7RB243cccxC6Go8QvDJgGlzDpUYsaU:Ox8suUYn7PX3cccM6Go8u5VqYa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692182356, "uuid": "30cb746e-fe3f-409c-8f8b-b8d2fa3ddf69", "value": 31816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692182356, "uuid": "ae08073e-a261-4e5e-a47b-0ceea32f135d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692182356, "uuid": "c3dc6e6d-7241-4995-addb-24012762e5c9", "value": "SecuriteInfo.com.Linux.Siggen.9999.8316.24532", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6749b5c-3c04-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692170143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692170143, "uuid": "4677351d-1065-4543-ac3d-ab1a60e47be4", "comment": "Malware payload (AgentTesla)", "value": "ff713daad2d3fd35b5ad0690cd8e4789", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692170143, "uuid": "0c630361-a516-4187-9930-10e8d1bcaee3", "comment": "Malware payload (AgentTesla)", "value": "5481f96217dc7e0bf68137087640a39ab609f4854cea9a13f92815c1c5a1adf9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692170143, "uuid": "67d73a9f-eb7e-4f89-8d89-daa1c95adc98", "comment": "Malware payload (AgentTesla)", "value": "bbaa0aecf8f2c5f962272b032fa1358e15fabf85", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692170143, "uuid": "7541694a-d446-46d7-bd3d-d3823918dc40", "comment": "Malware payload (AgentTesla)", "value": "c5e86bb095383b1c006f8a85ce18f15b82041d0bb0cf9a14134a8ccb3e86bdacc41e5718aecd6ecfe6489e33532fcf96", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692170143, "uuid": "af2af40f-bdf9-4913-83ae-8ea477a57151", "value": "T1D0E4233E923A842959EAF56D849F8B5FF231236C15FD87AC76633EB07449A314F4B042", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692170143, "uuid": "74458c1f-f281-4159-bc30-5df0f96374bf", "value": "12288:YzheP1/7qrGM4hYvbDvpnusiu4fo9RGUarVp9oQ6eF4M7+WFlWbgP/a5ct2kg:FN2rNbLBXiu4Q9RGUarBjl7+kOgaevg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692170143, "uuid": "124f7dc4-b14a-475a-9916-dd9bbb3a5b90", "value": 683872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692170143, "uuid": "82790427-41eb-4837-80d5-854a0e16430f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692170143, "uuid": "7d49126b-608e-416c-a816-502d356e35be", "value": "SHIPMENT SRK CONTRO.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9e7bd29-3c4f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692202388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692202388, "uuid": "a845614d-db41-41c6-b3d0-840c83e46ce9", "comment": "Malware payload (Mirai)", "value": "ce4ea880e3a16d5e602431251a866233", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692202388, "uuid": "3f8199c1-4c64-4f4c-94c5-990cd227b742", "comment": "Malware payload (Mirai)", "value": "55553f844cf013eb9c21145be6515e6265d9715c65fcdd119d7d9a2de362017c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692202388, "uuid": "ffd731df-720e-4978-b029-1d36ec454618", "comment": "Malware payload (Mirai)", "value": "6f445acc8bf284b669a42582d498dbaa03c843d4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692202388, "uuid": "ac126ad5-4291-48ae-ad13-5eac17d63150", "comment": "Malware payload (Mirai)", "value": "4b8792ad682a2481e0305357ad0124ce36fad3f1cbbca4ee7358bbce8500595b0169933fb8ad8bf0a418d38cd9d5360d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692202388, "uuid": "d72cf779-ff8a-43d3-84ff-420c27e5ef3e", "value": "T148338CB5C579EDE8D1144A78BE248E749723E100C6932EFADA44C6A99083EFCF5583F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692202388, "uuid": "094d299c-9fa1-4a95-80a5-4d47a3c4c4a6", "value": "768:jaixFwtLSYAagMo0ebH4/ZvQX3hyWfs3INgCJUU/qMCqKomQRCvN:jaQFwtOGBvQXxfs3kgCJt/qMF/RCvN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692202388, "uuid": "7cca093f-24bc-4252-ad2e-839de6f912f5", "value": 51584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692202388, "uuid": "65d927a0-316b-4e7a-b2d1-845c16f3a58d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692202388, "uuid": "3eb388dd-a4a8-4582-88cf-e097be52c994", "value": "ce4ea880e3a16d5e602431251a866233", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caf49f4a-3c2e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692188216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188216, "uuid": "af97576f-9b0b-434c-b555-651d4358e870", "comment": "Malware payload (Mirai)", "value": "f838dc6575ad99bbea2c2d98d0bca437", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188216, "uuid": "5857c8a4-b1eb-4ee6-bf5b-8faa8d8c2d8c", "comment": "Malware payload (Mirai)", "value": "5604d0b72b1875945b4ead15cc99346c613e58390dfa2fab8507c74529639c72", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188216, "uuid": "d56bdbc2-77f0-4e6c-9ae5-afed6ea3f459", "comment": "Malware payload (Mirai)", "value": "64a00f3253855971f8f217ff1909a41dcae80c73", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188216, "uuid": "928cc2e8-1da3-4c3b-a5d5-c3fa5ae6871a", "comment": "Malware payload (Mirai)", "value": "2f4dcb9c19e127b152b7f9268e4421149fb4a7cc7b47f312c571f5c1ee3984045c35678efa120d36b61430b6d5ba41f7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692188216, "uuid": "b78bbfb4-118e-4a24-8a96-05fd15ab798d", "value": "T1B2E2F297D372B452DE782AF1F56E85CA2B7D4B9CC67B70A31A0456183E8B0435E3C883", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692188216, "uuid": "ff1e5ab6-47e7-4341-bcf4-96599090af5e", "value": "768:koiWiO031vpAPbrVWZK3XVGxm9XWY9q3UEL5Iv:korm1vpALgUJMLY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692188216, "uuid": "9a8bc699-bcc2-4d4c-b4fa-407425cbb098", "value": 33028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692188216, "uuid": "27c5cc77-baef-4b5b-a785-94449829df98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692188216, "uuid": "30f203a5-d287-49fc-88ff-2c802d65d82f", "value": "f838dc6575ad99bbea2c2d98d0bca437", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de6d26da-3c2e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692188249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188249, "uuid": "849a5875-f99e-42ac-9198-b999e8a321a1", "comment": "Malware payload (Mirai)", "value": "5da8e490d04d57bb0024c2eaa912f3a0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188249, "uuid": "5cf0d0e5-b7f5-49f6-8cc5-d7110a9f0e62", "comment": "Malware payload (Mirai)", "value": "569c5e74a69aca9f135291c3369219867b8d8967f057ee17f130d0efc67731cb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188249, "uuid": "d6926a98-6b43-4317-a206-4a5a3beaabb1", "comment": "Malware payload (Mirai)", "value": "30d36243f2efad9bbe3625742fdd87ff690acbc8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188249, "uuid": "f7d80769-8079-4045-aaea-89ff2fc8a74e", "comment": "Malware payload (Mirai)", "value": "43174b73a3f83cd66101ca6c3e2a0ced946d5004cf9cb45bd5508452ff99219f1cef8c0aaa82024b723a0752752faa00", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692188249, "uuid": "eda40f9a-4c1d-4a45-89d3-176d65cb31f5", "value": "T1F1539FA5C5ACAE58C71441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692188249, "uuid": "e9a1b52f-c1c6-4da9-9450-b3c2f6c3d717", "value": "1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwN0T0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692188249, "uuid": "8db8181c-2cd2-4e19-9610-824dbd127312", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692188249, "uuid": "04679c2d-9447-4a37-b563-fcd86a09a12a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692188249, "uuid": "cacde241-aa18-4a24-a18c-3988bb71fc5c", "value": "5da8e490d04d57bb0024c2eaa912f3a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9545d584-3c38-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692192421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692192421, "uuid": "fffa3162-3ce5-4be4-a438-c8b2bee9c906", "comment": "Malware payload", "value": "20808a92a47913a519b3bdac34123bb2", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692192421, "uuid": "e9397eb8-af1a-4e99-b6b8-da11e14a921b", "comment": "Malware payload", "value": "56ed880b4dc4a091764ab8959c4a4f31523d319bca54b21db18c571f3595888d", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692192421, "uuid": "72a4e9c2-bc05-4d0e-bac7-c20affe54fd6", "comment": "Malware payload", "value": "40e7332b48d8ec1cbcf8f57c35a06a5690bd4dd5", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692192421, "uuid": "3d28786b-b7f8-4deb-ae6a-5957d6ae0486", "comment": "Malware payload", "value": "69b273d230f9401be3c3549ea70ecafe565fb87d929cf1c65a96d381e70a3ba53a043f449ce8eff1e8d73463d1e09f52", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692192421, "uuid": "3b111ec3-bab6-4c8c-bb32-730851ce0a7f", "value": "T1BBD3F1D36C94E87FFDBC6A72047916504ACA4A502507C9E4661B7C6F31EFE0C6AE8278", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692192421, "uuid": "a90adba9-4c93-427e-bd48-43f632029458", "value": "768:57ZO37OC/2KuHnmpfZNJh9i8Z/OgFecqorSpRZ35iwmpCY1h:57ZOS0uHyJHiUNFe7l3V5TY/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692192421, "uuid": "a6d02f4c-6815-4a13-8ada-482c35941ac9", "value": 141928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692192421, "uuid": "25180890-9aa9-4dd6-9903-f8b88728f7a9", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692192421, "uuid": "4a16e08d-9b54-439a-a2e8-6c4f8be76311", "value": "RFQ8000231899464120000455490000.tgz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d3c0a41-3be9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692158289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692158289, "uuid": "e901f771-1a00-4ac1-8720-eae88c32fc62", "comment": "Malware payload (Mirai)", "value": "3524ca9ac321ed2a3b692c96c17a2598", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692158289, "uuid": "e64c4391-110b-4ef6-a7cc-6f4c409447ef", "comment": "Malware payload (Mirai)", "value": "575944edff12b0b42de23155497e437a32405b9c7ea15441d6e608ab77117dfc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692158289, "uuid": "5ccd352b-164d-497b-88db-5d952d6775cd", "comment": "Malware payload (Mirai)", "value": "7bc50f88d4187c0b4b9b48949174d16f0473be91", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692158289, "uuid": "e6ede37e-227b-42fb-8aad-e6e26616b81a", "comment": "Malware payload (Mirai)", "value": "23fefe195fa5e2fa1c5b36e252da85949b817220ab020ae0c161c6b38c082c866b559a4a4413da7ee5c49cbb1b7f8f54", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692158289, "uuid": "e164dad2-c786-4ebc-8902-dc7e7474ea49", "value": "T15F631A51B8816A12C6D122BBFB6E42CD372A53A8D2EF33079E256F2137C781B0D77591", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692158289, "uuid": "e2b22e16-b888-4b4c-b3d2-a60c89585753", "value": "1536:4/ww7ZsaLgadcwcf1vdZe6TMiwpEQO3oI:4/HRkEzcfNdZe6T41I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692158289, "uuid": "5ad0b908-e479-4049-9b5c-1aa5e28b568a", "value": 67176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692158289, "uuid": "9e5d0288-a4e7-4aa6-bfce-d1a422228719", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692158289, "uuid": "be854662-23b4-4f68-8057-b70b9b8dbf56", "value": "arm.nn-20230816-0358", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19e8d83a-3c21-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RiseProStealer)", "timestamp": 1692182336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692182336, "uuid": "cebbbb1a-5a8f-4b2f-965c-27f9b60e1a0b", "comment": "Malware payload (RiseProStealer)", "value": "347f9b184c174b954f2730f8f5ee321f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692182336, "uuid": "8a1e79fc-7d13-4c73-81c5-c7b4b319c779", "comment": "Malware payload (RiseProStealer)", "value": "591791723591e2412e4804dd636ea3fbc11890bcf60b984bd5b74624f951c179", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692182336, "uuid": "8aa1ba27-363f-4205-b5ee-ec55397182a4", "comment": "Malware payload (RiseProStealer)", "value": "daa871a66c07d84cda7711b9a8d992821904d92c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692182336, "uuid": "f45f540a-7667-47c5-a849-ba6530939cfd", "comment": "Malware payload (RiseProStealer)", "value": "2a91adae8d1a62b12519cba9bd676b0f2617b68c5a841cefd6aa81fd00bf5b4a2160d8e4cfc843cf0d9e89566aa6ef1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692182336, "uuid": "0cacbfd5-d2f9-44bf-aebf-53c63009421a", "value": "T14726338F2A3404D3D47B8771009E6A73B84CFB1F92AE6746469864780A7C473B79FE15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692182336, "uuid": "b939c49e-b27d-4b43-9202-68623112514f", "value": "5e5ac8ab7be27ac2d1c548e5589378b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692182336, "uuid": "fe72c96b-2ca1-480b-82a9-7b7a1a2b75e8", "value": "98304:E1GU5l3Eo31e86Fltg64YTYzYGzqZgkdrJrmaAdEouTNcc:EHz3Eo3I86F34PzNzqZ5d9rmD+O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692182336, "uuid": "4bbaa338-569b-4dc1-a61e-54dc25bea710", "value": 4488192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692182336, "uuid": "87c5e7a3-85e7-4d7d-9d64-946fbd18030f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692182336, "uuid": "98a9366a-47ef-47a2-8390-2b892a6c3b63", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a265a6ee-3c56-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692205328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692205328, "uuid": "ef40a50d-53c0-45bf-9f60-2178e552502b", "comment": "Malware payload (Mirai)", "value": "49e8dd48227136d626e00b083d9d821f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692205328, "uuid": "191221fb-3512-44d3-abc5-7a8b4085492f", "comment": "Malware payload (Mirai)", "value": "5ab554f06b8ff16211d972955cb5e28880bedc1c0b7bc7cd5e51fd68b8175772", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692205328, "uuid": "33c69c49-d623-4ef0-a4ac-7dfc6abcb66d", "comment": "Malware payload (Mirai)", "value": "403cfbbf58c368846ac184a8662783555e3f39cd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692205328, "uuid": "430542fb-b6f8-49f2-b5b4-566b11a13720", "comment": "Malware payload (Mirai)", "value": "ebe258d0d5500a7fdc1b32450fa19bf81f44a8b889c8b53fbea18036bdd49245641febd812951be1bcd6534a00e79808", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692205328, "uuid": "fbcf833d-eb6c-4c75-bd23-c09ce6fb99d7", "value": "T1A4C2E140F145CE85EEEA29F12D44DAD6BBE03F5E6A618D8126A463C15F5D3B38305DCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692205328, "uuid": "3bba836c-6045-4d2e-8a4b-f3daf56d51d3", "value": "768:FVdafO76jpmNJJKehmA7trpfIX9KeA7PZX4uVcqgw09z:tam+AnKehPRa9aRX4u+qgw09z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692205328, "uuid": "b7551556-14e8-4943-ba41-3ccd9f523445", "value": 27048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692205328, "uuid": "cc0a7d6a-d8f4-4b49-a71e-b9155a9cdfe8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692205328, "uuid": "c2da8df4-8e75-4664-8c16-2d874056504d", "value": "49e8dd48227136d626e00b083d9d821f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddd873df-3c63-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692211011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211011, "uuid": "02fee39b-c88b-4174-a01c-d07235796cee", "comment": "Malware payload (Mirai)", "value": "14f6762f3dae3e00c7180c798d313731", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211011, "uuid": "d3afc11c-65a0-49a9-915c-bc143b564983", "comment": "Malware payload (Mirai)", "value": "5bc73029c7ec715707de70292b011a8d37ae702fc28b3398251af5ce7505cafe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211011, "uuid": "3e83ab5f-fb36-4187-bd19-7aa0dcc07716", "comment": "Malware payload (Mirai)", "value": "64d94878def2d0fb186c23c69141590b7f2e78be", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211011, "uuid": "9250dc03-dfda-4dfd-bf6a-309a4df0afbd", "comment": "Malware payload (Mirai)", "value": "ffd42e41ca928622cfe8f267b64bd62fa494f8adc90b67783a309f5d3dffd1c4bdaeedc97ec2e15ae886b514f1656629", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211011, "uuid": "7dd053e4-a32f-4c53-9b7f-02d68f2a093f", "value": "T1AD538D75D12DAEA8C0414AB4A9598E704F13E4C046733EF7EA9587A68443DBCF858FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211011, "uuid": "fb1fb10f-669d-4cb6-8861-dbdabce60ac0", "value": "1536:ragXV1f1Fl/wtkn9PQauiufs3Ii3O/qyD6EZeCc:r57f1b/rQHf+Iey6EZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692211011, "uuid": "a659c534-af78-40c7-933b-164bb50f250e", "value": 63480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692211011, "uuid": "aa5cad82-2606-4324-b2cf-23eb3114c49f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211011, "uuid": "cee32008-2010-4a7f-b1ea-18a1b22a1cdc", "value": "14f6762f3dae3e00c7180c798d313731", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf331914-3c40-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692195954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692195954, "uuid": "112a23bc-011b-4259-bc79-cb639d4d3771", "comment": "Malware payload (AgentTesla)", "value": "eed991f429eac15c1a3f3ab4bde49af6", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692195954, "uuid": "1feba389-e8bb-4fc2-9b70-1a0609d1e1fd", "comment": "Malware payload (AgentTesla)", "value": "5be3e890694f19ad4c766af8a5474d5c85541d65aa8cff919758953eaf936d81", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692195954, "uuid": "db98abd3-3612-4335-bd11-71d8e6377c0e", "comment": "Malware payload (AgentTesla)", "value": "a6d3748d91bb2dc338c15550c2e77a1b8e8ee8b5", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692195954, "uuid": "34f062c2-86ed-40b8-9658-3205d39c3514", "comment": "Malware payload (AgentTesla)", "value": "55db9216aeb6ac80d24c34ccca637edbd34933811f5280bd9c32b78af82f4e434acae7e6ee559309c82b8c3d0961f871", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692195954, "uuid": "465620de-87b7-4b20-a194-3459aeee544c", "value": "T151B42330BAABE22EB947507148782257BC05EA2DCD5612CEDAEF4679B3F207C1E35075", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692195954, "uuid": "52403686-694f-4e1f-882b-c0992801cba5", "value": "6144:2Z4cknbXjomALi03r/d6ZMcCPpCs1MAvFxJYc3LTtkDZ16LGxAsA5K0epwwqsaaA:2xIMFP3TdDRCsxVbqnBAs0Orqtvk0F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692195954, "uuid": "3aa88bf4-7bdd-453e-8533-e9e8874f78bf", "value": 521008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692195954, "uuid": "e4ff0fcc-7e28-46c5-81a5-d8e01c1d87bf", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692195954, "uuid": "b2ca099f-ac26-407b-98e9-3b239198ff2b", "value": "PO_4500188776.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "648ab1c1-3c04-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692170005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692170005, "uuid": "fe0ac024-c364-422e-acbc-2566cb35742d", "comment": "Malware payload (AgentTesla)", "value": "62e5864216fc38819fbd3147d3d6a757", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692170005, "uuid": "43871b4f-4d12-4d6b-987e-90b83a45ca27", "comment": "Malware payload (AgentTesla)", "value": "5c8356d7042466c0482da71475a6813f4e5b0135e59577f327fd00bf19be2441", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692170005, "uuid": "914600c7-b883-461a-8dc9-ca034effee59", "comment": "Malware payload (AgentTesla)", "value": "6a8a495e0acde08c95f6b44ec860ea23f11f2d4d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692170005, "uuid": "2c20cf27-d6d6-4183-888a-838339af40e0", "comment": "Malware payload (AgentTesla)", "value": "be6f98a661d7f3e4138e43fddca2a23aafd72ff2326e9320b4216c1a74ae89809f1eb3269a43ed228a464f7e07bb6e96", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692170005, "uuid": "c1c4f14c-0c43-4d0d-90cd-e44a186279d0", "value": "T18C05E06276F8429BE06F40B696343103DF72A5BB6566E6C5BCCE12E59F82F801603F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692170005, "uuid": "065dd5cd-d7fc-43ae-b938-6b5b003f9eb0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692170005, "uuid": "b4b208bd-9621-4c37-9686-71d965d14971", "value": "12288:GZnDftz9E6ARUR/GxVVGV/2yTGmZtrhFlslOYhW7fV2Wio/QAgxBvRd:GZtJUnxGY6G83lqUV2sgZd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692170005, "uuid": "48d6a1d0-4d82-4b35-89d1-edc2a4bc85f4", "value": 818176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692170005, "uuid": "0528e5f2-260b-492e-89f6-25537517cbaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692170005, "uuid": "7c3bb97d-fe09-44b8-8af4-5ded42d9fbfc", "value": "098366355627_2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c88f1792-3c12-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692176186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692176186, "uuid": "2a5cb4b6-acd2-4a8e-829e-9308bd317424", "comment": "Malware payload", "value": "21d37dd16df12e82fbebbc4f4369a807", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692176186, "uuid": "a0b65e17-5a12-4577-afb0-9c2dc737cb0a", "comment": "Malware payload", "value": "5cfc825e99ada58892436ea4dead24487987051bf3bc393ddb26fdbe07e4b133", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692176186, "uuid": "3ea99c4f-a65f-4ba7-80d7-d2d8bd232893", "comment": "Malware payload", "value": "5795a2bb026d2c078042c9215d2b3d47ed5eabce", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692176186, "uuid": "5f87cae4-3c78-4592-9010-20288692f3af", "comment": "Malware payload", "value": "912c6a2ab5443c6c13c5024b3e5205d909187e71e79f573fcbc7fecaa6718cc8cb1894458a52121d694484a1fe0c837c", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692176186, "uuid": "d47471f2-7c51-495f-bc51-84cec957110a", "value": "T17CB423BD08B74AB58E3857B89B9210A5ECF1A1D76C64C3F34712A77876224B3DF44938", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692176186, "uuid": "d7eb2cd9-f28e-4f1e-acf3-949dae0f363d", "value": "12288:kUiOv7QDq9IcrrIBMHo72FuRGwVRjXK0JcZA+a+tKkSdBbI:MOv7cqOGrI0oiwDbX+ARS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692176186, "uuid": "49f5e51e-df51-4903-891e-ebe9a05b2e39", "value": 522616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692176186, "uuid": "17dbdaae-2165-4fc0-b9b8-3e041aba9915", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692176186, "uuid": "cf9e5cf7-7ea4-4db4-a99d-5892206afcc4", "value": "PAYMENT CONFIRMATION.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "125c47ef-3c18-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692178457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692178457, "uuid": "16860d36-8732-4abc-9c23-eaebfa21c36b", "comment": "Malware payload (Formbook)", "value": "aa5a473625665e9702e4af5cd313a456", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692178457, "uuid": "b6363e5d-fcbc-4322-b1c3-18a6d05e549d", "comment": "Malware payload (Formbook)", "value": "5e356ba0663601a704ff745bf4e38b9a8ee7ececcd5443da641d46c30a04de07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692178457, "uuid": "205a7135-1e49-4b25-9a79-d2f333326e76", "comment": "Malware payload (Formbook)", "value": "067be80b521eb5d6c96a8ee6c5032b16a82fd68e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692178457, "uuid": "a1746ad9-2a46-4d90-959f-6aa41d881b3b", "comment": "Malware payload (Formbook)", "value": "0f46ae48aa555963ebcceaabd1b626d674d4d880a1f0ac726bce92718049fef8cdc798353f200d6ab874ef79039aea0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692178457, "uuid": "33d14d40-a098-42b5-9f8a-0cc19ade32ff", "value": "T10774120076A0D83BC15507343E7A13AB7EE1E0161C65A72F2BE09F627B72A439E0B357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692178457, "uuid": "6a769996-c26a-4382-b148-b257b182bd7a", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692178457, "uuid": "3a70d58a-4bac-4848-8e40-b4c42916dc91", "value": "6144:/Ya6whhgKy4AwQ0F/OzoSDi5A+rDHKQB24z6WidcIP3vUu/gHdfFAJDkcGNB6iOf:/Ym3E4Ab4go4EDHpBlzxNI/Mu/g9OocF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692178457, "uuid": "a519d5fc-6ad0-4ea8-a25c-eb64691ad10f", "value": 364222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692178457, "uuid": "a3320bb0-d5af-4906-806d-aa8bed29f865", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692178457, "uuid": "71eba765-38c8-4bf5-9a67-6fbe76d5a498", "value": "Original Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8a85299-3c34-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692190816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692190816, "uuid": "f459b0eb-8a08-417e-a4c5-a62b61c5aa6c", "comment": "Malware payload (Formbook)", "value": "c0946916543d40ed32bd41d37baa98d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692190816, "uuid": "84e6b8b2-0f03-4e7c-8dff-a36c28a46958", "comment": "Malware payload (Formbook)", "value": "5f4316e6d654f612b1aa557b15eae6502979697bcd4cdc101b49c2297a6dca14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692190816, "uuid": "57600839-2ba1-47c5-af92-f3c2f903c097", "comment": "Malware payload (Formbook)", "value": "9e1e5469e86238df567f36d0dca5f255d066b811", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692190816, "uuid": "9d079b2b-a67a-4daf-a646-bdef85f8a4ea", "comment": "Malware payload (Formbook)", "value": "59656c92150875d1902fe269ab416f538801b9989ea6ad565ac91c5e2e9693cb2abc481fb6c10e2d20bbbb88953f928c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692190816, "uuid": "8fc950d4-375e-41b3-adae-c20dfaf1751c", "value": "T1C75412A0DAA4D123D91641710BBB2A3B6FCB761111FE7B1727402B4E793B4C2ED2E746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692190816, "uuid": "09f5bca3-297e-43a8-8030-eaa937034d18", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692190816, "uuid": "00f58cdb-2c00-4a51-961e-a97c315d9403", "value": "6144:/Ya6vwC4IG6a8T746rJfJWTGAj83j+BPkMIWqud:/Yth4ILa+x9JZAoT4PkMIWqud", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692190816, "uuid": "d8e71033-ab58-49ce-80fb-60afb21ac3ce", "value": 281657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692190816, "uuid": "436f2723-9354-4593-91c9-e47f3cc60d1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692190816, "uuid": "611a5812-ba48-4162-b3e7-1aa96804cdc6", "value": "Sales Contract 2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f56f531-3c3a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692193163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692193163, "uuid": "78dd94b9-5c3f-42d0-86e3-70ef868a2f43", "comment": "Malware payload (Formbook)", "value": "95b033fe6839de85a9647cee68b64faa", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692193163, "uuid": "9ddc3727-ab03-4c44-9208-304b12be2a48", "comment": "Malware payload (Formbook)", "value": "5fcf3f2209854b1a96ff7bb5bd8ed56cf839eabd3ad1a91bdbf053c47c8dc2ca", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692193163, "uuid": "47cf0075-f15b-49e2-9cdb-6b84183c7119", "comment": "Malware payload (Formbook)", "value": "6ed192c140e4fdfd12f056748eaa574bce7351d9", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692193163, "uuid": "b223816d-a587-45e3-b03b-7fa2f7f7f8c9", "comment": "Malware payload (Formbook)", "value": "72b54114b25913e8bfbed95c2588425d2211f81ec578ecbbc692d11aedf64cfd533001110c990652d4776ec3a084d3e7", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692193163, "uuid": "19ea60ea-16b4-4a0d-8ee5-98fe717f6069", "value": "T1C34423C79C73C89E3E4ED0BA379096B665968B89451F61F12E4F6465D08B327078C2F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692193163, "uuid": "74e4ce5a-7ae6-47c3-8ca1-645267f721ab", "value": "6144:bcWMOBV+GnEycYaDy+1B3bH9AnUiX264mbc57mBsdLJJ:bcM7jEbYCbMT4mbcRmBU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692193163, "uuid": "69def184-7389-418c-bf3f-7dd3cb75a858", "value": 267881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692193163, "uuid": "647774fc-911c-4881-b76d-0a61e8d2c87e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692193163, "uuid": "31016666-a475-48a7-bc37-f10db7e4a498", "value": "Order List pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d94d5c1a-3c63-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692211004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211004, "uuid": "fbd4c819-1093-4c6b-b049-4301c92e27d9", "comment": "Malware payload (Mirai)", "value": "c331aa999326813532083ea54ae9dfea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211004, "uuid": "cbf4c3ec-1815-4e22-a773-db7462f6d467", "comment": "Malware payload (Mirai)", "value": "6024456eb0d6be3c997b022809d143b3cdb8fcd0351997c51df762a5c532b61d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211004, "uuid": "f85bcad4-2c10-4164-9922-0d27dd0a3ae1", "comment": "Malware payload (Mirai)", "value": "9f69e1dd150d23d18eca4530b7780c5c06831d82", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211004, "uuid": "dae6e668-9c1a-4201-b56a-fa1e89a81e4e", "comment": "Malware payload (Mirai)", "value": "8ee9fb1c3189d497fd77a3cab257d9d2fe34869b417f126117758c8093146996edab12a5a8010771b3c2a9ae0192140f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211004, "uuid": "eda48e4a-5e96-4fa7-ae76-626be2c6969e", "value": "T1AB330253F252FCA1E7227E79A6FD48CE3C893AB4C098A86028D57C26F4D0C03A5E55D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211004, "uuid": "2ef4b745-5c89-4c0c-875c-37e8cca413d4", "value": "768:SfZYvZxNZEjyLErIvjW1SNtGpubbHDFL/O9q3UEL2qEK5J6OAsNTGjf2tl8XOYnr:dPSyYsvKKt1HHDFLbL15J6RN2tAB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692211004, "uuid": "ef05eb0f-7c0d-4c9f-a89e-22a92ff9f98b", "value": 51432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692211004, "uuid": "dca92979-57a2-4695-9035-74b1388694f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211004, "uuid": "eec21ccf-4f01-4f26-af28-37dcafc35dee", "value": "c331aa999326813532083ea54ae9dfea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95eb3a05-3c07-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1692171377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692171377, "uuid": "be7d40ed-7233-4dec-8d84-73a65d7e1078", "comment": "Malware payload (GuLoader)", "value": "744e634d44453986306fa3602dc0bc9f", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692171377, "uuid": "200122a3-38bb-4193-8982-2c950123a8fe", "comment": "Malware payload (GuLoader)", "value": "60439c4cb16608a105b44bb6d6aa082c609a93279144356c474093625e7fc210", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692171377, "uuid": "841fd138-8ebc-45a2-a612-60c858f3c51c", "comment": "Malware payload (GuLoader)", "value": "d8022357b1c519ba4f6579ad89703148963d4de2", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692171377, "uuid": "c66ae118-e342-4e46-9600-a75c78e4ca44", "comment": "Malware payload (GuLoader)", "value": "426fbda0e979798f193389079243593fe33b29e701932247856642e4e9a58fca43b44d94d71de874037c4fbacb54d912", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692171377, "uuid": "298f9d8f-1447-43a6-bdc4-2fbf63c18b0c", "value": "T1A934239CA8FB4C9432C6F9AE21D23747C9291F5599333E653B34338B2D9335A039D496", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692171377, "uuid": "8bda063a-173d-4fb3-9b06-46d48e00595e", "value": "6144:gldoZk64KiZq+LGrT//X8T5v9huiOe778RLipG:g7oZk64KoLG//+5FheI7u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692171377, "uuid": "d871aee3-4f02-45a5-8e41-445247e9106d", "value": 234934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692171377, "uuid": "a035a9f0-561b-4056-9169-8593ac27d1aa", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692171377, "uuid": "d57f395f-5e81-43d7-a459-28c3da2fadd3", "value": "QUOTATION#6789034AUG23-INQUIRYS_THANHS%0D%0APHUONG_INDUSTRIAL_TRADING_COMPAN.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d2f0c58-3c56-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692205319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692205319, "uuid": "d65b4dee-5415-4fb2-aeeb-6b566266ffcc", "comment": "Malware payload (Mirai)", "value": "b95220491dd39e9970d2e16dbeb9cbb8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692205319, "uuid": "9e24df4b-1eac-45e0-99e8-c44579438980", "comment": "Malware payload (Mirai)", "value": "604e88da0c2e3ff2ae053039ad5a38fdf728b29aaba0d7e6d06f73f9fa544fa9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692205319, "uuid": "acdfc6e9-771f-48a2-b409-9ac82346a160", "comment": "Malware payload (Mirai)", "value": "c6b1d49baf581b4f9cb72eb4ebb8f5ed7c4b0978", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692205319, "uuid": "16515a4e-b7b1-4451-81c4-88cf4370f9e7", "comment": "Malware payload (Mirai)", "value": "0f552b61f2d217bbd5ed3de0fd3f9177253494efb03aae3d271ef8a42ca9672936b762b5f7f2818708c4fd5de552e062", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692205319, "uuid": "8f7c8ed0-0793-4b2d-aeb9-4e948481e6af", "value": "T1A6B2D1A48B916606C6B07476E37CCF926A3715E4C6F634272A2093BCDA5245733FC6C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692205319, "uuid": "38f7dc66-974d-4b5e-97f2-0a55ba3cc148", "value": "384:4GaKXlJIDFUS0Mggks3aIrokYVDoDDRRKj55N7LB9U+BZ3WAWt1hymdGUop5hu7V:4GaKQFH0rs3zWoDDRsjt7LB9U+Bhet1/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692205319, "uuid": "46bb4791-16ce-417d-b221-0b95a78b0022", "value": 24536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692205319, "uuid": "46f970b2-f4f8-435f-8889-e187cbb80328", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692205319, "uuid": "99b3c594-ce5b-4b32-93a9-37ec284ce565", "value": "b95220491dd39e9970d2e16dbeb9cbb8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90e37cd1-3c4c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692201004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692201004, "uuid": "f2215f2d-7f40-4141-9dd6-7e55998765e0", "comment": "Malware payload (Mirai)", "value": "127988b3523febcdd2fe452cc70c1136", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692201004, "uuid": "b1cdc57f-7c66-4a63-ba36-ed70f277531d", "comment": "Malware payload (Mirai)", "value": "608939b31bc0a0ff6eccb2fd4782944a42daf267697b6d996fb95595d7969c6b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692201004, "uuid": "2e149991-2b14-45c0-b56f-0e392fd98c59", "comment": "Malware payload (Mirai)", "value": "fbf9b4483c69a4ff9635f6385e598e9de7330373", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692201004, "uuid": "37788727-3f95-4d9f-b60e-f6a0d2263e46", "comment": "Malware payload (Mirai)", "value": "0742e362ec66ca2be10271c0b70e0be4e36df853eb31322ef319ab7c2cdc6eaf7e22458bd32fe6870434deb593227ac3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692201004, "uuid": "e8bd2c22-f6c0-4c2f-8a5a-acb9d834f437", "value": "T125B2E1D5D6FF27C3D2629332E07C9A4D92721AC1074B451A1109724EA3D770E87FB3A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692201004, "uuid": "7825eb2d-ede0-4d76-b666-3cbc28f9d7ba", "value": "768:w/QOC0Yhn6ROHWF09cwNPFCnNBxcvaocx:w/nihneF1wKNBavafx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692201004, "uuid": "6643afed-1068-4b34-94c7-1f4b8e8ff89a", "value": 24728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692201004, "uuid": "5d755b57-2c0b-49e1-a3f9-72ca58f4230b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692201004, "uuid": "cb4da4d6-cbb3-4e62-bb2f-2680dca390c3", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "791864d2-3c84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Pony)", "timestamp": 1692225016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692225016, "uuid": "e7611c0c-1267-4f56-8c79-48f295f8b629", "comment": "Malware payload (Pony)", "value": "0e17dd9e3ab01a67046c471b357ae4f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692225016, "uuid": "99100b6f-8e7b-4870-8a9e-fa456ae61b6d", "comment": "Malware payload (Pony)", "value": "60f0c2daba44c1f09f9677a15ba4031f2853e1d3a3b608721d25c261a2341472", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692225016, "uuid": "c5b9faa8-a474-4fdf-8f94-f335e9239842", "comment": "Malware payload (Pony)", "value": "23b4e39ad9804705e1773499ed87081ad3d58097", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692225016, "uuid": "59479821-7173-49d4-a625-1e6b128807c7", "comment": "Malware payload (Pony)", "value": "0191356524808f7bbdd4d5be41bb7ab83825e56acec46f45ab4588e9a6d817960bbc957ada2d3c95c274de9331f691d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692225016, "uuid": "bdaee17a-9e1d-4d5f-beee-156a0e52a0af", "value": "T183930802F480F0F1C1A22AB53BC15B71E7F89E79783A8E59EF4C45847DB728B6B16452", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692225016, "uuid": "5a9c0f46-a0b3-4628-9fca-76878284f309", "value": "9b4192c1bb37e89f7af1e420b76961bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692225016, "uuid": "75c1be29-82c6-49c6-a77b-7493525d2b47", "value": "1536:m2X+ju5qTBZnMU0DqLdt4n7yR1wrhSEgrOCENJkzZDNQt:3MvQqZt4eOCENCDNQt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692225016, "uuid": "cc865b57-df85-44db-ac66-f1e280bd9897", "value": 90112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692225016, "uuid": "0c96c6a0-1c1d-4390-b5a5-a42c9d4105fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692225016, "uuid": "462f332f-579a-444a-8af7-ec6f15ddbf00", "value": "0e17dd9e3ab01a67046c471b357ae4f5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87c6d933-3c13-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692176507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692176507, "uuid": "dace4614-b024-442e-8169-013ad887baa2", "comment": "Malware payload (AgentTesla)", "value": "f93b86ab785cc1422188c476d3483ad5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692176507, "uuid": "6319d921-3382-44ec-8018-ccb67b539198", "comment": "Malware payload (AgentTesla)", "value": "6217071ee755bb3de9914c5ee71161ed5666acd77c7cb6bd972d465707bf0613", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692176507, "uuid": "2b6264a3-d410-4310-8529-b6dbb2843ca2", "comment": "Malware payload (AgentTesla)", "value": "cb8e9cedad42afbf0a32cdc58643450fd149e6ad", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692176507, "uuid": "f042b6d6-9a32-4af6-adb5-cad18e9cb41e", "comment": "Malware payload (AgentTesla)", "value": "a7200a12a2a622b1a095f333ab66d46c0f8e71fb1e648d8e6a5254563abcc4154809c3dab2a9ec8cb2189120f91cfc06", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692176507, "uuid": "506cacb2-0530-4185-b982-a40fad420137", "value": "T1F615AEE0AB28C951E46B47B8407AD75F9233554D6C25C52D2D92BECBBC633C2009BB9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692176507, "uuid": "2294e0c9-01c1-4ed8-b307-198884200646", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692176507, "uuid": "de0e467e-734d-4c3c-8d1b-7fe52b300bfd", "value": "12288:D1PDogOtA1MUII0a6PCKv3rBtOpxP2eZrW2uvMrxJ8mJAsjFmR00lqTjgidAA:STUIIN6PCKCpxDrFyOxJ8aAwAgTjjA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692176507, "uuid": "2a2c0179-01c4-43ee-9e98-4fc4b9ecc723", "value": 948736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692176507, "uuid": "9d637976-8434-4069-bb2d-a4017e5a633a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692176507, "uuid": "3a047f29-c85d-4864-bf29-4b1e7bef3757", "value": "invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc84a58e-3c3a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692193453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692193453, "uuid": "1f2215f7-e793-4fda-83b2-276ba2171a5c", "comment": "Malware payload (AgentTesla)", "value": "2ca95dd3681e3df3c927b1acd3d19ab4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692193453, "uuid": "57ca4311-462d-4021-8ead-5af9025c376b", "comment": "Malware payload (AgentTesla)", "value": "625f5f55b3bf7030e442265c17eb69698ef907f78d6347a1870805a9d04c3e27", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692193453, "uuid": "a16cd809-9ee0-414e-99cf-98e85e90dcc2", "comment": "Malware payload (AgentTesla)", "value": "8579052fb4339a0476a79704017873a7e14310e9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692193453, "uuid": "ebd37632-893c-4343-9cdc-f00121699357", "comment": "Malware payload (AgentTesla)", "value": "cb7607a675aa02d027362287c9e28fbb13ba49d7d878c27c1f7bdc26f0948d831fe69ab664564ffd14ebc208c2befa67", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692193453, "uuid": "2c2769dd-5035-462f-9a6a-ffbeb86b2b76", "value": "T158D4235E340B9A5B9E7C73CA9B2F735C14FC5D08E63C9F62F94CA0418311691AE64AC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692193453, "uuid": "04a9dac1-7c6c-46bb-9078-1e814e0ce940", "value": "12288:xFeDkzL1LDFd9mfaKnIR1LfpaoJESJzUzbbUgNi57z6BeVxejPPWwJ2wS8Ml:x4QzD8rIR1rpaoeYMdNigfPPZpSX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692193453, "uuid": "9f702cad-d831-4b4b-a0b9-29307f66115a", "value": 626478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692193453, "uuid": "14991e7f-9078-42bd-8a4f-9e5fa6eacf32", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692193453, "uuid": "7cab331e-9415-4002-828b-bbbe509f023c", "value": "JUNE-JULY SOA 2023.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74f2dd14-3c2d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1692187642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692187642, "uuid": "41456c78-2eeb-40a7-b04a-a0442e958960", "comment": "Malware payload (RemcosRAT)", "value": "0e2282e4d804c6fc49e5e894ecc980f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692187642, "uuid": "5ac5f85f-79d7-48ac-aa3f-71dace7d0be6", "comment": "Malware payload (RemcosRAT)", "value": "6291532d8a12896b5213e468896e222ca6c112b977d53c6a0a61cd78a3ee7535", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692187642, "uuid": "4020d728-f765-4a4f-9ab0-71a92b6a4093", "comment": "Malware payload (RemcosRAT)", "value": "f447c6152c2ebe1c161f82355cf77a352035a35d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692187642, "uuid": "482e809c-67bb-44d6-a15b-e85e5e8d4b88", "comment": "Malware payload (RemcosRAT)", "value": "adb377c5ce72baae6ef9dbfc27dd9ee3d0803fdcd367720c5cda26c32b8d950d266b974e4d08c44a7e783dfdfdbf6216", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692187642, "uuid": "e04cbeea-2dd8-4643-9f8c-cbd29dd449ae", "value": "T14B341258AB2DD85AD194C6FC9524D6F222E95C7E0D2665CE1BCCFE2FFD27200EC910A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692187642, "uuid": "d6f9a001-f8d2-4522-bde3-96155eacf017", "value": "bc4f8e98d1041d53dd63bfb91ed10d0a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692187642, "uuid": "5ffffc42-39f1-4227-a3e5-4c5b277fb08d", "value": "6144:DvGSN9gWuLpcBKnVBYAsmrzpyDfOXXV1B:DvbGWulcBKV3uOX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692187642, "uuid": "12f3e2ce-ad66-4b23-813e-11e853bf3763", "value": 238080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692187642, "uuid": "f5a67d89-db88-437e-8e38-8bb87aa55e49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692187642, "uuid": "cb7f7e17-e48e-4a00-8a61-dbf0e5647fb8", "value": "bOV4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aa32e04-3c35-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692191034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692191034, "uuid": "629613f7-82c0-4455-b0d6-43cecd8e2787", "comment": "Malware payload (AgentTesla)", "value": "c399e483f4b00c95e7d47d6ddbc4a476", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692191034, "uuid": "695461da-fb90-44af-bdbb-c83cfc04aed8", "comment": "Malware payload (AgentTesla)", "value": "62e5c9828c17bbd1b16d8c5c0276467c9f4f2e443c64c3d647c2d01f8e27e05f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692191034, "uuid": "882dda80-76e6-4a0f-85de-15eebe83dc25", "comment": "Malware payload (AgentTesla)", "value": "da228b22fcc07fd2a4e62f2ddcf5b32b3ab31d87", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692191034, "uuid": "189ef699-436d-4243-8fb3-6760a27e8ec5", "comment": "Malware payload (AgentTesla)", "value": "54170a9d105163f89ddd38f4e59d2013f33ef44900c8c4d8e97d1ea78b557f0eb8789021854449573f5b94506ae5b400", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692191034, "uuid": "6a5849ad-2bf3-4c56-9fa6-c71af51b0927", "value": "T15CE42391FD233C9BD362890DBBDD4FA99221B084696FF3687E341AF98DAC0C2874D154", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692191034, "uuid": "6a588b9d-a4d1-4696-947a-9db3609ed489", "value": "12288:p4U7cT1VxMN8Qs9eEbVcrBGsfysmxHZRBKqGl/FwyMh5inN+vvty3ZrCVsBHHgTZ:p4bRV+NrEbVQpOBHQqiiyMSnN+vvt6Z4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692191034, "uuid": "ddd44350-0a31-4b81-89eb-c86610bf82ba", "value": 715405, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692191034, "uuid": "80cd9694-af0a-488f-a283-69a7063133ed", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692191034, "uuid": "50885d6d-f7ff-48ed-a0e6-ed3111648dc4", "value": "Documento de cotizaci\u00f3n.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4f32c76-3c3f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692195454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692195454, "uuid": "b0b31eb7-622c-4583-b763-2d50510f2c9d", "comment": "Malware payload (Formbook)", "value": "e6a795c7ecf096319a77ed69a1f560ac", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692195454, "uuid": "c975e6cb-48ff-4864-91c0-b090024ce967", "comment": "Malware payload (Formbook)", "value": "63d1114efc08537cfcc5fcf4a834b53486377bfdbcb1d9a3068a4178904877b6", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692195454, "uuid": "cdf0daa4-445c-4205-a747-11dab4f07ec0", "comment": "Malware payload (Formbook)", "value": "d28c3b6328b7db48bb598b038183b7b4ebea1c07", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692195454, "uuid": "30bb41ba-5230-40b0-bb4f-bb6e68862476", "comment": "Malware payload (Formbook)", "value": "c47d872b6cc6100245d19679f3685f7d25310d0ec635461c7fc47498e75e792c1e40e51a13a9f9a96816379f0f4b802a", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692195454, "uuid": "9db7c697-a0d3-48d8-b619-52d6d8441fd0", "value": "T12A327E2EBDD94CBDC30F61B99168A059E7FC79EAE366039AD970AE50C07139F4701358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692195454, "uuid": "5a9ca196-65e1-4a33-aa4e-fffe3e9c57f6", "value": "192:8ya0NPP+3WK4N5eNA2A+EnVs+mg1SoB0JY8O36PvLKhypY95cWexgyy:8yXPP+3WKu5+A2bkBdB0JY8OqPOya951", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692195454, "uuid": "03e86a42-e6ee-43c0-99ed-0a3e816a436d", "value": 11493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692195454, "uuid": "69f49526-4c3a-437e-9a1b-f3c48eeb3555", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692195454, "uuid": "b937e99b-dafe-4397-8eb7-f1bad0071b37", "value": "PIXorderXNo202307110.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b4d176c-3c35-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692191062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692191062, "uuid": "4a35661d-a464-49be-b1f7-c8c59a9106a9", "comment": "Malware payload (Formbook)", "value": "e153fb09c6996b4d1084836e32414396", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692191062, "uuid": "5ae2d751-2c45-47d1-9ffd-b6097d88d5a2", "comment": "Malware payload (Formbook)", "value": "63d353bf92bb9d4fa31656308d30a39b91b8dd4005d6254502b1e829b74ae79a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692191062, "uuid": "48e2e544-6929-4bc4-bf7c-390b99ca782e", "comment": "Malware payload (Formbook)", "value": "973dc1db4ef4fa87796a2d56bd7d3ce8a66318c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692191062, "uuid": "dddbd945-75f5-48f4-9770-e2442bad86a2", "comment": "Malware payload (Formbook)", "value": "8b5c75d9f90a855a7c0f961dca4605638b110d5b3ff106f95d75ad12956914dd0b01c85fdf4e06f071dc110e28b2639b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692191062, "uuid": "070bc831-6045-45ea-86c5-8a1e9a88f18a", "value": "T1F7341218B390C5FBE4824B314935A6A79EFC99062AA2D34B13505E5CB933792DF1F713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692191062, "uuid": "bfbe002f-ef5b-4087-be96-638ee9ed488a", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692191062, "uuid": "1ece9263-136e-4f78-82ee-385d930837d5", "value": "3072:HfY/TU9fE9PEtuGb4LnneJFbc6nJoSMzGe6Wrx7JNpOIigLbtbtj8c/5Vl8gNVqJ:/Ya6GBJjox6WVcWlR/5T8gNVqqWCSJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692191062, "uuid": "ef62866c-db1f-4d5b-9866-cb1a457968da", "value": 243598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692191062, "uuid": "71485c87-347c-4962-9a5c-0036cdb72d57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692191062, "uuid": "9d420f31-ef89-434c-8a20-cc0a0dd81531", "value": "Shipping Documents PO# 2040024998.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df92119b-3c23-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LgoogLoader)", "timestamp": 1692183526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692183526, "uuid": "afa9f745-771c-4f95-b114-64073cfc1853", "comment": "Malware payload (LgoogLoader)", "value": "1fb683c2cb13d0160e37f9d0eefda008", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692183526, "uuid": "3848ddd0-52bd-493f-b58f-28a7619b61d9", "comment": "Malware payload (LgoogLoader)", "value": "6527532bbe4765f402505e48290b20b7a4b450be6b6cc8aa7ddfeabd72f27ae5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692183526, "uuid": "b6a946ff-25ea-43ec-bd2d-a5c86a945c24", "comment": "Malware payload (LgoogLoader)", "value": "2ffc6cba8b6b53a4887f2025f6e0fed1a11498c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692183526, "uuid": "2865a91b-fc4f-4f1c-a568-315306651267", "comment": "Malware payload (LgoogLoader)", "value": "64f6c68671ea784f2eca099dad467cdf921f87ebeb0878982e874b6f6436d47dd1c2881aeea778bcbdaaa487b0168035", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692183526, "uuid": "34c55c2e-b94f-40db-a257-dcac6eed5fb4", "value": "T117C40243AE49DA38C66BBFF86311C34422F76F9CF72D4F65292020595CE1AB613F16A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692183526, "uuid": "60b7d079-6f7a-434c-ade9-94d7e2a4377e", "value": "12288:JXA9Z69M3k42ibcovVNBLMTyBkLYqz5OKzhILblfTV:XvTyBk0qzQKzcb1x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692183526, "uuid": "bc4250c7-3b08-422e-a4ef-643c5867ac40", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692183526, "uuid": "bce2bd7d-2979-4817-9891-53a435f33160", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692183526, "uuid": "8c9baa16-e545-4b19-84ee-49f91a8b937d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c472682d-3c12-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692176179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692176179, "uuid": "bb362b8a-679d-40be-96d5-4bb92474baa0", "comment": "Malware payload", "value": "2d7f907eeffb1520dc85f2d5b9a1b127", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692176179, "uuid": "f71dce51-2b60-4a17-a2b1-463d014c1475", "comment": "Malware payload", "value": "65418523280f9d1036212703845a309c177cc8bc83c53df79499f9d28b39ec5f", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692176179, "uuid": "d5f38663-c748-4e0a-9769-ba3453099a12", "comment": "Malware payload", "value": "d635d614edb5fd9c1e4c9ff5860c88b5e8a4127a", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692176179, "uuid": "fdfc08b6-4d91-4c51-8751-084c67e4bb66", "comment": "Malware payload", "value": "a3f0b50864db02fec1c870f6d4838082741fa74df5dff586b1951791bb5f33ab92610b3104c352d8363c168dd229b633", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692176179, "uuid": "e31704bd-de57-47df-926a-cd56e324cc40", "value": "T1E2B423BD08B74AB58A3857B89BA210A5ECF161D77C64C3F34712A77872224B7DF44938", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692176179, "uuid": "61b817eb-88c0-4f76-82c0-7397c9a8a73e", "value": "12288:LeicJ7kbqdI4br6rMHmD2DEd0wFRxXKmncXA+aEfKaSX6bw:TcJ70qu0r6ymKW1JXQAbd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692176179, "uuid": "4a470c5e-e306-4e72-bd3b-36113e33442c", "value": 522922, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692176179, "uuid": "5d57b540-3b84-4ba0-9522-e4cd06728f03", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692176179, "uuid": "ee7945e4-5e07-437c-8475-2d7deb26659e", "value": "PAYMENT CONFIRMATION.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2472317f-3c1e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (TeamBot)", "timestamp": 1692181065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692181065, "uuid": "855090e1-8385-44dc-bc09-258c4b52c4ca", "comment": "Malware payload (TeamBot)", "value": "916b3ca9e49bf2f3e104546eaaaf2a9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692181065, "uuid": "199b91c1-fef6-47a3-b1d9-623ffbc8a9ca", "comment": "Malware payload (TeamBot)", "value": "65a92f49f687b2f421397bbd3a6426b0b4914b896659c2d07a287e112a25939d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692181065, "uuid": "95e24450-52e3-4a46-bd86-a7e165f9b648", "comment": "Malware payload (TeamBot)", "value": "5b73bd1612e52d2a0e64e94c2b7a8d4bcdbcfb9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692181065, "uuid": "7a6f8e4b-fe67-4372-9a57-102aae614650", "comment": "Malware payload (TeamBot)", "value": "f779ab99bd62bdeccdbd05cc2b7cc378add1daffb2b435022d54280eeebb08f49b07defa6284eae7e10d62fe1c140f15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692181065, "uuid": "975cfc89-ef34-426d-8701-2e9d770ec358", "value": "T1AE34DF22BA82D4BAC95701705834DAB0BE7F78308774894737781FBE6E702D267B6356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692181065, "uuid": "52addbf8-b98e-4169-9991-83ae45854a31", "value": "49508a3995d8fbf9414c0227b05b6f29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692181065, "uuid": "81094a5b-22dd-4394-ad9c-7f9395d5377b", "value": "3072:wqfBX9u9RWRLX0cwm+H733Hga/Tn96azxgU7NbfQErGEuZ0NQ5Akz:h9c2RLZwm+j3AIR6algyboDZMk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692181065, "uuid": "496ad342-2499-4715-8472-6846a6acd613", "value": 244224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692181065, "uuid": "85ecf2a5-667e-4ada-8c70-c799e75b934e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692181065, "uuid": "d4dfaadf-f6a0-4cb8-b38d-2813537ec111", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8471e315-3c29-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692185950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692185950, "uuid": "7f5fd000-9dff-4294-b23a-f478e835b13d", "comment": "Malware payload (AgentTesla)", "value": "cde31b4300fff68b6a35ddae703a13b0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692185950, "uuid": "3074f316-8c87-4d43-ae73-7db4298d407b", "comment": "Malware payload (AgentTesla)", "value": "65bcbbf2323972738622f55d2d30638efe47735e0820bf4a310733cee1bf302e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692185950, "uuid": "6e7863d9-ba1f-49c2-9ab6-e19902f18ee2", "comment": "Malware payload (AgentTesla)", "value": "08704d710e2cd39acebea36634a0e3a246b57fda", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692185950, "uuid": "603b0a32-0928-453b-a6b3-e9501a36acb0", "comment": "Malware payload (AgentTesla)", "value": "7dd69b52ec3b8b6325fdca5042519cefe40e02c471cad1446d4bf4e78b047d3587c70813790a82971b0a4f7a51bdc18f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692185950, "uuid": "e5eac0ea-da39-435b-bf5f-db87f892d842", "value": "T174931268C1D6F75E5CE22832FB0DCA7D42224B7111F1A321CA9A5E699CFA957031D8CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692185950, "uuid": "5450efc8-b3d1-43ac-9d9f-bc6bb61e75ae", "value": "1536:Oz6b4Dx5K/mLsSharx+5EASG5liqZNVu6lzJmlYBK8R5cWtHydY/:J6x5w6PSG5TV3QYcw5cWtIY/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692185950, "uuid": "c34eaec8-95bd-4f00-9677-933ded3c7b7c", "value": 91545, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692185950, "uuid": "808cee19-c5ca-4887-bfff-68fe1a0f8730", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692185950, "uuid": "7f304a26-7e46-4854-aed8-e045d83e36a9", "value": "Hkvyss.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1313da7-3c4f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692202373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692202373, "uuid": "8b0e0db0-8ad4-49ed-b16c-5b8edeae2ec0", "comment": "Malware payload (Mirai)", "value": "0904741290e8c645cd8298ee20c33ec7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692202373, "uuid": "901590f4-b67e-4b66-8920-8335123af3ad", "comment": "Malware payload (Mirai)", "value": "6796653617b1a3b01627fe3869a16852bf1cf09b4dcc00cc6026f745f4d715e1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692202373, "uuid": "326e84db-7b21-4190-8cce-68fe47e563e5", "comment": "Malware payload (Mirai)", "value": "dac760a8e0a11b04f778c3eca90e96b58647aa53", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692202373, "uuid": "84e0c786-41df-4e89-9b98-ac342468df02", "comment": "Malware payload (Mirai)", "value": "971a5966d34d7a8a203e9d37893ada00aaaa6054d47a8d8e4f16de4aacf07ae0486b891819e5004b8b54ceb7c5f22b17", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692202373, "uuid": "11b8353c-f2ef-4464-aeb5-ff5e28c3458b", "value": "T118C2D098278919D9D2F8C17843A81B6C1DA40FA6B809DC8668FDF762DD8E4743027EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692202373, "uuid": "768d3dbb-ab8d-4331-a70b-e21415648951", "value": "768:I2G214DFyosXqgvV9o1ndB08iJgGlzDpbuR1Je:I2GdDgosaaO1ndkVJu8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692202373, "uuid": "089b1e71-a40b-456e-b4ea-8cfb04cdf875", "value": 26184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692202373, "uuid": "d8c41e78-5848-43c9-801c-36cb0a1d0049", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692202373, "uuid": "360ea665-8082-4a9b-98b4-a53c77ff9a08", "value": "0904741290e8c645cd8298ee20c33ec7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39955099-3c00-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692168215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692168215, "uuid": "5f734d26-7e00-4e75-8653-b826cfb82484", "comment": "Malware payload", "value": "2307cadc8fc345a2682868ee189f0703", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692168215, "uuid": "088cc88a-c31e-42aa-a104-78802e548ddc", "comment": "Malware payload", "value": "680d0096131eca28eeec0c65be0247fa93d6e3b8bf7cf6b1be52d45c0d69d1ae", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692168215, "uuid": "34d7ebd3-a5a3-47b6-9139-ca231136ba54", "comment": "Malware payload", "value": "7a46fcd720565dcd58b6d0200727a78ddec39342", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692168215, "uuid": "c8fa4fa7-8a27-4c43-935a-ea2fb6a3aa34", "comment": "Malware payload", "value": "a5bf2b894345a3dee5c3cfcbde78392dc800597bb2af43fe73b99df94ebc76e485471601d5a16e72097c816341c0ec62", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692168215, "uuid": "4947562c-28a5-4ffe-943c-9270a6c3b41a", "value": "T107451216962987C7C3B4DBBE8AC4A23402717A1D3D1D9FCDFD7EDA0E2F021744A905A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692168215, "uuid": "21efa148-6e13-487e-83c4-7235c7b4e839", "value": "12288:JT3aGrbzZfBNZ5Eha+N7YgoO3Iy3fC3MEm7PH:NFhBNfAa+NcgoFy3fKRg/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692168215, "uuid": "3638cb62-016b-4d88-94a5-72a46e3cb2f1", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692168215, "uuid": "3a02ec56-897f-41cf-9cdc-abf8d397d89b", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692168215, "uuid": "571a561a-295b-4146-bc2c-7da29129cd09", "value": "Credited Payment Sheet23800.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58f1979e-3c4d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1692201339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692201339, "uuid": "14631e7f-6b12-4eab-8fdc-b2f5df7356e1", "comment": "Malware payload (Loki)", "value": "b7cc0e31c282d8fcc23cb0ff60683c39", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692201339, "uuid": "94bbc940-ffb6-4fb9-bcce-f1297ae87850", "comment": "Malware payload (Loki)", "value": "68474247bb84f88cd66b384283af26a9019df34f0f4cfb74ca67ac43dee594cd", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692201339, "uuid": "3e35086a-87c8-4138-9f55-cdf704e67974", "comment": "Malware payload (Loki)", "value": "1bfbb6d4ce2b244f6d3c9d9ddb4987efad03804d", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692201339, "uuid": "343d5658-8687-4400-af52-ad1114726a9f", "comment": "Malware payload (Loki)", "value": "ac4c4b67e5c7c1a9e9565f2fef195c38bbe929b5305c20c1945540ad983644ea046b40436f9ecb7d65f1c32e5429b810", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692201339, "uuid": "6cb8ef1a-6230-40d0-ab57-20aeda193821", "value": "T16304129E95BCEAC2D9968D740EC48340503FBF1B475D59AAEE23003AECADA213D71D53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692201339, "uuid": "a7d8063d-0375-43c5-a83b-0e4c3e60dc15", "value": "3072:ApOz8IaLGIOOJs0aWmPyseHKVe44PcraifbiDz6e+oEdz+iD6dW/ZdD:ApU8PLGtOu6mJeHKLUkaiDiDzadedW//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692201339, "uuid": "ebf12c48-6232-4732-844f-9fde3f571819", "value": 173692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692201339, "uuid": "00859ad0-4ed5-4c88-aa90-ebd937d474a7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692201339, "uuid": "1644917e-3410-4db3-878e-fbf86e2c7e54", "value": "WM_11505138.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b6ce40c-3c3b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692193532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692193532, "uuid": "79046d1d-8cb2-4b95-b1b8-b6c180f07379", "comment": "Malware payload (AgentTesla)", "value": "ac33bdffcecfd66229ea73497c677b47", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692193532, "uuid": "0455c32b-a453-4875-9a49-ff85e5fc4489", "comment": "Malware payload (AgentTesla)", "value": "69a1f50fa4b123f980b2b111b6f38458a2ecba8e9fe7067272ecfc0372e49f4a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692193532, "uuid": "4f0b661e-a4cc-49cd-8d9e-a5c59902b7f1", "comment": "Malware payload (AgentTesla)", "value": "bf4cd9a8267fbdb27b24cea29841f24240682a6e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692193532, "uuid": "41a347c5-15f1-47a4-a104-dbc9b25138e0", "comment": "Malware payload (AgentTesla)", "value": "2efc06fe5ad5ab567ff691123acefd52f573fef08f1b3a1ad1556edda0117b03a4e531074df148b24ece6905a4382092", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692193532, "uuid": "cc69c6c0-af74-4946-8584-c2d8d51f7608", "value": "T175356F13D77F5475EF24A3FC491E48F1B4F59C84E0E9E14953E5283AC4BA3108D2EAAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692193532, "uuid": "b5616d09-c1fd-48e9-aeb0-079190ac2cd5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692193532, "uuid": "c8ec8e84-3286-405b-98e8-5c80ad3a379e", "value": "24576:uPjFw8Rs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUOcUFzrRRRiEhNFF:J8Rs6CE3jLbO9Rs6CE3jLbOcORlhNFF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692193532, "uuid": "0ada488f-a4bf-4f2c-81e6-027a2027624d", "value": 1111552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692193532, "uuid": "75b59ca6-3e49-4e2a-9956-c29427591c3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692193532, "uuid": "8d0038ea-4620-4b7e-a27e-e360aaed4500", "value": "Bill Of Lading-SZVB57987[2].pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5418c828-3bd8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692151080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692151080, "uuid": "7bc40928-6d52-4e07-8dbe-ded83d2cbcd2", "comment": "Malware payload", "value": "1347af31f1f759cea0164dd26eeab53f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692151080, "uuid": "6eefca50-1b8f-4d20-a851-eb04e352f47e", "comment": "Malware payload", "value": "6a625df2a22684ec5c95df37818afc44ca1d7aca39e8011b7c0287c369588728", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692151080, "uuid": "a3955100-7d14-407d-97db-cacb9b2bba29", "comment": "Malware payload", "value": "dfb9ac5849355a0144c8efc7884c7e4b5f56086d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692151080, "uuid": "0d109624-b289-480d-9e3c-ff9ead5bcfbe", "comment": "Malware payload", "value": "623eb01da161afc71679838d908bba03daedd4e1ba25b5f8b89c66377bd9e0e718a157675113f798ba8685813bc2b719", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692151080, "uuid": "a0e5d8cc-86e6-46a5-afa6-7f48e8267a36", "value": "T1CB652338B589F058EE55ED3E2E20D8642AA01C405CC5E1E77DD2B7EE99723C8CEA5347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692151080, "uuid": "8716ab54-62c8-4f23-b888-efac1fb2d3c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692151080, "uuid": "6f2b1d47-ef56-4e3a-8ab5-b52fee15b91b", "value": "24576:kZ/4jDkyXlNpezDB93fHVqsdEd7N+GawXJEC8zX8bSMVwgVI8Hx:4/4syXlNQDjTe1a2Kh8+Xg7H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692151080, "uuid": "be54de99-d89a-4c89-8fb9-ab5c20179c51", "value": 1457152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692151080, "uuid": "4d3eea04-723d-4e79-a824-cfe7226adbb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692151080, "uuid": "d0e880a5-d757-4f1a-8260-0b2fd9f29c38", "value": "1347af31f1f759cea0164dd26eeab53f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0edb53dd-3c36-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LummaStealer)", "timestamp": 1692191337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692191337, "uuid": "2cca3cd2-afaa-459e-b54e-658cd9a81afe", "comment": "Malware payload (LummaStealer)", "value": "048e94bcc447bc7c96688d2266006dce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692191337, "uuid": "489f03e1-e7a1-4a28-a005-a2a80d7db38e", "comment": "Malware payload (LummaStealer)", "value": "6a9e0666d7ae9bdaf122bb956891802f59e9de16be838a2bd2a05680f786f8ed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692191337, "uuid": "2bbfcb4a-457d-4d4d-83e5-e151aef0b1b6", "comment": "Malware payload (LummaStealer)", "value": "43a158739baa1a85cc612583643a8e48d18da1f1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692191337, "uuid": "3adf29ce-849b-409a-ad7e-08e5204bd24f", "comment": "Malware payload (LummaStealer)", "value": "19c0c67fc6d7fdf36889954a1c6cd172c71c303e042549375206d40494db7c5fecb1898127e33d169d7921ad9a7c21c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692191337, "uuid": "c1f7bafd-de12-4e74-9834-dec7dff711dc", "value": "T14494C05373D17863E5668A325E2EC6F83B1EF8254E19375A123BAF2F0BB01A1C163751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692191337, "uuid": "942d585a-6dc5-400a-b2ac-bb4166eacac5", "value": "7c940fbf921a895a6be12db5d2d5132b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692191337, "uuid": "d102f9a9-3775-4400-bd37-8abe3c057650", "value": "6144:PmvdKGJr9Loyj3MWS1YIeQjl/XZnv8AgvYoe28aQ1oddB/NOUrK2:+lKyr98yj3MGVKLnWe2hQ1odv/NV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692191337, "uuid": "d4c8cdd4-7e9a-4954-9894-7c9c0970bcd1", "value": 420864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692191337, "uuid": "210bf580-706c-4127-8d72-c75ae936700d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692191337, "uuid": "6f62808b-d791-450d-a199-ac4b4dd65826", "value": "048e94bcc447bc7c96688d2266006dce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e466a2c7-3bff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692168072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692168072, "uuid": "04f1ecce-05f2-4ea0-ba4f-3bdee24a5598", "comment": "Malware payload (AgentTesla)", "value": "9cf9c063b3d8b4d80ab258206247d11f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692168072, "uuid": "9f1d2010-e834-4b6e-b3a6-f12d58fb3dc4", "comment": "Malware payload (AgentTesla)", "value": "6ac379c3cbed43c8ed7911f66c916f96b0ea440a0f5e965de87d8d88a983989b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692168072, "uuid": "1ffcefbc-44eb-49e7-81ba-e8eda030521e", "comment": "Malware payload (AgentTesla)", "value": "e0a76d372f4c9734098659021d7682d3c1b886cb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692168072, "uuid": "28d25b6c-8392-4ac6-86ed-8e03e592fa67", "comment": "Malware payload (AgentTesla)", "value": "81e3402db80643168c9c504ef1e2741ea12e56c749b46e62551cfd55e4631055f8a4f23a516742b87fd53e877180df81", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692168072, "uuid": "65b91a70-7dae-4d05-96b1-89d2084d2f04", "value": "T105C423B9AC4AE5DA00832E43318409166CBB129590AC1B51E3A96E9D0E9F0FD9DFC57F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692168072, "uuid": "166c3fc9-3ab0-462d-8038-de7eb1e62fb3", "value": "12288:qzHuNswEOOOgaBleyjv+4Apqy3fiZfrgDbr:SOahOgSQsSfEcDbr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692168072, "uuid": "b26b1924-fa77-4525-baea-07162c5c0495", "value": 549262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692168072, "uuid": "60486e3f-3b84-4a3d-8522-adc4e2ba8bd0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692168072, "uuid": "0922c22e-4896-49d8-8bc7-ef82511479e1", "value": "Order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7efb681-3c46-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692198546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692198546, "uuid": "2213c3fa-7aed-4580-86e9-da8007adf488", "comment": "Malware payload", "value": "540d3bc5982322843934504ad584f370", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692198546, "uuid": "a2f6563c-b7f2-4b37-be8b-c9d4817fc15b", "comment": "Malware payload", "value": "6b0a2617bdea47c4a673c02ebde8ffa709d4526cfdff9cf7f8502afc10da390a", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692198546, "uuid": "13f7c908-bd97-4fe8-bdff-c097a2ff7440", "comment": "Malware payload", "value": "304bffaf33ed57f8c381725cf22e0de9c90dcc71", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692198546, "uuid": "6370a21d-4efc-4c57-aa2c-c2b30b98f623", "comment": "Malware payload", "value": "0c95f56e372b68643435dc8a1532b3ab57c74fa7b97384cd00944902f627a82848ad8f7371f1e7ffd977e940b4f59ec3", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692198546, "uuid": "b510671d-9bb4-4fbc-b077-1aeca0a03e0c", "value": "T157E5BF09B692DE2BE394A73AA017512A8671DA227713B72F0F7D113B7CD23790D423D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692198546, "uuid": "8adf656a-c8cf-4231-856d-033923a15b9d", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692198546, "uuid": "2cb0d875-f6ee-4631-9950-3ebf8eaf3561", "value": "49152:6pwv/BkMfwpWaoH+yegep4Dpj7YVH+eFe4Ehj9l+ghSTeRG4BAxu:mSHocpjkVHB1+j9l+kGx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692198546, "uuid": "252e3b29-cc7b-46da-a6e3-4878ad8e3479", "value": 3245568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692198546, "uuid": "b1fb0127-31ac-4124-b4ba-471dbab30b9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692198546, "uuid": "a4bbeaad-f559-42c2-a3bb-a18225212136", "value": "169219854439ca6210ad19166ffd0b0a831da93535b1c2d5bc62ad735d3361036f1aa68164651.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a063fe3-3c5f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1692209045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692209045, "uuid": "b159c975-6be9-49b6-aa79-0f58c3bf3403", "comment": "Malware payload (AveMariaRAT)", "value": "5977dd36993760dd4db4b717e4b898db", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692209045, "uuid": "9dc667ba-d7ed-4264-83bf-f79ce59c7892", "comment": "Malware payload (AveMariaRAT)", "value": "6ba3456ab3658804bb76d9bd2d8e59c4f6e5116ba5df1c0acba09440075d4175", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692209045, "uuid": "ee0bdf60-5369-4b2b-8e97-e63d71237156", "comment": "Malware payload (AveMariaRAT)", "value": "50fed42116203c1fb1b7dd9d418b66e7cabb1632", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692209045, "uuid": "8280d44c-7793-4bcf-959a-44fe297dff6a", "comment": "Malware payload (AveMariaRAT)", "value": "231cf6fd9bfb68e09d59e587a48bcced87f94d8e8f4756fd720ec669549ffdddd301651cf7f42004c48583fe16ca7b72", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692209045, "uuid": "2adb991b-4ba0-469a-9647-e3536d5ef0ce", "value": "T14C84DE1A6ED610B4C1908C70F7F961ED5AB9932FA11567EB649942FAEF12B4F31020F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692209045, "uuid": "1bf455c9-5495-4473-afe0-fab82fd65f0c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692209045, "uuid": "69cfa87d-c917-4dc9-b381-365d76393fe4", "value": "6144:fme7WPpL6mbNWo3lQMFydExk3hKrkT8oEPYoB8t2Ot:f1WPpL6+WoaMFydEOhd4ogs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692209045, "uuid": "2373305e-394e-405d-9133-b6f5c4dbfda4", "value": 374272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692209045, "uuid": "605687ce-cda8-4d59-addd-d67932c46c56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692209045, "uuid": "d81d2f3f-f88b-4775-bdeb-e7a6243ff757", "value": "Revised Invoice No_8562023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71c29935-3c13-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Neshta)", "timestamp": 1692176470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692176470, "uuid": "179f5873-0b12-4712-ab32-8ef61870dcfb", "comment": "Malware payload (Neshta)", "value": "062370f5c01316f37c0c1916e1d4cbb8", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692176470, "uuid": "8b7da9f1-10ff-4c6c-af06-990c8f687ed6", "comment": "Malware payload (Neshta)", "value": "6bc8f1b6b1f8f46a5c2bb06dd0f2a2fc030d19605652401621be7cd4c8c9a350", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692176470, "uuid": "7f659e4f-288b-49bb-ab62-6e895cdb88fa", "comment": "Malware payload (Neshta)", "value": "1c4f21d4de4770c5b10e37f27f9db0efbebf7715", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692176470, "uuid": "9651bda7-46b9-4e75-aaf4-2fee4d9abef4", "comment": "Malware payload (Neshta)", "value": "eb3d8c11bc5bdfe6780f5de121d1c402760e6c3c2e33f660780bccc6eb5ef8c31f98c30d7736a166af47c238c86ce9eb", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692176470, "uuid": "6aab19dd-9f3d-4052-b4ea-487f6579cef5", "value": "T1CC65D061EE39DF82E56B4BB8508ED30D83715C893122C6396DAB51CAD4837C106DB7AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692176470, "uuid": "c3ce5b04-f9d0-41be-aed6-3bb9deca5a29", "value": "12288:01PDogWdQyMffjBAVY7s45gr/cUepSDzj5NRm+mmo6rkmkraub9KSUEYbrvClqTj:NdRMfIY7ssURjdClmk5sdrhTj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692176470, "uuid": "4b288aff-9d7d-4317-8b6b-05dfdf79317e", "value": 1507328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692176470, "uuid": "b0479917-2336-40bf-81f0-e50d8aa9114e", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692176470, "uuid": "bae88ee2-e90f-44d8-9077-44edc700bd7f", "value": "PRINTOUT SCREENSHOT ivn055037.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f4ec465-3c3d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692194397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692194397, "uuid": "f6e737cc-b41e-463f-a40e-9051d520b519", "comment": "Malware payload (RedLineStealer)", "value": "c7f70cabc81d61cede4208d73228b7c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692194397, "uuid": "4cbf79a8-9d31-4d12-b2f0-121ef45a2178", "comment": "Malware payload (RedLineStealer)", "value": "6bedeeed8331c62628dc9333297ad61a1073773ffa86b3e328d563192148440a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692194397, "uuid": "a039b6c7-9de5-4641-afc5-6fbd5ed845f1", "comment": "Malware payload (RedLineStealer)", "value": "53960f40aa1d0053bae922365201fb25f943274c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692194397, "uuid": "461c9746-dc9b-45b1-9e9c-d2c17503f9d6", "comment": "Malware payload (RedLineStealer)", "value": "b2a90727ed49a897d094fd8e8a3527df1ce2e719157b405fefdafe21b414df9c2216727507aafdfeac5e62802a52891c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692194397, "uuid": "90877bf4-96e7-4bec-9f75-b444c3fabfdf", "value": "T1A124F7D63E24E003DAD12970D9E187AD244B76D74DEA0BCB0399C7252DF79F82A27907", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692194397, "uuid": "58bad723-11ca-42ed-b659-6c4c9734aaff", "value": "18b18bdc6d43bac07afb259e62e3e581", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692194397, "uuid": "aa26a16d-147e-4ed3-9596-bef047477d20", "value": "3072:vcXVyZekyrtmgbGgO8DJXDOHmQwzJeNglCooY5B2:UXVkGmgbGgO81XKHm3MNSB2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692194397, "uuid": "2e90d095-7b6b-4861-9784-28b53a2bf3bf", "value": 226816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692194397, "uuid": "58fc8dca-3656-4692-8cb0-7e39a86a308a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692194397, "uuid": "ea7af999-d4bb-428e-a46f-ffbe1a4663c2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5557fd17-3c05-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1692170409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692170409, "uuid": "47dc9e25-9b0c-4370-a354-474fafa56fec", "comment": "Malware payload (Loki)", "value": "278ab890465e7eb05bc135bcd47a5a82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692170409, "uuid": "5305d107-69fc-479e-b7d5-82b5fe93a7f5", "comment": "Malware payload (Loki)", "value": "6c3d83fab5c7425fdba8fa25710c014b5567d870115ef8c1345f463c3d4f4dfc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692170409, "uuid": "5f038876-0b70-436a-88a3-7ba57e708e42", "comment": "Malware payload (Loki)", "value": "68778ec3bc7118df4bc73af0c81ca300e947b46b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692170409, "uuid": "3fe9e636-e32a-4df7-a6d9-f93067e6ecbb", "comment": "Malware payload (Loki)", "value": "36e51e806d1b0ca9d1c2d63e7e0d41340fb237ed8229dba024aa26096666812dc682cda80897c8d1f93cb139d2894377", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692170409, "uuid": "cc4dcaf7-e0bb-4207-afcd-467de7bb3dda", "value": "T1AAD4ADC5E98555A0EC19AB706A37CD3582237EFDA874A41D29DE3E273FFB2935026013", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692170409, "uuid": "a51c035e-95f6-4632-b4f3-fc514ae28d6e", "value": "d4b94e8ee3f620a89d114b9da4b31873", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692170409, "uuid": "d422ad44-7034-43a7-9377-f98ab0789ef9", "value": "12288:gBfIP7r9r/+ppppppppppppppppppppppppppppp0YuxRv/j4WW3Z3lw1GN+1Swm:51Muxd/j4W+TIKgwp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692170409, "uuid": "24b47193-da2f-49f1-9d24-41974121ffd8", "value": 628096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692170409, "uuid": "fc45dc9d-5b9f-4a3b-b32d-53da35b6f582", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692170409, "uuid": "3e74cd9a-bc96-4de9-800e-900fa2e16f50", "value": "Bank details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72923dfc-3c01-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692168740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692168740, "uuid": "77e2787e-6f66-430c-a178-27296793e367", "comment": "Malware payload (Formbook)", "value": "84925a0162e8719fb21d9d9c21880787", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692168740, "uuid": "7fdf969b-cb35-4a62-85a4-3b38ed48a2ea", "comment": "Malware payload (Formbook)", "value": "6c68363beba97372d86173fa3074d01e4cddf41a01e1d50a549f4784852acbd3", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692168740, "uuid": "82550b3e-98a0-4abc-b9be-011dfb31e0f4", "comment": "Malware payload (Formbook)", "value": "678b5dda3eead59d9e15a3faaba06f1bfde07521", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692168740, "uuid": "a8100afa-1e83-4b26-be0d-bde274150733", "comment": "Malware payload (Formbook)", "value": "af56922c06802146a60667eb824fd2faf115ae6edc7e3c5d49d2d67590f78dc61bd943f83e0bd60340a083d8d801f954", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692168740, "uuid": "4540943e-56c5-4438-ad4e-391dcc896b47", "value": "T1C83423D0C936DFD578620A0F38D7A4F8C0E7E77E8E4522E642AA7569284046D31EFC67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692168740, "uuid": "085cb089-3462-4432-8f79-c6c9a0822952", "value": "6144:txmbTYd9LgFjhYgpTofGcbcPhdMoM7zesA2PP4OUjt5p7ITNu:tpLgbV9ouhA97zesAqP4/xnITg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692168740, "uuid": "a4567115-0dfe-480d-bf5a-02010db433fb", "value": 231705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692168740, "uuid": "5c0c73d9-46f0-4591-8dae-16a9ac459bbe", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692168740, "uuid": "ef57af9f-d0e8-4765-8e51-1f1c5c6a4fc7", "value": "Inquiry.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e5185f1-3c00-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692168223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692168223, "uuid": "40029980-a8e0-4b6d-83ab-98240fc737f0", "comment": "Malware payload", "value": "5fc2ab5d7ee58d720b51fcac2128e3a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692168223, "uuid": "10e14d23-a182-4fed-aa02-3ba15969971b", "comment": "Malware payload", "value": "6cf383ce1308f42e733499222566c933b72f72867e99a087208f556d321703c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692168223, "uuid": "e78418f7-dab9-464e-905d-69584bee8495", "comment": "Malware payload", "value": "dde96823e72d02e4b4012db0ae8584d89b4b6e2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692168223, "uuid": "f799f2aa-24d8-4f54-9dd9-c899a50d6bc9", "comment": "Malware payload", "value": "85b15208b16ecf2b745f63965493767b38e746ab816df75623df1f0ce757b70d060a056bf66e7ebf4ecf14fc640ae4b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692168223, "uuid": "aac30367-a2ed-4417-8018-76d32eb38e56", "value": "T12EC413169629C7C7C3B4DBBECAC4A23402717A1D3C1D9FCDCDBADA0E6F121744A905A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692168223, "uuid": "6d6cd9c7-7044-4447-a56d-006f6e28439b", "value": "12288:iT3aGrbzZfBNZ5Eha+N7YgoO3Iy3fC3MEm7PHn:gFhBNfAa+NcgoFy3fKRg/n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692168223, "uuid": "e50328b7-01e5-4d53-8c19-44a4e71eaed4", "value": 571392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692168223, "uuid": "df59e097-9928-4468-8a17-0f8a62b345d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692168223, "uuid": "92c719f7-7ffd-421b-9c02-628bc15d7f3b", "value": "ENUGWMKC.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54e867c7-3c62-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692210352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692210352, "uuid": "331ce27a-fbcd-4a9e-9bb8-ee8d4cb2e42d", "comment": "Malware payload", "value": "a3b3bfa816c4234a1f144733205704cc", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692210352, "uuid": "126ad494-468b-4fda-9021-5383e6fc57ae", "comment": "Malware payload", "value": "6d0e6ee8cdbcde5d3ab4d984d008ac5d8d45d482b8c513b64788ab128586a521", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692210352, "uuid": "7451fcce-99bf-4747-b158-b1f76388832a", "comment": "Malware payload", "value": "a230d964d61094be7f60648ffa338641391e2254", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692210352, "uuid": "506e2543-b2f9-4902-a12f-45a659f5f697", "comment": "Malware payload", "value": "1e69d7715baf46a621c925ffe07644eb99419dececde2ac5bbd921af81d208d5f97b38d80d5a6d2d5bee604736ac2dd3", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692210352, "uuid": "53c3a3ad-9863-4dd3-94ea-4cec88b65f5c", "value": "T173B533CD08C42EFDE25D3F74008FDDAE816ABF15DAD1F1A194B58C213ADA1E899D902C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692210352, "uuid": "68506b03-1487-46e4-b4dd-ca96525f591e", "value": "49152:Q8sL3HYZucJ34vR7B4ezGJZBORR7ZH1FkOMb+HFisnwMs:koocWvxBiSlZH1eOmwFiLv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692210352, "uuid": "07054363-e890-4a27-9e31-cb1d3a34f062", "value": 2360787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692210352, "uuid": "11a10f56-de67-4d72-8f6d-120b210fa58c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692210352, "uuid": "c65ab080-f5d8-4687-a47d-e3ee02fa6476", "value": "CHR-GGGDHA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32db0d68-3c41-11ee-a6f9-42010a9c0055", "comment": "Malware payload (PrivateLoader)", "timestamp": 1692196121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692196121, "uuid": "7f7e5521-3804-4296-bd35-37c99c465048", "comment": "Malware payload (PrivateLoader)", "value": "c43ad6bad1ff37ba9e4a2be4425492b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692196121, "uuid": "b69dd7eb-1020-46fb-b757-64f104004c7a", "comment": "Malware payload (PrivateLoader)", "value": "6eb58443e4186740619e7fb0e391a47517ce63ba4db0bd1fb4ce007c543db2be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692196121, "uuid": "edb4452b-77a5-4b52-b38d-c382bc3ba786", "comment": "Malware payload (PrivateLoader)", "value": "1bc489090d255ff124709a83d4c23510cc5f9bce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692196121, "uuid": "5d7a4eed-c6a2-466d-9aab-6948aef41757", "comment": "Malware payload (PrivateLoader)", "value": "8d0f97d957cfc3492fb961347d3f86bdb486457b45a635f8824b569dadf968a120316eaacf60553b01ae9ef74ace05db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692196121, "uuid": "71f9dec4-bcbb-4c6e-8433-b26d06957b9c", "value": "T10326E0FDD6188793C698757389556DB171B04C57F4E00BB6262EBBC8ABB2274EC42C2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692196121, "uuid": "2cdfa7dc-ebae-4e28-a4ad-f8c9f6b9eba9", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692196121, "uuid": "abf43e8f-f5ef-47c0-b1cc-b119dcb5b71e", "value": "98304:u8KdWf1VAGqpudRbc0SVjMyo0Pawc2XrUC5keZrYif9HC:dTqp6bc0ko0Cwc2bd7ZrJHC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692196121, "uuid": "dfae52b0-8515-421a-8ebe-2bdf177d0854", "value": 4670120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692196121, "uuid": "5fbeb12e-3762-4011-b32e-d4b715830ad4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692196121, "uuid": "ee328d55-a812-4795-b07a-8e0d7378e969", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "671d6503-3c35-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692191055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692191055, "uuid": "da853c87-6065-4864-a799-069118aa3ce4", "comment": "Malware payload", "value": "c3b806165bc819983038bbf4a9678195", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692191055, "uuid": "0d574de9-3fc9-4c99-8652-eb1db85de39c", "comment": "Malware payload", "value": "6f0702bd1067a59dc036e671bc71f3ace69ed18c1e765baf515ec71c024fce7f", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692191055, "uuid": "33bfe31f-162c-4a74-8347-d69e79aa4fef", "comment": "Malware payload", "value": "95d8b970434ec336140735a9784742032a4710ec", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692191055, "uuid": "c4830345-b9ee-4714-98a3-4faf27e9d1ff", "comment": "Malware payload", "value": "50a6200e9922611a7ccd81e1ed7f6cb0fe78289081eaf80475299546e9f6da9cd5c3b2895ae6d092f6aa5b68176cba6a", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692191055, "uuid": "c2d3f0f9-0706-4327-b74d-ed0088e69e63", "value": "T1F805330D79E3721CC79A527B0602EB6D2677EA09EF611F234943EAA4495FC94D18E03F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692191055, "uuid": "0fe94939-bd04-492e-93dc-3c77cce8054b", "value": "12288:eML7nvXmv0+eT6eqC8v+pdj+5xcSpCb9jR00+3uNy37GIT/6Pp87Zn9yK/D/DMJa:bmv0bWTlWLaxc5tB+7j2P+l9yK/DLZVR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692191055, "uuid": "d3ed1282-cd43-4aa5-9a36-0892cfff1c16", "value": 843952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692191055, "uuid": "185de465-c057-418f-924e-dbfc9fc12bf9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692191055, "uuid": "67e50032-0a45-4eed-8a85-4281683d662d", "value": "entregar confirmaci\u00f3n de direcci\u00f3n.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2516005-3bfe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692167666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692167666, "uuid": "66da5498-1941-42e4-a9b5-f670cadeaf6b", "comment": "Malware payload (AgentTesla)", "value": "ef9872c017473716478f16036dcc09a8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692167666, "uuid": "27c22f0b-b3fa-42d9-9f3f-d2af31e0a87e", "comment": "Malware payload (AgentTesla)", "value": "6f4954a23f51c48f450992f809848da3a8bb5c1d7c4bc262332fa2507f1a1cc9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692167666, "uuid": "5663ef57-4017-4001-ac89-49de381c67e0", "comment": "Malware payload (AgentTesla)", "value": "51d443812ec2c0185fa7c9eb50643e95a2889f14", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692167666, "uuid": "7cb6701a-e657-492d-9efc-caf52b17bded", "comment": "Malware payload (AgentTesla)", "value": "95ad0049ed9bf8c791f1c5059cc7c56e645775170dfb68a19c01e061bfa0e2ce67507676c01b1bb77987e958f0bbb813", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692167666, "uuid": "0a32813c-9561-4f91-9bfa-c3fcc9584b68", "value": "T1C205DFB522F84E9FE21D88B941206102BF7192B74996E1C5FDCF42FD9F88F911613A87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692167666, "uuid": "74d1a3bf-1921-4c12-871e-d57f66e47cc7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692167666, "uuid": "0ff71afe-c5d2-4bc6-9c89-b1c84d50b23e", "value": "12288:9XmYUJhz9u9GaG1/rVVPqUXvfrHMdQV4PKuyu+ZjF5oqt+yCXAV:IJu9tq/rbPpvjHM2MO9ZjF5oqotXAV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692167666, "uuid": "ac886cfc-ce44-4f3d-8a30-a3003efa0126", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692167666, "uuid": "98582a53-6ab9-4c20-8d73-ed019952c6aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692167666, "uuid": "7a3508be-404b-4057-9c62-09655aef799b", "value": "PO--080523-FM 06.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be3fcdcc-3c4f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692202368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692202368, "uuid": "e42c2c18-f75c-469a-adba-63dd8d22cdfd", "comment": "Malware payload (Mirai)", "value": "8ccd192284a5905646480575f634f8a4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692202368, "uuid": "2260d296-7679-4b07-93d2-0deb8280df2d", "comment": "Malware payload (Mirai)", "value": "6f7f6749edc61c13a2a33b3023c0217759ccc657998c91a775d80c9807c5a42f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692202368, "uuid": "cc291b1c-9665-4cbc-ab3a-9f93c7d3837f", "comment": "Malware payload (Mirai)", "value": "0b0487aef5c3b9cf60c1b25f8af76082f3f155b2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692202368, "uuid": "9ed8f24e-a2cd-478e-af5f-ad784454dad5", "comment": "Malware payload (Mirai)", "value": "070681230db5d373170fd93cfb1fa2c629cd406b29abc83ae13faf50e9f66328bfaa7cedbf9db5341bd669fe4552d0a8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692202368, "uuid": "8ca47833-5cb5-4ac8-9683-701b7b1bb1b4", "value": "T1FA332ADAB902AD7CF98BEABE80160E0AB23123541053073777EBFDD37E321549956E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692202368, "uuid": "dac15767-088e-49d8-a374-b4e2735b43d9", "value": "768:mLGOe2kf9e9X9nbermI7vc59QPQs5gFHviPuzWeHXpi2UJTpDnH638gy:mL/4f8F1ef0YgFvimzpZi2UJJnHY8X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692202368, "uuid": "cf26ec52-a3f4-4ea1-9a55-89ec3cc10b4d", "value": 53056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692202368, "uuid": "9af5bb91-d5b4-4168-8658-67935d08bb39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692202368, "uuid": "066d118a-db4a-480c-af18-96810e33bb79", "value": "8ccd192284a5905646480575f634f8a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cbd0b46-3c4e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692201856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692201856, "uuid": "ce1d105d-bd59-40cb-a47c-7d19e892f1e2", "comment": "Malware payload", "value": "b0d037800bc6c514d83be7781600b8f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692201856, "uuid": "f86c4f5b-381c-4817-8827-0acc1ebece84", "comment": "Malware payload", "value": "6fe53635784227ebf0b5e1cf357cd32055aec5747d095ff3dc3e66e5fcb3d5a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692201856, "uuid": "dc63e9f8-d537-466d-b2da-8cf2ec767af8", "comment": "Malware payload", "value": "29c5b6a0a4e1f4f2d2627fe7f2d9db99deddb5af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692201856, "uuid": "df999318-ca6c-420b-b7fe-5203fde03ec4", "comment": "Malware payload", "value": "6ec1c229456fa709cd6181b53f4acbb627fe6c8afe1a3c4c3505b8285802cffb061ea045d60fc84b4a9704a1b898630d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692201856, "uuid": "2272f32b-a41a-4f90-9ff8-bf4e27cb65e9", "value": "T1CC562947F89181E9C0ADD230C666D2A3BA717C854B3067D33B50FBB92E36BD46A79314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692201856, "uuid": "e5dececc-c0d0-4165-896d-918d6de93bd8", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692201856, "uuid": "28a8ee2c-fc4f-4634-a726-b0b7fd5698f2", "value": "49152:lbFhop8AOErb/T6vO90d7HjmAFd4A64nsfJak/dpo1oscklBWIIYt/JSnSbkeo8W:qn7wqnz8nEZopE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692201856, "uuid": "0d668023-7455-4a03-8580-80bd8d1c7265", "value": 6332416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692201856, "uuid": "5b5d744f-6bd3-4ba7-a6fd-925891c2add8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692201856, "uuid": "54a22e56-2535-4e8c-b046-e537aa79b18c", "value": "server.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8707ee45-3c0e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692174358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174358, "uuid": "22b5eda6-7b20-4349-b567-b7cec2aefb29", "comment": "Malware payload (Mirai)", "value": "acbc9c4118cf9ff9ea3ffc7f1fa344d2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174358, "uuid": "a7fbd24d-a444-493d-bcea-79398e507fe9", "comment": "Malware payload (Mirai)", "value": "71482cab7d33e4c869fbd575a57690ceea7a121c48d5088fc8153345655cbc65", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174358, "uuid": "406d833c-ab1e-47ce-b8fb-44a387d26ca7", "comment": "Malware payload (Mirai)", "value": "35279fd252e8acc6bc723aa2027dfdf040990f11", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174358, "uuid": "6a6da6b5-dc74-4198-acf2-cfc1741901e1", "comment": "Malware payload (Mirai)", "value": "35f7c3286c38c480da3424e052ac71a9dac01692c29fe1b5e01c7aac8eb16ebbe6b02ffcecec331d569c6ac29617379c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692174358, "uuid": "32f8fb50-01dc-47a4-8b06-0884d9d9de5a", "value": "T1D763399AF801DD7EF80FD37B4423080AB570A3D046924B366797BDA7FC361E61866E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692174358, "uuid": "85c20b1d-9f12-4a5d-9516-2fefcaf65190", "value": "1536:941/Dhq2LKc3cuU88LR8h7T6QCUtMFvj7l4jyL1eTBnHm:941LhqQKc3cuUVRRQFtsgi1eTBnHm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692174358, "uuid": "069c467a-b44b-49ba-9b63-30021280899a", "value": 70132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692174358, "uuid": "03245beb-d68b-4026-ae72-08c5e153eaa4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692174358, "uuid": "55fbde79-361d-49d2-933a-1011603831a7", "value": "acbc9c4118cf9ff9ea3ffc7f1fa344d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d441bb8e-3c4f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692202405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692202405, "uuid": "08ea61df-9b6b-4cce-ade8-df0a3a6e1515", "comment": "Malware payload (Mirai)", "value": "437b0b3f03238f67c05278f0669f2c38", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692202405, "uuid": "7507fbea-09c9-4ff2-82b9-72ceaa02eca8", "comment": "Malware payload (Mirai)", "value": "72c45f69fab50785e950016e6c099d90bc2a0c261f1a86defb0b99c94ac03069", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692202405, "uuid": "a8875d20-c542-4d21-a9e1-30abc55410c2", "comment": "Malware payload (Mirai)", "value": "651cac5a2f583b444c55505695e09e7b849268a8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692202405, "uuid": "fafb44f2-36fb-4131-b811-879f3aa3312e", "comment": "Malware payload (Mirai)", "value": "c78a754165fde964e303b5aa84b629bcdfb877a5fd508bbbd47ad6f4a55089187fc3575fb1950036099a0c873445f32e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692202405, "uuid": "fff7e8f6-10fa-4d88-ab1a-499090524b8b", "value": "T139D2F1027641FEE1C5B00231ED628A9B72257DB9D0D134FB863C0DF8A6E9A1D47F8A43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692202405, "uuid": "524d5dc1-7e0e-4404-9856-000907ca1c0f", "value": "768:tusHfRavjynNKnjFcZIhQzhKMXgk9q3UEL7z:9RwynNIOQQ1KMwNLP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692202405, "uuid": "b0eee97a-a163-45e4-8e23-f86b41d4c54a", "value": 29464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692202405, "uuid": "4a0966b0-c74d-4c8a-83a4-567cf3083473", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692202405, "uuid": "ae63afad-5106-4b60-a3f4-eb5efdb6bfe7", "value": "437b0b3f03238f67c05278f0669f2c38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a09a8a86-3c8f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692229806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692229806, "uuid": "6f9d204a-b475-4f46-be53-af74c6d3d48d", "comment": "Malware payload", "value": "3faeb1087cfcdb3a1675aaa4fdc3686b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692229806, "uuid": "1fd69837-176f-48a3-8834-dfb07d8d2022", "comment": "Malware payload", "value": "72f6325970cae69e7b7e6c6fd28f373ce28bad64f794bea68689110f7f2876a4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692229806, "uuid": "7f53de3c-1b52-40f0-9fcd-a0a12d968fa2", "comment": "Malware payload", "value": "b60d0218dd2add25cb284d841973243f6e3ac26d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692229806, "uuid": "6cfa4f5a-35c6-46e7-b8a2-65cc997bff81", "comment": "Malware payload", "value": "b8e38bddefb06fe74d0ab774371f2f2256107d5051821a7d35d4996bc988a0bbccf6384fd7a6f1cc262afeffe0422993", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692229806, "uuid": "06057bcb-e742-4947-a194-0b91572b3637", "value": "T12A33D79578D25A2AC6E4237AF9AE40CE332073E8D1CF3217CD151B147AD592F0DA7B52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692229806, "uuid": "1d341129-6192-4627-b59f-7d5ee6c4f8f1", "value": "1536:S5Z4fJ6tL/yXFeL5zvL5nrHwdA7WhKpQY:S5ZIs5LL5nEdAihWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692229806, "uuid": "9bcae6d7-3544-4854-b9b7-8f86f25c6841", "value": 51168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692229806, "uuid": "691918e3-b7b1-4fbe-a26d-d190d7716187", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692229806, "uuid": "f984cde4-d31a-4eab-8ae8-cb31709c6b00", "value": "jew.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69cf488e-3c18-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692178604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692178604, "uuid": "6ef31890-9b0e-4606-9e87-c0ae4452689a", "comment": "Malware payload (AgentTesla)", "value": "9db0dd34172a4cd315758354b8fd6011", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692178604, "uuid": "acdfbe00-9f73-45a6-9309-bfb6fe4c36cc", "comment": "Malware payload (AgentTesla)", "value": "7354295320e83b03fd2d618e1156d2f33873e4edd22123c2d415eb38ca8f8cb2", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692178604, "uuid": "b339f98d-55b3-4dc8-bcca-6f3dcbaf89b6", "comment": "Malware payload (AgentTesla)", "value": "87c9f96add7da9a9a063ab3c882751072c560ff5", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692178604, "uuid": "ae874e4d-a95c-473f-b533-beef1c5d8301", "comment": "Malware payload (AgentTesla)", "value": "295be1e5e1b904fd7f55d2eaeab054a92814b7b04c3b7f6789d76f1b45ff7f61ccbae8aa61987fac2b7db342fff231cb", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692178604, "uuid": "30f6342e-d21a-4742-9fbb-13d7c09a021d", "value": "T13C2533E058484EA00BD595FF7219F64D400447A828B834B3EA75BBC58D5FB33EAE51EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692178604, "uuid": "eb8d9e7e-99ab-4160-8d2d-66f9a9a932b4", "value": "24576:ojhKFIoZfmdawpxV/cIJ0EVKTasxD+Pw4EoHV7bmTUdm1:ghWHmxwAKxxD+PlHVAUE1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692178604, "uuid": "10dde8ed-37be-4286-aff0-97349c722323", "value": 967824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692178604, "uuid": "705fd5ef-e8fb-4415-887f-7e082edb3a22", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692178604, "uuid": "089f43a8-a540-450c-955c-f28820a38e8a", "value": "Invoice Ningbo.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92e97387-3c64-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692211315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211315, "uuid": "9a9756fb-4b46-4db6-9ba3-ecaa68b295e0", "comment": "Malware payload", "value": "b635750ee31868129ef6e51036370ff5", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211315, "uuid": "6747a023-f743-4ae2-8f9a-452ff6ef8324", "comment": "Malware payload", "value": "7404131edb207b588f8ae7bef2138a259a216c63001c3ee8640ed92c97ba7161", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211315, "uuid": "c57b55cd-5258-4f02-a312-74f2398bf39f", "comment": "Malware payload", "value": "3616b595c392be4c2974719fa5547222814cf63a", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211315, "uuid": "c241a2ae-e976-4534-ac5e-25c6879a58c9", "comment": "Malware payload", "value": "566dc692c99a6c267ab59443b5bf7486757337872ac0fdc529d571ae38d1e2ed3dce528dc0212914fcda07f5a2206a18", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211315, "uuid": "b4a12d09-a180-4e50-aa76-0f7812ff1081", "value": "T119451206A27C6F72E07AE3F90121882447F4766B5252D21CBEED72DA1F21F518A91F37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211315, "uuid": "c8118d74-3d6c-46f4-bf27-e077772c119d", "value": "12288:SyDV/OUipLGVStOQDEfDQ+x9EIdH0XoQ+Fxm013TADO+Iq0SZb:Sy8MV4/6Q+xf0oQCFTeHZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692211315, "uuid": "14db3ade-af62-4a38-a563-ac3f544ec03b", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692211315, "uuid": "f590cbc9-393e-478c-89ba-1a81abfb1405", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211315, "uuid": "c83915ef-48bb-48f7-bf94-0d8a6955a51c", "value": "invoice.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "010728bd-3c0f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692174563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174563, "uuid": "80b55b6c-9840-4afa-982f-70da99f8bd8f", "comment": "Malware payload", "value": "f684327629a64d5766d44a7fd1ed8c0d", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174563, "uuid": "709730f6-0ebc-4c97-858f-574bcd947123", "comment": "Malware payload", "value": "74b62ded9e42fa2082bb7615a4872fbe45c61736c748a3855ab1329ed7b29543", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174563, "uuid": "c2e4592e-2ad5-483c-ba58-c5844b573ad7", "comment": "Malware payload", "value": "ba25903b8e15616f89c0ad109357d7a1e6e249e0", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174563, "uuid": "7fe97c13-e0fc-4918-aaae-a7ed0a853290", "comment": "Malware payload", "value": "19bc82e8f970e9f0527a1c14a323969ddb3aa12fc095987a784bd89ade416bf2d6e02643e1dac3a624926c717f43f306", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692174563, "uuid": "f5b0e0ac-27b7-4294-9606-e3006d917529", "value": "T141D423B5EB837B305E1A56982960D67C70EA01D4D4C8BE4C49EE7DC8D4A73EB89413BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692174563, "uuid": "a595f90d-edaf-41d2-9e3c-c25ff1eb2cdf", "value": "12288:/GNJXDVvIr606Y9fzcMHfmY6wA0cNqqwQ8HC5nihSUwzxAkHFnGtEwHn1TXl:EJzVKrn9foMHfmY6wZcdwi5iXSqkHFno", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692174563, "uuid": "fc03c63b-e2c2-4c5c-8797-cd17cb8060e8", "value": 627670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692174563, "uuid": "3bb01f11-538c-43a7-a1a5-3040b7547936", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692174563, "uuid": "7c63c50c-acb0-40bd-9f12-29b3025f50b4", "value": "AWB 9057382937.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca205fc1-3c31-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692189503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692189503, "uuid": "5fd738a5-b00b-4b9e-9b63-70530ef08860", "comment": "Malware payload", "value": "36bd30a6fb524e19002080fbd6273646", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692189503, "uuid": "baabc477-7f6e-45df-9356-d5c4f80604e5", "comment": "Malware payload", "value": "74e1d8874281b83e12848379cc866367fc74c5958cf69b57ead6039b5f9a3184", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692189503, "uuid": "1c14abd2-352f-4c24-92bf-98a745438d1f", "comment": "Malware payload", "value": "e1c1bab56b3e653666dde549a13b3af84c463091", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692189503, "uuid": "98c272b6-68dc-41fb-b9f0-8ccd88b47a71", "comment": "Malware payload", "value": "dfabfaddb0d088bcad59af7c8099f5a8a0f1b7f993ee6449c1fe477e21b920b83e6786e20d865833ee2b6e4f0b2153b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692189503, "uuid": "ad469cef-0d16-4d28-b326-b13cedc53ee9", "value": "T19CA6339161711DE9E8B3523AC6858A509A72BC2707A0EECF53A0375B0F376E12D7EF11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692189503, "uuid": "bc028487-59a1-45ec-84e9-9544f5537271", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692189503, "uuid": "71dc12ff-645e-4a0b-bbe4-6f912a6f9a93", "value": "196608:HPMXM8K/OY3acuuDfyGKb21X5Sp6GemDMPwuWLEYT2kUw1YPGAfhzA:v+ML/OY3aADfDKCpfaMPfYT2R4Et", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692189503, "uuid": "2c523513-0326-492c-9635-6c89bbf4c3fd", "value": 9863275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692189503, "uuid": "7137f283-684c-4a17-9d18-f97b24688c70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692189503, "uuid": "fa2de1f2-c360-4f8a-a347-17a953277206", "value": "36bd30a6fb524e19002080fbd6273646.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5277946-3c17-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1692178355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692178355, "uuid": "0acbfbd1-a2cb-423d-ba94-f941660ec460", "comment": "Malware payload (Loki)", "value": "589aabd888fbe3154be84c960c28f8cb", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692178355, "uuid": "6bf50996-71f1-4ae4-b480-16bff705abc3", "comment": "Malware payload (Loki)", "value": "7687aa61cd0e7586d2b959c0921642c4aa8a664d31d61d6f62946b7740ac5fe6", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692178355, "uuid": "3138759b-2d92-442d-959a-f263c76f5d1b", "comment": "Malware payload (Loki)", "value": "9c855dc5833679f1ab302c01c924d5949183d2d6", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692178355, "uuid": "eeeae7d5-0b0f-4ef0-8294-d8264c65eb0e", "comment": "Malware payload (Loki)", "value": "f1ca450f18eb7e6fbc668b451b38cbb4e3a1b04c8dde84600aed50acca8616295b49e179a723d2f034ec9dd474c62be7", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692178355, "uuid": "021d69c0-e7b2-4e4f-8b1f-f24db2bdfd7e", "value": "T1E003F1A38D558C258DBF6FF7168195FE16B431F6E286202447BA0DC8CDD0D0EB5A2AA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692178355, "uuid": "40e0708a-9c5d-4ebf-856a-b202eb34bff3", "value": "768:0wT64VFo9wjA1WvvFqyFitPGGNWs1aUcX4tn9/CeL1OIPUc:T24VFiwjY4V0HNWQPqepHPB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692178355, "uuid": "cea6a07a-0f39-4745-96b2-dfe99c3f23e7", "value": 38112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692178355, "uuid": "a05c1e0f-5d0d-44cd-87bf-950837d08b51", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692178355, "uuid": "607226cc-dafa-4fc0-901f-de2181e5fc19", "value": "LPO011948.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd414db3-3c66-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692212245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692212245, "uuid": "049d556f-263b-4b6a-b998-4629b1c2071f", "comment": "Malware payload", "value": "05619ee6a5f0d30794b96ec801562ab5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692212245, "uuid": "6620e251-7e88-4ec0-b347-8f7484cbabd2", "comment": "Malware payload", "value": "7ab60e3889f873886e224de7affaeb97e64de4d90bd16ed3554dcf744a99563d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692212245, "uuid": "03dd5c15-9de0-447e-85b1-da7bda44b15c", "comment": "Malware payload", "value": "bc0768cef0ae464f93d621d0475829547069f69f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692212245, "uuid": "02346e60-dc62-46a0-8322-f8661885ab12", "comment": "Malware payload", "value": "1854684b7f71c73124f400b98f6b4d8d897fa7ee6d034872771032c9b1311149170f57f35f765a4e48785fff59f70744", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692212245, "uuid": "315c7e5b-e8f3-4ea8-8e99-822a01823a21", "value": "T199453304A8D110B1FA2149F315E8A16410DDF86C16E9EB3F252A957A5F9EFCF4F01B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692212245, "uuid": "d981f563-7e98-4cbd-9441-35c2db707e8f", "value": "5e5ac8ab7be27ac2d1c548e5589378b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692212245, "uuid": "f1c8c242-8a6e-491e-b597-5ad4e17e765e", "value": "24576:hMaLjyswUiS94RRMaWBKdkzVnNftXhVzdzPHwL7ed2OwuXjDjWGuPq6:W2G0mIemnN3VzWOnDjWy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692212245, "uuid": "f21ef85f-21af-4f34-a293-21ee72ccbbe6", "value": 1194496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692212245, "uuid": "80c25482-7dfd-4b8b-a29b-7c69520e8a0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692212245, "uuid": "0db1e182-75db-47aa-940d-bb3481db2e9c", "value": "BraveCrashHandler.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0beeba9-3c0c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692173650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692173650, "uuid": "bf00937c-1687-46d5-a45d-938d573ef4d6", "comment": "Malware payload", "value": "6f5d0aa028bf9be9dbefaea6794f14d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692173650, "uuid": "73589d8d-70c9-4848-bc9a-ac95ed7df1de", "comment": "Malware payload", "value": "7c4f33d72ad9b6858e8953f1d727f05cd0fa6b0c250738efed40040047ed3023", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692173650, "uuid": "e76a897f-930e-40ae-99c1-26686470294a", "comment": "Malware payload", "value": "0e111c0d3abd7345caf5c2bbb664c34f85ed3991", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692173650, "uuid": "67a19263-528b-45b8-9c0f-1757988f1f4f", "comment": "Malware payload", "value": "0cb1c55a63b02df1cbee5f6fd555326285a5b83d8b8d899656bf2c340bea9447659cb63cf09ddc503846583896de9c6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692173650, "uuid": "c2b565df-f6c8-48b5-b06e-24b776d6af1f", "value": "T1F864F11031D08433E9B229315970DF75AF7EF9B00F60DDAB938455B94F223E29629A7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692173650, "uuid": "02472427-c463-44a0-87d2-de19698f61cd", "value": "ac38e5925ca0b10384e0ec926685b964", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692173650, "uuid": "60358ab4-ad43-4a5d-afe1-e09fa706cb2a", "value": "6144:TVpeDfqKdgAbY/Auu92wZ+/DKU19CL1spq88f1d/21SzMUIH3sNWg5J1/13f:TVpeDfqK6AbYPu92wZ+/DKU19O1spJC7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692173650, "uuid": "09c07434-8686-4b56-b162-69a4e038991d", "value": 329640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692173650, "uuid": "f2919b99-e483-407d-96d9-61e7867dd632", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692173650, "uuid": "b98dc727-ae30-44dd-81ff-f7688c28f3ee", "value": "svrQAXDocProtect_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ec23d42-3c10-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1692175203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692175203, "uuid": "40fb46e4-271c-455d-b31f-7a7c3fce82fa", "comment": "Malware payload (Loki)", "value": "9724710d89e898347a07abe7dd2d94be", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692175203, "uuid": "96a35384-6755-49a3-b241-bbfc5912cfd4", "comment": "Malware payload (Loki)", "value": "7c58b0791f6bee42adbda7202736881d5554e61e67741e4f8350ba82abe1cd20", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692175203, "uuid": "17e204af-01f2-4cb6-9cf9-d9c410b348c8", "comment": "Malware payload (Loki)", "value": "bc0f687ab8bda8c52bfafa72629a5e0ecd3ddb6b", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692175203, "uuid": "086beb38-a4c2-471d-851e-57b9639e5bb9", "comment": "Malware payload (Loki)", "value": "7bdf5c904b20b43287b1feb12b6bae952e4f2a184bbba3f33e3e41b4a93200a39254380557853b78c01917827b9efef9", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692175203, "uuid": "23211b9e-8b80-4ad0-a51b-0f6aec2cbb68", "value": "T13EF313707F7D2E65E8E79F502CA262A748BCCF5BED4C5720686035B9024C7831267D9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692175203, "uuid": "2731af9b-2a8c-4a6e-9442-5074bcab44d1", "value": "3072:fpOz8IaLAqG1bhdePjGd/aBy2ZVvrQCoCMWWyYnCu/+wHu3i411HFgO3jFPokk:fpU8PLpG1tdIGdJ2bvr5oCDVMtOS411S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692175203, "uuid": "ed990a55-e0d1-45e6-9328-b48eea620ab2", "value": 173024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692175203, "uuid": "68177d25-9ea5-4f68-9f2a-14bd793bd869", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692175203, "uuid": "90f25dfb-4d56-4e9e-a84f-705d33e1477d", "value": "RFQ#Q10865.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a80a26c7-3c39-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Glupteba)", "timestamp": 1692192882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692192882, "uuid": "2d28161b-63f5-448c-887a-1e988fcac363", "comment": "Malware payload (Glupteba)", "value": "49531a3203aa3fa6cc64cd468c908016", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692192882, "uuid": "e16e03c7-0334-4efa-b646-300e87ee4ba4", "comment": "Malware payload (Glupteba)", "value": "7d07d17c2783ceeee097dc94082d7991a7e27755065dc5f73be10321803fe80f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692192882, "uuid": "f9606ca7-a5b8-4db4-92f9-50b290bcdf52", "comment": "Malware payload (Glupteba)", "value": "17b4a2dbab5e7b2908f035f021941a7d3a764f3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692192882, "uuid": "5564e872-c95f-4813-b8a7-090635a2d13e", "comment": "Malware payload (Glupteba)", "value": "0364536ac32975b2eb3e02b8821d9f4cdc63646d59383aff7d55528d0d4b1ace6385063aebc67ce7ff71e3e56e1eb9c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692192882, "uuid": "c6d8315c-63a3-4231-a7f8-cc35484aed31", "value": "T14536CC9D3103186697C3DA2199EE345161FEBDC37A7242E428E911CA6C897D9F3732E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692192882, "uuid": "76930d29-b90a-46b8-8690-c09101804e30", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692192882, "uuid": "105b5bca-d07d-4bd2-88d8-be6797fd0413", "value": "98304:IvniFEnwv1dsFPaMZTf1gNxnZAVKXJO3/ih1DaGPV9D62cruY:IPimw3sTDIjg/wX99DpcruY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692192882, "uuid": "2a248fec-00e8-49a9-bfe8-64170b8bf5fd", "value": 4871680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692192882, "uuid": "e4a2f471-c03a-4d94-8cca-f9ae86bbbd0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692192882, "uuid": "e364669f-91c6-4814-b0d6-461f2cfc3cbb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e2b248e-3be9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692158291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692158291, "uuid": "23b3cccc-c3b1-405a-92f2-05e214a8cb8e", "comment": "Malware payload (Mirai)", "value": "d3d5e636512481ec9e9ecfdac84137ca", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692158291, "uuid": "de412a0a-ee35-44ca-b23d-a53a4f8f3693", "comment": "Malware payload (Mirai)", "value": "7d50181e5c1f8fda18e1bcbd0f993637bf7de503dccd7b1e821915d49bee08a1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692158291, "uuid": "55fcd823-948f-48f5-9e2f-6db3283c571b", "comment": "Malware payload (Mirai)", "value": "99ca6682b04238b0f0619577fd46e3cec0a5ec36", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692158291, "uuid": "22726ae6-8edf-4c86-b9d9-0742279918c9", "comment": "Malware payload (Mirai)", "value": "ffdf2aacc02f50d0fcd6a52b6af88f6c72b8cc41e57f3cd55c0a2622697b0283475672b7415913391d2385b80ffad2e5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692158291, "uuid": "4b72ad7d-faec-42f5-9d4f-9c3c6b3cc976", "value": "T191E33B46A7418B13C0D22779B7DF42553323AB64D7EB73059928BFF43F8269A0E27606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692158291, "uuid": "ff6a53d3-2365-4176-a2eb-059a89e4c788", "value": "3072:nVXu9IKR7tiKJza2UORSMtrV+eUlS961tKeaqhbM/9nZb6/dzIi:nVe9Ie7t5za2UORSO+HSgieaqhM/9d6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692158291, "uuid": "17871e3b-5b5c-475b-a4b2-7e7d1271e2e2", "value": 150729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692158291, "uuid": "0621ce59-4c24-4ff1-adcc-a0a984b53023", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692158291, "uuid": "52977fc3-8cb5-42e0-ba0d-be96429de71e", "value": "arm7.nn-20230816-0358", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "951f95c7-3c35-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Neshta)", "timestamp": 1692191132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692191132, "uuid": "b7fddb80-6478-4c27-8a5e-0a959a9695d5", "comment": "Malware payload (Neshta)", "value": "e907bdefdf9098a9f1b473a3e2e55633", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692191132, "uuid": "2cf4c903-6c08-4ea3-8f3f-e98397ba9edc", "comment": "Malware payload (Neshta)", "value": "7d5f2db3ab23b9d7e49c141add2e501a13c886ad422d1cf46f2c955cb0a3f400", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692191132, "uuid": "e265cbbf-6c3c-4287-b9aa-f73dcbba296e", "comment": "Malware payload (Neshta)", "value": "482311e7da4b4d6549312467aa02da5116acce6b", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692191132, "uuid": "7c8c40e1-2a90-47c5-a042-333a01dca13c", "comment": "Malware payload (Neshta)", "value": "af3c8c969220e486c1ed733640bb27a560f59ed75d576141dc175db128fd81ed70512c2aef78e7f7d88c65b27d4939a1", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692191132, "uuid": "82d863c7-228f-4481-82c4-09226edb6d80", "value": "T137552360676C53B3C5FD9FB994A062048B7294723250E36979CD7AEA1FA23070B09F5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692191132, "uuid": "0dc05529-5eed-4b7e-b130-38b300cce041", "value": "12288:554lrrOdf21dnWRvCsQ2/aSqAo3WMov9c0gHiQbW8KqIZgrhVsAty857q4f8:554lX++D4LiSqdE+HiQyoIULsA95m4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692191132, "uuid": "393e6518-6eef-4463-aa01-d639f36985a8", "value": 1310720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692191132, "uuid": "dc2122e4-b7ab-4b3f-ae52-b925850bd73a", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692191132, "uuid": "fa84b01a-a369-4cbe-9bd1-3b64ac85d224", "value": "Soa.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81227c67-3bed-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692160175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692160175, "uuid": "a4619062-02d2-4e41-8e23-28ad0174264f", "comment": "Malware payload", "value": "328c3fa7e5e41c0ed5bcc5981fa67319", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692160175, "uuid": "b42fc8e4-1644-47ad-ba80-be6930d718b3", "comment": "Malware payload", "value": "7e4a853abe3821908d0bc38bca695db335ed45df3ec872acf00bebc784ef4b7c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692160175, "uuid": "ade55d64-7e88-472e-98b6-1abd35e25dbf", "comment": "Malware payload", "value": "c15943c4247a6be95e2c5f2373879cadd7224b93", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692160175, "uuid": "c33b478e-9349-4387-85a7-5ff7ded2891c", "comment": "Malware payload", "value": "3e25009823adaf4fe5135d2b529e065e72b7e8e703ea311838c2071d6aff9f5acf043c391b0462769e4038aea62c1655", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692160175, "uuid": "df92b38f-1d2a-486d-afb1-7b75745fc519", "value": "T14A2301A4A8994D78DB9F8EB3CE0C9AD137D39EC90942D176D4156FA80D604737F1C6C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692160175, "uuid": "29e36619-b10b-444c-84de-5106a2b98825", "value": "768:RSq176cBgL1Hrb8XwLbjqkWWknWaf2tkc42hbfTo1WUMdrpXvFiXLq6L8gBG4JVE:RXBOL1HrQXvWdaf4kc42hbmWUAyLwgBq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692160175, "uuid": "de70583d-c858-4bba-9440-3db9a372c37d", "value": 48556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692160175, "uuid": "d52e09d9-a2e3-435d-b23f-ebc388532c96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692160175, "uuid": "67252c6d-ed38-424f-8909-dbb4ef89362d", "value": "328c3fa7e5e41c0ed5bcc5981fa67319", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad67c094-3c12-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1692176141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692176141, "uuid": "e2a41ad9-11aa-410a-ac37-75190a9dd4b2", "comment": "Malware payload (Loki)", "value": "02d4ba36feede5c8af5da78e1f76514b", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692176141, "uuid": "aad15602-4292-47ce-88ae-3e7ac548f65a", "comment": "Malware payload (Loki)", "value": "7f20f702860bc2de73aa5f0936d5d96b317113e3318fce8ee02b90c36ee9b737", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692176141, "uuid": "da766467-f381-4bc1-875d-fe4954c1dd24", "comment": "Malware payload (Loki)", "value": "56c894507a686811ab5ab2d6331c170f2aba8e12", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692176141, "uuid": "c5fbab88-9126-441a-bcbc-66fd96c1225e", "comment": "Malware payload (Loki)", "value": "4d4d986ef0933908e4676731ea6d3d5588f6f1f24bcf4b0b11ce54ede30217f4709bd536d720790f07a0cb5c5fbf82b9", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692176141, "uuid": "c6cfe36d-d6b6-4a71-94ff-363facc36d9d", "value": "T1420412706F7D2E65E8E7DF5028A262A748BCCF5BED4C5720686035B9024CB831267D9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692176141, "uuid": "f94c30ee-f07b-44a1-a92f-bc63970138c9", "value": "3072:epOz8IaLAqG1bhdePjGd/aBy2ZVvrQCoCMWWyYnCu/+wHu3i411HFgO3jFPokf:epU8PLpG1tdIGdJ2bvr5oCDVMtOS411t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692176141, "uuid": "1f19bddc-6771-4e37-b3d8-79188c393569", "value": 173086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692176141, "uuid": "c7c2bc09-7eca-4b84-8103-413eeb4ec3b2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692176141, "uuid": "9650baa1-069a-4371-b82f-57306d5fa695", "value": "Original 3 - (for Shipper) - 180-38985892.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33a51801-3c35-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692190969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692190969, "uuid": "35f40c7d-e730-4c1b-9d10-92239aeae532", "comment": "Malware payload", "value": "19dac361e95ddc4e12aa1e3b20c7c23b", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692190969, "uuid": "30bc167b-ff54-4fc9-ac59-8243a38a0a0e", "comment": "Malware payload", "value": "7f57ce9a8b3a0547c2f1e741a6f098d61e9e49c698ec656bee45d36d3a5ed680", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692190969, "uuid": "93b2eb75-2868-4e26-8b57-ed4c891ea97b", "comment": "Malware payload", "value": "8afd489ed6b8f63b599f99aff959cc160cc85da6", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692190969, "uuid": "973d03ff-e400-4be5-b5c0-72972a8ddbee", "comment": "Malware payload", "value": "aac78dbd97bdca811df4a3049ef99b0b0965f98d155819c8abf59ee2ad19c5a4769512d8fc21dabbf6b547a5170cb10f", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692190969, "uuid": "c165cd04-6d87-4a00-81f0-d6cec1f80359", "value": "T103F433000303EA6C6D49B7398E293D9CE1F296DA0CD68550B6B9897AB5DE74F17D10E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692190969, "uuid": "90944fa4-25c7-426f-bf4a-c1852cc38a02", "value": "12288:R+kWcdjZ3+f3PHhF/0qYG+ncKuDp1To+eseDO9CL3CLVM/oz7TipKTv:EQjY3r/0/G+ncJDXJfUO9CbaKoHTlv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692190969, "uuid": "8b71e81a-4b48-432a-96e3-beadb4c4443a", "value": 755266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692190969, "uuid": "11a2877a-c0b7-4506-9c52-5cfd7a766850", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692190969, "uuid": "3654eec8-eeb1-4a35-91df-8fae273cb7ca", "value": "August QUOTATION.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5839d95b-3c02-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692169126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692169126, "uuid": "5408aee1-42f5-41ca-ab9d-d886aa767a86", "comment": "Malware payload", "value": "345f11349812cc9a7bf462227f8e48cd", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692169126, "uuid": "5ffdb0d1-cc1c-491e-8f46-5f72614fe101", "comment": "Malware payload", "value": "7f92a82d04cef4be932867f5be1e5e1739ead1acd8471f419c5820e27f5fa183", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692169126, "uuid": "87bb1bfd-e704-4e59-87b1-0e5b6d754ab9", "comment": "Malware payload", "value": "da854deb3cfced446ea13456430b4d9727c0924a", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692169126, "uuid": "7e46cad5-372f-46c6-a2b8-baac588fda62", "comment": "Malware payload", "value": "b012b4f0e955230b0d1dc0212c0359dfc2711daf060b38d0d341014e52d986c579c585a07d2dceafbea3220e27915fbe", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692169126, "uuid": "7989b7de-5be6-4985-879c-84d35d326013", "value": "T1C7E312769D4F4D8ED03896F983A7B38F4E26B327B5C74846F61E6B00C247F0D02A6556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692169126, "uuid": "0dbe44a8-628c-44ad-888c-1d5e07d9f82f", "value": "3072:R71tq+zzTznq/Lyk64k7q9mE1rynYAtZDjg7O1NH1XtiwZ1zvnS4:1CUDqDT7XF1yzDjl1NHTP1zvn/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692169126, "uuid": "cee5031c-a341-4456-95f4-00bf2f08ac1e", "value": 150702, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692169126, "uuid": "7b61e18f-54f5-45fb-b58a-8560311f576a", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692169126, "uuid": "26c62691-e181-4269-9bbb-58281bc2c7e6", "value": "\u5173\u4e8e\u6838\u5bf92023\u5e74\u4eba\u529b\u8d44\u6e90\u90e8\u5bf9\u7535\u5546\u90e8\u652f\u6491\u60c5\u51b5\u7684\u901a\u77e5.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a7d12ff-3c2b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692186605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692186605, "uuid": "400d68e2-c6cb-4e9d-8832-28a746d73bcf", "comment": "Malware payload (Mirai)", "value": "08045ed5bba2cd788d415e732edb85f6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692186605, "uuid": "03c7f96d-6054-4691-8b8e-dab3b1290a5b", "comment": "Malware payload (Mirai)", "value": "7faa33e8ad9862eda5ce4e673e627b9c907cf6085ef9c1875ddf954e4316335b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692186605, "uuid": "ddd432a0-884b-431e-9420-1f6f621be12e", "comment": "Malware payload (Mirai)", "value": "9382afb33dc254c80d26dc2790e124df4be8d736", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692186605, "uuid": "554c002e-3bee-464f-aab2-7a827f758ebe", "comment": "Malware payload (Mirai)", "value": "9d0431e932ddd6e5ad475a64600b55d29fa3f9cf5e132d06fc8bc3b5f3efa146cd6fc6ab89cda05322de59bec79dae6a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692186605, "uuid": "eb34b81e-710b-45ce-bd02-e05979e90adb", "value": "T15C33F2A26B6E39E291B05777FC33AC1A669C17F89C6B30972CF0651577C48024FF2686", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692186605, "uuid": "566be5bc-8332-47bd-8293-56294933300d", "value": "1536:d9O/ZMAXIxNUk0oSTLcPqF1aBexo4opKZb8:d9O/ZNKyMSTLGqFUFZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692186605, "uuid": "a658f75c-0c7d-4bc4-b793-58334d4a75f2", "value": 52512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692186605, "uuid": "25d50eba-55a3-4674-bc9c-6fb59cd4c912", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692186605, "uuid": "587ace9d-527a-4b4e-bfbf-e6549b6812c4", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26e67388-3c21-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1692182357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692182357, "uuid": "a12d0225-ddc1-4dfb-9728-6e449a256568", "comment": "Malware payload (ConnectWise)", "value": "a313d9dfd6bddf4cf0412d887719c5be", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692182357, "uuid": "100d01a9-da09-444a-ad81-89dfbded3eed", "comment": "Malware payload (ConnectWise)", "value": "7ff6a3fcbed316b6d900789a7dfdd482017eb502bdebd6db59179dc2a5b6d5fe", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692182357, "uuid": "974bf8eb-4062-4687-b368-59f65d9eb48b", "comment": "Malware payload (ConnectWise)", "value": "6121aebbe89637b876a1b5b83cd578db7e94920c", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692182357, "uuid": "52f28bd8-a871-427f-a15e-e7210b66096a", "comment": "Malware payload (ConnectWise)", "value": "b3e7fcbb694740cbbfacf36f12f4bb3cba1d808140a75572eb35a0132524fca4ef728dd5bc6b4771bbe84877a3ff0008", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692182357, "uuid": "3ae9ffed-a061-40f2-b8f9-cd7ae984663e", "value": "T1D5837C43B5D19C71E9721D3124B1C9615A3FBA211E348EBB239802AE4F341D1AE35FBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692182357, "uuid": "0f04a2ef-885a-41c6-9d87-e61fa677ae1c", "value": "1273eaec87da7c0a308253f29e7857eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692182357, "uuid": "5f2e18b1-36af-402d-a5b2-ab099e2cc4c5", "value": "1536:NXn1JYSnExFkcgKKjxfmqshiKW5Xs/iYQqQJtsWFcdfRMvb+xWbaa:tE3x5KBDYiKWm/iSw0fRMvygGa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692182357, "uuid": "50718725-8026-4444-8ca1-2cd626d832aa", "value": 87760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692182357, "uuid": "06c29fd1-9da7-4399-9458-b246e8ba333a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692182357, "uuid": "94e8f2af-517b-4bbf-8cbd-7f641209d3c9", "value": "SecuriteInfo.com.Trojan.Generic.29525.5394", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef0dc84c-3c64-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692211470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211470, "uuid": "a6d7e21d-f40d-4be2-b8a0-6a6fa6ae3900", "comment": "Malware payload (AgentTesla)", "value": "a14ec1dcd8a1d4feb16ecc7d8295e0fe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211470, "uuid": "718ba8ca-5c80-4717-871b-cd217e51e924", "comment": "Malware payload (AgentTesla)", "value": "80ce2400bd043e879047241b94e7e403dc6e95c5b8c5bc47a61b64e7600920dc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211470, "uuid": "8b1ed737-2734-4d8d-a932-ffea1fd59c0b", "comment": "Malware payload (AgentTesla)", "value": "01c0ecbe929463913861199a8b89a62d3cf6c210", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211470, "uuid": "55a1d418-8cda-45c5-8e93-f510a76cc101", "comment": "Malware payload (AgentTesla)", "value": "399177aab2f4b77eab0c2ad3b529a3941e6e0e37d75add1411fb4e5fdbad18001f07dddb09841c7404396ee62d9a0244", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211470, "uuid": "d6d4d316-c2f8-4312-9e31-aa0ab89ad456", "value": "T13855E0077A755172DD00CA34D6F6AA1086E7EE59A7F2C60A388D735D0B323FC8B17986", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211470, "uuid": "2cf9802b-d739-4d21-988f-b35ab53a247c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211470, "uuid": "88fbcb71-330d-42f9-bd01-6a2d3fbbbdd5", "value": "24576:7NEujJdw1Y+aBP9+/pR6qNJPfmB9I05FLWuci3RiTjSI1M8A:mY+aZMplnC9IYLtci3iuoMr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692211470, "uuid": "7138e480-1848-4c9d-b6f1-7e137fcb1bf9", "value": 1301472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692211470, "uuid": "41e37853-33a4-4d69-abcc-d9cd8ff03594", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211470, "uuid": "ac2d454a-3277-436a-9597-65ae823105b6", "value": "PROJECT PROPOSAL\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f032fe57-3c77-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692219632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692219632, "uuid": "b1d9b901-4aae-454c-9f46-24fd4c0ab8bc", "comment": "Malware payload (Mirai)", "value": "a97a57e9b16592394449a97bdd816eaf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692219632, "uuid": "df329772-6faf-447d-aba8-1ed1d57c50bf", "comment": "Malware payload (Mirai)", "value": "82dddcaa017893990455c990668ebbd93ad51167e9f8b6e6d0fef30c2d4f1099", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692219632, "uuid": "4af06544-80f4-446e-813c-1811e5bd501a", "comment": "Malware payload (Mirai)", "value": "dae24ebde4e25a56de251da63f38c2ada2dab888", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692219632, "uuid": "5c44b7a0-d35a-4942-bce9-612b428cb252", "comment": "Malware payload (Mirai)", "value": "90cc0a3358b31f73ceac345ea046ca0fefbcbc80c96bb0dba8ec0aecf938c65fcd2bdd2a8b8d9c3d73374a7ed0e81f37", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692219632, "uuid": "8054f6a4-889d-46b7-9cc7-8a67f0556c21", "value": "T1D8C3E730E8044B1BC2D223F6E75A869E3F351E9797A733155B3879B02FF27991E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692219632, "uuid": "1712c1e2-8aac-439c-8906-036ca7bfa04a", "value": "3072:4jDy/+mh1vtbPIKaWbpcUPium7/L7QsvmGfIiNb:mOJ1vxfaWbywm7/L7QsvmGfIiNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692219632, "uuid": "01bd842f-a670-432f-b8ff-c0bb660ba8cb", "value": 125008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692219632, "uuid": "225c169d-adc4-41eb-8126-d6296782cd3d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692219632, "uuid": "04eba23c-d3b7-4395-bc1e-1d468d1f9a3f", "value": "a97a57e9b16592394449a97bdd816eaf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "096f3d33-3c2b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692186603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692186603, "uuid": "3b38ee1f-62e5-4561-bcde-b1331e4fa26f", "comment": "Malware payload (Mirai)", "value": "0ede21d973c0d071c10c78e6f0c4cf68", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692186603, "uuid": "ea5a21d7-8042-40ac-a620-111f432a3e7f", "comment": "Malware payload (Mirai)", "value": "83672bdd7846c60f2e72572490af6686d861aed0e63a25e987268cfb740ca936", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692186603, "uuid": "67c6e267-8aa1-422b-96b7-bacd0dc0924e", "comment": "Malware payload (Mirai)", "value": "1683df266b26dd5ed5195b0a7722085fe0c1c02b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692186603, "uuid": "43596528-b488-40a0-8fe7-bd83dc886372", "comment": "Malware payload (Mirai)", "value": "fdd6f19c3606659cc594206b7f54bbf789129dc7cfea2ccba7acc81f6183e12d951e5f861471fc00f5fa13c8705a2a65", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692186603, "uuid": "458cea9f-796b-47f3-89bd-a78db799148e", "value": "T18EC2E1BC3EFB2E87CE1A00356858FE3782F0A5A5D3AB7797B24440026D121E57A66DD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692186603, "uuid": "77040a8d-a318-4af8-8d70-0799ef7f9050", "value": "384:Mp1DMwk8JPyGNoDZsEXVZVBy6xIJSlSmknnLZddZ6TJfUVlMWEbo28tEe5mjU0AO:UMw4DZdFbBy6x3K/KdWnH5PvmD0Nu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692186603, "uuid": "fd46fd15-5435-47b1-91f6-4a74ae9ec67b", "value": 28048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692186603, "uuid": "8947d654-1c8d-4689-a8f4-8878868401b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692186603, "uuid": "20665a7f-1c18-4137-9abc-132cfb78caae", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a652f5a3-3c15-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Neshta)", "timestamp": 1692177417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692177417, "uuid": "9c7395eb-816a-4149-beb5-c1df23a788fa", "comment": "Malware payload (Neshta)", "value": "1b6c3efb052cb98aa92865852aba7a57", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692177417, "uuid": "9753d67a-d776-4ca0-ade4-0e539f12e180", "comment": "Malware payload (Neshta)", "value": "83783fa24b36db9cd8f648127e203cb0cdbb35e122e236d89d7f714251060f9a", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692177417, "uuid": "4f7db350-8785-4c57-ae2f-8ed3070b7b62", "comment": "Malware payload (Neshta)", "value": "1a60c0e5db2c3a089e1bf5bc324d2d9bdd1f598c", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692177417, "uuid": "646f4532-72fd-47bd-abd0-a07923ae9542", "comment": "Malware payload (Neshta)", "value": "82f9019f7daa336c0d800e78bd82b38e44e4c4101b477da2778da0a0ade0bb7246eb08ef204f83af59ef8cfdde6d2449", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692177417, "uuid": "1f870fee-8551-4444-9dd2-24d4156420ca", "value": "T134E42366A4EB3BF92D7075D929EDAEE4B437F012311DAF3D3C4612C4A2A72DC251B124", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692177417, "uuid": "8aa7c567-2c70-48cc-b2fb-bd33a3cc55cd", "value": "12288:ha41qD67Z2Do20c2NqcPygKSvAi3WJAEZ0xRQYBbryKmAjy1ouGbPTod6SwtQxA+:ss3q69cS3Wa9/kWhrl1zkV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692177417, "uuid": "bb4cefe0-0a19-4131-923a-732ac86677f9", "value": 664129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692177417, "uuid": "ebb02c14-61d1-428b-b939-d9511d7b47fb", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692177417, "uuid": "c62c261e-3848-4243-ae77-ad9e9381a7dd", "value": "CI.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebe76f24-3c77-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692219625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692219625, "uuid": "eb696f37-6b38-4703-beec-679bbbbb90e7", "comment": "Malware payload (Mirai)", "value": "98e6485d5ad52684e315affa82e7b4a8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692219625, "uuid": "3b445dc5-8a75-4b6d-a0bc-f0454fe06419", "comment": "Malware payload (Mirai)", "value": "83db9935f4559f1bbe0dbc1b533565ea702f6cbcebde7261f92756a9c2e24a0b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692219625, "uuid": "d09cf597-6764-40b1-9a4c-67e6ac257489", "comment": "Malware payload (Mirai)", "value": "304845c7e48bb130ab2869ec8f05a6e7fc3dcbdb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692219625, "uuid": "b16f1462-7b50-48be-874d-62671a0c7bbd", "comment": "Malware payload (Mirai)", "value": "dbed8239778492f6e0c42eb1ca714a1516957bfcdec76d6c394c0fb611a786cf9b51316d2049bc7273439a544e2bc2a5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692219625, "uuid": "26988db4-24fb-4880-8902-6b94c82d0560", "value": "T131E32A30D4504B17C2D213FAA79E825E3F221F9793DB33115B38BAB41FE279A1D69924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692219625, "uuid": "33c3e21e-615f-4b86-aa95-7d0324a8af76", "value": "3072:Cv/WwsLgaq353qHiCOvhOp8qkDQHbeskmhxQwoVSUNu:KPLaq351hOp8qkLskmhxQwoVSUNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692219625, "uuid": "9f7ea6c5-ccee-4117-863b-f1eb3c73c38a", "value": 143019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692219625, "uuid": "3c03710c-2d91-4818-a64a-f5c55ed91403", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692219625, "uuid": "ac48ef12-f685-4097-b82a-81a3a6abb8f2", "value": "98e6485d5ad52684e315affa82e7b4a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5217085-3c54-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692204608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692204608, "uuid": "0ec25bce-c1ee-4ab5-b802-345ba5c0906b", "comment": "Malware payload (Mirai)", "value": "be306e7b7f8555165deae2d7d63fe372", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692204608, "uuid": "5fc7b780-44e1-4aef-93a4-b04cd9988dfe", "comment": "Malware payload (Mirai)", "value": "85d4e651a6b8f0b74ee013de2c5b001eaaff3a3f7913725137571cfb722235e6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692204608, "uuid": "00cad4d1-7814-4f60-8a59-3ac349446dc7", "comment": "Malware payload (Mirai)", "value": "9b5d64b4dbb0fba077fdeb9684591023bd0dd6c5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692204608, "uuid": "d72a8670-473b-42c6-94bb-781ee1ca27e6", "comment": "Malware payload (Mirai)", "value": "bb70c61397f961e46e2786576823afd0ab14481894be7e65f8b0b3150f5aecf8f680a45c51684baebf390fdf89261eca", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692204608, "uuid": "91d93af9-074c-4335-9774-39cdcdb3a0e9", "value": "T17BC2D030A6A92CF5C7500572E7BC57C9BE430F7DEAEF3890110087BB794190969EA8C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692204608, "uuid": "45038921-cb4e-4e0d-b424-7e654839b9e1", "value": "384:ARt/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNEQ4PlhymdGUop5hF:A7soTAZ3alkXLvFh8nNEFls3Uoz3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692204608, "uuid": "4df5671a-583d-4420-83aa-c8e56eb77d79", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692204608, "uuid": "eaa5f4a1-4075-4c4b-9a43-90ccd51e5d38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692204608, "uuid": "ed6ab93a-fd66-4424-a3f8-1ec0d88d4093", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52cc5a1a-3c49-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692199611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692199611, "uuid": "f2693ea5-a6f2-4258-aa4a-ba20ee733bac", "comment": "Malware payload (Formbook)", "value": "cc076ce160b654ecefb5e4de65f35dec", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692199611, "uuid": "2020cfeb-2d5b-476e-bde7-bf5b4b65e30a", "comment": "Malware payload (Formbook)", "value": "864e15f2ceb6cdc5c6aa5a7b34c680c7bec149e0fb19fbc827e42111772048e2", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692199611, "uuid": "9ff71273-bde1-4294-b14e-be6f42d87ac0", "comment": "Malware payload (Formbook)", "value": "fa80ea08851efdb274a065619169c1df286459ea", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692199611, "uuid": "2c455af6-8631-4373-a094-106343cd136f", "comment": "Malware payload (Formbook)", "value": "533bc3f7415a2c8c062baed1283fe318d62e593eff18c01ed55082428f53011759229918bbe513b68ee502d059b3cd98", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692199611, "uuid": "2b1c68ee-9091-4be5-8000-7b16ac5b6acf", "value": "T14544231218CA5C741E6C58B22DAD0B8F7C9FC656CC7438269BE76A8276450ED72ACE70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692199611, "uuid": "b57b5986-20ee-459c-afb1-45b4e9a96cbf", "value": "6144:vbAm2GQBX0G2PBwfBiyfTOfYhVL2hnORiZQa:vbD2GA0ZPcHfPVL2hnya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692199611, "uuid": "7c716cc7-e695-45b0-a205-67d6ba8d76b6", "value": 267478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692199611, "uuid": "a4ad4cd8-bf03-485f-90d5-5c94ea9d835f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692199611, "uuid": "32acd583-0b63-4913-9968-46c2bf7e253c", "value": "Swift TT Copy pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92a05a14-3c4c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692201007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692201007, "uuid": "6a7798e6-f428-46ac-af31-5428c38e3122", "comment": "Malware payload (Mirai)", "value": "35950730e27f8318210f9dbc3b034817", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692201007, "uuid": "7e327348-c8f3-4105-a71c-d45014040508", "comment": "Malware payload (Mirai)", "value": "86ab710dd30516e17a837764423e0e0a4a036457edde776c15c7abafcbf2dbfd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692201007, "uuid": "13c98f76-e1f9-49e1-9f43-0cd9941799d4", "comment": "Malware payload (Mirai)", "value": "8784204d748b45f47bc426939d1216e708918a5e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692201007, "uuid": "5eb0270f-f46a-4e84-9ca4-7fb1c3081891", "comment": "Malware payload (Mirai)", "value": "3a6b52d7cb22722b96105ee82db210f7de3bd403a811ac0d485d5b03262a97e7549d846475041574eacbd6886e2b40e7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692201007, "uuid": "6e79a1c3-a665-4fd5-aefb-79316b66338b", "value": "T13FB2D0B27015F8B3CAE501B759EDDB43BB800AFCD0E8B3295469099DEAD5942AAF0147", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692201007, "uuid": "edaed6c6-9730-4b6f-973e-4dd45b311b51", "value": "768:QX9nxn8o9wnBoWzEQf2EjKb3pCfs3Uoz0:Qtn+o9wjfBAZbz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692201007, "uuid": "448a7ce1-e26d-4e14-9da2-b7c7dd0a1dc6", "value": 25004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692201007, "uuid": "0e8b2500-1168-4fed-ae99-890a11f5b8c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692201007, "uuid": "1868b343-5994-450f-a0d6-a3b991c2e906", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec48ff9d-3c27-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692185266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692185266, "uuid": "4454e40a-d0ef-4a82-9a42-8715bc68d808", "comment": "Malware payload (Mirai)", "value": "61d8fd9e7dd3102987285a27e20541aa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692185266, "uuid": "aef3d438-20af-4038-bde0-8567582a68b3", "comment": "Malware payload (Mirai)", "value": "878ea9b6a7681ab2b33287bf8b92bb3830b2d2331e80c0c086fab4a699bb3384", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692185266, "uuid": "2297d531-f111-455e-8a44-7239c8ac47b6", "comment": "Malware payload (Mirai)", "value": "037cc234558b4361667191f82bc9a221374fd98d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692185266, "uuid": "530e3956-0f11-4a0c-be47-42fe40d73a78", "comment": "Malware payload (Mirai)", "value": "50ff90304623d39a128f2056e6ae4c92106ac3868dc42ce7e9af712b189777e736043d9e38fc9a09df6b78d8058e42e9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692185266, "uuid": "49a68930-e0f4-4fc0-8da5-16ae295f8e48", "value": "T136238EB3D46EAD90D24C42B4F5359AB42B63E104D2972EF65B45C6668043EBCF62E3F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692185266, "uuid": "e7eb469e-4b63-4203-a7cc-779586d88229", "value": "768:7aywtIehq/ScqBUOFMPj176HWeg9Sny0nKCjZ5UonVkTChet:7aywtIOcE3Fk9L90Ko5Dn+TChe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692185266, "uuid": "3dbef1f8-e8b7-4259-a561-3e76338da5ac", "value": 48760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692185266, "uuid": "cb3e7cf5-e626-4c30-b32a-4ef3137bf7a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692185266, "uuid": "7cd8f8e0-ff79-4246-9907-faa9ef387c83", "value": "61d8fd9e7dd3102987285a27e20541aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5380769-3c5a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRat)", "timestamp": 1692207104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692207104, "uuid": "d00c42b2-69f5-405b-84e6-a8de076d1a9e", "comment": "Malware payload (AsyncRat)", "value": "64023657cca817495e94afe5f8887be2", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692207104, "uuid": "298d111c-9458-476e-b02b-4ece63c79a20", "comment": "Malware payload (AsyncRat)", "value": "8817a1e8ad3bacc4b983ea52a54fe54b595a75986978ff60e331f8a134aafbd6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692207104, "uuid": "4d4bfe6a-59fa-4f41-a23c-b818b0305952", "comment": "Malware payload (AsyncRat)", "value": "d55e3d9b41c4cee294cce54964f7e7d7d8788d01", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692207104, "uuid": "84eb3561-e276-442c-901b-f993436a2692", "comment": "Malware payload (AsyncRat)", "value": "0723a12cc1b4568b5da157e783bde622fbbf74234deb3bda119953aadd67fd7fa4a7c37dbe070ebac8fa512bcdd29338", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692207104, "uuid": "6a510452-2412-408f-bc6f-ce9b3c9b5a29", "value": "T15E8633239FC4B866D7351C309C66278463F3D91A6485F2F22DDA41F35A7B3884A934BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692207104, "uuid": "8f30a1b4-92a2-451c-bd15-310a85540888", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692207104, "uuid": "bf268187-d434-4a84-8074-4026e9242fb0", "value": "98304:ax3zJiOlgXb/hT3y9eLAOk2stoG6isn5MsXSlmxetu1SPbgMp30ac5A8O7KaIBtd:akF3mesOJGX6d4EegATDT8cGZkYg2qp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692207104, "uuid": "14f1c12b-098a-49df-919b-f9d15706c72e", "value": 7839232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692207104, "uuid": "bb4f0e32-c7e6-4a9c-a5fc-5bb152d1f8a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692207104, "uuid": "f2d0b475-69f5-4642-bb75-7a4b82a3e3bc", "value": "SecuriteInfo.com.Win32.RATX-gen.15036.22247", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fee9ee3b-3c33-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692190451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692190451, "uuid": "2f098b3c-d275-4e11-925b-10e96548caf2", "comment": "Malware payload", "value": "c95c6a0d0af21a96e16a3a9291b730a2", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692190451, "uuid": "1c4564df-c8b0-43f5-86ab-29cd29abe417", "comment": "Malware payload", "value": "88ad7ebec1471c70d46b0fd6f7a41b5d7f0b89b14ff08768a245067821a210c8", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692190451, "uuid": "799ac660-d48f-416f-adae-c338a0cb5309", "comment": "Malware payload", "value": "cb51afefa8bcf0b64daea5069e649089fe11d8f7", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692190451, "uuid": "dba8e523-041d-4541-b507-d1a4698b19ef", "comment": "Malware payload", "value": "68cd1fb521e329ed7894c8a03d644de6109061be92fb7a63cedd3514e61f4052e1df3ee14e5d5a5e3166ae7555d6d77f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692190451, "uuid": "69a351c1-2b77-4173-b497-66161b8d44ce", "value": "T155F2BF3CC078B829C2B6DE7C955D5AE463064A43E226B76F2DD5F1AC4E40A9F131B2C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692190451, "uuid": "0050a260-3058-49ff-b7e0-8c2025769011", "value": "768:5QbQzcHupPTX4xzv13j9E3m8AsiqUWoqz498s69eQOZumr8NU:5QUzcwz4xzv13j9E3m8AVJGBMl4meU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692190451, "uuid": "1e0840aa-94b4-4b83-bcf9-a1df38dde8e9", "value": 35355, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692190451, "uuid": "605faf86-7d72-4683-aa11-6dc4ddd28feb", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692190451, "uuid": "be2e2d63-bcc4-43e3-8046-4d8caf5d8a3e", "value": "President CEO 2023 Annual Perf%0D%0A Evaluation.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b26ec418-3c65-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692211797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211797, "uuid": "691c29f9-9a82-4c28-8205-aa5f896dee37", "comment": "Malware payload (AgentTesla)", "value": "91f23665110845a73f3e3f9277ed35d2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211797, "uuid": "2570ca87-9059-401e-a7b6-628f32863b09", "comment": "Malware payload (AgentTesla)", "value": "88faee7ce0b31cd39a046b75b5f351d59400cbc826a3f9ebf3cbee6cf44cfa77", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211797, "uuid": "aa33ea6e-a30c-489e-982f-39ed8c3d615c", "comment": "Malware payload (AgentTesla)", "value": "91abb358d7afd4e501070a947b6b6c61394375f2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211797, "uuid": "37f6ea2c-fca0-4c30-bf89-2d0aeaf50160", "comment": "Malware payload (AgentTesla)", "value": "82b93984d8cdb476be44ebfbb366a9f4463e552b265e8548d41f438fe49316e20c1b5f7f1f819d8cb92661d562b9c7e0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211797, "uuid": "9b62f5ef-e792-4c15-b4bc-73414aa67af3", "value": "T1A26302B8C88463598CD786858B88D232C8FC9BB3F15ED2834697A220DDD32A7C17E715", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211797, "uuid": "8e06596a-c34d-41b1-9952-752a5f6a50a8", "value": "1536:7Mr7PLButLyVMRBHpUJXCFo9mF31F9X1utpBVSkjtc/lVJcMX6i2mE49:kLBALFXFoy1BGpB/jtoVJcxmEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692211797, "uuid": "5aed9201-8540-4189-922b-ef9fd49b43a8", "value": 73032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692211797, "uuid": "199b8fbc-297a-4a9d-a5fc-79a409bbba88", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211797, "uuid": "8bbc1da5-cd59-4bf0-8b8b-3fd7b9ed5601", "value": "Neworder.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2193f0e-3c07-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692171505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692171505, "uuid": "c6e69bfb-42a2-4e86-9975-4724568218a7", "comment": "Malware payload (AgentTesla)", "value": "6d7a7a3f32c13bd9521fca71abbb8775", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692171505, "uuid": "e3369706-edb0-4f81-9a9d-1c69d707419a", "comment": "Malware payload (AgentTesla)", "value": "89d158abf58d8a9bff59abad438ef6b7937afe1b966a762e3341f501a906c196", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692171505, "uuid": "00550721-f546-44dd-8953-cbab6be90049", "comment": "Malware payload (AgentTesla)", "value": "8da379c6dc53357477d05579ba8b155617790eb1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692171505, "uuid": "db6488a0-90d4-4259-8d52-2660d28da201", "comment": "Malware payload (AgentTesla)", "value": "00b2a0cf83a5a3878c4a3f45fdfe57a77a177e0c4e84dd91cf39b8498dd3da325d40a9b09589d7db3c5a4bb6145657e2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692171505, "uuid": "881631fc-4c7e-4aea-9d44-a6c2ac4f0c85", "value": "T148251822E77B658AEF25A6F84E2F957179D6DDC0F1B1C488B7E6280384C13104E35BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692171505, "uuid": "19d4c222-dfc9-4b2b-8876-c86878cc0bde", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692171505, "uuid": "028df8bb-e142-4f24-b391-0e98548c5cd7", "value": "24576:MltYRs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUOWOguuOMLFTq7HzSZqDL:IiRs6CE3jLbO9Rs6CE3jLbOGuuOMLF83", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692171505, "uuid": "15a04ed9-2cc0-491a-b504-ed9e41d475c2", "value": 983552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692171505, "uuid": "aa2809d4-c260-47ab-b26f-dbf074a461e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692171505, "uuid": "cf39e1ee-2742-40d2-86ab-1ea221c12252", "value": "PO-02603_FINAL.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "369be2be-3c3d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692194410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692194410, "uuid": "4bbc39c8-40e0-4044-a25f-4add956c8975", "comment": "Malware payload (AgentTesla)", "value": "e694653e17e618e8656fc7c63bc0affd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692194410, "uuid": "77fbffb6-aebb-4b6e-82fa-6ab948e695d7", "comment": "Malware payload (AgentTesla)", "value": "8a1d94792be773399052a49aeafff4d338422b8a60bd71b093e0d0be6a57e567", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692194410, "uuid": "5a6fa3eb-1646-43fb-b553-0c882c05bebb", "comment": "Malware payload (AgentTesla)", "value": "530e3c2aa632696aa51671393a016dadf8c9c5d1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692194410, "uuid": "a470d6f9-1d88-4028-b472-c33be6eff49c", "comment": "Malware payload (AgentTesla)", "value": "b8d40b08c705cd892162eb5f57e718e7a8a1d0f4002496e7e2df40d703c0dcf20c4ea4c670a6ecaa90bc748e7a30cdb0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692194410, "uuid": "a3664835-2c4e-4055-9044-c31b791afabb", "value": "T15CD42363447F035EA73666EA710579D2EA0A0C0F6F2149CC7D86A398EFB29C164971BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692194410, "uuid": "b0e74106-9230-480f-87b4-bfa95dfc281f", "value": "12288:7jJUavpnAYiH0hadKZmTiVZF8YaUaYtIvuNEsWELnm73nRVMPe11lyd4:7jANUhMXeFZaYqZBVMmHK4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692194410, "uuid": "c8c3e20c-44c0-4dea-a386-f7607723b9de", "value": 610439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692194410, "uuid": "f0a4ae2c-9ae2-44d0-a380-df63b201ff55", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692194410, "uuid": "7bf9daab-de4f-4131-968a-c72ae93ece84", "value": "SOA.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff015cca-3c65-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1692211926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211926, "uuid": "140df2ee-2d65-4e25-b8d0-ac51ec2b7587", "comment": "Malware payload (Loki)", "value": "4b261a00bf01727cf3fac85187f54a6c", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "Siemens", "colour": "#EADC3E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211926, "uuid": "2aa07e13-78a7-49f4-9851-32ec9dd7c515", "comment": "Malware payload (Loki)", "value": "8b28600d7cd4363b36e25c47b310e14db2c175a6c49b343f4ff3aec6b4b81ef6", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "Siemens", "colour": "#EADC3E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211926, "uuid": "2903036a-b0b2-467f-8708-7e4e33f75c8c", "comment": "Malware payload (Loki)", "value": "2891a0e75b3691b8e4f8fda886cde13d8d6ed652", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "Siemens", "colour": "#EADC3E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211926, "uuid": "d6d64e79-a6a6-4157-ab79-3db9be8d67f1", "comment": "Malware payload (Loki)", "value": "0f8864c74ea2db4b455e4bce27b51042da04a24c83377ac34b5b409c1743b3b4358344f742fd4c28fe060be6ccb34fc9", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "Siemens", "colour": "#EADC3E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211926, "uuid": "adf6eaeb-7799-46d8-a03e-816754720282", "value": "T1538423C0DB12DEC25CEEB1DA3A069ACD897B391D116D7C359F990F8221E8DECF512606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211926, "uuid": "41385a3f-7c2b-4af1-881f-ccf1510e48e5", "value": "6144:BcMQTjichKRRMPG/OxJrsthFnEmmHBYiQaNxsE2XZ9psoU2O5xlI6Ed:uichYMu/2JSFnEmmHBYijsvZHUP9I6s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692211926, "uuid": "ec7ad3ab-8eb5-47ab-b367-3d36ee372959", "value": 382582, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692211926, "uuid": "e54ab64a-c37c-4815-8655-6756312e4b42", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211926, "uuid": "a5836b3a-9881-459e-9f5c-b517204eb7e4", "value": "Document.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9e9a8db-3c13-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692176564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692176564, "uuid": "0b5f59e6-da3f-4de5-89ac-f0b6b1755c99", "comment": "Malware payload (AgentTesla)", "value": "d37fe27e73ac9955f456e05355d165e7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692176564, "uuid": "be74136d-bafd-4b3b-a1be-c080e69b2fce", "comment": "Malware payload (AgentTesla)", "value": "8c414fd23baa45985fd610990929794b1e99d2ea6054b0ad8b95d2fc2ceeecc7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692176564, "uuid": "dd7f3713-a144-41dc-967b-9ec9b8a651e0", "comment": "Malware payload (AgentTesla)", "value": "e7b4afc8c5702041f3e0836867b04d2972dc926b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692176564, "uuid": "9d62c752-7301-4225-b68b-e641d3a6c781", "comment": "Malware payload (AgentTesla)", "value": "0cbc900e5f438e6a1b2b56d45c62565cebc16d83ac08d703a527d4fdfa212a8e791d01b3fe4c13ae924f1a80b17da32f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692176564, "uuid": "4ef6199e-801b-4b41-8f30-a7ba4d540aab", "value": "T109151825E77B255AEF2AA1F85E2F807239D6DCC0F1B1C588A7E7280385C23514D35BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692176564, "uuid": "df121690-9fbc-463b-b1b9-fc243e942eb6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692176564, "uuid": "1a0ab4c6-ed7a-4afd-b2ce-598eaf20d349", "value": "24576:fkpRs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUOhUFn0iGJUYIN27XoL3EX:fORs6CE3jLbO9Rs6CE3jLbOhM0iGu2oE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692176564, "uuid": "71682b3c-6c03-4735-9823-a6a47a38125c", "value": 957440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692176564, "uuid": "1cfb9942-1b97-41c3-ab6e-b96db8b15889", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692176564, "uuid": "1d5dd061-5965-4242-9c05-97dab3ae4133", "value": "CI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd53e20e-3be7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692157806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692157806, "uuid": "6fff7f89-0b9c-4ecc-af0c-436342ca7922", "comment": "Malware payload", "value": "212c7cf418fdfdb4f993b553719fb8c4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692157806, "uuid": "070bdb7f-ae9d-45e5-bc8d-abcf79b1707d", "comment": "Malware payload", "value": "8d8d236885ec43fcf50d7007b61b96133db7139eb857d6dbc4653e00ac304e84", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692157806, "uuid": "25d5975e-1967-4771-8404-68d129955a3a", "comment": "Malware payload", "value": "370acedb389bc1db5ecd767dff7658b1b4321321", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692157806, "uuid": "6b4df32d-e09b-45c6-aef3-f48e0ded9b88", "comment": "Malware payload", "value": "9bb19080cce9902b579894b2fea0c0533429797b51af48703cb770528ce5e3f5442a838530a05ffe081f488fdefca278", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692157806, "uuid": "86374176-0d2a-49f3-8a45-17211fb6ec8e", "value": "T14733F210F388EE179BE01C3395B65D04467729DAE52E342E1AA8835AFAF00D76FF594C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692157806, "uuid": "b164117f-d355-4040-9699-be3c4661c4db", "value": "768:T8nDrq102JJxUi5vZPMH9qshE5fDmHXIHgUxcMdqMvYhy2SsM+jPfMJV8YDhFA7y:G21XJyi5NoAoExD3HgUGMDgPfu1h62", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692157806, "uuid": "49dbcb66-3a45-49ae-a17f-aa347f6abbb9", "value": 50200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692157806, "uuid": "3a46e419-0e67-424d-b352-430e0e54b4da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692157806, "uuid": "79f232c0-f929-4dc9-8335-a7982e40c189", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "364ae36a-3c17-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1692178088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692178088, "uuid": "face430c-0fba-4447-9c57-fb528ff37719", "comment": "Malware payload (Loki)", "value": "1195cfab5f196a6b1616f1be4c4af958", "object_relation": "md5", "Tag": [ { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692178088, "uuid": "9b369abe-04f7-4d6e-bef8-27c5ae179e16", "comment": "Malware payload (Loki)", "value": "8db033aebd6a0192357eb2133a4a877e6c9401e5e68869224a5b11c39d2b8887", "object_relation": "sha256", "Tag": [ { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692178088, "uuid": "4c14bc2b-76f5-4be8-a67e-585a1af33c43", "comment": "Malware payload (Loki)", "value": "24473b6cae7aff0e2eab4ee2cb1d046814572afa", "object_relation": "sha1", "Tag": [ { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692178088, "uuid": "faf2e107-d952-4e4a-947a-2538fc3565ee", "comment": "Malware payload (Loki)", "value": "3ee29bd60da3396ec96cd051dc23e16f37beaf5af1833034b70ffbc3737802402e892cd332364d51cb28994af7261f07", "object_relation": "sha3-384", "Tag": [ { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692178088, "uuid": "e9bad4c6-a451-41e9-8a17-05939ab8634f", "value": "T10C03F1638D558C258DBF6FF7168095FE02B431F2E2C6202447BA0DC8CDD0D0EB5A2AA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692178088, "uuid": "50fb68f6-d753-4d1d-84fc-01081cebe364", "value": "768:0S3T64VFo9wjA1WvvFqyFitPGGNWs1aUcX4tn9/CeL1OIPUKN:F24VFiwjY4V0HNWQPqepHP3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692178088, "uuid": "73069db2-fcd9-43af-9611-2b4663c648c1", "value": 38114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692178088, "uuid": "c0539ee2-02c5-4f34-a755-e4f1045dbc4f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692178088, "uuid": "d2ba5f51-6b7e-4090-b158-cd85cd4307b6", "value": "RFQ_Q10865.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8749c6e0-3bed-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692160185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692160185, "uuid": "da7fb569-3130-4304-b718-ed3606c4919c", "comment": "Malware payload", "value": "b41abbf2583c82965153cf2e4a165002", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692160185, "uuid": "73ff7db6-557a-4487-9ebd-5ad1012da88b", "comment": "Malware payload", "value": "8e7621fae5abcb742197a76737d36b1b3ed978c3003168521d50607a5bb37c03", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692160185, "uuid": "1206fc88-06c4-47eb-bc4e-0b0ef0b1725c", "comment": "Malware payload", "value": "1814b58f498169fb9b3fcbc2faf4e2b6a3ae22e2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692160185, "uuid": "635186cc-1b5e-4653-ad67-e6d29b865242", "comment": "Malware payload", "value": "045f6a184a50527db43c601784471a6b3da72ecf9440dc76f6aa0e84ead88d7f4cb73e1a1967f3a752c350de71661d50", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692160185, "uuid": "77e5049b-eb93-42a3-aa5e-84160eda2527", "value": "T1264302C3D486F7B9A2F2A838F16A0002792E2A74F2EC356D131CCAD5DE59445FB9B611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692160185, "uuid": "e81088b0-2e82-40a4-9c40-fb85b73615f2", "value": "768:5ut6h8SbFzNBRym3H6wDjA5+8/MLn50mBYa36qZKgCYxP8PK2h2AMFQu576aq3US:5uTSb1TRl3H6wPamBYC6q9P0XHu5PO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692160185, "uuid": "9c09c530-a197-4063-ae5e-284b0e070d2e", "value": 55644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692160185, "uuid": "21fcafd4-e852-44c3-8354-8adc83aa65d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692160185, "uuid": "b095a64d-9841-4ef1-b5fb-ab1852a58a3f", "value": "b41abbf2583c82965153cf2e4a165002", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb8eb79d-3be7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1692157803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692157803, "uuid": "56d2ad9f-3ea5-4dbb-b25b-084fbc43d3aa", "comment": "Malware payload (Gafgyt)", "value": "22944de529fd9e355fd3c21d53b2b1b4", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692157803, "uuid": "0ee63fcf-2fc3-4248-89e1-a54f0e1c565a", "comment": "Malware payload (Gafgyt)", "value": "8e9e4a12198fb030513c6fe39a97c8fd1a9379704aa64b7bafc2a27c39e1beb6", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692157803, "uuid": "a271cac9-8caa-4e80-88c9-3ad4e4cf8c48", "comment": "Malware payload (Gafgyt)", "value": "8c18e7282b4aaa915e028dc726f069964c2f24ac", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692157803, "uuid": "3251da95-5bc5-4c5f-864a-3b7919e2cbc1", "comment": "Malware payload (Gafgyt)", "value": "dc5ec245ee465c3b7dd7d0ec5afba8fa0b8dbe21b1bd75a5dc1e6f29ae46ae58414c75d075e4c8787b58b978443d8f8e", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692157803, "uuid": "e65e32b5-e1b7-4fee-81d7-4305632f1f26", "value": "T1BF230291F2B2C3E5E0CA823B1EC839161F20625F214CBB7A1ACDB1578ED6B6C12C435D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692157803, "uuid": "f79c3dac-85d3-45d7-a962-b4362b2b51c9", "value": "768:Yyi5uDGqnYVsxpkO0FVbLLyk/0qptmPSKTsS/k9c1NJXfrGXmMvdnbcuyD7UWyqL:bi/q6sXaVGzImpYvuzXTpidnouy8NqL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692157803, "uuid": "9c59438e-e736-4d2c-8211-fe9049bd4955", "value": 46376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692157803, "uuid": "c271e77a-c2d4-4427-b34f-06822d3ee40a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692157803, "uuid": "b355b0a7-1578-41e2-afb7-f39a298d116f", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2a5c670-3bff-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692168070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692168070, "uuid": "0d2b48bd-6e2b-4882-a330-2b7d207d169a", "comment": "Malware payload", "value": "37aa56bfa94b385226709a1ae1e6fdd2", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692168070, "uuid": "819265af-1fb3-4ee2-85d1-2f310d65f777", "comment": "Malware payload", "value": "9007c4d4f1aa375270514ece55d4b0a316e77114ed74d7aa0e6997fe0a5da623", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692168070, "uuid": "414000cb-709e-4093-bb21-4bcff13eeca4", "comment": "Malware payload", "value": "56ba836b2db03506ad77b069b3123882b166414b", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692168070, "uuid": "898957af-a04a-4993-b3d6-a5d44aa53d8f", "comment": "Malware payload", "value": "504ffd3134889e6dee65e45a7689266cce73a23a48e5c5e7679391bad3da39742262276dca7cc9a8665fef0061beeb69", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692168070, "uuid": "69700d12-3261-4f32-9a59-5605d4092d5b", "value": "T1D865F103D9049BC3D41D83F8BE530EE51F0A6F19E9966DDB01662F9B3B70A72099E12D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692168070, "uuid": "6ea5cfce-e635-4c04-9256-98d7f8b55c54", "value": "24576:krOZy2w6VmjKaWlEzp7alZyDw6VejKaWlEzp7aRzdl3ZEFQA3QptwTx5LBA:krY26VmjKjOzY/6VejKjOzKd0F/3c4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692168070, "uuid": "ce33eb4d-017e-4fa5-bbe6-af1a9116a939", "value": 1448960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692168070, "uuid": "ca2d2977-abc8-4e17-aa39-d76ee9316b50", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692168070, "uuid": "1f80ae3d-8419-4749-b435-0cf404a9d9a8", "value": "Request for Offer.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "574f99fe-3c49-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692199619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692199619, "uuid": "bf8703cf-c446-44b5-b9f7-6d0d0c43c161", "comment": "Malware payload (Formbook)", "value": "becff9b703669062005159bd35dc315d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692199619, "uuid": "b6279e15-0a38-424e-9f50-6875a7eae75d", "comment": "Malware payload (Formbook)", "value": "91407535cc5852ecae7889b9f034920694c733c9e47f89d08a470e32b9d31e13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692199619, "uuid": "e599e167-3878-4df2-823f-c67ddee11bfa", "comment": "Malware payload (Formbook)", "value": "042b87bb8d7f28e363a6f3de67d37b0cd4fdd1b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692199619, "uuid": "a207b812-d4fc-4dee-bc9e-816de88f3d2f", "comment": "Malware payload (Formbook)", "value": "4e0d0d642608b53c1f10110ca4c01bb37f6a6d5bd1e5f7b777fa25f71efc313abb969b1b94376068ac1ac2a12558b1cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692199619, "uuid": "b55b4bc0-e87d-483f-a66e-f3a3ec69c7d3", "value": "T13954120179D4C4B7EDA519721E3A13ABBEE7C6224878391B27A16F493E260D1F60CF71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692199619, "uuid": "300520b6-bb42-4d3a-a53b-59119227a23d", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692199619, "uuid": "c08c9032-c6d6-4487-a779-8f693b709a9a", "value": "6144:PYa6x92BX0wKPBAfBiyrTOfYJVL2hTRiZQd:PYj9S0RPYHrbVL2h/d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692199619, "uuid": "1e0b445f-6e92-4e5d-90f8-c7a5457ce596", "value": 281500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692199619, "uuid": "3bf7f6e0-d0fb-4c5f-940a-085940b207c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692199619, "uuid": "d9aae87b-b748-4954-9bac-f99af8aac162", "value": "Swift TT Copy pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca2adc1a-3c10-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692175330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692175330, "uuid": "069e60d0-813d-446c-8019-9e6075e8e765", "comment": "Malware payload (AgentTesla)", "value": "36149d84234e7ebce2d4ba490c3ce732", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692175330, "uuid": "67f82595-8846-4345-9e0b-ca4662948092", "comment": "Malware payload (AgentTesla)", "value": "9185a3c9f8a6045d4ed6ff68b890af52b015ee1530b1d3d1e7f52814a358ef3a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692175330, "uuid": "163e7004-d5f1-4400-9e19-47d13b22c230", "comment": "Malware payload (AgentTesla)", "value": "df8bba2e2ba114a792b908b41f05e15cce01583a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692175330, "uuid": "82fe29e4-77a2-4911-8535-8e9a05df123e", "comment": "Malware payload (AgentTesla)", "value": "e1d5dc8eb0907b67d5438d439be6d7df54de1d7c054b2c4d33c4ea4721f9615997414752158b1c93da1d85979a045659", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692175330, "uuid": "c5fa4eb5-eb8f-4c48-9789-d1adf31bc54c", "value": "T154C4236AAE4362461A3911B345D5B6BFB1AC4081D8CAF85833F0DCE0947DDAE7E704BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692175330, "uuid": "322a8805-6363-45ec-a21e-7a0217dd6790", "value": "12288:hAmDdw1sZNN1uqYwEd2qRqwNS+cOrxUbtAXXXWvTP5xjRIP:imRfNse0NS+cOlkKuV+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692175330, "uuid": "34b6a99b-c0d2-40f6-a30e-f47eaf8a4403", "value": 557687, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692175330, "uuid": "8f36fe2a-1770-4920-92e2-9dc68c1ab6a8", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692175330, "uuid": "b4fe2e7e-cf1b-43dd-a18d-e0fe25e464bf", "value": "40023540MES_S Quote.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d3c0eea-3c1f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692181697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692181697, "uuid": "80d9dcd0-63ce-4e5c-8e38-d6622ba4a687", "comment": "Malware payload (RedLineStealer)", "value": "3c3dd71a24f072c9f7a68be543721cda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692181697, "uuid": "62412334-ce3d-4298-815e-912c1635874e", "comment": "Malware payload (RedLineStealer)", "value": "925ee0ffd82be3ae76ee70c8c3396d646904402adeaca72a75545f35896d2fb1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692181697, "uuid": "e6101c76-ad06-48b8-98b6-61069401b27d", "comment": "Malware payload (RedLineStealer)", "value": "dd7804405e91a95a900aa6af69fd228a0b9f960f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692181697, "uuid": "89b9b772-3fd8-43a4-bccb-e1363d42a152", "comment": "Malware payload (RedLineStealer)", "value": "2be40ccf5fe3f437bbcace47f5e677088e59b32d671a1b1d67b1ecb41d71e79ca8654814e0c2dd15ef3e49badbecce3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692181697, "uuid": "ea283e02-938f-4936-80ac-542cd543531f", "value": "T139840212B682C072DB8B04359420EAA56F7F7C349275894773A81FAF6EB02F16767316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692181697, "uuid": "74bf33ca-e86c-48ae-8b6e-041d1117bc85", "value": "49508a3995d8fbf9414c0227b05b6f29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692181697, "uuid": "de98836b-6d54-4a92-afba-48cb184fe4de", "value": "6144:11QiLa6egZs2HWy3Ks7qmy7jU61d3cR1VCnxDrDB+JmbnIvmKJGpILCPXFfQXsCC:11pm6egZnHWVWpy7jU67+VCntWlL8SC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692181697, "uuid": "0e17dd07-e9d5-486d-b961-4ba3574cfafd", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692181697, "uuid": "a1b934ff-379a-458f-bb1b-5e4d455006c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692181697, "uuid": "2ba1b481-b18e-4341-90d8-027edf1cfb7d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecdbfa9d-3c63-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692211036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211036, "uuid": "1415db3a-af52-47a4-821e-fe684e682f0c", "comment": "Malware payload (Mirai)", "value": "5e1bc63141674ec29424d0c0270b217f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211036, "uuid": "94bc4672-0034-42c8-8861-f2f57357ff2b", "comment": "Malware payload (Mirai)", "value": "9312effaf0dbc02bead9583560a60530f9c4511182bc4da95568156c410e9bf9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211036, "uuid": "0a4b71d7-933e-4b14-bd40-503d467e22a3", "comment": "Malware payload (Mirai)", "value": "9d029f461fc9a59926786c07b3d71fc8e3ccbb5d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211036, "uuid": "26de1787-1d5a-4e2d-99cd-a5dbe705cd16", "comment": "Malware payload (Mirai)", "value": "9db88b751349378b137397222d09bb78a779d1641aa03518e58bf6b6c5baced713a33e46063779b068f8f119465b44db", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211036, "uuid": "c010e205-9c05-4528-9516-9dd04a0153f0", "value": "T19BC2E02368AE5AB0C3B5E8B9E694CB87429B4771F594743033144F5CE9E38436A395B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211036, "uuid": "f9544b60-c0cd-40fd-aba0-4b1809209fda", "value": "384:5XNSIfjdxuZ1DUofVOyPqM8SVp0I6Kvkmes8HbuCHsxmIowEkWGeWchymdGUop5x:LjKX98SVCI6E8s87uCSmRIFcs3Uozx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692211036, "uuid": "7de15280-6fab-41fc-ba7e-ea0865883e40", "value": 27336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692211036, "uuid": "1ca63708-405b-4f47-ad0c-4cacae2e99e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211036, "uuid": "c7579c55-8262-4b20-8b24-d6505447217b", "value": "5e1bc63141674ec29424d0c0270b217f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3cc271d-3c03-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692169736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692169736, "uuid": "360bc9d1-10dd-4d00-8ceb-5afa3d61a58a", "comment": "Malware payload (AgentTesla)", "value": "c7c60aa159e7f977818395b5bc252248", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692169736, "uuid": "eaed596c-0bb9-4517-8c2f-e18cc7af7f71", "comment": "Malware payload (AgentTesla)", "value": "938414723da0fea48ee1407cfd12c674dd3a397659e6ffb84fcaccb5e46d74c4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692169736, "uuid": "e8ffd05c-f4a9-48f8-8f23-7f5291ab51bc", "comment": "Malware payload (AgentTesla)", "value": "de780a5d88c0a7e571f6e48eb92673c2b20aa406", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692169736, "uuid": "0f2c52ad-8b6d-458d-9673-018e094c830f", "comment": "Malware payload (AgentTesla)", "value": "e30f18b9888da6cfb5cd6bd4ae4a9390f1fd5980aa8da540abe9a6ae03895d6e12580c41789528fabd72d64a66c04dde", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692169736, "uuid": "baad6e8b-3f52-4333-a55b-0052b407d2df", "value": "T1B6C423B9AC4AE5DA00832E43318409176CBB139190AC1B51E3A96E9D0E9F0FD9DFC57F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692169736, "uuid": "1692d936-e1fd-4257-8d7f-8bbddd5a1289", "value": "12288:HzHuNswEOOOgaBleyjv+4Apqy3fiZfrgDbM:TOahOgSQsSfEcDbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692169736, "uuid": "3a68d43f-8fa3-4b25-a938-359e119df9ff", "value": 549292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692169736, "uuid": "1ed8393a-91a8-467f-afa1-f66735dce591", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692169736, "uuid": "37bac948-85fd-4063-b9cb-91d2f2abbab8", "value": "ACCOUNTING STATEMENT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fffb44c-3c35-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692191043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692191043, "uuid": "169fb8e8-f23c-4ba2-a8bc-5956f745822f", "comment": "Malware payload (AgentTesla)", "value": "c8b9a6be650261fb8db798710f1f99cf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692191043, "uuid": "31cf36e7-b0a8-47dc-adcf-252a6fa99e49", "comment": "Malware payload (AgentTesla)", "value": "94ad3eef0d43e0106874b7c7b848789a628bd62a3c4eb2d7afc97212ec8fa4ec", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692191043, "uuid": "f5aa340d-ca17-408c-b59e-e19d51d1d5b1", "comment": "Malware payload (AgentTesla)", "value": "cb72fd8c1ebaa0fefe8f9d17cf5231d0e90def90", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692191043, "uuid": "96e9244b-8641-42e1-9409-01dbfd69b751", "comment": "Malware payload (AgentTesla)", "value": "b0b5414314cf687fd833578ac892531e7ee2865dc2255cb91bcbefdc45fed2b353d07ee477e009ee5052fb0e140876cb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692191043, "uuid": "38be8b42-a97e-4910-ba51-39453c0e3e26", "value": "T1F5E4334E50D7897F9661A8318E8C14379FD255F72181211B4AC39B2B82D7EB30DCF6E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692191043, "uuid": "c8894718-a74b-4bc3-8be8-8dde607e8a96", "value": "12288:qSWQTuv5XGzaN9k1gSXdg46bsJI5GJXmHoO5Bw3H0+AET6YiGrWh+mC6DYy1f:qOT0FGzWkyvmJ2rw3H2EmY1W1C68Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692191043, "uuid": "da070904-932e-4288-ab5a-38d9732dd832", "value": 719331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692191043, "uuid": "f0c8c21d-a845-4c2f-9221-fa4bb89376d1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692191043, "uuid": "f5a311b8-832f-44de-80a3-5c1bbe6ce6fb", "value": "=?utf-8?Q?cotizaci=C3=B3n=23especificaciones=2Exlam?=", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3f22a8a-3c11-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692175803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692175803, "uuid": "887d25a8-df07-4178-a110-becc9d35afd5", "comment": "Malware payload (Mirai)", "value": "ba6afd10955ceeb02cd154f30c661e20", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692175803, "uuid": "13f30d59-682f-4f06-9e8b-c19c478b7e7d", "comment": "Malware payload (Mirai)", "value": "960b88bbed9941ae22b68d873c1c474fc58c71dec78daf29ff40ce87a3b17181", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692175803, "uuid": "d7c6c5a1-a456-47a3-9c46-9c1bb5548d3e", "comment": "Malware payload (Mirai)", "value": "948c1c1d3baeaea4f0fad3d7d8e9223f272bb92a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692175803, "uuid": "fa15f167-c932-41ac-8b98-98cff3487549", "comment": "Malware payload (Mirai)", "value": "33905cbb339f2e7491dd78743ef4fb94712d6ec0961a9d5e0271424baf859cd23c8f72d8fb073d7185942bb451e9b2af", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692175803, "uuid": "74d89e55-5656-49c5-b1e3-824a416917c6", "value": "T177E2D08BC5A9FA70D437DF72893219C9F4317C9384A087EE05A5B07CC9EB1523E95916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692175803, "uuid": "439069c3-a1e4-4d08-b8e9-a1ccac1c8f7a", "value": "768:loitCah+so0k8uaRcLMPyWGdxuhNhX55ycNg57jwjwb5IN6tis5DRv9sPCR:loitCacso0zM4yTxijycN+biN9Q1FuCR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692175803, "uuid": "9622a56e-e3f2-4f42-ac5f-3a5ff7f42564", "value": 31524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692175803, "uuid": "2d56c1b8-174d-4501-88d5-b21f20d93ed5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692175803, "uuid": "6cdb2630-43ba-46c1-94aa-f3832b63b1b4", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05d78873-3bff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692167699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692167699, "uuid": "7d030be7-61f1-43c0-b054-dad688c9967b", "comment": "Malware payload (AgentTesla)", "value": "7a43bb0fb05e75723d918b824303af2c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692167699, "uuid": "9f4c3c87-a270-403e-84d2-215547935789", "comment": "Malware payload (AgentTesla)", "value": "96df12776607bce40d6ca1c8b9e79ac9b8bc8057ddf91014599e5452896ef4e0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692167699, "uuid": "b2a44ea1-a68f-4b36-994b-011fc0d58093", "comment": "Malware payload (AgentTesla)", "value": "ff4ba50098ee816876e75f62db0f8687cee91a61", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692167699, "uuid": "daef73f5-407a-4ae1-aa72-263e5d14c6a4", "comment": "Malware payload (AgentTesla)", "value": "c2eee924975460e7de6f4be7d2adb460dfafff8750a18285be6e4a3eb7cab4d2611fa4da64464b3e2538760063f3028e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692167699, "uuid": "b49b2b41-51b8-4af8-bd4a-30aaf8b4e237", "value": "T12605D06636F846ABE03F40B656247003AF7395B75566E6C5BCCE22E69F82F801603F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692167699, "uuid": "780f4912-5a54-4f07-a87a-52add87658ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692167699, "uuid": "107a2d18-1548-4e36-b34f-8c89c777e174", "value": "12288:QZnDxtz9SZTVFlAlSCogYMt+2oMHdvZZeUd3RMtVuQ8HPJjQL1Fupggr8:Q/tJSZTVbP2k2RHtZQUET8qRFuKn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692167699, "uuid": "dd7ea932-0789-48f6-8618-9ea2ca7320ef", "value": 811008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692167699, "uuid": "e5c048ce-3d78-4a20-ad6c-3cb6888ec1fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692167699, "uuid": "3d162670-34fd-43e5-af86-f4f270bb1937", "value": "PO - 140_HEXANE_29KL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fcbc4c8-3c8f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692229805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692229805, "uuid": "542326b3-45dc-430c-a3ec-2cec8587f9da", "comment": "Malware payload (Mirai)", "value": "e4a697961c986973089e62506ef67f0c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692229805, "uuid": "ad654032-24b4-440e-b6ff-072264800750", "comment": "Malware payload (Mirai)", "value": "975cce24c2cef7cdc281102d548101ca52389f7c5d6b66c97d803a373bd9ae13", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692229805, "uuid": "d24ff3d1-3345-4f5c-98e0-a8f47da9dc7b", "comment": "Malware payload (Mirai)", "value": "1252af1e1e334ac806ea2ddcfd65110fa4332acc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692229805, "uuid": "04f29511-47bb-4808-ab24-0b80d71e28c3", "comment": "Malware payload (Mirai)", "value": "9ce4bfc545e21b8975318e2f4f3a90429ead4a348ac6fbaf3e78bc7cdf38108de99c4674d3dc5fa2f13bfdf1c0e9adc1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692229805, "uuid": "5bf09670-d415-410e-ad0c-a1aa5a4fe526", "value": "T195334AC5AB93DCF8ED1506713177EB328B77F03A612ADAD7C3899523A842B01E50729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692229805, "uuid": "cafcf4c6-e284-48d1-bd69-69e0bd763bcc", "value": "1536:3hSgebzgP/AY+39afOsMJRdnhNU6OQ6xpwhNbr/L:xZebkP/Ad39UMJRlhN1L6bIbDL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692229805, "uuid": "20f3755e-7b20-45b9-b368-bd498971679a", "value": 50608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692229805, "uuid": "f4efcaa0-161e-4f76-9c1f-0f3f4da2cf47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692229805, "uuid": "af3a73c3-39ec-4321-98fd-2624ff43f159", "value": "jew.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0b2eea3-3c21-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692182642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692182642, "uuid": "0f311159-3a6c-44e6-8c1f-e241d89c9e26", "comment": "Malware payload (RedLineStealer)", "value": "f10de712a3beaf2f25104268c16fda9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692182642, "uuid": "5e3ca94d-587b-4437-b371-07903c08716c", "comment": "Malware payload (RedLineStealer)", "value": "976b89bddadc27d5fad7fb789ecedcd96865267c9202616bc94b434d4bfe5039", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692182642, "uuid": "df2f5fdf-7e91-428b-92b2-a5888ead5001", "comment": "Malware payload (RedLineStealer)", "value": "7ab495d3a42947c896c119d0e764713b71b1f927", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692182642, "uuid": "a5709cfe-d1f6-4175-90cc-b63c3456a255", "comment": "Malware payload (RedLineStealer)", "value": "146861c641546ecfebbe474ae2b9eae65eb2ad41740d9735764f6b8485a629b11558be25b4bc68947b9013250ffb385d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692182642, "uuid": "fe4bbd9b-003f-4e07-a7e0-edbf8c93e26e", "value": "T1163408E039F985D0F4F7A2734B10F04C5AA9192E4A1B3129616736573B736D9FE0AE32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692182642, "uuid": "5820a5d5-f21c-4347-8ce1-ec5faf2efecf", "value": "7aa10e77f9dfc4304021ef0bbf288b2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692182642, "uuid": "4c2672bd-baea-4667-a26c-206d98763051", "value": "3072:LDuN9/rlccXDSNH1I5qMXcVDdyYsvwcgtVX8qXGVhyNO9PXtt:uNRtyRMXcVDdy3vwxTw3v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692182642, "uuid": "d6dcda72-a0d6-485a-8a0c-166846d52b25", "value": 237056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692182642, "uuid": "c608abcc-fe44-4c24-82de-23c36d1a03b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692182642, "uuid": "b9af232b-3604-4906-95b5-54a787192a56", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc8db19d-3c77-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692219653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692219653, "uuid": "c1241c4c-45f2-4446-8b43-622d54ff7c6c", "comment": "Malware payload (Mirai)", "value": "6370251d5e752b7590f10c1bcf871b7e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692219653, "uuid": "047f5bdb-052e-4848-914d-568354c20a9c", "comment": "Malware payload (Mirai)", "value": "97befab08511ad4f4070e72b96798b41b02d664db06dec73612fe06e519de830", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692219653, "uuid": "ddeeb526-cba3-46db-8f30-50fddbb0f2ca", "comment": "Malware payload (Mirai)", "value": "12ec7485d085b979a4c8ea2992266f67eb2ebb8e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692219653, "uuid": "b575871a-76f2-43e2-9f31-adc852fe9878", "comment": "Malware payload (Mirai)", "value": "404159c317d5eccced36e30d3aaeb017a03a9f6a4b7f8caa354323f69ba723d50519169163cdf267d5bdab2851cacf2b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692219653, "uuid": "198d8991-3f05-4b8a-8e28-b326d8ee2de1", "value": "T186A3F872E643CAB2C4430AF201A7DA6B0D21BE6B0A7A5A85F31C7CB09F334C57655F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692219653, "uuid": "4f8eb681-b099-4fdb-beed-2867821eea88", "value": "3072:wW8FUmgujld6Mkxm6AJ+4fWHmmFVcqq0GnDZT:wJFv4Lm6AJ+4fWHmmFVcqq0GnDZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692219653, "uuid": "53a6bc58-3379-4f75-8506-bcaac2f2a7e7", "value": 104138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692219653, "uuid": "54549571-e923-48ca-b1f8-aa77acf286ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692219653, "uuid": "266e1cd7-729b-42e7-803e-692586b62c81", "value": "6370251d5e752b7590f10c1bcf871b7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17abda26-3c65-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1692211538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211538, "uuid": "f9e3fb9e-8556-4e15-bb2b-c3fd631abd35", "comment": "Malware payload (Loki)", "value": "55a49b06fbdcad5839b1b4b0c47a8809", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211538, "uuid": "f20f9d55-f94d-4ee7-8a7e-7e50bcc0effa", "comment": "Malware payload (Loki)", "value": "980b68c45eba8b6e83921f521b3832ed36ffa4443c38f3b5c965d526010210f5", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211538, "uuid": "ae903cb3-d277-4b67-99b5-784a8f184d28", "comment": "Malware payload (Loki)", "value": "b3b58e4225ca759555da61dae2c8562ab1cb2503", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211538, "uuid": "9f95c2e8-2a7d-498f-bf35-0ff8cbcd8a2d", "comment": "Malware payload (Loki)", "value": "d85b351f37a3159c06f6903968ace2e3efdaee3530ba46e3fbb9b09b4d4c8408fb211adbef1b921f0cfef7680520c2a1", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211538, "uuid": "f64afdcb-b844-4193-b4d8-6d75a7ecd4a4", "value": "T10404129E95BCEAC2D9968D700EC48340503FBF1B475D59AAEE23003AECADA213D71D53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211538, "uuid": "c5e6fac7-4005-4f03-ac5b-0476b3d0d131", "value": "3072:GpOz8IaLGIOOJs0aWmPyseHKVe44PcraifbiDz6e+oEdz+iD6dW/Zdr:GpU8PLGtOu6mJeHKLUkaiDiDzadedW/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692211538, "uuid": "c2fd8f4a-d1b1-4438-a0a3-ef9ac8e4c430", "value": 173714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692211538, "uuid": "67ba199c-6c84-473d-846a-f9a5f09f2cc7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211538, "uuid": "a9f45901-7c20-401b-a283-9116700a0afc", "value": "20230815130403855_0001.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0433c6f5-3c34-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692190460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692190460, "uuid": "9eb37956-e024-48ed-b4c3-d8ab8092929a", "comment": "Malware payload", "value": "bd4b41e27b2c936b7c82d1f71e2b263e", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692190460, "uuid": "3a4957e6-86a5-4d55-b503-9b560836537f", "comment": "Malware payload", "value": "98ed61943e4f0bb2833a3ce0193fdebda47d64f438ecc1689006140cd6d26f81", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692190460, "uuid": "8a65667a-e881-4d8b-83f3-6d866a00f910", "comment": "Malware payload", "value": "e647fdac6e6d7176aa287641d72027b3c7968bb6", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692190460, "uuid": "90a5901d-7683-4d2d-9b51-5bd95cd6b020", "comment": "Malware payload", "value": "bd7641735a38f74db266c8edf5dbbec0bfaf0465a3e0e0c88e0b329b161e0ad1387e634a080459634f416703e3b3d40c", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692190460, "uuid": "cddb03da-236a-4a46-bf07-6cd6a7b0498a", "value": "T19B326C3AF9D0643EC432C87ED16E14D6E28DA452230578966C18FA1F2B915D617CF3ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692190460, "uuid": "0348b33c-5cbb-49d1-be0f-075ce0a2d50d", "value": "192:KxdHwHb3UVL2aFUlbVvevUqztq1s2bcEaexaY9:K7Hk3k/UlM9zwb3aY9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692190460, "uuid": "bd02966e-4367-401b-b0a3-ee14b6c3602a", "value": 10931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692190460, "uuid": "2efb22f2-37e2-4fc3-922a-2e52645e5579", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692190460, "uuid": "8161650f-74e5-4c0a-8dae-75aafed19be0", "value": "Indiana CMHC CEO Compensation to%0D%0A Board.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3c87b90-3c4f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692202377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692202377, "uuid": "9a77d47b-3e5f-414b-8294-c70dcc7f17eb", "comment": "Malware payload (Mirai)", "value": "80dd8b4483df4490f58e20aee32ba230", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692202377, "uuid": "c8420e0c-e88a-42da-a907-8ba7169365b2", "comment": "Malware payload (Mirai)", "value": "9bcd67e9df09f1528487b6d4c3a90f11f5691acbb4afa024b8a94b9b75850d6f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692202377, "uuid": "84eb873e-1339-4fa5-8fb1-32e8feb57a37", "comment": "Malware payload (Mirai)", "value": "59640937c0d6c3969cdb5cd26e4f798c651b78d5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692202377, "uuid": "d0d9fed2-c0b5-4715-8172-3a69ae5ae041", "comment": "Malware payload (Mirai)", "value": "6486401d1b27e680af294a6086c1051cc88629cb4bc2ffa0b5e90f533e4d4639acd64291a16a7a5abdfb021e495b160d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692202377, "uuid": "6e35ed96-e646-4c85-9f98-300eeff841d6", "value": "T1DFB2D019C0AE2EB4FEE77D395941E2817FA15BDF7A61CDC016C15A110222D382F98AD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692202377, "uuid": "6462a7aa-1fe1-424d-9f49-0239d5f8aaee", "value": "384:EA0AeimAzNCdvw1PwIWWtKfz9VuBFoeIoA8FXw2t7tTmojIotM4uVcqgw05VxJW:KApCdvwJr69VJoA8FZtxCo8D4uVcqgwd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692202377, "uuid": "592dc6b0-b5f9-4561-ac36-b83407f226fd", "value": 23936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692202377, "uuid": "64a15784-c824-4736-9106-ebf24c3e9897", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692202377, "uuid": "b0d26b13-752d-4df5-9480-0926a8901d14", "value": "80dd8b4483df4490f58e20aee32ba230", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "135e446a-3c3a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692193062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692193062, "uuid": "b07dc651-41b1-414e-9a0a-a7e2e2cc118d", "comment": "Malware payload", "value": "2c3446810e658ef2d584e8d9ebd57b57", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692193062, "uuid": "d5633194-8e82-4c3d-b566-4e8d8fe89972", "comment": "Malware payload", "value": "9c04badf89fa766885ad05082de8e91f69676e83eb41f8c6206623f4019394c6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692193062, "uuid": "54163f5c-4a81-45ec-a0b3-a4a1e7db9237", "comment": "Malware payload", "value": "bdfdf1b9f705ec239825a1bbbd13488c75e021ce", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692193062, "uuid": "c61ebf2d-b089-4f43-b4e5-aa9c627cf2a8", "comment": "Malware payload", "value": "e54538d8e90517ab4499be67d333d09fa03541a1b98ae29576de5ec0cf85ba9271a1fdc3e0a522d4e454d5861964e130", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692193062, "uuid": "1223e64c-6033-4f7b-b749-17f8002bcdf5", "value": "T191937B11B2D29072EA7E0A351460D6A14B3EBD11DEE0DD6F6B95063D4F702C1EE31E6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692193062, "uuid": "9fd70aec-4fa0-413a-9634-38b4528f24cc", "value": "fb8a80b0fe085dc3c95842d94bc1ac66", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692193062, "uuid": "2a242419-1ece-4397-aee5-a899d0c063cc", "value": "1536:olHRGZPvU5tww+9uyads7t9qKgb5Y62ur7oPUmT8tYu8K698tsWrnwcdbS+998mW:oRHfwdadsbqLbB7oPe56ybS+9mmgr90s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692193062, "uuid": "06d16de9-244e-4624-b90a-501fd06f4838", "value": 92672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692193062, "uuid": "a268baf3-f517-4a06-917a-3b46a3c2d87a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692193062, "uuid": "c6972764-fcd8-41e0-8399-513573e91c0c", "value": "SecuriteInfo.com.Variant.Cerbu.181806.24975.16516", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16601301-3c10-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1692175028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692175028, "uuid": "ba6b32c6-ae34-49e2-bc5b-f93754ee1ce8", "comment": "Malware payload (Loki)", "value": "d2792dd1f7bb8dfd9f1717c8370565d5", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692175028, "uuid": "ca0880ca-f989-42a7-a94d-f5d7cff7a569", "comment": "Malware payload (Loki)", "value": "9c5b9ae0f90df85d3eaabd91f7678abce13494cbff7b106fe85c1c235c3e1ddb", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692175028, "uuid": "7da10d54-c613-42ee-8f31-c1b60967b4fa", "comment": "Malware payload (Loki)", "value": "880eef7139499eb8788dc1df652e0cd2945e7847", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692175028, "uuid": "f60e4d30-06ec-4976-ae6d-06375ee7e5af", "comment": "Malware payload (Loki)", "value": "e1c0ad476a53e341bbaef9fe5442991d26b47ec08187cc38f212981259d74846c30e41c5811ea2fc2fa258ce457ea91d", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692175028, "uuid": "a18ed4bb-25db-46bc-9157-10a1cf21ce0f", "value": "T10BF31370BF7D2E65D8E79F502CA262A748BCCF5BEC4C5720686035B9024CB831267D9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692175028, "uuid": "acdf7864-aeaf-4d52-b43a-2034e5f1f904", "value": "3072:1pOz8IaLAqG1bhdePjGd/aBy2ZVvrQCoCMWWyYnCu/+wHu3i411HFgO3jFPoky:1pU8PLpG1tdIGdJ2bvr5oCDVMtOS411s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692175028, "uuid": "cd83b7e7-73fa-45c8-b9a7-7316695e63d0", "value": 173024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692175028, "uuid": "4f7372ec-8aa0-43e4-8d19-13a0acf70edc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692175028, "uuid": "f2745a16-5e26-41e7-90bb-9f69c0eb35a5", "value": "LPO#763296.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6783697-3c78-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692220072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692220072, "uuid": "d01dfb74-3e19-40a5-b047-fbc7b80297f6", "comment": "Malware payload", "value": "37bd1d677cf44c5fe21499cd2f1344ae", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692220072, "uuid": "e2e1053d-6135-4b3c-a1cc-9244555264ee", "comment": "Malware payload", "value": "9c82758a108c4a072a74d343dd2af597baafdb509cc1d6325fde95e8a990f11c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692220072, "uuid": "b5b59151-8de4-4311-8bf9-40b75fcc5883", "comment": "Malware payload", "value": "6b9e6390de2511178f20c0c42d7de168c2bbc32a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692220072, "uuid": "bc6b21e8-555b-462b-8c8c-11c5aac3519b", "comment": "Malware payload", "value": "a8b2280068eb914863c54c93fa4328f788ad2789547ef1fbb7667bf96820f08cdb58e191a2a1a26e3251ef253eafd3ce", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692220072, "uuid": "e3d34a83-9c59-4910-9431-d94c396fa795", "value": "T1A5612A423A13206FEAA923F0CE0827C42BE13993770F680F3AB7D4546F567619C128E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692220072, "uuid": "33fe2fe6-2eea-4581-be9c-80abbe629455", "value": "48:95ZRwEJ4LbwBonvjGcQMKOYeOvTGYmKQtfmmfyVnByWTxGgmS1HPSroN3tFW:lRwE8bwBs7iLGoTiRmxym4JoHP6H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692220072, "uuid": "68541227-c2b4-42cf-882b-7dfc3da4c29f", "value": 3370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692220072, "uuid": "728dde37-f05b-4dfa-90d3-fee8e37536c6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692220072, "uuid": "9d498e6e-2186-47db-96ab-195c40ddcd0b", "value": "iezkuonh.dll.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16d3b2b6-3c69-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692213254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692213254, "uuid": "19d58142-9ea7-4049-aafd-90255760486e", "comment": "Malware payload", "value": "91f9a723f84def69611caf50a3b4471b", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692213254, "uuid": "e6cf8388-dd9b-483d-9717-b689821d9f15", "comment": "Malware payload", "value": "9d51c25978fb22c1c0dd6938f27a2e73df1652f4863546a0691f1832cb700328", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692213254, "uuid": "58ab94c3-526d-4373-afe6-4c40166b1e9f", "comment": "Malware payload", "value": "8b0eaeb138600087c5c2f535e3aee0a4dffdc6e9", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692213254, "uuid": "952dcc17-8cf4-4176-8a28-d7770657f0f0", "comment": "Malware payload", "value": "030150b384fd1009c37eb35f072a2aad640a09f9cebd77967644ed844740371d6226793557f65a8a3bdd0f5231f67d6f", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692213254, "uuid": "f0caec19-3d2e-4f9b-b7b8-ade3d6297200", "value": "T1A245220173905128DA7E87F80AF5611513F0A2247672EF2D7A7E36C9277BF90AF60B52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692213254, "uuid": "9fafc695-b311-48f0-b128-cfac8d266b0f", "value": "12288:L0Dl+C42xjWYXEsWYGzxfk+PdnBGFaSj29jwX9np3BkA+5CTXgJT1HLE+tki:8TXwY6xH1nu+wXrBkA+5eQJTVLE+t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692213254, "uuid": "bcbcf236-ccf0-44f6-ba63-ed73b06aaac8", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692213254, "uuid": "6e76c937-02fd-484b-b281-13954287281f", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692213254, "uuid": "cf6c2e25-a92c-475a-bac4-611761a837be", "value": "nSR-2305001-C ORDER Gulfstream.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1088947-3c13-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692176576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692176576, "uuid": "6f9f0a07-b25d-43ff-860f-e0be8e60af2a", "comment": "Malware payload (AgentTesla)", "value": "d93c61635050d9001ca5d674b26f700d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692176576, "uuid": "2e4eee3a-4e29-4a2f-9d0d-e7bb57ca8239", "comment": "Malware payload (AgentTesla)", "value": "9d53228a6769b706acdb19165318752f58ad1f36cb24628a202372620eff57ee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692176576, "uuid": "e6991e5a-4394-483e-bfcd-645914bdec6e", "comment": "Malware payload (AgentTesla)", "value": "cc4d69f45f23850da6c892ef77cdf8677f633139", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692176576, "uuid": "c43fb568-0fba-426d-955b-700322de275f", "comment": "Malware payload (AgentTesla)", "value": "50289b60d206bc2c7484f3eda7f30798a234640c943be98a738a3888fb720ca8aee6ad78b9b2d6ca4be6c6999422045f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692176576, "uuid": "a067a5a7-dbf6-427b-a6f4-fa3a505484cc", "value": "T136C423F6D74444BD4EFC0F599423F88CBE3693805928528DB34A54E8B195AB0AE0D9FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692176576, "uuid": "59ea7657-7537-4367-9fdf-ecbdbbb880d1", "value": "12288:/8DdvVzB7vYeAxgr6OlrQu5hrX3ddDXReJ2iUIOxPEBUPLfjEiD4Omko:K9pA7OlrQgjNdDBeJxUBx8B27E04Om3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692176576, "uuid": "23f23de7-14d8-4cc8-bd4b-df7d7ec6e34f", "value": 557779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692176576, "uuid": "6c630270-1bbb-4e3b-b9f0-6e47777a29b9", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692176576, "uuid": "f7e33ab7-7cd5-44fc-8f4e-81e72ae53f0f", "value": "PL..rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "977b65dc-3c56-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692205310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692205310, "uuid": "2dab3c8d-cf73-4d6c-8346-1021fc299da6", "comment": "Malware payload (Mirai)", "value": "2ab1b55d2da8de969a369406fdd24aa7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692205310, "uuid": "26cd9d48-bd80-4c0a-b592-58b30eca4565", "comment": "Malware payload (Mirai)", "value": "9dd159f404e6f71f7270d05b4b065df8344f46b22196d312e426c8f39563c401", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692205310, "uuid": "bdb29ae4-4aa3-481b-91dc-dbf99d5eaca6", "comment": "Malware payload (Mirai)", "value": "a3b737f7620670a0c7f3363f3d4a33f31137a1e4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692205310, "uuid": "238c210f-e33b-4ba3-be68-53eaba6a0ccf", "comment": "Malware payload (Mirai)", "value": "77955fc93fb9e1a8547337f3e6714099fb5e0f54a097b8017ae62fd54336a5fb54fb5968b5df3b3c9ddd3268e626629f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692205310, "uuid": "9b3acf6a-bcb4-4351-90d8-387f9a6cff1f", "value": "T17A536EC6B4119E7DF5CBE7BE84224D0EB821722150531B27BB6FFD83BD721A48946E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692205310, "uuid": "be09e9d4-04a6-4cb0-8f26-51e29a14fcc0", "value": "1536:kPqRg0FGTbSX5xpLepSGorsF7QhOx2X/ZOqc/yA8Q:p5VHV8I9cKa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692205310, "uuid": "2fb4d153-e3e3-4430-8c16-ea1acdb09144", "value": 66508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692205310, "uuid": "a9f46d5b-b48b-4027-b9fd-dc001303874f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692205310, "uuid": "e3ca6d32-84f6-4352-a47a-9a8d4c7ac229", "value": "2ab1b55d2da8de969a369406fdd24aa7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e789df5d-3c77-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692219617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692219617, "uuid": "4b4b9560-f39f-4feb-93d3-de9ca4ec0432", "comment": "Malware payload (Mirai)", "value": "711fd526e70c2697791fa0e2afb5df5a", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692219617, "uuid": "dc029fd3-4cc4-43c7-a593-ef9e9c0cacfc", "comment": "Malware payload (Mirai)", "value": "9e01dcb5f50fa6a34ee19e0a995ba32c581a6a1302ee6656ed39cfd5eda64e81", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692219617, "uuid": "2b500f6b-280d-4e0e-9e27-d1d1518893b3", "comment": "Malware payload (Mirai)", "value": "03233ebd360f16bbd2a924bf0ac7e5995e860b50", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692219617, "uuid": "002b50da-e2a8-4059-bd22-35d5433b9275", "comment": "Malware payload (Mirai)", "value": "6594b610f9576b1ea67b132ecf9052760f5fc4d163590f45d534b0e730fac5930072e42d28e2c24fb4c3ffd6eb66c017", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692219617, "uuid": "0e06c837-8fae-499a-a3fd-16ac6b6a1d7d", "value": "T183B33B376251C97AC08356F427EBC5729D13BCBB0B32219A33D47D60AF368DA1E99B05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692219617, "uuid": "be4633f3-2f0b-4ff8-bd9a-458d7831fa72", "value": "3072:kiry859a2ADJf9wHYqbgFFo8+HeA++TRCm7FnVqfJXFWbNb:T9a2aLqkrMhsm7FnVqfJXFWbNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692219617, "uuid": "2d0c9db2-2262-4224-8b2a-b7ef64deb09e", "value": 116503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692219617, "uuid": "f85e6a81-aa2b-4ee0-8cc6-ae09daf9360e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692219617, "uuid": "9c174b67-e536-45c7-aff7-1a9547727ecb", "value": "711fd526e70c2697791fa0e2afb5df5a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2e0e1cf-3c1c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692180418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692180418, "uuid": "e24dda1b-c63b-4433-8e4d-634258c7f8c3", "comment": "Malware payload (RedLineStealer)", "value": "654e2409f2a1636d385c8c280394efd4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692180418, "uuid": "0e323195-6447-4fa0-a9c0-338c724ed08c", "comment": "Malware payload (RedLineStealer)", "value": "9e3f41755858886bd7df4426cf9529c92df5891cc232f916dcd85af0afe7eae1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692180418, "uuid": "c4966cb2-4896-44bc-8651-b83275148dfe", "comment": "Malware payload (RedLineStealer)", "value": "e7b3549dc62e0c174f59a19361da8d3249e3bbeb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692180418, "uuid": "b4b18971-a7aa-4fb4-bfe3-d430760abcb3", "comment": "Malware payload (RedLineStealer)", "value": "de48b5776f0f46865ba9bd65167ba2e7fb596867ed522fa43d511db4a653496b31e8a1ee114b51864bc2eb4f5f3619cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692180418, "uuid": "bf39e197-1e8e-440e-8ca0-0cc15abcaed5", "value": "T1ED358C20B4C05575EDB3117782BDF9A55AADE8B0075D13CF02F85FEAD6602C23A3A693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692180418, "uuid": "91a848b6-0787-4a10-9f70-8e20e2762771", "value": "2fa65fd0486d003d198825a742a530d7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692180418, "uuid": "f6f16112-7517-4789-89e9-1742e15ff9d5", "value": "12288:30kDEexIP6hupW828cFxj5QFC1OvBF5aapVnueyqz5I3pI6AKEyQr:3148IP6EpW828mHCBFnpV63dQr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692180418, "uuid": "95c3abb3-85e8-4f62-84f7-dd13ff6fd192", "value": 1121400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692180418, "uuid": "034eb1cc-fe8b-4c42-b8d4-c83506705378", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692180418, "uuid": "5fe2b25a-406e-49ea-a9e4-ac845550b053", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b55f74d-3c2b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692186606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692186606, "uuid": "9337d87d-43b2-444a-8cae-c61a13abe6f2", "comment": "Malware payload (Mirai)", "value": "063155ad43e4959109f3e328f53e2865", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692186606, "uuid": "ebb72293-39f7-4222-911e-a1e7206bcca4", "comment": "Malware payload (Mirai)", "value": "9e731181537a38f63ec2bca9598be6862f82c7fc9c519b095066cb5531fa866b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692186606, "uuid": "cf8528c7-d5dc-48d1-afed-8066db6b3e73", "comment": "Malware payload (Mirai)", "value": "9d480f66d7430d45ed57afbfca162f895d8b4a3f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692186606, "uuid": "2930b782-1def-405b-b1d1-4cad70a9dd54", "comment": "Malware payload (Mirai)", "value": "65308168c9f856a0055e833274b698e89ccb84d66a66973c1a216e952fc9780296e6143abad3c423efbeb679049da101", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692186606, "uuid": "368a132b-6f99-468a-8753-63b1c1c6eb77", "value": "T1DCA2E11572A32D66E3ED1C3DC96AC357F9971BFC90F532B679401620C90D24A3E39A4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692186606, "uuid": "4a6628e9-dfdc-449f-92f9-2dfe8be2c32e", "value": "384:vvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjd+BhymdGUop5hC:vvQn4j+ZO5fKAlxBWs3UozY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692186606, "uuid": "6e86cac0-bc11-488b-88cb-9ecbb112c5a8", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692186606, "uuid": "e51ec089-cf2b-4c8d-81a1-03b7f1a2155f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692186606, "uuid": "6934056b-4939-458a-b99e-220e4d9d0eca", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6325069-3c39-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692192986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692192986, "uuid": "db540669-5c88-4a6d-bc92-5ae80bdf61dc", "comment": "Malware payload", "value": "fec5f029902eaf33a54b0a7b266f377d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692192986, "uuid": "4fbff82a-8340-4a1d-beba-1d92b536d530", "comment": "Malware payload", "value": "9facad6fd7d77eb992b4deb73fe102d571d7e36d29d7f0970d1c1e1e12cd5635", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692192986, "uuid": "e2c22b65-5fcd-4bc1-8e5e-fed3b608e369", "comment": "Malware payload", "value": "b3a8d8df1089274758a3f0503e097d06e51730d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692192986, "uuid": "e7fd34b4-b0f6-4810-b4d0-4bd02ed874ac", "comment": "Malware payload", "value": "1021a78e66e4627a867746c1bb0aa697a33c846c60c1f96340407e2c4d17bbb5fbac2b42960ddbfc37f921516d840d57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692192986, "uuid": "a1b5ae31-5d10-42f2-b7c3-9fa5442e4fbb", "value": "T18145AD2162E9DFC2C19F2575DC96B1F80617EE10CD559FDB3E84BE1A34B22A2A93014F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692192986, "uuid": "1d215ea9-f1f0-498a-973c-87bb55e928fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692192986, "uuid": "f25c0002-73f4-4da2-a34e-4c8e19c3d45d", "value": "12288:T3gndrEp7MW7O3AJYWhtAdsL38MsDpN9JUNXU+wEV:T3gGp9O3AJYEtT3sDL92N9V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692192986, "uuid": "b268d921-fd71-46cc-95e4-6feea3d0fc54", "value": 1216032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692192986, "uuid": "af2b5f89-5dfe-4dc7-a81a-bae1fceeb5d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692192986, "uuid": "4c332f70-f2d8-48a4-9eb7-32aaadcf0ac6", "value": "DOCX_6802_1755_02_2023..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d480bce7-3c40-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692195963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692195963, "uuid": "ad9c3dde-0b2d-4a90-a67e-00183cd50227", "comment": "Malware payload (AgentTesla)", "value": "d69059b06e45728c584add1ffea138ec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692195963, "uuid": "59427259-9c59-4cff-8c0a-42d37f755293", "comment": "Malware payload (AgentTesla)", "value": "a091bedfbfd0485956951b3908b3fc988c3b916458df36bfd0932ed4bb3550f9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692195963, "uuid": "0f5b43ae-12b7-4165-93f6-c004d2eaa11e", "comment": "Malware payload (AgentTesla)", "value": "35e3ac3faca47f63d22b1a7fdf0ae4141a932864", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692195963, "uuid": "0797f77e-3161-408e-9273-96bd15fae2b9", "comment": "Malware payload (AgentTesla)", "value": "df86b5a9ac0ad80632cbd6aa13e9dbd65dd2cf142c5364dad3035f3698cb527909dc8ab9a7fdddbb77638199deb519e2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692195963, "uuid": "19789269-6ee6-41cf-89dc-a19bd1dd516b", "value": "T19F352921D7BB545AFF55A6F88E2F9531B8D9E980F0F5D589A3D2280394C2310CE21BF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692195963, "uuid": "75bf7a60-c117-4724-a1f7-41469e5e0ef9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692195963, "uuid": "4959a3d5-aa99-4d65-9e41-08c472d4e8ff", "value": "24576:mPqwtw7Rs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUOoZ6eyjlb7YvUFbm:N7Rs6CE3jLbO9Rs6CE3jLbOpeqNyOm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692195963, "uuid": "565e209e-4972-432f-b43d-1c332bed6305", "value": 1071104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692195963, "uuid": "1557ac6e-cfb3-4957-8487-8299e33f2908", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692195963, "uuid": "d61aaf9c-0815-4269-a9b2-27b941ecef8a", "value": "PO_4500188776.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37af2468-3bff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692167783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692167783, "uuid": "800862d6-5470-4b2a-b594-28298aa94464", "comment": "Malware payload (AgentTesla)", "value": "9995387010ef964c584032bb9fd6ce39", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692167783, "uuid": "080a32e0-1910-4038-b2c3-e86b705a3b46", "comment": "Malware payload (AgentTesla)", "value": "a0fef35dfcd0a26bab66af912e02360f499d55297f9ce71c55abd9ef180305c8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692167783, "uuid": "89d80714-c7f7-428d-b4bb-08c0e88a45de", "comment": "Malware payload (AgentTesla)", "value": "f0db421791c5a8c6b2675d2a202f5403383d0a99", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692167783, "uuid": "384279fc-07a6-4f14-8b27-75ce34c06548", "comment": "Malware payload (AgentTesla)", "value": "b68b3b13454d5dfc0a6ffd55820d267284113cd702a91fc8430033c52001a0b8bccb7e7bc9e837c7914b9392f8e26ac7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692167783, "uuid": "06f88a1d-f2d5-497c-8638-853db74555e9", "value": "T12205D06676FC06ABE06F80B656243003AF72A1B75576E6C5BCCE22E55F86F801603F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692167783, "uuid": "76fd6a25-fdec-4998-a047-e042fb7ba5ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692167783, "uuid": "6a8c8d30-7c32-41fb-879f-ea4c6d6b33c8", "value": "12288:/ZnDutz9Hfmvi8FtZT319H0ios1drbFhz8lMgCAm4EW1dZYb8xT:/wtJ/mvd53rH4otL8lRK4EW1zu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692167783, "uuid": "fafc20ee-cc8a-4d8e-9f87-ba90a197f2d5", "value": 803840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692167783, "uuid": "d8689faf-1ea5-4fdd-b73d-fad8ced47c87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692167783, "uuid": "18638fca-420c-4046-bee6-1c37fc147cc4", "value": "Request for Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce12fc6a-3c2e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692188221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188221, "uuid": "6e10b235-ae76-4569-9d34-29a3dc390300", "comment": "Malware payload (Mirai)", "value": "566e77578f8c78187ebb9477ddd4af02", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188221, "uuid": "53c6f353-f1fd-400c-931b-c2cf1748fba5", "comment": "Malware payload (Mirai)", "value": "a1f837737311942d38584cdd6d7f3b0f8237cba82ff4b1104b4a08e3a7bd0d89", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188221, "uuid": "5cd504e2-d8a1-4c2e-a881-163d80788684", "comment": "Malware payload (Mirai)", "value": "cebf0c91fe763e1c51081ef044cb406cafa91883", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188221, "uuid": "63362700-7655-475d-b341-d0e02afc8d13", "comment": "Malware payload (Mirai)", "value": "e485c329d28033a3658f046a06fb71c6b04a62ce3cc90d04be82b3eeb01ced8d2bf1a148c8fc0878cecd799ddb03b953", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692188221, "uuid": "863fa6af-4213-48ff-9061-b0f2c65fbb07", "value": "T1E6C2D084F0819E41EFF669F13D80D6DBBBD02E1FAA628D9062A153C25F5C2A35306DCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692188221, "uuid": "fe886fb4-c866-4bc5-b400-f0b11fda79cf", "value": "768:IVdafO76jpmNJJKehmA7trpfIX9KeA7PGh4uVcqgw09w:4am+AnKehPRa9aOh4u+qgw09w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692188221, "uuid": "d9a176eb-a047-4ff3-92ea-775cfa9ebf76", "value": 27048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692188221, "uuid": "6a6ef3ab-1072-4ab3-b134-0e8b81748c96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692188221, "uuid": "fd135bdb-affb-489b-8b46-adb743ccadad", "value": "566e77578f8c78187ebb9477ddd4af02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be0f63dd-3c2e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692188194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188194, "uuid": "70fb2b47-83cf-487e-aed2-a4327633fff2", "comment": "Malware payload (Mirai)", "value": "99c3cc6d462d600629684209eea15645", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188194, "uuid": "2d9b930e-7b78-4e84-b9f1-db71ae7cdd48", "comment": "Malware payload (Mirai)", "value": "a3cccd7594369c2e99a6a8870a8be1a1ceb2a18ae0eb99f6b05f05684e89967e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188194, "uuid": "cbbec8d3-64ad-4e14-a866-363caa1ea416", "comment": "Malware payload (Mirai)", "value": "fa6cd351d084b065c0deeb8b145d90b06b52fa31", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188194, "uuid": "c62d52f7-2887-491b-9e29-cffef74aa282", "comment": "Malware payload (Mirai)", "value": "e2b6e977623f12553f27f8cd6eefbcd8799394d781cda44373dd5f998b92ebc9f789069f17eb9ac890dbec8f1d10cc24", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692188194, "uuid": "1e4ef14e-09a3-4bc0-889f-eae97ea0882b", "value": "T139D2E12CD55DBE06CAAD3DBA50CF56B5298C74C0A359B6CE17228448BA17A8BFC070B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692188194, "uuid": "e35a38f7-c327-4644-979f-48bc892fbd88", "value": "768:C1uUtLrVDsAp6tLkF4FuetwEub4sU/M9g36KN9KTJb8WUb:CbDs06t4BEub4sU/MbUwTAb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692188194, "uuid": "a4338b5e-167b-439d-881b-b14a2ce4576f", "value": 30316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692188194, "uuid": "c0dc6f77-d7a5-4c0e-8012-b743855ce34d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692188194, "uuid": "575e5987-7649-472a-880a-aa569d63564b", "value": "99c3cc6d462d600629684209eea15645", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc0a1d1e-3c39-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NanoCore)", "timestamp": 1692192916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692192916, "uuid": "66f17d0b-cd69-4ff9-9fe8-8cde158b8aab", "comment": "Malware payload (NanoCore)", "value": "eddbe6e18e6df19183b1e22da1852a79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692192916, "uuid": "32631fe3-ece4-4491-8e87-bc17ada097ea", "comment": "Malware payload (NanoCore)", "value": "a4b8d3c0a35222b1349ea8b038db184ded1a4c8e1a37803fd67f9e7b23320a6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692192916, "uuid": "8a939e04-6a9f-4f53-891e-ed4e2d03ddaf", "comment": "Malware payload (NanoCore)", "value": "ef4ff0ad9beafcb4164c7a66045dfcaf67536017", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692192916, "uuid": "3a4b2062-8f27-4191-92e6-2a999a1b89e4", "comment": "Malware payload (NanoCore)", "value": "8100b3570c0aca1987abe3d3ce74f610a74ce9a53e4cca7351c78eaf4da3e4b23715e9429a220c536de8463c14fcce9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692192916, "uuid": "1e9ba556-311a-45f9-807b-e7d4c27be9aa", "value": "T176351206EBFAEF31CE25043FCA60351A4F7D2EE254A1F94D764DB1912DBAE409404B9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692192916, "uuid": "8dc5d3ce-4240-4245-a122-6ccb4ab20386", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692192916, "uuid": "618b3fec-3e49-4403-b93c-c0089344a660", "value": "24576:LeEFk1drJZ73kENXWnAkXhnnhlkuGjo0BMDFLkdi:X6dFZ73kK0A2kpQeo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692192916, "uuid": "f64dc455-4390-4805-b68b-ef2241e0aef3", "value": 1074688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692192916, "uuid": "01898f11-1cde-43ca-b605-f49d1cdd9542", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692192916, "uuid": "9651f42e-f1c5-4b67-983a-d6a879d14738", "value": "T~741B0238-DC75-489E-9AEF-B0B04ED1D3FD.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dad8dfb7-3bff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692168056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692168056, "uuid": "205809c8-055c-435b-956a-e900035a691f", "comment": "Malware payload (AgentTesla)", "value": "752f2c3589148fc83a4d602e4670faec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692168056, "uuid": "77b443a9-621d-4249-812f-50e281e1287e", "comment": "Malware payload (AgentTesla)", "value": "a5299852cbd114f85d0ef4a8605caf998214014e89348d7af5d9df0c096a8863", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692168056, "uuid": "2a6fd574-5d40-445b-aeeb-8c348e0368f8", "comment": "Malware payload (AgentTesla)", "value": "84ae1cc5b764c406989a02818b3b33eba32359ec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692168056, "uuid": "a716c47e-e4d0-4a55-b22e-0d578293f212", "comment": "Malware payload (AgentTesla)", "value": "fe275cfe488aa5b980660ed555786b3295c125d5e306012c6a8e6cc84de47380276905279e3a3679af058caeaba4d822", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692168056, "uuid": "5a73df4a-ec99-4e5e-821e-d05252b79fa8", "value": "T10C150822E77B658AEF25A6E84E2F447179D6DC80F1B1C58CB7E7280385C23114E35BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692168056, "uuid": "df7cc64e-38b2-425e-91d4-9f9c63b6e290", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692168056, "uuid": "ea7780d6-7266-4d44-9e8f-a73239c08e05", "value": "24576:M1YYRs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUOIOguc02ZccLbB:KZRs6CE3jLbO9Rs6CE3jLbOQub2HPB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692168056, "uuid": "3acf1bf5-5f0a-4bb4-82cc-aef12e0b9afd", "value": 903680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692168056, "uuid": "07405f61-799e-462d-9e38-84d05daa525f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692168056, "uuid": "cef246a0-a283-4e75-9a08-e4aa0a31da1b", "value": "New order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "babec7c3-3c08-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692171868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692171868, "uuid": "110eaa62-61cb-4807-a92d-3f39d2bccef4", "comment": "Malware payload (AgentTesla)", "value": "afc99a2ba1582c1ec85a946cb3c24dda", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692171868, "uuid": "1ecb579d-cfc3-4316-a271-42f1effbfd3a", "comment": "Malware payload (AgentTesla)", "value": "a570ab383f6f19a12049dba10c0e4ecd6f4df4e4fdf4c93ffaf6c672268a6c60", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692171868, "uuid": "e7730888-ccb7-45ad-94df-587e5c57e4ff", "comment": "Malware payload (AgentTesla)", "value": "4d1ab6611a372b6e83ce9b43680f7f07acce08ae", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692171868, "uuid": "ed49b64d-9f5b-49e8-b35e-d2a9ce53332c", "comment": "Malware payload (AgentTesla)", "value": "5d75f1d6b337b5a1216b899227639e711ec8de1a82bbab3eaa3f27410a385adf196b15b364dd62f11c3d92a380a48d84", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692171868, "uuid": "90d55733-a84f-4f75-a46f-0325166bc84c", "value": "T17645229563B84B30CD7EC47F994685245772B00FD9BBD29F3A8C12356B32FA01A81AD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692171868, "uuid": "f1b7920c-2b76-4ff2-9a61-b21af88e15a8", "value": "12288:yGTIYlV2yMgiNCZuuowLlr8xIko635aGToOqeBf+u:NIYlVJiWuuos8iP635aabq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692171868, "uuid": "a9a1dfdb-388e-4d6f-8cce-b68e3d9fed0c", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692171868, "uuid": "f42d465b-fd59-4f7a-ac48-f8b9d8446e3c", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692171868, "uuid": "d6bfb6c3-e709-4b2b-8b11-b5e7c6677412", "value": "SAMPLE ORDER PICTURE.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb019f99-3c2e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692188189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188189, "uuid": "57550a61-cf6f-44de-81ce-da651ff8b472", "comment": "Malware payload (Mirai)", "value": "b64e31b53b439a05b14998c7bd693c21", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188189, "uuid": "2a1c7bb9-6055-483c-a8c9-8c04a06b2536", "comment": "Malware payload (Mirai)", "value": "a5f63a3299695c6c08bb0f1659d44e06964ecbf68f92ef6fe970e9146cf43257", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188189, "uuid": "9bdd02d3-d9d1-48c1-bbd3-dbfb678cd67e", "comment": "Malware payload (Mirai)", "value": "a84fdd5be7ea029a34e9f801f662578697aef5b1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188189, "uuid": "58335a58-7130-4581-a9d3-b2633d378d44", "comment": "Malware payload (Mirai)", "value": "1d7f97773df7978e0deaf042d7ac7d4ba79ce86fc3159bb0d4d3a3de027ae33cf931903bccb9e5d13b60b9b40ddc4ba7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692188189, "uuid": "aa56321c-2897-4162-9f47-6f1860c07653", "value": "T1B0536DCAB8119E7DF5CBE77E84220D0EB821726150931B27BB6FFC837D721648956E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692188189, "uuid": "d911cd6e-f49c-462b-8d72-48a7a2f78257", "value": "1536:AXyRgQF4TbSX5lxLepSGY5cFnehON2PPB+qG76E8f:N1TjJ8EVGO1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692188189, "uuid": "1106a190-63f5-4e57-83a0-9b17d625045b", "value": 66504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692188189, "uuid": "fb39dbb7-52f6-4332-964f-7ba86bc21cde", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692188189, "uuid": "cfba93c5-1b7d-441c-83c3-7e927f92bcd0", "value": "b64e31b53b439a05b14998c7bd693c21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90479c0e-3c2f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692188547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188547, "uuid": "a7a90501-2550-4f70-b126-f9bc12c9f6da", "comment": "Malware payload (Mirai)", "value": "7c5c206b71b667b821e11254c9e83d77", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188547, "uuid": "c5a7cebb-fe7e-4dff-a520-a87777275718", "comment": "Malware payload (Mirai)", "value": "a6531681c22a278c69522da70e33076a22daae7319927c852a5324701b6a32c0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188547, "uuid": "8919edce-46ef-41a9-b41f-6513b2735fb4", "comment": "Malware payload (Mirai)", "value": "0b7402ba92a8fe5977be48f955b09145d02bf4bc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188547, "uuid": "c2527d1a-6404-4cea-a7fd-a45835c9dd2a", "comment": "Malware payload (Mirai)", "value": "e5822ab064225950378435dff96275bd492cc4dc80846e991ef777f488d24ff283680d449699167aa33c185823a8549c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692188547, "uuid": "92f5da39-2127-43c1-9edd-81b1cf5bdca2", "value": "T129432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692188547, "uuid": "e8526b0c-6238-4d88-aa07-49986d678c1b", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwU:RqtmZPuutfbltZFBSJsBcfDSTFI+BEU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692188547, "uuid": "bf2e5d17-f599-4679-9d3d-7a0893f84216", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692188547, "uuid": "70505710-806a-423f-bba1-69276137d259", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692188547, "uuid": "4e2c2b0a-4661-4e2f-8ce2-410c61635d5c", "value": "7c5c206b71b667b821e11254c9e83d77", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5f88664-3c08-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692171833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692171833, "uuid": "40332c2e-2dd0-4111-90c3-e56c385e5a0c", "comment": "Malware payload (AgentTesla)", "value": "05b7e8436576fa701a4e805f89ccc922", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692171833, "uuid": "e53b3697-d284-4397-b840-28e9aaa708ac", "comment": "Malware payload (AgentTesla)", "value": "a67ebc4e481484e3e9242b65a941311dc1d3584d0ca7e04c4a87428c435c9181", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692171833, "uuid": "e7e9b35a-8ada-4705-a7b8-e4ca8f34fe70", "comment": "Malware payload (AgentTesla)", "value": "62cb57175e8ba8fcfa94e547b0ffa1167849c8a1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692171833, "uuid": "c6492b6c-3fa7-46ad-a79e-c391ff7dfed7", "comment": "Malware payload (AgentTesla)", "value": "eb8aae24b80059ceaffc56c62a87c9e05eabe4d65e0754dedd6d3a5c0e105aa5c50a2d28d3d9d51ffc6acf3fba0ad9ca", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692171833, "uuid": "ddcd995a-3622-40c2-b7ee-c7d5695b3d56", "value": "T17D052326D7F57E7F20E219290A92942E31D38764233BBBEDC9F77536D2316932C01A61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692171833, "uuid": "bdf44c94-c85d-49a7-a073-bf5e72a9dca7", "value": "24576:t593IhZtqdue1lYEiiwxCGy1xdDO40YBjuBp:T93Cj0TpHwxCZD1lu/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692171833, "uuid": "c14d0567-66df-4647-8b34-f3fe6de264f6", "value": 855392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692171833, "uuid": "e91f5ea6-5ec7-4707-838e-40ee59661473", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692171833, "uuid": "e388f6ae-0ef5-4120-b3c7-077b72c1b045", "value": "Kxfuvhqzn.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b43b5af5-3bff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692167992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692167992, "uuid": "b6338d8c-de1f-498b-8680-d8c64f67e925", "comment": "Malware payload (AgentTesla)", "value": "29d98845d5c680b0607ff8870e2c2800", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692167992, "uuid": "74a0f118-1a42-4338-94cf-ad1a3ee0a9b4", "comment": "Malware payload (AgentTesla)", "value": "a7656d7dd9f4ad43bc2a2e25e76f91aabd83c05fb2a6c5a04467e185898b94a3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692167992, "uuid": "9a6a74f7-ebc8-4dd5-aeff-3ee30ad4a5c6", "comment": "Malware payload (AgentTesla)", "value": "8d563f131920965f1f76763bd929e4e7b601a98b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692167992, "uuid": "79737675-cb2d-4088-8d11-b97e61ae89b3", "comment": "Malware payload (AgentTesla)", "value": "ed752aad32c982709f0cc11771fe264acadc9107a54f48d2785e4a05794dacdfaf6e21d9dfffe0d3c04c8cf1e5bd23f6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692167992, "uuid": "ee7ec906-6f10-41a1-a9b7-91f68baa1428", "value": "T1E1D3FA1BFB8B89F1C1C4773AC1975110037DD682F2A3CE3AB6CE23951943FAA594964B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692167992, "uuid": "a9c4b6d4-d1f3-4763-9c0e-ec107bbf36f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692167992, "uuid": "772be9d3-9106-4a23-b206-c6e370f8ac7e", "value": "3072:L94dCv+uotdVMLuAjMM0EAYgm0Xjqpkz:L94cItTMLuA0EnT0O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692167992, "uuid": "d1957572-f4f2-43da-b825-1d287af40c0b", "value": 136704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692167992, "uuid": "558a0920-e4c5-4419-8d98-d3d4e29dfc81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692167992, "uuid": "692e4759-d3c6-418a-9cf3-0f2f7e9aa883", "value": "anfrage2309401.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0a116fd-3c3b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1692193729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692193729, "uuid": "7b06ef6f-b928-4504-b080-1a1d0f3746bb", "comment": "Malware payload (Amadey)", "value": "858fdb852d79904f35085e2c1a0a23bd", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692193729, "uuid": "b28ae47c-03eb-4683-a1c5-aca861a64f92", "comment": "Malware payload (Amadey)", "value": "a84a64e85f64f52e37b27f2dfd8c69755e12f5e760b900425809a864cfb784fd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692193729, "uuid": "4c9e2bbd-3d10-4a48-ae72-c4f21ebf7754", "comment": "Malware payload (Amadey)", "value": "2ec38e29af1541081f625fbcc3a55c6ee7aeb654", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692193729, "uuid": "aaba112f-982a-468e-8695-f7607ec9ad17", "comment": "Malware payload (Amadey)", "value": "2c2f83eac8837832bda21082cc26fae2f1603271b1f7f7f3871b6b27312f7866fd56900ff00f89a14a60b90d35ce431f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692193729, "uuid": "1bc15884-9117-4325-b739-9a070d425ec5", "value": "T1FC152312ABE88433FDA61B302DF703972B793D968D64479F3785694E0CB2280A5747B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692193729, "uuid": "edaa365d-2c80-44b8-b2ac-ca8e2b8faf1e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692193729, "uuid": "9312723c-8ca9-4f33-a3ab-72d5e2e0c355", "value": "12288:XMrEy90X472Epnz2kt6M5I46bHdX2hOQ7bBaJTNf4Lr0QG2c48pTl2wzSzNfehvp:7y0EpnEV46TdmbBaJTahcO+SBGhR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692193729, "uuid": "f1642525-4e03-4bf9-bed3-7a07117c3ec0", "value": 875520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692193729, "uuid": "bcd0620c-f99b-4f93-b19d-3376ee4c3738", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692193729, "uuid": "d7793fc5-9aff-4656-b93a-77f9b35ee7cd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0ad6ec6-3bfa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692165865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692165865, "uuid": "42c0f2f7-2434-40d7-b255-026ce1812e1f", "comment": "Malware payload (Formbook)", "value": "980f568beb76050a027302b52e60ec13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692165865, "uuid": "473af45d-190d-4b57-b03f-571a23290eb0", "comment": "Malware payload (Formbook)", "value": "aa1b4b158a379befdf36eac18399189fcb89b2b89ca128a0009ba548bd194a41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692165865, "uuid": "a71c6d7a-3e6e-4250-bc4c-e4b12a319a5b", "comment": "Malware payload (Formbook)", "value": "0b56d235f2267bbc4b91fe43621fa73c416147f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692165865, "uuid": "3bf32e30-7819-4896-8723-b4eeb2cb867c", "comment": "Malware payload (Formbook)", "value": "cc3f75472a7ad5702bd958aab76cabc17b9d74f1e2eea5c4c34c6e8e12fc0e643e87b81a484bc9f30880a18b85c3f3c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692165865, "uuid": "b8c4a8f6-a5d3-48ab-b06e-502963a09307", "value": "T1533412512250D467D83685B11B3E07ABCAF6FA230468AA6B0FE0672CBD23756ED1F740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692165865, "uuid": "6fb12c28-dd81-4da1-bb69-d69b71b97ee6", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692165865, "uuid": "09c3d367-4d8b-4d03-8480-f1aebd044199", "value": "6144:/Ya6JH+zYZQArfnaCyhAWOP+gb0Im9v9cQZV7vIxCyjoeBvcN:/YLH+sZQAbnayNP+gPerZ1I86oeKN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692165865, "uuid": "94a96999-7aac-4c77-bd4d-02eae9248915", "value": 247855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692165865, "uuid": "51d5136b-7f9d-44fb-8dee-aa26d257cfb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692165865, "uuid": "682a5a2d-6d93-4947-8af6-6f97d3b86c07", "value": "Payment advice-BFTI_EFT71230809.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f017c7d9-3c41-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692196439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692196439, "uuid": "c56bd4f1-99cc-4c1c-92ba-f1067b837947", "comment": "Malware payload (RedLineStealer)", "value": "ad9184eb222900da8ebb040d7405516f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692196439, "uuid": "eaf57a88-3c91-4e1b-98bd-62f26a778c3d", "comment": "Malware payload (RedLineStealer)", "value": "abde6bc0712d53028c2c085e2564bf5e06bd348396a06f17712ff300e6e21790", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692196439, "uuid": "22e03a7f-0bff-4d41-a92e-b2eff98bcb6e", "comment": "Malware payload (RedLineStealer)", "value": "fb25a943e7d67a19f4f6193ea82eb6c49b17e8e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692196439, "uuid": "495e13eb-ad0c-4656-98d4-61837507fd7a", "comment": "Malware payload (RedLineStealer)", "value": "d839596ca3d7df9517ede3d7e64ac81841640c5b971b6244a9287aeb59a90c026168ef21f220f23cc63641248a71db47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692196439, "uuid": "4d62b9ad-eb12-4960-96e6-687fe1ab13ec", "value": "T1B2052212B2DC5237E9B91B309CF303E74B353CA15E7C8327278A6A66087369195B573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692196439, "uuid": "d0a0656e-deb8-449c-8c75-162ec5d7f61d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692196439, "uuid": "dbdc6d46-a0f8-4045-a5d8-237e328e84b8", "value": "24576:LyomeAs0s8eY91KkNEjN8gBKYdwhF6CKH:+omM0UY9nNA8KUhFp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692196439, "uuid": "e3c701c0-b545-4230-b8d7-7a575e6e21f0", "value": 874496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692196439, "uuid": "ff931813-050c-4e13-b097-e51804414857", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692196439, "uuid": "6a62314b-740c-4f92-80df-b681ed7a8614", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6980d193-3c09-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692172161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692172161, "uuid": "96f5c37b-617c-4bfe-a7e5-468030e48ab8", "comment": "Malware payload (AgentTesla)", "value": "043be70986acc8c848f963927da97938", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692172161, "uuid": "648f0fda-6326-4781-8d12-0e540c11eeb3", "comment": "Malware payload (AgentTesla)", "value": "ac10ca617baa3ad65badaed406b424473517cbffe025e5356b64962adc40c8f0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692172161, "uuid": "e1929dd4-f750-4462-93f6-06d7087f11d3", "comment": "Malware payload (AgentTesla)", "value": "14f0f4fb07f699d7f3addf7fc473ab971d1601c5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692172161, "uuid": "6f1defab-edd8-4ba2-b577-1218f9f1eaa0", "comment": "Malware payload (AgentTesla)", "value": "212e145cfac10f1d507a6e1a6115658d5dae79209fa68137ac971174457cc09ba13602afa774d64092d4be2111901596", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692172161, "uuid": "8e2140bc-70e1-4ff7-8697-d636e44b0db7", "value": "T1E354120DF3A5C017E09B16B25E35AB670BB16B29A42D49168734E99C3936ED2C60EF13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692172161, "uuid": "d69340f2-96b9-475d-847f-6c0fee6f9552", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692172161, "uuid": "363e9862-0a9e-47a8-8515-0e8e5fb4e11d", "value": "6144:ZYa6kk/2bAL9H03JwnPULK83m7iAULbi6FtoJKwLH6htyHx6qL2I/p02NzSb:ZYmxAZG6/ipmSt/wr6htywqLhRc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692172161, "uuid": "2fcdc7ff-e645-4b83-b4a8-181c92cd7acc", "value": 304261, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692172161, "uuid": "cc7d257c-03c1-45dc-a87b-70b8ef499691", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692172161, "uuid": "515a7436-202c-4a96-aa8a-fa89e4599dae", "value": "Lab Equipments.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c098d4c7-3c2e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692188199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188199, "uuid": "21a29e31-d8e3-4567-b581-d7c43bfdc3b8", "comment": "Malware payload (Mirai)", "value": "0d11a073b1e8eb0583193518876e40d3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188199, "uuid": "38c64ca3-8e7e-4d0e-a84a-af250351b4fa", "comment": "Malware payload (Mirai)", "value": "ad48787df6494093891972d0718d51de47ffa4b5cfb79af9f029065db3798193", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188199, "uuid": "b8732e65-7d53-4ee4-8d68-da6110cbb52d", "comment": "Malware payload (Mirai)", "value": "11a24b5a40216b8d01bf1ab25060243e44b945e8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188199, "uuid": "8a4bc06b-4854-4662-93e1-af08d8b68e1e", "comment": "Malware payload (Mirai)", "value": "d2f512bdf7f3650e59697d1948cf7225c443d8dea5628252822b1036f8e4227aff3caba1c068cd5540ca821393d50ad5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692188199, "uuid": "443e1bcc-860d-4135-a728-12270ab6e8ce", "value": "T107330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2757BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692188199, "uuid": "bf52c57b-fa5f-4ead-b089-b30d64176740", "value": "768:gduPBFnHooqR8qOCKq2cH4Fje+TK806MMUVjzMfQXOtHud2oGw:r/hqaJMcjeqK806MHdMfQXoHuCw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692188199, "uuid": "984404e5-db7c-4eda-8fd8-c01ab47aad11", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692188199, "uuid": "2903ea84-9d60-4765-b37d-35e7394485ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692188199, "uuid": "486c6dfd-77d1-4bc7-bf19-e56b6fce3969", "value": "0d11a073b1e8eb0583193518876e40d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8052a76f-3c50-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692202694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692202694, "uuid": "67b920ae-64a5-4fd8-85be-9fffaa902d2e", "comment": "Malware payload (Mirai)", "value": "a1ef2f411fd0bdda75d696e573343ce3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692202694, "uuid": "c765c02d-5fb1-4d6b-8155-437daaca3d52", "comment": "Malware payload (Mirai)", "value": "aefb5f0d51e01cc2004cfd51249f724c3e18872a66338b80b2304820a43943c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692202694, "uuid": "a82c69b9-c0b0-4c95-a379-3223283211d3", "comment": "Malware payload (Mirai)", "value": "d9fb12503a3e4559e8571e4ff9612af0144da01e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692202694, "uuid": "aed7b5c1-c18e-4fff-b6cd-2bf811d153fc", "comment": "Malware payload (Mirai)", "value": "ed4004e025b1b05cae2131552c82083461559692b96923c0735ac4828f6d68979090c3fbfa9db199cb6159e493e9a83e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692202694, "uuid": "f6fcc621-ed92-4355-8dea-fa120338bf87", "value": "T122432925AD792E26C0D8B57E11F78724F2E2224E25B8C65E3C721E4EEF04740A5537BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692202694, "uuid": "a25f1985-9a2f-4934-a0d8-2e7262a5b01d", "value": "768:eLobAxU6q9Hfymp0xginuYvCkLB6WsTwIC1DQdszoDaS0O+DCDJ:eL0AxvSHfymp0xgunvCkV6vTMDauq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692202694, "uuid": "87bd8fb8-f6e7-42a2-8114-43a34f57015f", "value": 60412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692202694, "uuid": "c04f8869-44aa-440b-af46-9ad1635fa797", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692202694, "uuid": "103a322b-9c30-4d99-8b1a-4b56e8ecde16", "value": "a1ef2f411fd0bdda75d696e573343ce3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a695861d-3c4c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692201040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692201040, "uuid": "35e3eb26-2290-46af-9121-57236292aa51", "comment": "Malware payload (AgentTesla)", "value": "a0d448dacabf678087b5cc4d2346180a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692201040, "uuid": "c69eb6f8-bac8-4e2b-97aa-5e83bfa302e0", "comment": "Malware payload (AgentTesla)", "value": "af633eeeed469a8e02a0bf2ec33023fabe24fc669b92bfb24c9d8336608faf2d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692201040, "uuid": "974fdb1f-5f93-4d21-99bd-10686cb7b853", "comment": "Malware payload (AgentTesla)", "value": "ef782ac2653a1489c979b058b21400c112da1b61", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692201040, "uuid": "6605b963-133b-401f-9fd1-576fdaa79917", "comment": "Malware payload (AgentTesla)", "value": "45b0816962c6f28ceb205b7a901f173b4c3701ea4894b99dc2ee80767f4e26b2359b8be0e0582b4cfd3da75ab7dc757b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692201040, "uuid": "5b17a55a-b08e-4633-972b-804bebe1f80d", "value": "T1D3A4236FA85CDCB09BB6C0B742B5BA305BC1A6C5B06593F8B811DC6D050370E77286BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692201040, "uuid": "2696f7a2-f41a-4c93-af00-4512c5829378", "value": "12288:HtyLhdn0atG9I7ZXqoIqcKcdcLe0eu4Mqw:NyL30a4YXuKcdKe0GPw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692201040, "uuid": "c9bc772d-e214-431a-baef-6364b97c2256", "value": 478262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692201040, "uuid": "4a9b343a-8d53-4c01-8dfd-b262c7c20296", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692201040, "uuid": "0e430001-7f5a-4388-8e77-dc87c7b252e9", "value": "PI.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "506a54f3-3c62-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692210344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692210344, "uuid": "903b0d2d-2ed6-4c13-9e68-63810b7dde63", "comment": "Malware payload", "value": "d8018636f87db96ec7e2c5ed37b201d5", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692210344, "uuid": "b27344a1-504f-4ab9-b5d8-676060fdd7e8", "comment": "Malware payload", "value": "b0f02cd9ec273b7697d985205ef85eb7bfc8c3cc78c67acf2b8c84e08b3a838d", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692210344, "uuid": "cfe75d25-1fb0-4e54-9e87-96c45d75972b", "comment": "Malware payload", "value": "575be55deeaefc35a98c12d17eb7f9636170319f", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692210344, "uuid": "cd9b5b5e-9b22-46fc-a401-b544e5f58d0b", "comment": "Malware payload", "value": "478479b373431dba0d8b7030336a615b34ad2213c6a012f746bd852b8dcf55dbe00467e4482fc93828e162b8b71c96be", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692210344, "uuid": "577d291f-96c8-4061-b2f7-486f84722bb7", "value": "T19BC08C60451DC824C16B081C890E8DBCE9131082611AEDE102A21E88FCA38351F4C196", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692210344, "uuid": "ba5bb92c-b527-472f-9ab2-36d9527ed8b3", "value": "3:HRAbABGQYmimmQoPzKEgeIBhfoovUo1YSo/QJ5nQyYesbBSn:HRYFVmi35zfA3gyISoIJ5QyYesbBSn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692210344, "uuid": "41fd206e-7a92-423e-a8a9-a307d3c903d6", "value": 152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692210344, "uuid": "a5adc644-03fa-43c9-97cc-a566778dadea", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692210344, "uuid": "cd7ac4b9-2386-4e07-b862-fdfcad05ea2e", "value": "int-enUS(downloader).url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8b6a50f-3c2e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692188239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188239, "uuid": "e1229a24-a90b-4b67-ba48-7055ed667cc0", "comment": "Malware payload (Mirai)", "value": "b9fa60f638ef842306ff1f99ac121bcf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188239, "uuid": "43a88582-a70e-445e-8af5-7c459c181cd8", "comment": "Malware payload (Mirai)", "value": "b114cfa1c9f782bdf6928a012964cc73f635ea1f51922174e011bf7b6ab717ba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188239, "uuid": "ce25fac4-58ed-4e19-aa17-4b1f891e0bd3", "comment": "Malware payload (Mirai)", "value": "1d3c92dbc60dd773bf018f54056ba58c429bd032", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188239, "uuid": "60328cb9-55e3-4f80-b36e-804e5959b550", "comment": "Malware payload (Mirai)", "value": "a380f9d7ccc0469886f1bf75f7aafb9b1f4bea3d3fc1f6c633e2f69948d51e2c3e347c2e1b6970eb4cb580b178a7c3d5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692188239, "uuid": "2d2f5635-b8de-400d-b52a-b950e4b6eeac", "value": "T184B2D0A48BD19606C2B0B479E27C8F965A3B15E0C5F63927262093BCD65245A33FCAC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692188239, "uuid": "72068be2-5b34-4e75-b78a-32d850b0602a", "value": "384:4GaKXlJIDFUS0Mggks3aIrokYVDoDDRRKj55N7LB9U+BMXOuFhymdGUop5hu7f:4GaKQFH0rs3zWoDDRsjt7LB9U+BUs3Uj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692188239, "uuid": "b1b13443-204e-4b44-b9fb-9acdfab7f36b", "value": 24536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692188239, "uuid": "d839a4f5-6c89-414c-98da-bc2b194e00c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692188239, "uuid": "f970cfcd-60a7-4990-87c2-21863fe1d4fe", "value": "b9fa60f638ef842306ff1f99ac121bcf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5abcfdc-3be5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Nitol)", "timestamp": 1692156854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692156854, "uuid": "93984e04-57dd-49a7-aeb6-a6ec3bffb346", "comment": "Malware payload (Nitol)", "value": "2c32b46915b341c488a6323e7c3e2469", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692156854, "uuid": "ad4eafcb-fadd-4a4c-a1c9-75a54e7402ce", "comment": "Malware payload (Nitol)", "value": "b1870fd579ff9cebb303603a5ee9716e7f4d6b9c7b3d3d6cccb81cb926c30b80", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692156854, "uuid": "01e727d7-7532-406c-9221-f9ecb1bda18a", "comment": "Malware payload (Nitol)", "value": "eb34b4b3aa1937b2516de93e8692ccfd1c65c0ad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692156854, "uuid": "a8bb3f0c-a88e-4b10-bfd1-a92388498dcb", "comment": "Malware payload (Nitol)", "value": "7ec9097258ac56c290f467457c0a154bd5c08a07de9304235d89bf4dc200f2eb928e23724e905b3a7925a3ea9d592ba3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692156854, "uuid": "5149417d-48ce-4ee7-a919-8ee1f560930c", "value": "T13584D010F542C01EF5D281F6AABACBAE692D5E70031060C3F7DCA796673D1D66B3258B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692156854, "uuid": "eda0484a-58e9-4541-9c5a-a25c7e5f161f", "value": "032ac126bef9dc99c70a99a6b91b16f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692156854, "uuid": "161fdb2a-77d5-413c-8a58-97ea7248c271", "value": "3072:6NK/yLrQbWaR5Qax8c/YtIZiftPRAqE3PC8tSoUMK:6EyLEbWaR5CcfifXc3PXS/MK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692156854, "uuid": "f649b169-8aa6-4d37-9d85-ddb90bf06add", "value": 389120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692156854, "uuid": "604f8c27-f64e-4f2b-b070-eaeae35cc96b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692156854, "uuid": "1759fa9e-6695-4cf6-a0ec-767ce1049888", "value": "2c32b46915b341c488a6323e7c3e2469", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57d51eb0-3c25-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1692184158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692184158, "uuid": "809c3755-5d4d-4e64-8c3f-6510d3bc97f9", "comment": "Malware payload (DCRat)", "value": "1be17fac645ce652683a5c336390052e", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692184158, "uuid": "569415f3-0cb3-45e8-9548-52aff3a63586", "comment": "Malware payload (DCRat)", "value": "b1cf5b547fe76867bbffdd9dc575ad92e47c4c0529c0ecfc646584b8fadf8e3c", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692184158, "uuid": "035f0ccc-e754-47e4-b0f7-af198c72e91e", "comment": "Malware payload (DCRat)", "value": "212c23870e5905283ca2800ae97994b9c13288ae", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692184158, "uuid": "61f18cb4-3a4d-48ea-8592-4d610c7390b2", "comment": "Malware payload (DCRat)", "value": "b898399fd82a819b2c533eb2943b3cbe569282a27acba7cb225eaeb55363267cf95ba1c26adab0b86bf01b1801f9dcb1", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692184158, "uuid": "5e596fca-08e6-4d10-b7d8-bd29d8cdf60f", "value": "T17F86338AB6E108F8C423403CC482D895E677786757B8E68343F9959B3F63982987FF15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692184158, "uuid": "7206d0c1-7dee-4e98-95d0-d776c5e67db6", "value": "ba5546933531fafa869b1f86a4e2a959", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692184158, "uuid": "73d2c606-6d67-4ad1-b080-efe93731629d", "value": "196608:88Ee+FP0X4FMIZETKwjPePdrQJ/BNOqAYPLo:T+FeQETKwvJHOqAKo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692184158, "uuid": "7a76c49a-91c4-4fa7-97d9-99ae8d4311bd", "value": 8147341, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692184158, "uuid": "bd34964f-b0d3-454a-914b-85f84f405acc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692184158, "uuid": "a4df4692-e9b7-4795-8134-fdd434e1f993", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e5fc5c8-3c4d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692201322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692201322, "uuid": "7cc05461-66f0-4378-8ce0-d1b64044392d", "comment": "Malware payload", "value": "1fb6a9f16c9b610a08c49867e5ef9f15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692201322, "uuid": "e9cf848d-9763-478a-b10e-faac65639810", "comment": "Malware payload", "value": "b20b4e7d4637065e0bf78dfd26c861976c0e8f605ee4986f42c56d7920e83e1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692201322, "uuid": "9fde4832-8b4c-44cb-b2e9-7b1bb81d3413", "comment": "Malware payload", "value": "4a226594c1e4b73575819c0339c9e6e91c1e2d29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692201322, "uuid": "9d18236f-b056-4751-a8f5-194fdc97c08e", "comment": "Malware payload", "value": "266339c2e39024db951230a5ef35bcacf6adb699fbc6498aa8734cc25185ba3ddaef787c63ed377209da9125273d13c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692201322, "uuid": "f818b890-457a-4556-b859-62fa6d8eb0cd", "value": "T1AE253DB015349645FF3D26BCC6D3433D2BB60933E1A2C0D87B32678A5DE2D521E6A798", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692201322, "uuid": "e00039c0-af8d-4bf1-bdbc-3e0b8b2611b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692201322, "uuid": "8ebe0aa3-cd3a-4b71-aad4-74c62b289802", "value": "24576:6QbCcpppXpppppCOopppXpppppCO4xqvrfXSFRJCG3t:5AO/ODrfXUe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692201322, "uuid": "d6024e4b-0007-409a-925e-58957f1efefd", "value": 1020928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692201322, "uuid": "89f5168b-b336-4633-b33c-ea5955174894", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692201322, "uuid": "8a19cdbf-aff2-41b6-a536-714e08a96661", "value": "Order availaible to ship-TWO USA-8.14.xlsl.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffa30b70-3c01-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692168977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692168977, "uuid": "bf826567-1d7e-45cf-a32e-d9c552b86d4b", "comment": "Malware payload (AgentTesla)", "value": "512f62783114fc8fcc55287f8662ef0f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692168977, "uuid": "e374353d-44c3-46f2-9c6e-f4f98081172d", "comment": "Malware payload (AgentTesla)", "value": "b29c9d76b4c43da47d986dd2afcd9c763b3a0a64f90cca291a4553168162645a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692168977, "uuid": "1d6a480c-a5ba-4778-958f-8bd807c304ce", "comment": "Malware payload (AgentTesla)", "value": "870b321754b2e42d088b29b9a24a2576fe7a97a1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692168977, "uuid": "3d6acc54-b8c7-4d5e-bd0e-632005094251", "comment": "Malware payload (AgentTesla)", "value": "716ed8c75536dcce77087f11a3e0d01288ebe73dc34ae38c47bea355ec1a9e08c8827f91f1513bf37b14f404baaf06bc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692168977, "uuid": "6342a203-d42e-42d2-b39a-24d4b7bf012e", "value": "T1F005F722E77B655AEF25A2E84E2F447179C6DC80F1B1C58CB7EB680385C23114E35BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692168977, "uuid": "6b2c520e-a274-40d4-a0d7-cec7b8ff53a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692168977, "uuid": "f273cbfd-02d6-4e45-95e9-1538bf8d1af5", "value": "24576:9wYRs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUOlOgu3AGn0f9lhDt7:9BRs6CE3jLbO9Rs6CE3jLbO7u3AGUlv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692168977, "uuid": "1970a312-3444-4735-8926-2efde8760814", "value": 844800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692168977, "uuid": "3214a389-46fc-41b5-b343-70ff6be34efa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692168977, "uuid": "659a09ac-6e77-4391-a57a-a8d2f54ef716", "value": "new invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea487a79-3c63-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692211032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211032, "uuid": "52460849-a262-4f0c-aab7-ab2058a5bf91", "comment": "Malware payload (Mirai)", "value": "30c7c401f695e9b94570878b4d12b476", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211032, "uuid": "67c66adf-17b5-4837-8e17-75c0179155c0", "comment": "Malware payload (Mirai)", "value": "b2ac31dfa7c6bce81d2d79a2d1a91c93ea3bbb1d45dbcbe262f726f639f7ff7f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211032, "uuid": "a69078c0-5caa-492d-a57f-f35459a1b5d9", "comment": "Malware payload (Mirai)", "value": "5449111d6ee105afa750e93d8f07c8356f14c2fa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211032, "uuid": "21e5c363-05fb-4e76-8351-02dd2d87245a", "comment": "Malware payload (Mirai)", "value": "c282a24616a2a8ad4aaf788b655928067efff335c0277cd48ef78e1a8f706c16ba958d8bbe70ef70adee9b0ff831f81f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211032, "uuid": "2aa3c5a0-6b7c-4170-9c49-165ec5c7a229", "value": "T1E1E2F1C9C5B2D0F2C1309E36F5AF840D561E0BFEDC7633677A2639541BC69402A3A2D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211032, "uuid": "0b8bb918-a676-46de-bbee-51cf8d84c8f2", "value": "768:58Lm6COq1fewFfTVj2UdmZkwq1eCJlB9FYu9q3UELdN:KLJCXfTVzt1VlB9FYTL7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692211032, "uuid": "444d6cd5-cc90-4d1b-86ee-30a1ba0b08c6", "value": 31872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692211032, "uuid": "11ee994f-a348-49a4-91a0-1c93fe4a3bf6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211032, "uuid": "69bb15df-28e3-4448-b2f6-725e71823e58", "value": "30c7c401f695e9b94570878b4d12b476", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa5d8cf3-3bca-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1692145346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692145346, "uuid": "2e645b47-dda1-41ab-8ca0-d1f597530328", "comment": "Malware payload (Gafgyt)", "value": "c755ef8b96c4b1ce9c0686a43c3c78cf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692145346, "uuid": "f9de1263-29ca-46d8-8001-f56ca7928b5c", "comment": "Malware payload (Gafgyt)", "value": "b37badaf55acb8b64009d82f849e9b6143bf4b857bb9a38a6386ae78ccc6a1a5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692145346, "uuid": "ceab1061-125c-4031-b930-fdc4bf662ba6", "comment": "Malware payload (Gafgyt)", "value": "6782126735c9b9cec40453dd06f6bb87296836d2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692145346, "uuid": "6660e858-e513-42f8-8ad8-8c568d03e55d", "comment": "Malware payload (Gafgyt)", "value": "109a687a2024f5f10d0a44e00f21af9ea59cdf08c7dc669a6a4aa00779c5d5a213c7204c4208bd7569d903911f53803e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692145346, "uuid": "b20c9aba-2e79-412d-93a5-d65fe11285a6", "value": "T1BDD35973D8296E68C564D5B4B034DF792B53A69181472FBE29BBC2B48083CCDF505BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692145346, "uuid": "07c217f9-6c7f-44ee-b6f4-74feaf3726b3", "value": "3072:hWIJRoGCVFmeFOWxCm6OD09JWTk0Eg3Ffn:hWIXsVQecWdEUTt3FP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692145346, "uuid": "7fb4fb22-6338-4f4b-8613-b2a80ff51efa", "value": 133920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692145346, "uuid": "1a291536-17b2-46ca-85cc-82bc7b789cc8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692145346, "uuid": "5375ddb6-6f22-4f8b-abf1-af85a0fa09d3", "value": "c755ef8b96c4b1ce9c0686a43c3c78cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a63a8d0f-3c13-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692176558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692176558, "uuid": "ccbfe75b-c14a-472e-8aa7-58cb613e451c", "comment": "Malware payload (AgentTesla)", "value": "bc206d38d467957a0895eab2faeec96d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692176558, "uuid": "c2c83bc3-66be-48d6-948f-11674cc6f4e1", "comment": "Malware payload (AgentTesla)", "value": "b6d27e1ebdb29559bdd0380eb284117b0d727c72ba67a74caa75ad0d9d586b8a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692176558, "uuid": "152d5701-2981-45fc-88d1-0be37c8699dd", "comment": "Malware payload (AgentTesla)", "value": "3be0b0d49bba2c2cbda6641060fb25dc9e0518ee", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692176558, "uuid": "db97c197-5994-4114-bc64-24519c670981", "comment": "Malware payload (AgentTesla)", "value": "295c1740e02c8ba8ef9b23bc768a2716c6847f34fb43e5b47b369f458011480f7944a2262fd2bf0579c200e337ee791f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692176558, "uuid": "f663b997-8e19-464e-b443-95114d2bd263", "value": "T19AC423F6D74444FD4EFC0F599823B88CBE3653805928528DB34A54E8B195AB0AE0D9FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692176558, "uuid": "d9ada3ee-cf22-4f89-b1e8-0c6243a0d211", "value": "12288:v8DdvVzB7vYeAxgr6OlrQu5hrX3ddDXReJ2iUIOxPEBUPLfjEiD4Omkn:a9pA7OlrQgjNdDBeJxUBx8B27E04Omq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692176558, "uuid": "d21da54f-c73f-4055-b440-655dcadc07e5", "value": 557777, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692176558, "uuid": "e770862f-82ac-4fe8-b2e5-f06ffe14ffdb", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692176558, "uuid": "b7213b8f-2aad-4f33-aa24-de6a42009e53", "value": "CI.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55bdfb12-3c3d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692194462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692194462, "uuid": "d478b212-26f7-4dc1-8ddc-b2a8edb03ce1", "comment": "Malware payload", "value": "3e8191898769512a245524e116d9f3b0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692194462, "uuid": "bea848d3-e367-49d4-96a8-585f8e98fb64", "comment": "Malware payload", "value": "b758242cd46514bc166fed7323126fbcc56bfb47560b0158a51278ec85c99c02", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692194462, "uuid": "7abb1c99-24de-4119-bea3-64ab1facacb5", "comment": "Malware payload", "value": "c4f7e8e08e9214700447b3f8b071e4a35c8634d2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692194462, "uuid": "889d37bb-079f-4331-a5e8-ef099a606fca", "comment": "Malware payload", "value": "bddfbb7af04de6f4b955c1af01e9e5564b45372d3a84f5f0520b7805c73d500b8c21c192131e379c5683b62449b80632", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692194462, "uuid": "3495923e-408f-4e6c-8436-10eecfb179ff", "value": "T12844431163FD5108FAF73F846DB592A40E26BCA6ED79D2AD12A0105E8AB2F40DD71733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692194462, "uuid": "aab6a98d-caf0-4bdd-b640-7ac4a0388734", "value": "3072:T2WoPpYBQpIv7N4Kd6idEKvomig87p15rASQ+:VE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692194462, "uuid": "0a4c8692-8b8e-4409-a19a-a15f8057064b", "value": 262418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692194462, "uuid": "45ad15e9-94fe-4fcc-bc61-c2f5d3e08fe5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692194462, "uuid": "3ab95d7b-90c8-4201-b196-f5e41c643f8e", "value": "Notice_4331860.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f561226-3c12-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692176063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692176063, "uuid": "df822d6f-0409-428d-adfc-282352465ff5", "comment": "Malware payload (Formbook)", "value": "82c3676aa6f06106028f7cba8560c0b9", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692176063, "uuid": "7680d37f-6edb-4353-9a72-ada972999b8b", "comment": "Malware payload (Formbook)", "value": "b86f13cfd7dcbd4bcc8854bcc8e9c1fbad55441e045ecee8acf6ac8ae6286a53", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692176063, "uuid": "d450a716-fb26-4d3d-a55a-a3294d114ee6", "comment": "Malware payload (Formbook)", "value": "7c2e1d3eb0e16e43e34d0a76251572f57c1c2f5e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692176063, "uuid": "fff91435-0501-4e88-9228-b0bab9a667c7", "comment": "Malware payload (Formbook)", "value": "f614fc3a251fb068d8335fe5934a64b006770e5837dbdfc47a21e3c43241a739b09d7e00c730be17d1572e679a5b3eaa", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692176063, "uuid": "4d606b4f-8ceb-4240-aeb8-dfdbcec97138", "value": "T18E3423E3E4250B5AE52D6B31749B3F48D4FE75832BDA48D0756621AACF92C700FB0978", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692176063, "uuid": "8fda000f-0199-45c7-a230-140525986555", "value": "6144:gBUSDVteBmv7Wgw05PE806hA1V2pSEwVe:gBUSDXeM1KOA/REw8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692176063, "uuid": "17e14655-4c20-4cb8-b1f4-66dac724bf3b", "value": 234450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692176063, "uuid": "af7b6822-17d4-4b51-a822-0927b86514d4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692176063, "uuid": "80c704fc-a19b-4933-8e5f-091a0ff113b9", "value": "Bill of lading.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c310275e-3c2e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692188203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188203, "uuid": "ce0d6553-9495-40d8-a7c8-cf042652374f", "comment": "Malware payload (Mirai)", "value": "816fbfcb43658d9d0e2a8a6a168a43f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188203, "uuid": "9dd96862-d4b6-4cd9-81d7-c5e8af4f47ff", "comment": "Malware payload (Mirai)", "value": "b890b5ba10c211d6a8292e765b664aeb7d53c5bc4137d99e1a7314481078ad74", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188203, "uuid": "060b79fa-2d83-42a2-a3fc-407e5c94d87d", "comment": "Malware payload (Mirai)", "value": "d3805593e796b473bf75b914edf7f9e5204361eb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188203, "uuid": "cf9d9604-60b8-4586-b01b-e7f26fe0ef0b", "comment": "Malware payload (Mirai)", "value": "3bf2fd192ddf652451f0336d7bb767c60cfcf0922fabcef9a50dec4016fdd359c617301db473e6c0c22c1685c09a255b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692188203, "uuid": "e4f9c052-8226-4f43-a8a2-47defa05759d", "value": "T14F336C36E029DED0C6560234A4E88F751F13F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692188203, "uuid": "4c0965b0-11d6-4aa0-aeb1-aa4e6a8ba710", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692188203, "uuid": "1c178a14-51d2-45c0-a338-56e7814b29cc", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692188203, "uuid": "0325a961-da00-4387-a8e3-d3a697d8401d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692188203, "uuid": "7c3e09eb-3cee-4945-a33c-b98e1dc22624", "value": "816fbfcb43658d9d0e2a8a6a168a43f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef99f662-3c63-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692211041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211041, "uuid": "0dec9551-df68-4803-8c64-613dfc6922bd", "comment": "Malware payload (Mirai)", "value": "40dd0b92cd0b6934e554d903a3a9064d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211041, "uuid": "f9227e0f-caad-4d13-bdbc-989045edfafa", "comment": "Malware payload (Mirai)", "value": "b95e4e8bd923effe67ae9c60779c8fc54034ffccf5501b72836807b5d23ebd51", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211041, "uuid": "8c7928a3-bc3a-44a0-a5b6-ddd6de09d936", "comment": "Malware payload (Mirai)", "value": "e69ac054ca4a0839f5ca481e9226c32f7cf81706", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211041, "uuid": "5f2724b8-7e68-479a-874e-a8f2908b75dd", "comment": "Malware payload (Mirai)", "value": "06b58346c3b9e91add7ca82ec88a4bdd706a2f4049d86f6335f303495650266a4e2f797139623a284c17a54d812bfa2e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211041, "uuid": "5ec51104-466b-42ed-a5d6-a19f7b3e758d", "value": "T1E0533B99F4028E3DF88FE9B984160E05B93023D212931B276BAEFDE37D331659D12D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211041, "uuid": "6dda5b43-6578-44e4-adbc-5fe83389f5f1", "value": "768:Ge4gpsM204GEkRbj3eXyVnQiiQthc3gFHu1eu48B8vB6J7EzNfXuuJpoz4K3G:Go3EkRbrtSiPDFu1X48B2SEzNfeuJw2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692211041, "uuid": "fa142fd3-3d7e-4311-a697-663165b528d6", "value": 65100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692211041, "uuid": "7a5913fe-c46e-49e1-94e2-94a27feaee44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211041, "uuid": "7f22f539-3497-428d-a88f-c887f215b396", "value": "40dd0b92cd0b6934e554d903a3a9064d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7ffe860-3c2e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692188211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188211, "uuid": "ee9bc482-0fdf-47ab-a03f-7689a696b25b", "comment": "Malware payload (Mirai)", "value": "3f3184be7da1c5a42a799676f9be630a", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188211, "uuid": "e1801753-d681-4cb8-a45a-04f0746606ec", "comment": "Malware payload (Mirai)", "value": "bb48d62b87cf582ee547bd5b751bc83b8b2137922cb2e73f3cf1d7a46f1c0273", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188211, "uuid": "be3cc107-af7b-472d-9395-e9c14d64df17", "comment": "Malware payload (Mirai)", "value": "9f0dbb2e72b588af2598abd0878637a1228ec6f0", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188211, "uuid": "413fc8b4-5289-49d7-93db-b575cc4f6ee7", "comment": "Malware payload (Mirai)", "value": "c8cfa937231e112b47998e496b906785d602897c699b617d6e0f54e97f3b8857c511232c5ff64ddea0b3a1db4dd85fab", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692188211, "uuid": "81f3d71a-4142-4913-9ce0-06575e96f2ef", "value": "T1F0D2D0EB68BFF177C0367874346005D4FB383512E31D976B0CEAADAC69F66913650A50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692188211, "uuid": "08601491-2b76-49fa-b4e6-ecc8f1188a21", "value": "768:UYSoXdJZ5U05VxmHSSc+H2c+lPQO5X0WSx0sR:UYJdJZ5UQVH/+KQO5XctR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692188211, "uuid": "f31c009a-04fc-4691-bb5e-ce4b09da6945", "value": 29432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692188211, "uuid": "f081b4fe-dcb2-4892-b144-39633ae6699f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692188211, "uuid": "138ba26b-e293-4662-9351-9491178d24ad", "value": "3f3184be7da1c5a42a799676f9be630a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2b9e84e-3c77-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692219609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692219609, "uuid": "27a7d47a-e836-4a39-ba42-f713e2d80954", "comment": "Malware payload (Mirai)", "value": "534d1923b721d65b63de8ea2a2a57c0e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692219609, "uuid": "68d27dd0-96fc-4408-b478-f1f070806f70", "comment": "Malware payload (Mirai)", "value": "bb95377514514e23201df4a562caf5f2fd082a85c86acdb71d4c3d5bf1d9e7ed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692219609, "uuid": "55735bc2-1b94-481e-96b9-13d9e3857f34", "comment": "Malware payload (Mirai)", "value": "d08c20d8654b7e63282ac817cfee08e4b3b16792", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692219609, "uuid": "5c32df58-69ce-4338-b846-fcf9184867d5", "comment": "Malware payload (Mirai)", "value": "67bbacf036cbef3e90e8e507a0ce9780b0ce5b88139d377d9b26f2f16f76bc6769c8e81ed0b8275636badcb93aeed56c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692219609, "uuid": "4620e82a-976c-4b4c-8ab5-57135b067e39", "value": "T186B31A37A61C0B43C09B55F02DB77BF24F69AEA313A611C46609FEC04B73AB22551F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692219609, "uuid": "67f4a162-28d9-4cae-925d-57aa191587c4", "value": "3072:pC/4rdZHsXsZwwR9wNk5mm/QcuLmHniPNb:pCwrvHwsZwY9wOmm/QcuLmHniPNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692219609, "uuid": "896ebf3d-47bd-4dae-a9b9-84f58fe63b0b", "value": 116786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692219609, "uuid": "800b0075-def1-491c-a3e1-06e40ee5c7dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692219609, "uuid": "f5354bb2-9adb-4ffb-b958-8ad233b076c2", "value": "534d1923b721d65b63de8ea2a2a57c0e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d41ebfb7-3c34-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692190808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692190808, "uuid": "b345b0de-1bb1-4006-9591-457c583744fd", "comment": "Malware payload (Formbook)", "value": "76d2e42c53fd1862ac549fa2be41c225", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692190808, "uuid": "b78478c6-0f6b-4847-bca8-02262a85f597", "comment": "Malware payload (Formbook)", "value": "bc2c45dcf1cb8fb1cfe74acb109569f9fd705f2dced5081e44af394ff4ac8d81", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692190808, "uuid": "87a8bf56-753e-4f34-9143-5fd42f9d1488", "comment": "Malware payload (Formbook)", "value": "23209ec7ed01fa36bad2b42561e5842f858e5451", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692190808, "uuid": "ba1b176b-ae63-4805-bddb-d1cb03f45e0d", "comment": "Malware payload (Formbook)", "value": "477019e76909709fc508a749f39b9f07a47ceae4c2addbd956c36d9e05b1d9a994a0adee9590770f0e29b6e20b9a79ed", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692190808, "uuid": "2430a9f9-e501-4df3-b649-a2d903cd4091", "value": "T19E4413E1C9693211D61AD0A103F22D2A9F8B33D852EE3B22758965564C6FCDEAD31A0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692190808, "uuid": "32fe981a-a83f-4e8c-8042-f7fed0308aba", "value": "6144:SBTTl4I86a8T74arJfJWTGk183j+BPkMnWqur:UHl4Ixa+D9JZkGT4PkMnWqur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692190808, "uuid": "72df041e-4877-43ec-ba81-e5019f542d4a", "value": 267665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692190808, "uuid": "af6bb629-76ee-48a9-aac6-7a36d4972306", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692190808, "uuid": "22ad3a4a-50d1-45c5-ad38-c4806bf37511", "value": "Sales Contract 2023.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d68a8cac-3bce-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692147004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692147004, "uuid": "47c9ca8e-e28e-427f-ac23-4cfcf41862c9", "comment": "Malware payload (Mirai)", "value": "656c6a01de888c5f8a936baf2c0f6451", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692147004, "uuid": "726a7100-ca2d-40d9-959a-deb6c53f5b4a", "comment": "Malware payload (Mirai)", "value": "bc4a3ffaf6c43c0c918dcde468b311b4eb967a24bc67a0128e89229a81d3abb7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692147004, "uuid": "b37025a0-c320-4040-9212-89bcc28b6a3c", "comment": "Malware payload (Mirai)", "value": "4b0569549a2ef9eb3fd3a26abfb0a58f93cb7957", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692147004, "uuid": "d7644710-493b-40a3-8db5-840e6a2fc44a", "comment": "Malware payload (Mirai)", "value": "4a0231e3aae3a6e27f5a226cafcebb3bbab05ef0037e5e26f17f7dca4f6ba4455a9d7802956671d9a6600b652f624248", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692147004, "uuid": "237f24da-5b78-458b-bc7e-c9ae56773a7e", "value": "T15863E75AF9819F11D4D522BEFE0E1189332367A8E3EE7112DD215B2567CA92B0F7B402", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692147004, "uuid": "a58403ef-aaf9-45fb-ab39-a92882ac5a79", "value": "1536:k5n7BoMZ92vPlyhCCy4bo9TmAFYhq8HeTlN9lrViSKD5V:GBz2Hl4+io9KAOhq8He/tKDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692147004, "uuid": "ffc0809b-6c40-4962-9059-071bc6b3adef", "value": 70032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692147004, "uuid": "0a7b0d48-3252-4184-ae13-ec7c42b1eef0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692147004, "uuid": "d24f705c-e9d4-4424-9dbd-fd0dbf244c90", "value": "la.bot.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa14e387-3c29-11ee-a6f9-42010a9c0055", "comment": "Malware payload (STRRAT)", "timestamp": 1692186013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692186013, "uuid": "b458be4b-90aa-4070-8525-0faedc7ca0f5", "comment": "Malware payload (STRRAT)", "value": "5124131a36cb434f5b3b78e4cd2841fe", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692186013, "uuid": "55d5e0b6-1a44-4296-8583-b87bafb4648d", "comment": "Malware payload (STRRAT)", "value": "bd3635be7a55b651be08f30b8bf19da6389d7cb79e40ed04956f6910d4992762", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692186013, "uuid": "2df1195a-eb01-4018-a809-8d01824bfec2", "comment": "Malware payload (STRRAT)", "value": "ca0c564957b8c13ab3d6b8ed3a1e61e529c3bf18", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692186013, "uuid": "01d2e556-d920-4e98-bfd8-b50a81c51b34", "comment": "Malware payload (STRRAT)", "value": "73f9e788323be9b94f37d2314d2f5e48bb7d486f211c11dc6cea82e912c6375769d2392d2ab03994b43d1c1edcb038b9", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692186013, "uuid": "1054f975-2fe9-4358-b1b8-ccad5c719800", "value": "T1D863F12BBEE0D42DE63F16386289A4D708CE84C5F91BB00BAD8513554661CDA17CBFE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692186013, "uuid": "bca56dfd-e1ca-4443-b928-8f434cbac3b6", "value": "1536:jajdqnHM8byAhPyFdSKgE1LQvs+H4kThUvnGJMGPM0fp:W5as8hK3Tg0Ws44kTOPp8x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692186013, "uuid": "db8444b6-b5dd-404f-8683-38af7bee7904", "value": 72290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692186013, "uuid": "749796e3-3692-4f7b-bd53-ef537a759e63", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692186013, "uuid": "144b612e-2786-461b-814c-df42bcc6d5bd", "value": "PaymentAdvice.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3acda62-3c31-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LaplasClipper)", "timestamp": 1692189519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692189519, "uuid": "de7cae71-c513-40d6-9b0c-bce9f3c1e71f", "comment": "Malware payload (LaplasClipper)", "value": "e5cbc0114ff238740e72e907ad20223c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692189519, "uuid": "ae912c90-3dd1-42e0-955f-8854f186d965", "comment": "Malware payload (LaplasClipper)", "value": "bdf326424f960a66d01dd645db9fd335a157ceb86d7f482ff15205fa7d9cc7b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692189519, "uuid": "e7427775-fc58-485e-967a-9ebc91600dc5", "comment": "Malware payload (LaplasClipper)", "value": "98c5d3c714adb3fbef71c19eaaa53cb680dd2d91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692189519, "uuid": "7ee2d76a-dc3b-4cb4-a0e9-f7bb421eaeb1", "comment": "Malware payload (LaplasClipper)", "value": "e043afbba4b80cd842010be1bed15e2891cedbe6e4a50e1d81e0a2f75752d60202d18695d524b885d45aed520fb298c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692189519, "uuid": "a6c8cef3-b46e-4352-93c0-baa00910a914", "value": "T17C95234372AEB860E5178E325E3BC1F4763DBA259F5E1A56623DBF2F08B09B08553311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692189519, "uuid": "938794e5-2c18-4def-9725-64999226cf4d", "value": "d318a260f63cbb9427df058a9e28a3ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692189519, "uuid": "3c1d9e71-e849-42fa-bdcb-8f1595c778eb", "value": "49152:bm/7cijxOPr17ocI5ut5TrCEJ5GtFRpr:bm/7cijcPr9ocI5K5NjGnL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692189519, "uuid": "cafcf8e5-26a2-42a2-9764-7e0b4f55f67f", "value": 1925632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692189519, "uuid": "27c230c9-9551-4b46-95a2-9b6d12be1eeb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692189519, "uuid": "d64d0843-5827-4754-82a6-cbb67fa0d04e", "value": "e5cbc0114ff238740e72e907ad20223c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e1781a5-3c01-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692168787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692168787, "uuid": "e3f78556-38c6-4da6-a69e-ed82ee601523", "comment": "Malware payload (AgentTesla)", "value": "2c25a8e3dacee86eb44b23edb1b69656", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692168787, "uuid": "c9df87f6-bc3c-4740-b474-6c944373e5ac", "comment": "Malware payload (AgentTesla)", "value": "bf149d09f72fe32445b0903f5bf24980e7871350ae87036ab9c9dbf76ecd9d84", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692168787, "uuid": "5c882a05-574b-4f2f-aa97-5af82fcf5f14", "comment": "Malware payload (AgentTesla)", "value": "6c0b87b50254020886a7efa45086c26c84ec3036", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692168787, "uuid": "faa2aff2-fd96-427e-ad9d-30db287ddd6c", "comment": "Malware payload (AgentTesla)", "value": "706ca6a5aebef7df58ddd544c18b378449abc9a6d0eaee09f4fe76c5b9bdaa4767d03dcf6d4fc9dba3dc67f978d96cb1", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692168787, "uuid": "7a66fb84-b20e-4734-a5a4-82df59f349f3", "value": "T18F0523565DCA1976F2CE21F1237DA3BC6A02EE13A3B114395943C0A719B7C4B04E6DF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692168787, "uuid": "131d204b-6ec3-4099-8c26-5cfa0dde6aef", "value": "24576:ISDN9gi9cYOptz2Y4kkfCzbcmYL4FohCO60:ISD3V9cYOpxLqfUYEFo560", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692168787, "uuid": "ff3cf285-2c55-4bc9-8901-c71df0e00f8e", "value": 863882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692168787, "uuid": "0b02d391-59fd-4ce0-acf5-6df8ae4758f2", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692168787, "uuid": "eb6c07fe-5520-4a6f-82d4-80bb58244edf", "value": "anfrage.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8dc3c72-3c77-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692219646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692219646, "uuid": "c633743f-e214-46a3-b0bd-0c58f5ae8752", "comment": "Malware payload (Mirai)", "value": "6ea210d614a8adc5db48e6ecff6c9ad3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692219646, "uuid": "9213132f-b575-47ad-b73d-5966b197b1f7", "comment": "Malware payload (Mirai)", "value": "bf498ec6151f52c7b0c8f6dca737d3606e6c825db1b68432b653cd678fb6da02", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692219646, "uuid": "299ba8f3-332b-468d-ac50-6302c42e4f77", "comment": "Malware payload (Mirai)", "value": "7e3cc10e8d11c1b5b542d6bd2b6220a59fb28d16", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692219646, "uuid": "db286a81-543e-46bb-a355-3e6039c3eb46", "comment": "Malware payload (Mirai)", "value": "61592d62cd7adbf761fb19b0c59d3d4fe4a419a5f62f62115937ee1303c0a078242b04ab71cb12aa4696399615a81bdb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692219646, "uuid": "fa5ecc30-2fb4-40e4-8d4a-b7f3671878c5", "value": "T174B31877A4654F73C045A5F125BA9A310F12AD931B1F1A88763CB6B04A3B4CEB84EF58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692219646, "uuid": "f8b0ad77-3b23-4cd5-9d65-d048a0aebcf9", "value": "3072:MDVLSItJP+Xsp4JlN3HYjmH1cuEgvniuN/:MDV+ItJH2l3HYjmH1cuEgvniuN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692219646, "uuid": "33fd65b7-f618-489b-a1a3-6b7f6bce4dc3", "value": 112633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692219646, "uuid": "4d21d41b-392c-434b-824a-3220e7c0081b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692219646, "uuid": "c847784f-0328-44c8-bba9-8108d798eba6", "value": "6ea210d614a8adc5db48e6ecff6c9ad3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e16c262-3bed-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692160197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692160197, "uuid": "7d2ac13f-3be8-4bb0-9f8d-b4f2fff04867", "comment": "Malware payload", "value": "80e3717e2965f3b0cd754976821155e2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692160197, "uuid": "8cd25056-b587-4190-8da9-6ebee4a25213", "comment": "Malware payload", "value": "bf568d0a624473027d3ca25aeeb6a8c7bd6a43585ae6866aea562c990f3d8f9d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692160197, "uuid": "f3cb9e6a-7b44-44b5-ab68-1dfd7cb7b87b", "comment": "Malware payload", "value": "10881edc98dbcaa88568de5fa0d34afb2ccfeef6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692160197, "uuid": "0d0e44b5-03ed-4e3f-8160-0c2a0709149d", "comment": "Malware payload", "value": "4332e0fd27e18f939d26e5e077d26887a6c0405deaa8105373b132018e7e64f4006a228f795e39564928095a8c2c2166", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692160197, "uuid": "c19727f6-e5cc-4936-bda3-975499d9a974", "value": "T11533F18EE6D13E6CEEEF1E36107E423541D0719074BA94C96B01AC625F3BCCB65CA86C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692160197, "uuid": "327f262a-6fa3-4ab2-a545-30e1ae2d0b8b", "value": "1536:BYlT2wMACvm9ejzlVZQV1Lhmn2SdGZf83TZF4X4JO:GtSAKhu5C8ZfwTSX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692160197, "uuid": "5343abd2-f843-4a7e-bcbc-56146fa36c53", "value": 51760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692160197, "uuid": "377f7dd8-690f-42e5-93ee-67622d09dcb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692160197, "uuid": "edf7a603-218e-4f79-869b-48e390bcae8c", "value": "80e3717e2965f3b0cd754976821155e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b788945-3c3d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692194472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692194472, "uuid": "1a0271b2-8d0e-4375-9db7-17e6ff43088e", "comment": "Malware payload", "value": "8831383636fc14d3fa37b70dd9573719", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692194472, "uuid": "b3bc2074-dff7-44f4-a2d0-25e6922f9634", "comment": "Malware payload", "value": "bf8e971d4e6c0628de96a3976e704dfdeca56dc5a53b0153bee0a9dc50808625", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692194472, "uuid": "09ab846c-d652-49e1-9493-90f5e9ca2bf2", "comment": "Malware payload", "value": "9c9dbeee2a2a17a73b7dc7d29a00323d9bd73ca2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692194472, "uuid": "1e38d185-9a73-45b3-81d8-1a209bf5b464", "comment": "Malware payload", "value": "20d6926378e48ba9dbf9db0b55552f9ce98185a6a21efcbdd8bcf2689c286faf9d03435bbfc7b26a2e2261d09f3acdc1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692194472, "uuid": "bc2bbea3-300d-48f4-b4d9-c3844fc41904", "value": "T1BBB43211A3FD5108FAF73F806DB5A2A44E26BCA6EDB9D2AD1250105E8A72F40DD70733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692194472, "uuid": "f325bd17-166f-4ba5-8c87-6fcc5524f618", "value": "3072:Yzmzxnu80Ol/RiV4VN4KjqNUGkPmQnserYWjwfhE9MIuz70wle3l9:PJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692194472, "uuid": "5769290c-d937-46d7-9cc8-0a9cdfbb411f", "value": 536574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692194472, "uuid": "8e1fe20b-3c1a-433b-8ccd-e57fb75a1db0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692194472, "uuid": "264844ee-f6a7-4473-8a1a-86781b8ad636", "value": "Notice_5595225.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e169dd20-3c34-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692190831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692190831, "uuid": "ec389726-e24f-47f7-a87d-83ed071b62cf", "comment": "Malware payload (Formbook)", "value": "0e75bbe5c51766f7bb4d46c1df5a2a88", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692190831, "uuid": "7129b492-c661-4c65-9c76-fa21991bd733", "comment": "Malware payload (Formbook)", "value": "c00286f39747df6bfac21279612c4a6c29924140465de8bb62ee804064d97b8f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692190831, "uuid": "16ef3fd6-7b22-4222-90eb-a42592f1aa18", "comment": "Malware payload (Formbook)", "value": "b95a81be6c8ab3d9a6c00c8de9a871534f0f584f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692190831, "uuid": "faf538eb-ba17-425b-990e-c61b9afcb4b2", "comment": "Malware payload (Formbook)", "value": "3b813ec025a5a6d32d0233682a87313a8e9ca17edb574d975495d606e3863fdbaeb6c4fc5edc135b800369cce9388cc5", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692190831, "uuid": "be884a1b-6213-46e9-83bd-b9c8a823dec3", "value": "T1144423E1C9693211D61ED0A103F22D2E9F8B32D852EE3F22758965564C7FCDEAD31A0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692190831, "uuid": "fb503cc7-38fb-4b8f-9324-3cc1766dc9cc", "value": "6144:gBTTl4I86a8T74arJfJWTGk183j+BPkMnWquz:OHl4Ixa+D9JZkGT4PkMnWquz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692190831, "uuid": "80384650-5644-4228-8122-d9b2a9e209e0", "value": 267693, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692190831, "uuid": "d150597f-ff7a-4396-a41e-7871aa4db32b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692190831, "uuid": "4e1aba76-445f-452e-8aaf-ebc1610ee3a2", "value": "MYER PO#3260913, 3260916, 3260929.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86ae199c-3c07-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1692171351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692171351, "uuid": "e9192c57-7f4c-4108-86cb-477f6029e631", "comment": "Malware payload (Amadey)", "value": "aa486e83365ae67a5778758685ca4d6f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692171351, "uuid": "cc0fece0-0d2a-4226-9592-dad39315d6b1", "comment": "Malware payload (Amadey)", "value": "c010da0b5ee5ca9b8d48491d007af10e5b80f6d7950145e1cf81a195c19836d7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692171351, "uuid": "2863cae5-cd90-4648-a00f-1392c08db5a1", "comment": "Malware payload (Amadey)", "value": "633e328f5deb9c09e99368fa25f6deca4a601bbb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692171351, "uuid": "3a908e66-9360-4f25-ac96-ce683ac4c68b", "comment": "Malware payload (Amadey)", "value": "6839c20057fa42af482cdf724be808ea44405cb3b508815bfa6369fd5c121ecc03bc14804a005fa89e8ff2d487b04473", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692171351, "uuid": "905ce5ed-e8ae-40fc-afe9-1525200490ae", "value": "T14AB527017FA9CA72D129BA37C6C2142543F2A9C76712E61B3EC227C60913BDF4DD694B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692171351, "uuid": "825a865c-7210-4cac-8f2f-8fe147d00671", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692171351, "uuid": "2df6c38c-620e-48c1-bf53-e13b1895760a", "value": "24576:hH1FcclmgReLIGaIhJxSJ2lKZZAsKQ7F1RBdaBZZR0DBfg92KVOikDlbnJ6dT17x:DlbKxF8qg11A1o6Xqm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692171351, "uuid": "3f3ab0f6-553a-40d6-83d7-090c6a135f75", "value": 2367488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692171351, "uuid": "7e4713af-d3c4-4f33-8f80-3c371dbc234c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692171351, "uuid": "48752ab5-89c8-4d03-8afd-f041878b99f6", "value": "aa486e83365ae67a5778758685ca4d6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a2ba8e1-3c65-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692211515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211515, "uuid": "30fae686-d3eb-4d36-9e22-cad74ee8f25e", "comment": "Malware payload (AgentTesla)", "value": "adc5ece44281c2a8b565424a4a56c367", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211515, "uuid": "b6a2188f-77cf-45fe-9cbb-ea8f7fed7630", "comment": "Malware payload (AgentTesla)", "value": "c1091eace5ea1fda0f62bfbbf244c25dd8deb6d26472ec86fec81992adbb0b2b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211515, "uuid": "50d6a48b-a0f2-42bb-ad1f-5efd58efb5bb", "comment": "Malware payload (AgentTesla)", "value": "3ec8953b5438f4a94099ee0f1cad15e330919d75", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211515, "uuid": "fffb1eac-9ff0-4d55-b6d5-7fcea00f8ea9", "comment": "Malware payload (AgentTesla)", "value": "1b438bccf97e300a06f07aa00767f2527acdf0ca0dc75e47f0aea88dfdc87202bfc034c93667f6a9e57beb5c8ec69b54", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211515, "uuid": "f8b17717-2114-486b-8a1e-3af12162df46", "value": "T13FC423D309861205878396CDA9AC4B50B895B4B9F33FE973D3DABC80A9C01786BD3757", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211515, "uuid": "bfe7a593-e495-4cc5-96b2-d7c37e2d01a2", "value": "12288:79G6/B7pnEu8YLNY1ct2bh+w0TOZI+upleRDOUC:79f/vnEuDLFy0TOZI0Rq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692211515, "uuid": "aeb617c0-6850-49d8-a40e-c929b128b48d", "value": 588602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692211515, "uuid": "e35e8d46-ca4f-48b2-8e65-4166781b7c80", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211515, "uuid": "3ddbe14f-a438-425e-b6d2-b0109d689fdf", "value": "New order#2_W4355097002.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5e5f715-3c36-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1692191697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692191697, "uuid": "50785fc8-cabf-482b-afba-9b1e0859a360", "comment": "Malware payload (CoinMiner)", "value": "3b27f584157b2b53c41a5bc80751a817", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692191697, "uuid": "7da444b7-9bb4-43bd-a7e2-8a24b23e4e22", "comment": "Malware payload (CoinMiner)", "value": "c29e86a3004211718df934dff69c681243ecd855e3749ecb76e2bc490aa01456", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692191697, "uuid": "305f3bd8-18fa-4e2a-9573-21c5121a1449", "comment": "Malware payload (CoinMiner)", "value": "a103ec0692dce259f35308868d36427558501101", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692191697, "uuid": "1d773c6b-b44c-4088-a47b-d5d2eddc7d67", "comment": "Malware payload (CoinMiner)", "value": "0c3b2731f83fab8d2d8f2c4c6404f6f908c5f5ac48359a7df88ed4558b4049bcc91639f24ea6337d484973e8f1277216", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692191697, "uuid": "d00f0194-35ec-4839-8405-127a84aed7b5", "value": "T18156D0DFE26688EACFF89FFA130236443891F560D2C1D59D7864298A0BC4D783DA4D79", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692191697, "uuid": "1ff2dd53-037d-4fc0-ba93-eb03969b57f9", "value": "d3be2dc19ba54f7225d7679c3f791cf7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692191697, "uuid": "41f7987e-192f-456b-8b4b-cd6509af4621", "value": "98304:VbTtpZeefe0LEz0HJJcXYIZHUx2qWD/8xxAyZUN1mKm0Pk:VbJpvLLEKJ8ZHUxVw8CNFk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692191697, "uuid": "c06a1683-21d4-4236-bbb2-fa1c3b630a0f", "value": 6025104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692191697, "uuid": "d0a638b2-f402-48d1-8b18-f384219830f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692191697, "uuid": "1d84bf6f-7db9-4092-bdfe-8e6953d7ab89", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0050d9e7-3c0c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692173273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692173273, "uuid": "03a8b03e-5f55-486a-b6b1-237752d7099f", "comment": "Malware payload", "value": "6198271ff4fddc87447ca2c6e5149916", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692173273, "uuid": "7583eb39-308b-4650-85a9-850a67b79752", "comment": "Malware payload", "value": "c3276dc4c8fc391de453a3fe3172cde5c84121a81309052fe99b355a4c531446", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692173273, "uuid": "c5bdd16e-63df-445e-aee8-9db74a6e824b", "comment": "Malware payload", "value": "97dcff181df3465392b76440ce32555cdf4223bc", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692173273, "uuid": "20798c46-208a-4a25-9abc-51df6bc34472", "comment": "Malware payload", "value": "ae7ef7745cf2bd487e4ef0dbeada3e1e440029f6b2c2040e190b27f59e2a41f4c5ec7e151741fba849e9936eb4e57059", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692173273, "uuid": "d2c7e3a2-bbd3-45da-b03e-e70b3c875135", "value": "T1DAE312369D4F4E4ED03496F983A7B38F4A27B227B5F60846F61E5700C347F0902A5B56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692173273, "uuid": "c399b0e1-b398-4ba0-89dd-dfc88fb76c55", "value": "3072:E71tq+zzTznq/Lyk64k7q9mE1rynYAtZDjg7O1NH1XtiwZ1zvnS4:gCUDqDT7XF1yzDjl1NHTP1zvn/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692173273, "uuid": "99f7b334-72cb-4e56-9701-7c99681d50c1", "value": 152878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692173273, "uuid": "0fc10a7f-8646-4ead-9472-a932d8b325fd", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692173273, "uuid": "5bbfcaf0-cefa-451f-a748-f5006013cee5", "value": "\u5173\u4e8e\u6838\u5bf92023\u5e74\u4eba\u529b\u8d44\u6e90\u90e8\u5bf9\u7535\u5546\u90e8\u652f\u6491\u60c5\u51b5\u7684\u901a\u77e5.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83cc210d-3bed-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692160179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692160179, "uuid": "955a846a-3681-42ca-84fb-7c0e7af91820", "comment": "Malware payload (Mirai)", "value": "5e20e44e8e1edbb4612bab78b93ddb74", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692160179, "uuid": "1243a519-138e-4be4-b7bd-01afbe723db7", "comment": "Malware payload (Mirai)", "value": "c4c28d073462073ab948bf30f7fe198f54f2d75aea6e909ea1a8eb92fbbb61b7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692160179, "uuid": "e983869d-9145-401a-8aba-4a72cad440a9", "comment": "Malware payload (Mirai)", "value": "1af1f68962d78aad70728b45fa3874ac108b036e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692160179, "uuid": "82bd35f4-1b4f-4e40-9689-46898f89d886", "comment": "Malware payload (Mirai)", "value": "c57ca3de0f4ae04ad206331d1c1498a613e0eb84fa007b352e6a4b00d3580f9aaf6513df00e48c99ab459e1010ff0050", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692160179, "uuid": "15a8b995-3f7d-4f19-b107-d01d954f3e9e", "value": "T12CF33FA2A84CC6C7D0166279A0DD8F3BDE7E72D72745CE027DD120368E91EDB291BD81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692160179, "uuid": "bfe128c2-7283-4f1a-b06c-8eb19e8df130", "value": "3072:r90C0vqJo4RL33q8Q6ZHh7nSEmdejObWNTYzpoAz0DVopw8sEyEjVT4ijZ:raC0vqJo4RLHRQ6ZHh7nSEmdejObWNTC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692160179, "uuid": "9cf8d7b5-afd5-4b1b-99b3-ed5d77895cb5", "value": 161512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692160179, "uuid": "019d3687-5b94-424f-a74b-e70b12db070c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692160179, "uuid": "bb1aaec0-5164-46e5-bf11-2e5bada2b67e", "value": "5e20e44e8e1edbb4612bab78b93ddb74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75308424-3be6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692157148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692157148, "uuid": "4cf777b5-8190-46a7-bdb7-a953ae347926", "comment": "Malware payload (RedLineStealer)", "value": "ef8272b8854963717097c26092490bf5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692157148, "uuid": "86ab088d-3c51-4e35-98c1-ceeae2c78631", "comment": "Malware payload (RedLineStealer)", "value": "c5c07f198b8a705a5546d1a813175006eb931d070bf64182256637a10a9ed232", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692157148, "uuid": "7947c129-5e00-4e70-b50e-0aa30dcba185", "comment": "Malware payload (RedLineStealer)", "value": "553aa5b46a4ef8d648f4bc986894d0be7a5bf4b4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692157148, "uuid": "40faf421-4363-4987-9394-45917c771473", "comment": "Malware payload (RedLineStealer)", "value": "23f727d492b51373d189e437e6228014030bd978b3b4ac0678426b356f8a86dbc9e9085516839b2a2662b4df1722c0bf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692157148, "uuid": "1185bf59-2bd1-473a-a960-49d9ad5c860a", "value": "T13F4522063881E4B3D4B6217581E0C7790A7A69750B6690E7FADE1BBB7F187D0A3312CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692157148, "uuid": "bcc2524b-568b-4076-92c6-7aec606a38b0", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692157148, "uuid": "6ff6bef9-83e5-40da-9d18-f2bf95376b3f", "value": "24576:6k70TrcqDji728OUVwpjc4ytpNqbjk+TZyTlZ8KrMOpNUXb2jITrL04yGuF3w:6kQTAqDjiac4ytpNijk2op9sbAITrLfL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692157148, "uuid": "5eb98a56-3466-44e2-8874-f86a6402ee8b", "value": 1254912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692157148, "uuid": "b5beabee-dd97-490d-bc26-baf17cfedb9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692157148, "uuid": "10fb7b72-b611-4710-b65c-9f140802045a", "value": "ef8272b8854963717097c26092490bf5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f13649a-3be9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692158292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692158292, "uuid": "495121cc-eb1c-4ee1-904d-37871596129d", "comment": "Malware payload (Mirai)", "value": "d61bd5fc97768b1fef6ab4539179d486", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692158292, "uuid": "d61e47d9-e1ef-402c-985c-10c766f0ea48", "comment": "Malware payload (Mirai)", "value": "c5e7158b2a545d2cd4de6176c9879cdc5437ff339d7cb7fdfbb87b5ae98a33a4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692158292, "uuid": "83b1207e-4185-4143-8ed2-9cf73f51d586", "comment": "Malware payload (Mirai)", "value": "6903019c677e10e237104058b4d5ff945fae6b0e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692158292, "uuid": "3953b88b-e8f0-407a-81e5-806559829f8d", "comment": "Malware payload (Mirai)", "value": "29f630a16161308a1b2e4c40b7250cef90bff64a0f524a00555d95804ea7de59db7fa6ae24039763c2c3eedf12325350", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692158292, "uuid": "6cfe68f6-16e0-4a07-9353-bfaae1d3e786", "value": "T1AA632A56B8819B11D5C112BAFE1E118E7313477CE3DEB3229D24AF24738B96B0E7B506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692158292, "uuid": "d8a9300e-bc30-4221-9177-e17a5fad29d4", "value": "1536:rXnPhcKu7/DS0/gkYLaABVaxeWIQIMmiY5o5PtXc37+h54T:rhDu7L3VZABVaxU5o5PtXc3KhqT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692158292, "uuid": "4af45651-a4ca-40a4-aaaf-fb2db4ad0c2d", "value": 72992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692158292, "uuid": "0d1a4303-f568-42b8-8bf5-e1c35f63d661", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692158292, "uuid": "82751b49-1874-4872-80cf-199e9f21a7b2", "value": "arm6.nn-20230816-0358", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27d01f45-3c35-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692190949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692190949, "uuid": "7070517a-3722-4143-ab43-b586af0eab07", "comment": "Malware payload (AgentTesla)", "value": "63b22a598a3265464805fc889cfd1dbc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692190949, "uuid": "64564087-2cd4-4cb9-9b5c-21cdfe3df592", "comment": "Malware payload (AgentTesla)", "value": "c62efb929b1807011eaed4e8c50d2c9870fbb4bf67af212abca6be1043286e54", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692190949, "uuid": "f80bb5d3-7181-4a05-af18-b52e870cd38e", "comment": "Malware payload (AgentTesla)", "value": "2153e9b47a9be2e1075191e06018a7caec6a3e01", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692190949, "uuid": "c454c127-2048-4bb4-8ae5-6e5a15d3ea22", "comment": "Malware payload (AgentTesla)", "value": "e4c800ae0b27a5ef2b89e0ce4830530cd7762c9bd943e5c12737b6f44269f1bf7f84a97cec168873eac23b0b69246b9f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692190949, "uuid": "eb51b4ab-8332-4274-957d-a4ce02af5889", "value": "T17CE4DF386E938096D5FF07F2391992534FEEADED24B4C756223033391EB539D990A272", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692190949, "uuid": "28c72e58-2327-44c0-b275-967f6a226389", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692190949, "uuid": "c9aad94f-a16d-487e-865e-2dfb4f6d2c82", "value": "6144:WYa6rHUPAE9LupuvAiybV2KD1vi9+C174Dck6S2Vq5h70kQ:WYFUPb9Lupu4iI3K9+Ci/6S20hq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692190949, "uuid": "ad375255-e1ec-4022-b500-b64b803a889f", "value": 662166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692190949, "uuid": "2dd2eec9-8aa1-4957-8d1d-5c20cefbc688", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692190949, "uuid": "9fae84c2-c14c-492c-8e70-2cc13fbe3102", "value": "ACCEPT_014STSY529093.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d14c1a1c-3c39-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GhostRAT)", "timestamp": 1692192951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692192951, "uuid": "27de5413-25d1-4f5c-84c9-ec97994341e7", "comment": "Malware payload (GhostRAT)", "value": "010cfb902cae00576e39556914eb7af5", "object_relation": "md5", "Tag": [ { "name": "GhostRat", "colour": "#66C979", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692192951, "uuid": "be8cbaef-7eb6-4c5d-9a35-4ccc282a2e80", "comment": "Malware payload (GhostRAT)", "value": "c79ac8a613c7a25793b2a0167d48a6a5e8e7c811ccdaf01d0a47efc7dff99dbd", "object_relation": "sha256", "Tag": [ { "name": "GhostRat", "colour": "#66C979", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692192951, "uuid": "5c9d44cd-2505-4359-8175-19cc01b4e293", "comment": "Malware payload (GhostRAT)", "value": "86bb5ed57999602fc4540ace6086a891c996e3f3", "object_relation": "sha1", "Tag": [ { "name": "GhostRat", "colour": "#66C979", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692192951, "uuid": "a3fd567a-15f1-45ce-8cd4-d8edade9b2bd", "comment": "Malware payload (GhostRAT)", "value": "6823c56815acc45bb52bee0a053a4bf3fea1cf5d8fc0cac817d048e62e3da1be3cb8e399fc9cd16af1621705c44b6669", "object_relation": "sha3-384", "Tag": [ { "name": "GhostRat", "colour": "#66C979", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692192951, "uuid": "bc0a6c2e-da5f-47dd-832b-d672fafca74d", "value": "T1E7E2E0EE54278A42B78816E78C0A5C5031851BB4744AFB4DAEF7EDBD00B253371CEB66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692192951, "uuid": "4bfb699f-486a-4391-af53-da0ffff371f9", "value": "768:1WNTeakdIbb8karXzilV7uUdzM1VyY8dLDFa1X87MEH2fZz:1WxeanbmXeF3doVypdL5amYEHw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692192951, "uuid": "fa8fa888-321f-438d-94d1-c6c548708946", "value": 33050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692192951, "uuid": "a25322e7-5183-4595-b5a6-ac6d07d67ea7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692192951, "uuid": "2eb7fcb2-7d9c-40ad-a375-0fa523e22801", "value": "Unconfirmed 609728.crdownload", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79c3f7ea-3c0e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692174336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174336, "uuid": "390abf97-ea0e-40c0-8372-afe276da6194", "comment": "Malware payload (Mirai)", "value": "2a39d576d37c6b028784aa2118575b2e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174336, "uuid": "9b54d110-6401-4ce5-b264-e4032f426df5", "comment": "Malware payload (Mirai)", "value": "c8895f5d4809b396733393d65e8824188235c9b553f1667e47b42ee648af08b4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174336, "uuid": "108dee12-15e2-4d98-94ab-99b693425364", "comment": "Malware payload (Mirai)", "value": "4a7ebc175a0493012cfb660907d1a23e86e811df", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174336, "uuid": "0fddd41a-a8a1-44f9-81ef-f2f5190bc36f", "comment": "Malware payload (Mirai)", "value": "13190aa37d59079321446c9dc9e2afb16a890abbcbab13c568072994714c900fe74292318bbb81e4f90c49a688b90c14", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692174336, "uuid": "31fa7f19-4a0c-403a-b581-51324c0a9f5f", "value": "T1AAD2E151B5099CF0C2B01DB255AA5152B33909FDFCE3B57836244E38BAE681226F94F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692174336, "uuid": "78f2e64b-a793-4f5e-a017-ebf6e218b79a", "value": "768:ACWn1lamBgQnuXjQhcxc/Wa8IujKOkn3Uf:Ax1laPQnuQEeWa8DWa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692174336, "uuid": "d27c394c-527b-4cb7-9aa3-5449941094e4", "value": 30308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692174336, "uuid": "b4249af6-8bfa-4eec-8e62-0678477d6c2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692174336, "uuid": "32e9960f-96be-44d9-ab78-83b3b6b425c5", "value": "2a39d576d37c6b028784aa2118575b2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "373e2cef-3c35-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1692190975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692190975, "uuid": "d556e2d6-8868-4c7f-a85f-0c695e662566", "comment": "Malware payload (Loki)", "value": "6ac95d0ff18baaa2fa5bbfa1cbe4ff6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692190975, "uuid": "d1ae8182-46b8-4f68-ab02-93badd6ae741", "comment": "Malware payload (Loki)", "value": "c90bb9ff7894af79b5f98b328712d1d8817d8e941b1cf70805706902ed5a6457", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692190975, "uuid": "d60a6368-a4b8-4fd6-afdf-026375516601", "comment": "Malware payload (Loki)", "value": "25415858c21fc5b62cdba919ce1e13d35dfcfd46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692190975, "uuid": "9129b1d5-f6e4-4fda-ad1d-71d607662782", "comment": "Malware payload (Loki)", "value": "6f918025e0e2d125a43d494959b4a14a756b7fafa2c9531f6f855095eed24d59cacfc25ba7e09052e2b3d2b864553057", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692190975, "uuid": "f2428d01-c3e0-4061-ba20-1b64f3cdd4a4", "value": "T1DE445C1363E97C61E56B8A329E3FC2F4363EF9214E5D77561228AA3F08B19B1C163750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692190975, "uuid": "c60886ec-feb1-464f-beee-a7524f44f193", "value": "d318a260f63cbb9427df058a9e28a3ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692190975, "uuid": "efe17157-ddd5-4fbd-90b4-f5afc056d71b", "value": "3072:TuPvhEX9Xq5nLdIQLJpXiuMbMDF681ewdbysVuJAhGQhGsK:yP1nLdIQdpi28Ybzuq1C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692190975, "uuid": "13f59f06-22e5-4390-87e1-b3304890103c", "value": 256512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692190975, "uuid": "88df57a8-0267-4cf3-9c41-f7032144d3cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692190975, "uuid": "c33f9cf5-3c14-4de7-b891-b5c68c71067f", "value": "DRAFT_SHIPPING_DOC_INV02523L1+PACKING_LIST.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d29dea77-3c2e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692188229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188229, "uuid": "398edd73-df23-45b5-9570-7c0b4040eb2c", "comment": "Malware payload (Mirai)", "value": "97a7801743ee151ed057c0863d25b91c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188229, "uuid": "e56dbd78-7a9b-40ed-af72-881ac676d620", "comment": "Malware payload (Mirai)", "value": "c9894f0911ea06cdaeba734800da01780ce1f85e5410f0e78207ed3bc33a6ef4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188229, "uuid": "aac8aed5-7516-49b7-8db2-1cbac5adc1dc", "comment": "Malware payload (Mirai)", "value": "9db46d724ec7adbc790feffa19e9e054975f17c1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188229, "uuid": "47d876e6-5736-4c5f-ac5c-62d025c7b87f", "comment": "Malware payload (Mirai)", "value": "aaab8403504f8cd500d23720cf09c90e9f6978cb92fd66b3e3bb23928015664ca4dfe9146fc09eb72c1532c005862490", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692188229, "uuid": "3d6b91d7-683c-4c25-94d0-41148f096a91", "value": "T1EB82CF3061AF78F8DBF14431FAAECEC6971A0BB8D1FC379216586B38C94150651F92CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692188229, "uuid": "7c12d818-261e-4fe7-9fed-390ec43fbcbc", "value": "384:MnfzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMaKhymdGUop5h5lt:2dV0P6+kom0tVAoNvm+to1Ks3Uoznlt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692188229, "uuid": "91e2df5a-e15e-4225-8768-db7f8faa991e", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692188229, "uuid": "d4165e25-13d5-4a31-8367-2a9ced78409f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692188229, "uuid": "ae61996d-1016-4d30-8c02-7eda9e88cc78", "value": "97a7801743ee151ed057c0863d25b91c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bd7f45c-3c3d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692194418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692194418, "uuid": "a3a78edf-cad9-4629-8398-698f97d15b40", "comment": "Malware payload (AgentTesla)", "value": "1590025ad2aaf51dc18b198be8c8168f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692194418, "uuid": "796f1582-ea50-4354-a79b-2035c5b0130b", "comment": "Malware payload (AgentTesla)", "value": "ca26076fb095e2acdc06f27e242238ab5f3c8b79496b2a82c1729175dd928c82", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692194418, "uuid": "d5fad7ab-7a55-43ee-b2cc-7fc5e8d487b3", "comment": "Malware payload (AgentTesla)", "value": "15574c5017f032301b8519d7aa53330c69b0818d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692194418, "uuid": "3ab603c6-4521-4988-8a22-9db73f69d5d3", "comment": "Malware payload (AgentTesla)", "value": "ce27d0b05c5dcceca7af98724be1a053fc86f7111e8728b2308301b219829939259761e89054c8aec1980032712d83ec", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692194418, "uuid": "a3a968ae-d323-4a91-874b-97a324a8ee40", "value": "T1C80579D6E57AD2E3C82446F4219AD0344F392FD92569D1981CE13DDB36F2B103A93A3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692194418, "uuid": "ab97a211-6997-4840-bc2a-7207b1345b4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692194418, "uuid": "2731ae84-508e-462c-8eca-d323a904f66c", "value": "12288:jJaa4lrrnLHr9daOkrNBiY6Ojw295pleisXawi9Qp8875E:jJz4lXnLLO5PiY62N5TdIXsw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692194418, "uuid": "3e1c9a8a-df76-4483-8f21-2c4795a7588a", "value": 821760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692194418, "uuid": "5ba4c054-8542-4fa9-8ccc-db9f48d925f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692194418, "uuid": "0c5a9565-12d5-4268-8132-826469ac1323", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c48fe28-3be9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1692158288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692158288, "uuid": "ebf83ea0-7737-4e1c-865a-2b67f9b5b9e4", "comment": "Malware payload (Gafgyt)", "value": "b41e268a08f47bf3f3fc9a5011f7f3e3", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692158288, "uuid": "823b36c4-249c-4f07-bc91-648bd44c724c", "comment": "Malware payload (Gafgyt)", "value": "caaf492570c34ffa3841c488428ac7447d252683addcb7af8fdb796ed0e05f5f", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692158288, "uuid": "7340992f-8059-4a43-ae1a-7a5b3da7604d", "comment": "Malware payload (Gafgyt)", "value": "f252878777bba559b1fe7750c740c75f1d4de66b", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692158288, "uuid": "23861f8b-2777-44f4-9d05-347c3f4a0169", "comment": "Malware payload (Gafgyt)", "value": "f3246d8b37242fcc9ea7dc41ed60d500d5484608aad8a62b345b1cf59ef3ac82618b0467304828bc45de27959c11a837", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692158288, "uuid": "b7a1c207-70e6-4744-b214-851b5bebf2c2", "value": "T168534B55FC819612C5D1227BFB5F428D372A53A8D2EF33079E26AF21378782B0E67641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692158288, "uuid": "53f3b10f-ca89-41d3-8e94-5f7cc1fa9a5b", "value": "1536:ywHT3G0uIuKfcW+jM5x4eYNT+XWwLNqtI:ywRFvEW+jM5x4eHXnOI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692158288, "uuid": "bcc1fdfd-e091-4837-82e5-027b97dc2b4d", "value": 63080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692158288, "uuid": "18526635-dc0a-4fe7-b3ae-0986a1e1938d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692158288, "uuid": "3e8cec86-4407-4f59-827c-45398a749ae8", "value": "arm5.nn-20230816-0358", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "102109f1-3c39-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692192627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692192627, "uuid": "378b16c7-cb52-4c83-8f2b-6c03cc40388d", "comment": "Malware payload (Formbook)", "value": "a44bc752e7fe301289d01da694e8f151", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692192627, "uuid": "6c6b5732-0d10-40fb-87de-948df8f42da5", "comment": "Malware payload (Formbook)", "value": "cbd35093a173bb62ce12acbc35a065d4b2e4dd2ac9bf07c4876a4569e76e2bde", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692192627, "uuid": "7d0da342-d4e0-440b-b0f6-9a992e91d734", "comment": "Malware payload (Formbook)", "value": "41c37321b305f05c38c61e7423216e4b42f9a4bf", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692192627, "uuid": "7ef491d5-8f4c-4e18-8396-46f3d688e018", "comment": "Malware payload (Formbook)", "value": "00951da85d598d6dd736e2f053933f48d82224d27ec67778f6fcf99ffa8eccb8e2895d7c6fce76cb436bde1a960a3d95", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692192627, "uuid": "1f6e2629-9340-470a-815f-69dfcea84cc6", "value": "T15A54235F995F8347CDB03844AD66713BA9E806D9383B7D43D26E691EF1C0644FC60A93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692192627, "uuid": "2882de80-00e3-41b4-a21a-5a8dccc2048c", "value": "6144:xeERRdqOW1rRLceXk888io3ryL/p8SIaDJg52o3rwpvjGvdXd:lRzW1lZk8Nio3WpE+DorwBcRd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692192627, "uuid": "f202611b-9627-455d-9a3f-ab1f098deefe", "value": 304206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692192627, "uuid": "d94e7d40-9092-4ec8-ac36-8da754b034b8", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692192627, "uuid": "817a5584-717b-4cb0-8e15-8c71883c5937", "value": "Account Statement For Month End July_PDF.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b58822bf-3c4e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692201924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692201924, "uuid": "3563eb39-ca75-4bec-b187-bb25e6553521", "comment": "Malware payload (AgentTesla)", "value": "605de924ffeeb14ab8113b1f8a2256be", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692201924, "uuid": "7cab026a-b288-4aa9-b222-dd852e20b6e0", "comment": "Malware payload (AgentTesla)", "value": "ccb3e41aff5b7db4edec1584d33f82daee7b1869a25ca6f4283b42a04b897c82", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692201924, "uuid": "e4c265c5-7b9c-415f-b199-73c07f7e9ded", "comment": "Malware payload (AgentTesla)", "value": "780295c3363231f6e7405effe3bf538545e9c3f2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692201924, "uuid": "d497afdc-e9bb-4e6c-90c1-2bde2a236ff8", "comment": "Malware payload (AgentTesla)", "value": "a9974da208de5397eec1da0148a3a24b51f53205a8b48815e77e0213eabb4abff0f3e50c8b72bf7902c7c186467b4346", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692201924, "uuid": "546c22cc-1bc6-4a1d-83f6-8cc659de8557", "value": "T1CAD42310B3D0DF3AC01347FC18A5A91617BD35211826D73C9A9A2ADD9B77F80AB40F97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692201924, "uuid": "6c6bdd43-d162-463b-8335-c75a998ff52d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692201924, "uuid": "d7248acd-542f-45be-a6ba-fcd220f92ef8", "value": "12288:K0Dl+C42xjWguvhWP9XkPODlGL4FgNR8D1TdxQ/63qeDnvOAnI:v5V0WhGL0eqpTui2A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692201924, "uuid": "1f2f011d-b99e-441e-b284-e9b3634a312a", "value": 634368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692201924, "uuid": "526036ed-8002-4950-9f12-341280aed70a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692201924, "uuid": "caa7f7d7-481a-4889-9e7a-3851f5bad9b0", "value": "invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f386e34b-3c2f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NanoCore)", "timestamp": 1692188714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188714, "uuid": "ed886d83-4bcb-4602-8ca8-a25417e18b7e", "comment": "Malware payload (NanoCore)", "value": "2c2acbe195777c5814e7e56783d7765c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188714, "uuid": "7bfbb932-e1a2-4f66-92e6-55c54484509c", "comment": "Malware payload (NanoCore)", "value": "cd7c5af1f4a0a6bb9536b0685e39046cf22a08662472193f8ad5e0ab41735e7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188714, "uuid": "74cf51d6-1066-480b-92c9-70ccb0892911", "comment": "Malware payload (NanoCore)", "value": "02549d55a7b094d208e84d0c0d4b1c53e9887863", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188714, "uuid": "6f77f923-8caf-4bde-ba99-18cc845166c3", "comment": "Malware payload (NanoCore)", "value": "2e2d8a8b489904872d5f6b444addd53edf8f690d9bed3555f14c1706731b2b05a010af1513c7e0a003b207f392d31be3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692188714, "uuid": "4fb2a62f-eed8-4f49-bc08-f39f496c31a5", "value": "T1BE14BF2A77E8893FD2CE897A612112528778C2E398C3F3DE68D454B75F663E40A071D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692188714, "uuid": "e284d782-0f3d-44ab-9ced-9ea328ef8749", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692188714, "uuid": "84af66c8-c63a-4147-814c-f57f74b8f4f8", "value": "3072:gzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIwzIpciQB2u9Pco9NbHsRUSmx1:gLV6Bta6dtJmakIM5ZIWIto9ll7dn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692188714, "uuid": "0fb57cca-bed8-4be4-96d3-3442dd2cd203", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692188714, "uuid": "39cef037-aa42-4429-9fca-6300c46c9c6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692188714, "uuid": "166c715c-6ac9-4867-b38d-a200785f94e9", "value": "2c2acbe195777c5814e7e56783d7765c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39d4fb3e-3bd8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692151036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692151036, "uuid": "279f441e-caaf-4180-aaf7-aa9e2aca7a40", "comment": "Malware payload", "value": "2aa82aa4c787c4f6299a22767d2ead47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692151036, "uuid": "d9a92b5f-5cd3-44ad-8126-7ee1c991da3c", "comment": "Malware payload", "value": "ceecc1833d5bd98f7377e20514c3574e5e7baa11462fb952be29b2d7d2be10af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692151036, "uuid": "8d2abc14-ff35-4a67-a54d-f0df9d93b88b", "comment": "Malware payload", "value": "08ac2ac3c0dd008b7aa31c68f4ededa2a37c7b81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692151036, "uuid": "bf9650b2-2e77-4e90-b382-c6b6c0208e08", "comment": "Malware payload", "value": "ad41d7463548d90361d22c1742052fd59118d2dc941b59d99b3589135dec3cd04b8f180f8f5f356aca6d5951894ce949", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692151036, "uuid": "4f1a394d-ca19-4803-9dbe-028b5c8ac709", "value": "T1A5652338B689F058EE55ED3E2D20D8242AA01C405CC5E1E77DD2F7EE99763C88EA5347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692151036, "uuid": "07439fa9-abab-47b5-8c5f-0f0644a51f8d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692151036, "uuid": "26fe6a7c-e090-47af-af5c-49acfdeb9526", "value": "24576:8Z/4jDkyXlNpezDB93fHVqsdEd7N+GawXJEC8zX8bSMVAgVI8Hl:w/4syXlNQDjTe1a2Kh8+fg7H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692151036, "uuid": "2dc7eaac-4c60-497d-bfe6-f1e74b35ab59", "value": 1457152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692151036, "uuid": "fe6c24c4-4368-4462-8071-4795604ef88c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692151036, "uuid": "c910d3d0-ca40-4674-a8f5-e8d76a011afd", "value": "2aa82aa4c787c4f6299a22767d2ead47", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47842edd-3bd8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692151059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692151059, "uuid": "73ee1ee2-ca1c-4a41-b38f-0920d73788db", "comment": "Malware payload", "value": "18ea6c3f285a0609de3b4be052d26e99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692151059, "uuid": "7cc3b14e-3332-4de5-8781-ad50710809ee", "comment": "Malware payload", "value": "ceeddc45a3e52e50445abfd568287edf87649fa4e94d75d3a4533a7396ae1604", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692151059, "uuid": "58dfae63-b546-4d88-a6cf-0475b3010ec3", "comment": "Malware payload", "value": "b8450d9f4745ae05cf54eaf1506b3c9fbb34a43f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692151059, "uuid": "847d0be3-8781-4ecb-ba53-3c8a082a909c", "comment": "Malware payload", "value": "80c293f14c908fd2f13b692248d59b9a4624a2994e9bf5121d1ee0c9e9eef41de42c0ef45b3760d968ef8f55aa9c9c9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692151059, "uuid": "fa44f082-71b0-48da-a0bd-e690cd6e4077", "value": "T1B46523387689F058EE55ED3E2D20D8242AA01C405CD5E1E77DD2F7EE9A723C88EA5347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692151059, "uuid": "71ddcf64-4e3e-4f9e-805f-dd9b60f47048", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692151059, "uuid": "c1fa46d4-a3c9-4c35-bdf7-8304bafade94", "value": "24576:8Z/4jDkyXlNpezDB93fHVqsdEd7N+GawXJEC8zX8bSMVAgVI8Hw:w/4syXlNQDjTe1a2Kh8+fg7H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692151059, "uuid": "f80d9707-a0b8-43b8-945d-b2ca04f7f81b", "value": 1457152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692151059, "uuid": "0773eaa8-c657-4ab7-983c-179e9d61dec8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692151059, "uuid": "6977b7f7-ea79-4c3f-8c0a-f0989370eec8", "value": "18ea6c3f285a0609de3b4be052d26e99", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db4d4d3f-3c2e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692188244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188244, "uuid": "08866103-c171-4cd7-ba22-f8a30bb99ec0", "comment": "Malware payload (Mirai)", "value": "4c2ff8d9c9da1ca12a507897cbe3bcc0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188244, "uuid": "23bf1ea3-c683-4501-931e-f9b5a23b0128", "comment": "Malware payload (Mirai)", "value": "cf41d341dafc7b5dbad05b97e80bf099f0e3cb0ef08bd78f99f40f284d6a8ae8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188244, "uuid": "10471e6f-7e1b-4e2c-a131-37bb85bbe957", "comment": "Malware payload (Mirai)", "value": "917c0ef088739c320a299c7b4de4fdf068f78ea0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188244, "uuid": "d0729c22-8a89-4f7d-bffb-90a83ab60fe1", "comment": "Malware payload (Mirai)", "value": "d14c9ffdfdaabefaf26b4b29a7e0c160fdc8807732a593ecc0904e499ba2f71ae5c1a22d3b16d27309045d2d7be31a7c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692188244, "uuid": "e9deb703-9866-443b-8c31-996a51a96227", "value": "T15AC2D0E07726FD31C420AC3DE52A4D8A3A51167C91FF393664258D358FC169B62F88FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692188244, "uuid": "0d65c0f0-43b2-45e9-ab93-d7fbe6cdf7cc", "value": "768:DMKyhegCCMqfizjoNpd2vJdX6vwre79q3UELu/:oKy4qfqoeJdXWgeaLm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692188244, "uuid": "b33b0bbd-bc7d-47b5-8f63-ff5db43b7099", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692188244, "uuid": "231a7ca8-ccb8-4689-93e6-022410f0f78d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692188244, "uuid": "d87ffbe4-d62e-4e0d-a771-902ac0ad9950", "value": "4c2ff8d9c9da1ca12a507897cbe3bcc0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f39f0113-3c54-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692204605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692204605, "uuid": "1b921e80-fe5a-4310-a915-7a5147e0d9ef", "comment": "Malware payload (Mirai)", "value": "b7a04bedaccd5ea870e4206686e2e191", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692204605, "uuid": "5a948ede-1cba-441f-9d1d-65fbe7346f41", "comment": "Malware payload (Mirai)", "value": "d04aaf28843f97b498affcc8500f6e336a2a8bb62366f2b4c17d4ac003839ec4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692204605, "uuid": "d1f66950-2914-4977-8fab-24ab8ab695c8", "comment": "Malware payload (Mirai)", "value": "0ea99eda32b41d68ff93baa6dac88e1927f17ecd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692204605, "uuid": "c57ef2a3-fb0f-4001-a5f5-d4b99b594b4e", "comment": "Malware payload (Mirai)", "value": "d6a7b95a356593ef10d17149c9fbcca42ed3c5257abc1ca89ca4a97c191b1cfb285695e37e44326ecdc9c6430b86c624", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692204605, "uuid": "211f71a6-bb09-4eba-8b91-b0a420b628e7", "value": "T11B330262576E2AD151B09777FC33BC5A66AC17B99C77309A2CF0961573C18024EF26C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692204605, "uuid": "ecd3aa23-e529-4891-b4f6-628cae573385", "value": "1536:d9O/ZMAXIxNUk0DLcPqF1aBexo4opKZbJ:d9O/ZNKynLGqFUFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692204605, "uuid": "b61b1e66-ba15-4bce-83f2-fe715665038b", "value": 52512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692204605, "uuid": "f371edff-b064-499d-bce3-b013b759584a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692204605, "uuid": "3669d27e-b141-46db-8ccb-f40243dbcdfa", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51a8be79-3c0f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692174698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174698, "uuid": "8adafd59-b8a2-4f52-93c4-44af62d3a606", "comment": "Malware payload (AgentTesla)", "value": "7fb37e441045c5a737db920c7d8a44d3", "object_relation": "md5", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174698, "uuid": "011fb707-f7b2-4de0-a2f2-823428e7f99e", "comment": "Malware payload (AgentTesla)", "value": "d0a081ce0c8a424c79d955b5f7d86a4303a0b2a26dc59f69014ca15ff4b76c30", "object_relation": "sha256", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174698, "uuid": "7e8f370f-74d9-48ec-b085-847b2997c3fc", "comment": "Malware payload (AgentTesla)", "value": "a9d638aacb3184f091525b0d7d0bff5733aa9208", "object_relation": "sha1", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174698, "uuid": "81784b70-709b-4fdc-89ac-1d1bf2658056", "comment": "Malware payload (AgentTesla)", "value": "3bae3107101b73f2085ac24107d159dbe6e928a4953c30231d57736f9392168a2c74a8cfae09eac4552a998f23b74018", "object_relation": "sha3-384", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692174698, "uuid": "aea93fa5-9945-4715-8525-9215a6602769", "value": "T18EF423AFE46EF8D23A9F291FF4724E54E85E23171886FA6FC9C0329A35C2762404D157", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692174698, "uuid": "0bd67280-647d-4fec-8a59-37b9df01c3dd", "value": "12288:KGtLku5ghAcZOLKFPZ4TmAVOzyrUXdGl7tyASFUs4CO37i6l9+4b7LkF6ZCohXXy:KCvxLKFPZWmAEztdCyAeUDCcitbAZCHl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692174698, "uuid": "ecb715a5-a56b-4826-a91b-864b6a92705a", "value": 762735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692174698, "uuid": "f091b3a3-f75e-4d76-83e0-7185874102dd", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692174698, "uuid": "33818f59-af0a-4145-a221-5b2bff1c6a48", "value": "SWIFT COPY.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8ab31a0-3c77-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692219592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692219592, "uuid": "381ef604-e96e-4317-9449-ba509864ece8", "comment": "Malware payload (Mirai)", "value": "195fefd67bbb0557ba1fd425a3939a2b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692219592, "uuid": "7a14808a-78f1-4153-b427-65e24f2260ce", "comment": "Malware payload (Mirai)", "value": "d0d190a1b2accf4de4cbbf9850213756097ef574ed265a6f3d24f6fe78df9092", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692219592, "uuid": "7b88245f-15ad-4ea8-aec3-c76337f7cc9e", "comment": "Malware payload (Mirai)", "value": "df3433f23b5107f90cb8a2b1f3b1c23f4cea97e1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692219592, "uuid": "cfbd349a-2865-4e90-9ee3-c03ecafe84d0", "comment": "Malware payload (Mirai)", "value": "4518bac71f6422f0bac63a3a5bb26f9c41ba665c62c87096b3149d1df0d13ba6f77506e470aa267f861fae0e4855a6e0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692219592, "uuid": "23042f82-e54b-41ea-b64e-3f701f2f43d5", "value": "T161C3F731E8044B1BC2D223F6E75A469E3F351E9793E733115A3879B06FF27992E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692219592, "uuid": "e252f12e-f3b2-4fb4-9c7f-5030ea0db255", "value": "3072:6jVlyaL5JCrIpv04s0bttiEiTmP46aQyfPlfKsNb:yoCJCN4s0bHemP46aQyfPlfKsNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692219592, "uuid": "0496b869-b295-47b2-8af8-648389dd7c01", "value": 129898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692219592, "uuid": "739bc345-a59d-4c9f-8d29-83c50e29dc1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692219592, "uuid": "de0e6c29-d354-4d7e-a22f-7af7da1e9e01", "value": "195fefd67bbb0557ba1fd425a3939a2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c541e7a-3c2f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692188541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188541, "uuid": "149a5103-7d07-4d9c-952c-1992559a0722", "comment": "Malware payload (Mirai)", "value": "749c19c1347ccaee78155df063ba6eab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188541, "uuid": "54aaf15f-c5d9-42bc-a400-c1d1f6fc93c7", "comment": "Malware payload (Mirai)", "value": "d34540adb29a0f6678e0215421526d3aa1668d6bfeef77c7282f24a60c8cf28d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188541, "uuid": "ef0286b3-1315-42e4-84ed-ce7d31dd6443", "comment": "Malware payload (Mirai)", "value": "f48653c56ce77a2119ffa057b6deefa7b72318e3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188541, "uuid": "1a024b5f-a56b-490d-9c6d-c6e7357c1dd0", "comment": "Malware payload (Mirai)", "value": "5a57f1bad24d3d4947ceaa56c2fb8e72b53a4895ee6e654cd3dbc7a2ca697ed1672bbc38b066ea147642b444f6758efa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692188541, "uuid": "cf819604-38c5-4886-802b-5ffd44a9b34a", "value": "T152735D24A9792E26C0D4A17B61FB8361F2F6230E25B0D65D7C760F8FFF2464468162B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692188541, "uuid": "774637bd-43e6-4345-8c58-dd96eda53371", "value": "1536:5ms+geQfvznpCR8ee84cNsAUiAvFI7IlNnws8h:YwfdNu4cmZvFqI3w7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692188541, "uuid": "ecd5deea-6b4d-4fda-9870-91cd4258995a", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692188541, "uuid": "40bc3603-4a19-46aa-9ee7-83f4408f3faa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692188541, "uuid": "b6c5f30f-92b6-4352-9de1-e5b84f797bfa", "value": "749c19c1347ccaee78155df063ba6eab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ede3f0c-3c3b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692193484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692193484, "uuid": "0a93a542-4d73-4251-a134-91ff3f83cd4d", "comment": "Malware payload (AgentTesla)", "value": "e1e46a2ea9dc4f895ff7a37ea8c7a155", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692193484, "uuid": "e2f447ac-9450-43db-98d4-90c78b18069c", "comment": "Malware payload (AgentTesla)", "value": "d4152060f7a62526aee2be1944b5fe427ac6810d990a39326034a8c6ad607bec", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692193484, "uuid": "d868432a-5207-492f-8bbb-0ff6a72f26e4", "comment": "Malware payload (AgentTesla)", "value": "9da4020ea3ec56ba11459ceb5d82519e93c37be4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692193484, "uuid": "115f2f48-9140-4106-9f14-91db14366aa1", "comment": "Malware payload (AgentTesla)", "value": "af2e6462b3a23db178c154eb27acb1f008310dee3f7db226ab4699c03e2f43ece306e366d95aff499bed1e3e12f0b64d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692193484, "uuid": "d0bb70b8-84d6-4f27-a358-812f2b3d24a6", "value": "T13FD4235E340B9A5B9E7C73CA9B2F775C14FC5D08E63C9FA2F94CA0418311681AE64AC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692193484, "uuid": "c9affe12-f163-4984-acc4-dbbcb8efbee7", "value": "12288:IFeDkzL1LDFd9mfaKnIR1LfpaoJESJzUzbbUgNi57z6BeVxejPPWwJ2wS8MU:I4QzD8rIR1rpaoeYMdNigfPPZpSC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692193484, "uuid": "8ae7adc0-4984-4d18-b036-92419210be73", "value": 626472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692193484, "uuid": "24dc7c44-8138-42c2-914f-fc75deddf278", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692193484, "uuid": "dbce0319-411c-4852-90a0-a790dc77197d", "value": "New order B0001.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed5309fc-3c0b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692173241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692173241, "uuid": "3bf60c9f-1456-4ab4-bd99-6ed78ecff967", "comment": "Malware payload (Formbook)", "value": "5ed22aa6e87bf6e4c8c4d52cf4ea98c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692173241, "uuid": "b4587463-3750-4343-8e99-bd140ed6078e", "comment": "Malware payload (Formbook)", "value": "d42982244991b0dfebd50189a25dfa04916430c652826126e0b31678e2c532fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692173241, "uuid": "74c4de7c-d7b5-42d0-91c6-c7e3c75f6ce8", "comment": "Malware payload (Formbook)", "value": "0459cb358ba89271414077a22d05da4d861c1a4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692173241, "uuid": "1cd01e11-c153-4e7c-b612-f629391f70bf", "comment": "Malware payload (Formbook)", "value": "0f64e038d59f1e445a79d17aa8f91d70114639b682640aeba1220cadc49452e8c5c7a3280d29627b538857748cc8b775", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692173241, "uuid": "d84ee1bb-351b-492d-a594-58ae2014264a", "value": "T1E5D423A62305729ED4B497B18C53629523B0934F91E0FB97FE842064732DE691F53F8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692173241, "uuid": "6f231825-498a-494d-877a-e7676cd9e23c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692173241, "uuid": "ffa7fd28-c7b0-4831-b849-878a21f9a82e", "value": "12288:GmL87+24UJeNdz2d6BNvurMkCp5bUoYQe9YX0/Gjb+99u7fL8:9g7+2deHKdTw5bzYlKE+8cfg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692173241, "uuid": "942e5688-ba0c-438b-b48e-a0404919d6fd", "value": 651264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692173241, "uuid": "1a97af5c-22a7-4813-95c0-a441354542f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692173241, "uuid": "adc40895-11e9-4711-8a47-e3813d393ae4", "value": "72RSDOCK.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77eb63f9-3c65-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692211699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211699, "uuid": "5463e42b-df8b-4388-94cc-b816f1675eca", "comment": "Malware payload (Formbook)", "value": "e833c0c7e47370745396c4d1fc51d008", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211699, "uuid": "9e0b7bc7-ef81-462b-8da4-373fa50e6c88", "comment": "Malware payload (Formbook)", "value": "d54197de152cea04b823618588d90e7462b78e11602a9eb5c425ce8db7057a80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211699, "uuid": "929b45d0-9159-4f9e-8e56-4c4ae1df1f51", "comment": "Malware payload (Formbook)", "value": "bdf531e251a1e569ea0530e20d47a014a2056c47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211699, "uuid": "b826df85-b66b-4046-8c37-c8f8dcdb20e9", "comment": "Malware payload (Formbook)", "value": "0a3c4dc4533133cdb5c08f16ae99a57a1b6c1cee8ae95c413df2b762b5d07e9e7c8c1ba96fc5fbea0bb8d50f6c6480e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211699, "uuid": "4b9be55e-81ad-4800-85e3-11c8e32bfb49", "value": "T1A5D42209B7A21B6AC06E43FD1CDB660563B92239B011DF1D672C5AED5B27F942B00F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211699, "uuid": "e9eed8c9-3a08-4149-9696-d8cf445fd316", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211699, "uuid": "60f74299-0626-4dc8-a67d-c0b04924e209", "value": "12288:W0Dl+C42xjWXt5UQDSylKN3qGDpoScyDKabMG/+WfktHYIFBSUi:bitOgSO4TbMGDctHXL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692211699, "uuid": "da21707f-220f-49f5-bcc5-97b8db100410", "value": 603136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692211699, "uuid": "e7bb464b-1e8d-47d0-9b97-5eb1b18309a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211699, "uuid": "558c9fc2-783e-4596-8892-683bc0456cf6", "value": "TRLS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0085a202-3c78-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692219659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692219659, "uuid": "4fb08b72-7f07-4a0c-80ca-53d49bb600e5", "comment": "Malware payload (Mirai)", "value": "5af55af67c41817b629bb65f6c257853", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692219659, "uuid": "5f5e5233-cddb-4b5c-81a7-6190a5d875ee", "comment": "Malware payload (Mirai)", "value": "d54c527a60a1b17247c84a27fcd0193f65b4303dba05415f6fb785bed953f4e5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692219659, "uuid": "6bf039ae-4cc7-4663-bf8f-5f85656ecfcb", "comment": "Malware payload (Mirai)", "value": "989738cf5d4d2deb3ef0da902567b629e0b654d8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692219659, "uuid": "34497d52-0814-4a0c-964b-acc88f7b0794", "comment": "Malware payload (Mirai)", "value": "eb8b54ad6660caf6a251e4fa0f1f70ee9a0a66150d8584b7c73644c11c08ed5b9e12312c5fed68ce9db499e958ddb857", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692219659, "uuid": "ec246a0b-1c9a-4593-af2b-1a64c20b787d", "value": "T10BA3F831A641C973D04305F212A7DB660D32FDBB1A6AAE56E32C3CB0DE360C5B565E9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692219659, "uuid": "06ef9b35-e3f5-401b-9a6b-ce43bac13255", "value": "3072:VK1z13U6HzHoXRtmTUhQogSEmmFVcqq0GnDZT:VK7DDeKlogSEmmFVcqq0GnDZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692219659, "uuid": "a0911468-8369-4c8e-b5cb-aad173fdce7e", "value": 100042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692219659, "uuid": "cfef0989-c751-4a5f-8055-7eb09b105b16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692219659, "uuid": "a2fc2aae-006f-4c38-b1db-beb9d465f912", "value": "5af55af67c41817b629bb65f6c257853", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "713cb900-3c35-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692191072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692191072, "uuid": "b1f5587b-87e3-459a-b4d6-ac7c20d0bf2e", "comment": "Malware payload (AgentTesla)", "value": "e31412bd4db582bc4f01eabc7b12456d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692191072, "uuid": "fc486c10-5c5d-4793-adab-a6a032a76397", "comment": "Malware payload (AgentTesla)", "value": "d6c2a28fe43fac1aa9955eb5895ea04f8e1e323491519722d84639730fd819b9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692191072, "uuid": "bc277d98-b7b2-4e2c-96be-67ebebb0219e", "comment": "Malware payload (AgentTesla)", "value": "5a24be31d747fa279a0c3cb10686e619187b3ef4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692191072, "uuid": "e6a850dc-e209-4747-886b-42ff58395b3a", "comment": "Malware payload (AgentTesla)", "value": "18a4a05652a273ba4b01b591e4e7214eddc6e6ae15623580ad93ac8e1a30063c0478f2e8e7f9acb8a7efdbd681d6fc0b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692191072, "uuid": "f461499c-387e-41bd-b713-2821a03956a3", "value": "T13A251C6CFA45DE3FD38C8C3950F9DB2B65B99BADD0E1A391C01091B518E6CAD0DB6063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692191072, "uuid": "79e27e0a-8460-439d-8bc7-db79746ac75d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692191072, "uuid": "e4dd3620-5a5e-4241-bd01-501372c0b3b4", "value": "12288:4H41ItaBXaJxsSWr3eRgR4SenyUSmCHx4/Fd5pSKST84V:k6uVtpdUx4z5wKWV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692191072, "uuid": "1af0769e-a460-4566-85f2-e454d6fa4fb5", "value": 1037312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692191072, "uuid": "4cdc49ad-661e-4ace-9963-5ef1ca7a8fcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692191072, "uuid": "05cba9c4-cef2-427e-84ed-ba2cd40821b2", "value": "Inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c65f55ff-3c31-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692189497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692189497, "uuid": "9122aee2-398e-47c7-9216-d4f2ddc755a5", "comment": "Malware payload", "value": "c93e2e102c6ff2efd9099342108c71b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692189497, "uuid": "cd541532-5568-4e7e-8b83-5b83937de132", "comment": "Malware payload", "value": "d765acb7e9e12b6a50c8abc69c991e7d8c61248cd3a661960910e27313b142ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692189497, "uuid": "24556396-70b1-4cd3-9e2c-2e92749cc009", "comment": "Malware payload", "value": "e43778408e2bbbc18cfa6d74afe4e2b946c9a489", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692189497, "uuid": "ba79b1c6-76bd-4315-949f-166df0100932", "comment": "Malware payload", "value": "28afccc387302c290741247787fe9faa9c674a6d18bbb21945c1fdecfab3c0042afe07f55d9c4dfdc1b5d434a06db39a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692189497, "uuid": "d70f6a31-2946-4563-aeb1-82bcc877bf9a", "value": "T1D8E63345B3210CD8E8B6437BE9C14A111663BC6B03F4FA8B5258369B0F7B1A5BE79F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692189497, "uuid": "99ccfb17-4d8e-41c3-ab10-68e2d6a89278", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692189497, "uuid": "7b41c57f-3709-4b2c-a970-e738608398ed", "value": "393216:UoML/SEY3ayIDfDKupfaMPXaw2OYsW8S2WDEt9:3MLFY30bO4f9Pj2OYsW8S8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692189497, "uuid": "251813cb-e4cb-4a23-b622-6bb21570c797", "value": 14626881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692189497, "uuid": "9a4f8644-5f2d-426c-87ec-7530e1bf1e49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692189497, "uuid": "75d28b64-68f6-4f13-9503-97bdcd942f38", "value": "c93e2e102c6ff2efd9099342108c71b1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "400e16dc-3c39-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692192708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692192708, "uuid": "34edf81a-9f8e-4694-81a3-f6b45229312f", "comment": "Malware payload (AgentTesla)", "value": "e5dcabe097369abf54444f4297293fd4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692192708, "uuid": "fc547d04-2982-44a2-afaf-dbc1553bba4b", "comment": "Malware payload (AgentTesla)", "value": "d827653375fc186bab05813fb21a26330cea1c4bf19a01c6f551a8098b8f3c0d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692192708, "uuid": "3c405886-db68-4159-8709-7e0ff2d8d6a9", "comment": "Malware payload (AgentTesla)", "value": "ee36afc6d5454da98c0d0ed21a291b845806720f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692192708, "uuid": "e70bab75-fbcb-43c4-b048-c50a50050594", "comment": "Malware payload (AgentTesla)", "value": "3f3a7c5db5798d8b22d24365c25ac7e747b10cf9753fad3ba5d1bdd9f6ca819c37a8bf78970351c9a0e302d3ba87cff2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692192708, "uuid": "42605256-0f77-41c6-8d99-6a910d95e5b5", "value": "T1A3D423213A9A1B25C18F1BFD0CB2942493F627726A32F73CCF15A9DD1B427942760B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692192708, "uuid": "57de5f8a-e623-4ce7-a78c-cc5699e128c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692192708, "uuid": "fac8a888-5939-492f-b618-e74f10a10925", "value": "12288:u0Dl+C42xjWPLeG/9dVFMOee7IFB4eEFWWYVyUNoBlzbap7j/C4Xa:TYLeGldVFMOXIsETVypHY3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692192708, "uuid": "98e8b30d-b27d-43da-985f-b5556caebd87", "value": 644608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692192708, "uuid": "1658c15b-ebc5-49f0-bc93-276b49b53f6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692192708, "uuid": "824a3586-8110-4724-86ab-fb7959398036", "value": "Scan_P.O_16.08.23.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1ac1e60-3c03-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692169705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692169705, "uuid": "9bd8a769-d582-46c7-a1e4-a5fccd0605af", "comment": "Malware payload (AgentTesla)", "value": "df97c27a03c79bec70fdcfa7ade5a8c1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692169705, "uuid": "f87ba1c3-a14d-4217-98da-416ccff345b3", "comment": "Malware payload (AgentTesla)", "value": "d95130318576403e5ebe25a82dc1bcf128e5d4d91d729e51922f0d6c977803a0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692169705, "uuid": "e2bfd154-0c7e-4339-be23-c075691fce29", "comment": "Malware payload (AgentTesla)", "value": "e12a6040f4dda789230f3d2239f47faff834ccac", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692169705, "uuid": "7136d0a3-e570-4e2e-ae67-8bfd2754ab9c", "comment": "Malware payload (AgentTesla)", "value": "891cefc954b297c5909207e46ea0f039e9617774df89c6e67627dca87d5863d3b7082a56afc0d5b01c911396c5c732e4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692169705, "uuid": "12bdcad9-d135-4590-85d6-acbf6b0e6ff7", "value": "T1C7C423B9AC4AE5DA00832E43318409176CBB139590AC1B51E3A96E9D0E9F0FD9DFC57F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692169705, "uuid": "9b35339b-3bc5-4b5e-8166-7d5076d02f4f", "value": "12288:rzHuNswEOOOgaBleyjv+4Apqy3fiZfrgDbA:nOahOgSQsSfEcDbA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692169705, "uuid": "587cdf8d-f444-427d-9acb-fafe45b849b3", "value": 549270, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692169705, "uuid": "c186f795-a942-4b50-b5d2-bd8a50137bf8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692169705, "uuid": "deef9bf5-0126-4d4e-a156-af0b4e7ee16b", "value": "STATEMENT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea05a5ca-3c3d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1692194711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692194711, "uuid": "c904d85e-4364-4757-800b-82ae58c2be1b", "comment": "Malware payload (RaccoonStealer)", "value": "be6381dc3f83d6134c2d23f6607be2ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692194711, "uuid": "745c7b98-64b7-46f0-b259-f9fac2b4448a", "comment": "Malware payload (RaccoonStealer)", "value": "d97e8c4b846f1743bae248137e96b7ed4c241ef71aaa2227347e71f509f0cd78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692194711, "uuid": "67902fe4-ec0a-4f6e-88d5-1037f76aea09", "comment": "Malware payload (RaccoonStealer)", "value": "26490592f3d71c2aaff76760e9d6ce7daeaf8a8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692194711, "uuid": "0e29860e-1929-410b-94f0-96b4760577cd", "comment": "Malware payload (RaccoonStealer)", "value": "779f8cb85d018f8047342695c260e105faee7d980014bdc3e1d8fa8abf2bad18ac5912df46ae930e6985053b2c6817e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692194711, "uuid": "13dbef7d-04ca-4736-8fd1-02bcc6a7b919", "value": "T156A53B017E54DA12F059D237C2DF440907E4BC047BA7FB2B7BA8776D58123AB3C499AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692194711, "uuid": "79ef7207-3e9f-4bfb-84c1-6988f89bda68", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692194711, "uuid": "321bb81b-b102-40b5-a19f-4887623f16a9", "value": "24576:7NDh/Et25n61RW2wzG9RI7Z7v4uCJIJIJv5nQmDFzyLW0/Yzq1xxqKOI:MY4uCJIJIJR4WAd1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692194711, "uuid": "df75a7a5-017d-473c-a33b-04bd42e14bcc", "value": 2195456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692194711, "uuid": "af2475cb-78ad-40c2-98e2-78a907e8e668", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692194711, "uuid": "74523396-f649-46b3-8347-0b6da60c8ce1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f57087c5-3c68-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692213198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692213198, "uuid": "ac8c33a8-b557-4f3c-8ef2-eff33229a2ec", "comment": "Malware payload", "value": "e03d64bf90d748796f37108ecf61f5a5", "object_relation": "md5", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692213198, "uuid": "1058e523-73ed-43f3-8ade-573d24d948ce", "comment": "Malware payload", "value": "dafc2802cb939f94e007a9efdf4c2935da18020aa8baa834e39c7f3be218b5d7", "object_relation": "sha256", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692213198, "uuid": "79a99c10-ddf4-41f3-86be-1c8dc7b0bc30", "comment": "Malware payload", "value": "8ba730ddb1ba5dee5076373049934c2bb2422874", "object_relation": "sha1", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692213198, "uuid": "bee9d33f-ae06-453a-8fcc-419882a81ff3", "comment": "Malware payload", "value": "f71af56a316403e4670d5f6b86327709459be8aee6c7b8bc08657e8c211d46ed75056ebea00cf07842bd234781b4e7e0", "object_relation": "sha3-384", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692213198, "uuid": "a4f9dfa3-e5f0-4c79-8980-0d7fa6463ff7", "value": "T1D215335A13CD6A3DAC6D95D2D59086FB8E7984916EE27FCE08433CC64E6F08102F85F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692213198, "uuid": "cd46ba49-d3e4-409a-b446-67de313fa38f", "value": "24576:WSCxyrrqGaAAB178IAEIWtTOc+mNpKFXo4/RJoQX2y:TCx0LnAB1A8paFH/sQX2y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692213198, "uuid": "39298c3b-fefc-4630-8918-a06e1511d2f3", "value": 913688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692213198, "uuid": "3c928b2d-345d-43da-813e-dd9ae111780f", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692213198, "uuid": "4d44797c-a5ed-4d41-8046-10f78e81cbe3", "value": "nQUOTATION_AUG7FIBA00541.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcc1e2dd-3c77-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692219599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692219599, "uuid": "0d173044-13e7-4fbe-bd26-70f3f7f279d9", "comment": "Malware payload (Mirai)", "value": "3b25c57d711fba99990ba6157127fa66", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692219599, "uuid": "04864644-d3bc-4510-aa06-56696bfa1c38", "comment": "Malware payload (Mirai)", "value": "db3bd4480c12e03798e784bb5c14281c9fd9fdb47dec44304df97ca17aafefd4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692219599, "uuid": "14d8f1bc-134b-467e-9163-c5d4d104c6a8", "comment": "Malware payload (Mirai)", "value": "25b0c4724a207e1e9305a0c7b7bd7d3872b173b9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692219599, "uuid": "10c801f7-bd02-4758-a60b-4e05d29eec6d", "comment": "Malware payload (Mirai)", "value": "02732e6d94eab2e0a83579b0da56def6854329b18cb1a14f1427258544417857fdc87f4b37f7696cdca9556f74938ad7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692219599, "uuid": "3aff573a-bf4b-47ea-9e16-668bce2dfac7", "value": "T147C3C63B67170E23C0CA50B101E34332AE75DE9B34B952D7AAD07D686F36A843856BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692219599, "uuid": "766cbf92-67bd-45c2-ad3e-35dfc54ff49a", "value": "3072:wsrp9xV+GZTZepNPhj+e3fSqPfL7ymm/QMurB1nKGNb:SMQplVfamm/QMurB1nKGNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692219599, "uuid": "084e6449-3d22-4220-a691-a92bb495a568", "value": 129856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692219599, "uuid": "b2d4791e-5a75-4984-b967-7f58c051e0b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692219599, "uuid": "974a1e06-a5aa-45b1-89ee-fe1f978b792d", "value": "3b25c57d711fba99990ba6157127fa66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5b10c57-3c38-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692192556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692192556, "uuid": "321a3da2-ae84-43d0-aa1d-10f97ec710f1", "comment": "Malware payload (AgentTesla)", "value": "a766d21f134938f02c49de483b325fd3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692192556, "uuid": "1e26315b-fb38-45db-a184-d29e0b2ed969", "comment": "Malware payload (AgentTesla)", "value": "dc47e60938515845878c3ae3b830f38c4c91c3b55ab1f675259b2ca65dc6a52e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692192556, "uuid": "331faf56-caac-4b5e-b603-100450156049", "comment": "Malware payload (AgentTesla)", "value": "3a5eef7e3c533e5716c8e49dbaf0efb1813543aa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692192556, "uuid": "6b9aa691-abae-4385-b81e-2907866a70b1", "comment": "Malware payload (AgentTesla)", "value": "3ced16c1046477329929f9df1ffdceb63d5bd27f4357f7f0cfe054e134b64b79283313fd5556a4120b01a70167f6bb9b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692192556, "uuid": "7fb7518d-84f4-4117-9726-e325a555e535", "value": "T1D145221552A81BB6C99EAFBE5585206107B1E173B312E3997F8C38CB8763B078B4075F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692192556, "uuid": "414f4497-9a49-4a40-b5a3-5e432d288db2", "value": "12288:o44lrrWwuWNh+Ds0boF2pYLQ5zvv4yOyn+cNh4mUVOZVI4:o44lXWX4Fmo9L+TZOS3lU4u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692192556, "uuid": "ae84119c-9ba8-4052-b4e4-64b3529c2d31", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692192556, "uuid": "00d979e1-1d71-40f0-8b6e-48eb259302cd", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692192556, "uuid": "c637a1cb-cd5e-4eda-9d79-1c78d9ea78d8", "value": "invoice.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03138497-3c66-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1692211933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211933, "uuid": "aa33c974-c94d-4c73-8726-3ec5edf3ccff", "comment": "Malware payload (Loki)", "value": "85dd400cf4a587a7f5ebb27035eb4a29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211933, "uuid": "6d0bbc01-a899-4619-995b-2355a1ad626f", "comment": "Malware payload (Loki)", "value": "ddd19c40c8ac0970b895e4a7476e9433f7cb774f6b7b550db914b0e40e636441", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211933, "uuid": "73753e1a-4e80-48b2-9b52-8f649748176c", "comment": "Malware payload (Loki)", "value": "1d39c377c106df23b1240dd272314b1a4f39cb4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211933, "uuid": "000cf637-8b50-40f4-b451-0854f09af60e", "comment": "Malware payload (Loki)", "value": "667ff20d07e91accc87d896bcc5a6ba24584366bcd10542bfdcecf1549ec944f0589bb48f941db2233db77f4fd935455", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211933, "uuid": "0dcb542e-e9f6-4f5a-a385-011b5f8a3068", "value": "T199D47D7406A6C50BE41B1738DCF2E2B57FAD8FA492E6C7434FE4BCFBB8490566681094", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211933, "uuid": "1231c063-05f2-450d-8389-63ed52506931", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211933, "uuid": "40737266-a69f-4bf9-9bab-363e2e00cc34", "value": "6144:ktT+iT+Ayp1I2Rrz5irIMW01DASCNrxuvm2Kyeylyej/3uZGhVjS4Z2/O1t9dz+w:ktBGpNrpwuFxhM/j2QPjSfO1Xde2O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692211933, "uuid": "39328630-04d6-4904-9899-b5f27456abc8", "value": 643072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692211933, "uuid": "83126548-4410-4a53-ab56-de2f8ef68f66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211933, "uuid": "32a4e2b8-a187-4636-977d-ce258a25c40b", "value": "Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fc4b8ba-3c56-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692205324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692205324, "uuid": "6fc3c8b4-9da6-4d90-aebd-7704cf75b991", "comment": "Malware payload (Mirai)", "value": "d437ee026c8aaf5952fd9911c7a4b096", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692205324, "uuid": "f4906497-1537-42a4-9601-99cb9a82c172", "comment": "Malware payload (Mirai)", "value": "dea4eac65775a06d577e220bdf4e67c4493760802d4cec9f8af517399142dc13", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692205324, "uuid": "3804df76-fc5d-4b03-8161-bdcf3b91c304", "comment": "Malware payload (Mirai)", "value": "141a11ea8bd2a7bf99f8bfc335cd80bab13c2f78", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692205324, "uuid": "3a60a26c-896f-48ab-888b-ce708f2983e1", "comment": "Malware payload (Mirai)", "value": "f227b0f6fd29f49645953a230702b3ba468efc3f64821de74f2f859d147d99620d4aff12c5a97e55ee85182ae23d16d9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692205324, "uuid": "f2dd853d-f902-4581-875d-669d2c78b650", "value": "T1A3E2F197D371E452DE7827F2F9A985CB6BBD0ABCC57A30B3161157282A9A0431F3C493", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692205324, "uuid": "50b94607-31c5-430a-a478-367e7c7e6357", "value": "768:PoiWiO031vpAPbrVWZK3XVGxm9XAjua9q3UEL5IQ:Porm1vpALgUJWgL7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692205324, "uuid": "cb59ea09-c387-4738-8638-7b2f2102a014", "value": 33028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692205324, "uuid": "26f7b77b-cec0-4cd3-b575-099dbf9b1f27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692205324, "uuid": "cedf2b06-6c4e-4969-9504-85ce237218ae", "value": "d437ee026c8aaf5952fd9911c7a4b096", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68358b96-3c0f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692174736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174736, "uuid": "c3f7d371-eb2e-48d4-9778-4945c2a95c79", "comment": "Malware payload (Formbook)", "value": "ff9fa8481daeba9be9f6923b0c500b34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174736, "uuid": "cecb1143-84c6-4401-8543-430effc9297e", "comment": "Malware payload (Formbook)", "value": "df0e6c210eb76bf9c8bd104041e73ff4f760ec17c1687680ccbebf8e45735ce3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174736, "uuid": "70297399-8568-4d90-978d-6bf87da52548", "comment": "Malware payload (Formbook)", "value": "b23ad4296254b86d10cf896cbac88367e534e815", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174736, "uuid": "401b4075-ca96-49c7-be92-f3f97f15b0cc", "comment": "Malware payload (Formbook)", "value": "a7b49ad6f0218a22c58e39f4839411ca7d7d194d08be01faffb3505f1b60c56f0dd882d9e98da14caa2527cd88497062", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692174736, "uuid": "850d21b0-bef4-417e-8767-4f62df3f1cb4", "value": "T1F05412146AF0C453F8EB5A700DB99237BDBED41016E0A22F53686F1E79722B16E4E712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692174736, "uuid": "5058f628-62cc-4ca3-b8ca-45c375cc2995", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692174736, "uuid": "512a70b1-46ea-4dfb-9955-c68802364d3c", "value": "6144:PYa6Tp4G+xcdmkhtTqGoFZFQJzBbGHICMoUT7TAw5Yn+My8g:PY5GG+xcxT+G/biLMJT95YnNi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692174736, "uuid": "6f8624c3-ba7c-45a9-8d10-2e8f5efa2fe9", "value": 282848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692174736, "uuid": "20ec31fe-2058-49dd-bce5-b01d085617d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692174736, "uuid": "c69225d4-6a58-4216-9ff0-2eb81bf67199", "value": "RFQ_8_10_23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff0d551e-3c1b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692180143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692180143, "uuid": "33637dea-6e9f-4319-b46a-5ffeb15bb7b9", "comment": "Malware payload", "value": "eb46af4e10e3256df38a22f584494ff6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692180143, "uuid": "f5caf83f-6965-4bc0-9e38-246aa1ce029d", "comment": "Malware payload", "value": "df31be81823df03c434880f9d7bc4204ba78c8987d2fc6de819db397a0e390d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692180143, "uuid": "4b8802a6-53a4-4f92-902b-3e092d7aec27", "comment": "Malware payload", "value": "7668daaef4bb70998fa9a99166b4b1f603b4fdfd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692180143, "uuid": "1a1b6743-368c-451f-bb84-9d9969bca2fa", "comment": "Malware payload", "value": "15f2966d0e218cb9abb035b5319cf224740073bb20ed05c790d5e810009c95c78115aeae54eb9c7f86771ed0b36524a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692180143, "uuid": "408f6f4c-367f-433a-a5f1-88b288b7278e", "value": "T132D3B4D632089892C96C073051B6FA7C4736ADE53650D6BCAD80F38EC8B7B60E67174B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692180143, "uuid": "159be188-09fa-4677-b2f8-8651e3586cb7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692180143, "uuid": "bec15b3d-2107-4b5a-b481-118e18c1cece", "value": "768:ri53Irdtm92Sthr2bfbXA233AvBo/pTq+bNZNTtli3T:6gfbXAk3AvypTLXTbo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692180143, "uuid": "09f61b2f-6229-494b-9ef7-78e973572a9c", "value": 132096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692180143, "uuid": "58630f42-847e-4335-90f6-d6ca61a8e387", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692180143, "uuid": "3d92683a-202e-49b2-accb-dd12b60f40cd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c56c576-3c2f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692188460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188460, "uuid": "5fdbd7fb-c7cf-4069-8dc1-384cbb6dbea7", "comment": "Malware payload", "value": "22ea8999735e30f1f91cc08705d0a491", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188460, "uuid": "19799941-8ae5-4f3c-a723-96a377c282de", "comment": "Malware payload", "value": "dfad9b11a79d675010d7df374f11fb8fc5142568e1384a0067a27f1d14f01f85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188460, "uuid": "fdb0cffb-a66f-42ec-b6a9-c4d853cf2381", "comment": "Malware payload", "value": "f672bebf02203dc7c9a334ccd573a6f5523c7099", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188460, "uuid": "505d125a-9672-4651-8b62-51476ae35bd0", "comment": "Malware payload", "value": "a3bdca71a83fe9c268cb68380f5e14188c473b7bf9d48ee46dd1372b93317a869f5793dd341b1ec172155ae3fea3aec7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692188460, "uuid": "c9cb4156-b1b6-49c3-8ce1-d0da5c5d9e54", "value": "T10C233DD47ED85CC3ED10637C51E682212A3DBAE08B5387076534B6321F23BD16EDA26A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692188460, "uuid": "33c347ea-9984-42f8-99ca-d1983a0eaf75", "value": "46cee98f6b9612ae29c7d776c20a3f96", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692188460, "uuid": "d13b96f7-e3bf-4285-8435-a42cb7fc2ec9", "value": "384:kJhA5hz9OVmNX6VZyT/o1ar4a4tnJKQka2UQQnNvU1MQgCiRR:kAnIi6VZs/KM4tnJKraXRcsC4R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692188460, "uuid": "12e54d80-3543-4097-8f26-7972ebfcc08f", "value": 48732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692188460, "uuid": "b0691486-45d0-47a2-9712-62eb6dd5e572", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692188460, "uuid": "f9548375-a686-41ca-8415-72d6eace19bc", "value": "shellcode64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1824d5d-3c2a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692186509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692186509, "uuid": "b05cc90b-406e-4ba3-ad4f-ac6c60771e31", "comment": "Malware payload (AgentTesla)", "value": "49bdc4bdaf5c44085438b0d3233b3ef9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692186509, "uuid": "7b345589-3a29-4c0b-969e-9a31336a38b3", "comment": "Malware payload (AgentTesla)", "value": "dfba6d9c101eb1273aaf962047fd958424bfac70a1162c2a910640981a23d054", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692186509, "uuid": "caf4bc24-d1a1-402f-8192-062a9e2e151a", "comment": "Malware payload (AgentTesla)", "value": "5fd73d318f5abc616aa98e5231ca468976e83051", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692186509, "uuid": "26f908b7-6655-4f44-b2a1-da35e468ab4f", "comment": "Malware payload (AgentTesla)", "value": "931109aadf24f47bc6933ae1cfd33a3fdacfdccd0d926acb2446a90adf3308c218c5220a417bcd5ffc876358b146f4b0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692186509, "uuid": "a2d460c3-faf8-4f9c-bea3-6017c57ffa7a", "value": "T14EE4221137934A18E1AD13B65C71E53813BABC26287AE96C36D93DCF3B73B004745BA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692186509, "uuid": "0ab3cad5-4ab1-43c0-bd8c-9482bf1ccf6e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692186509, "uuid": "a722bf65-1763-4199-8a6a-16325ddd0dd3", "value": "12288:00Dl+C42xjWhRn+fqz6Hvq7gJODTLDKqPSeiSHCdtKUJRVfhDQP3M:tmn+fqz6Pq7gJODPxSe1HStKU3VfdQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692186509, "uuid": "e4767a6b-14fa-41b9-81ff-856343a0f2e6", "value": 699904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692186509, "uuid": "60ed058f-56f3-4ccd-a7fc-1383804c927e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692186509, "uuid": "e9027be4-439e-4de0-a2a9-463dbae4ccc3", "value": "SecuriteInfo.com.Win32.RATX-gen.6117.26429", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2fcb4dc-3c2e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692188176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188176, "uuid": "b78151ef-be88-4698-a861-efad992ac4dc", "comment": "Malware payload (Mirai)", "value": "edb45f53c8d09f918b670b2e1f8492f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188176, "uuid": "53402629-3d32-42a0-b6de-61cff47b811b", "comment": "Malware payload (Mirai)", "value": "e0bdd106c5f89f2242f9b6357b868fcad06f26aa7562c01575cd709614dbe8ae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188176, "uuid": "75f3e10e-12b9-4611-831f-689ac294fa79", "comment": "Malware payload (Mirai)", "value": "d8899d57326749c5b011e5e80307e38438174d49", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188176, "uuid": "87c1face-2e02-471b-9ae7-d1e05d69bcc1", "comment": "Malware payload (Mirai)", "value": "bae884a89b79828c46e4dafe5897665be8f4803b46ce3e8aff4067d29486eb14bae5834eed262648eebc31ad4d36d881", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692188176, "uuid": "1db6cc27-6d00-49b2-bd64-c730a963b251", "value": "T118A2D025D345AEF8DFEF9D9457C2C2C276E943C6268AC8E340EEAF012506046B788D59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692188176, "uuid": "fa6a092d-9f99-44eb-8f0e-1ff3540e19a4", "value": "384:m/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5eHM4uVcqgw05VxJi:mRxsSVsMD6xiJJE5zRWNx4uVcqgw09w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692188176, "uuid": "9d764f75-eaa5-4ed4-9da7-cfc54ea8a5f3", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692188176, "uuid": "ef752fee-7710-4fb7-8af8-315cc6f78016", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692188176, "uuid": "63fceefb-39b4-4a83-8e9f-76672355f137", "value": "edb45f53c8d09f918b670b2e1f8492f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7cc6db0-3c0d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1692174037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174037, "uuid": "3b89ffbb-de13-4e35-8ec8-c196577cd8c2", "comment": "Malware payload (Loki)", "value": "a2acffac7c025160781bfdd117fcaf1b", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174037, "uuid": "3ec74a8a-04ea-4f67-bf87-1890545c6103", "comment": "Malware payload (Loki)", "value": "e0c03408172ea67884b93c60c988c8bc1b5e0096789419bfd881f455c06db35d", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174037, "uuid": "1ed3eb26-3069-48cf-8cc9-7ef9b9e072c9", "comment": "Malware payload (Loki)", "value": "213bc5cf9e42e33aba348a80c9fb9dae64fa0a77", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174037, "uuid": "eac24914-cae4-431b-bd7f-fed0c88d5e97", "comment": "Malware payload (Loki)", "value": "e9c2ab284deef315295c64996ac113ba08384badb527f5261807feb1006e25336d6b931fd2372f2fce08f594cd1997db", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692174037, "uuid": "9e15dac6-c640-4193-b0b6-169cfd6fb453", "value": "T15D842332265B5CD937472222C23FAB049A7CF3E51C45EBC7EFB2A84CA54D7015D268AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692174037, "uuid": "878b0bb7-437e-406d-b4bf-df9eb49137aa", "value": "6144:eragDTERuqua1sW3yYgTmaT8Ny/F+LI9CpG5QLHPQWga3GLfYurYtHWPgifXvm2v:EapEqryxTm9k/FMIopeMgUXucBWPgif1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692174037, "uuid": "4b16394d-832d-447c-8e8a-787b04d57db0", "value": 378375, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692174037, "uuid": "52e403f0-4c31-489b-9977-a9d3557e59aa", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692174037, "uuid": "f2325a2a-4d52-412a-9535-62153b1c7f4e", "value": "Shipping Documents.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8da5e1de-3c41-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692196274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692196274, "uuid": "8cf0eff6-979b-4755-a23d-a6afbfc92993", "comment": "Malware payload (AgentTesla)", "value": "cb1b6fb8adfd37bec6e99a78ab7b7aef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692196274, "uuid": "07c35752-e8f9-46c6-b007-bb4cedf85a89", "comment": "Malware payload (AgentTesla)", "value": "e1b7acfbe15a0fde89a1bb1f0f51142061b2ff50bc6c33c770a40f1c43b0d7f6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692196274, "uuid": "d4bb7ee2-ebc8-41d3-b5a6-444c715737bf", "comment": "Malware payload (AgentTesla)", "value": "45682c3e42bfb5d9e318ea8a132ae4df7b5897bd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692196274, "uuid": "c9674bd7-03e5-491d-9140-3949a633ed8e", "comment": "Malware payload (AgentTesla)", "value": "dcc83d069112c761cc83fa18ac6d84fa6466ffcaa0029933f07dfa685e85ca97c29619c9a0c8b84d943fb1c4917d4149", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692196274, "uuid": "cd53a0a3-712f-4124-8964-91a92b21a4cd", "value": "T149E49BC6E976D2E3C87147F560A220148F357FDA3469E2A40CA630D67AF1B043797A7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692196274, "uuid": "ef82fdcd-8486-4743-8fb1-963492d5f874", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692196274, "uuid": "15d2db4e-7de9-466e-aa45-4c18bd093123", "value": "12288:CGaa4lrr9mCaUJfPwR3xiV6b8W2w790aSr6vKTfihOSfso1438:CGz4lXErUJfO3xtQbgSaTMik61b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692196274, "uuid": "5eb1e569-9621-4b6f-8070-d20a5804e599", "value": 718848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692196274, "uuid": "365b1dc9-fee2-4f8f-98e7-20e1a26f0808", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692196274, "uuid": "9a2e6f5a-6c65-46a8-afaf-01a8d69b968f", "value": "cb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cd6ac63-3bd8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692151068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692151068, "uuid": "ba6e71d9-3e26-4b4c-9ea0-711ee358e40e", "comment": "Malware payload", "value": "25e35c28e0212a5c1e6c177be4d48b1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692151068, "uuid": "f4d53a82-d9b0-441f-9478-448c4a8fcc52", "comment": "Malware payload", "value": "e237afed733f19fb87d226904faa1f6b13a9279db2970aa9821bd7ba03a61487", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692151068, "uuid": "a309eba1-d45d-415d-b841-d63390eaef1a", "comment": "Malware payload", "value": "2d7dce91567c39526f4edbf5ba5e1467c81cbc5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692151068, "uuid": "6e042926-840d-4d15-b3ee-333cf61c636f", "comment": "Malware payload", "value": "52e5b322745313eb2cf4c22726f57659089c7b294f4abdadc41c578b51798ba22b3f39a4dfdcdc1deeba9d0b69986916", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692151068, "uuid": "f3c5ef55-f4bb-45c0-aaf8-182082f2538e", "value": "T1856523387689F058EE55EE3E2D20D8242AA01C405CD5E1E77DD2F7EE99723C88EA5347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692151068, "uuid": "bd31fcf7-e19e-4836-9337-9bfa1e573205", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692151068, "uuid": "ec07b858-98c7-45e5-badf-c8a25eab1a80", "value": "24576:8Z/4jDkyXlNpezDB93fHVqsdEd7N+GawXJEC8zX8bSMVAgVI8Hn:w/4syXlNQDjTe1a2Kh8+fg7H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692151068, "uuid": "c88b17a4-87e9-4a5f-aee8-6a0d879b3492", "value": 1457152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692151068, "uuid": "f4ae37e4-8ee7-4720-bd86-aef2a0f55d54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692151068, "uuid": "2d2be6cc-68a5-499f-ba7b-7b9bd07fb20b", "value": "25e35c28e0212a5c1e6c177be4d48b1a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d76d374c-3bce-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692147005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692147005, "uuid": "a8efe0dc-39e6-4a71-95e6-df15d629db4a", "comment": "Malware payload (Mirai)", "value": "f005eee0b1c181f710f355a1b7e20605", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692147005, "uuid": "58c64651-6044-48e7-88a4-9bee9d8a0c28", "comment": "Malware payload (Mirai)", "value": "e274611bf6527aec8a2353304609b0833839ac535a7cbe101a7d956b1fe38463", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692147005, "uuid": "8b4eb809-16bf-4b54-8728-4d01b8011e1d", "comment": "Malware payload (Mirai)", "value": "a98dc66a2069114e05b85afdee9e2038e73ef22c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692147005, "uuid": "e589a268-94ff-47b2-bacf-01f9df142ec9", "comment": "Malware payload (Mirai)", "value": "fb4cb4f6f3e11868466da91458742e96d9cdc8f02d3ae9fb4f9bc41fb4099f5e12b77789bc787cdb161e065cd0c7884a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692147005, "uuid": "024b0e28-6be9-4d5b-ae34-a192102afc42", "value": "T16623E79579C19A06C6D483BBFE0E82DE372263ACE2DE3213DD252F51379653B096B111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692147005, "uuid": "ab6208c7-d6d3-4b04-be2e-29ef31cdf377", "value": "768:EBImSV5VqA3Gybq5UFJxpWenLHDTEO55ijjVwkrKufS4pxyKfML0Z35FZJwq:LpIpMq5UpWeLcW5zXAxpPf+0ZpF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692147005, "uuid": "a5fa31b7-1c4b-46c6-9298-4f0864baf1c3", "value": 45928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692147005, "uuid": "86c0b26f-861b-473d-8490-ee2cd1ba026a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692147005, "uuid": "6b30a7ce-90e7-47e2-b5b5-acaa236681d6", "value": "la.bot.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5faf8db3-3c3c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692194049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692194049, "uuid": "3eafb559-dbd7-40b8-807f-b63ad2781407", "comment": "Malware payload (RedLineStealer)", "value": "dd72c7ba7c67467c4e6b6a03178d1a4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692194049, "uuid": "69bfca64-9eb3-4202-b5c2-26f88e1b80c5", "comment": "Malware payload (RedLineStealer)", "value": "e328321c9027a8edf973fa89db96463673e3beff0c96fa462ae9a6f393e71400", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692194049, "uuid": "9903e15f-988b-4bc9-8efe-ec8324adf2ad", "comment": "Malware payload (RedLineStealer)", "value": "9cddb69d3140be4fc173a37b1ac98ec3ad94c761", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692194049, "uuid": "79b542f1-58ad-40b9-ad6a-594e49800d13", "comment": "Malware payload (RedLineStealer)", "value": "cf55d4e95554772ce6bfd5da1032f981e459c814f070bfd75649c756b426c54549d993c147edf78b616e36d9479cac71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692194049, "uuid": "521e8760-07e6-462e-a166-e2a52c3f2714", "value": "T1E184012ABB92D4B2C5A705314520EB956BBF787002B1C91B37781BBE6FB13D19B53306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692194049, "uuid": "a2d64312-829a-4c81-a517-7e72d3504d6c", "value": "81a47929bdbad1a6e843c1dc8ab5e1d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692194049, "uuid": "41c939fc-aca2-427b-a31b-3898e9c4f26b", "value": "6144:hPiwL1Q0h0OT2m8OQk69MY8s+xps0PXhh2TW19g5IRERp6tcD:hPx5Q0hXT2rk69MpPpsQRh2JIepL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692194049, "uuid": "a13fa007-44e0-4bcb-ad9a-b041fb58a531", "value": 392192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692194049, "uuid": "60a2d2e5-3a1c-4eaf-8c51-d31c69418645", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692194049, "uuid": "519dfcd4-7999-458f-acaf-9fc5e7660afd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "840955a3-3c13-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692176501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692176501, "uuid": "6a1316fe-1969-4e3b-943b-e37517784782", "comment": "Malware payload (AgentTesla)", "value": "dfe058750f3718d527baf78c6fac9e15", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692176501, "uuid": "f6823665-ff9d-422d-bbb3-a23982fff982", "comment": "Malware payload (AgentTesla)", "value": "e3921e3d49ebc5e8541b75a72dc137e89431e182ecf63d2dfc52d7be73455c3a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692176501, "uuid": "6f98e922-c502-4bb7-b108-a4362abdc68d", "comment": "Malware payload (AgentTesla)", "value": "150a2d83de4a0a2039a66e29fc2d72cd4c372384", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692176501, "uuid": "929d1bcf-54d4-4fb1-b7cb-a251f4e5e7ce", "comment": "Malware payload (AgentTesla)", "value": "ab234f2713df119cdd3d7da0239d1342e589a1a2b1e21a7aadb94370e4ed8bd3fcae19bb5eb99de9829bf1bcb832077b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692176501, "uuid": "1e9952cb-0b2e-4f0c-a38d-f4be8a86a6a2", "value": "T154E4230E949C28B73821BAA915C9DA0DE9B17741439D2F337F981E7263BC1C25FF815A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692176501, "uuid": "490f7bf9-92e9-4dc0-989d-ca24f209ac30", "value": "12288:Ldd4IPMUIW406PLKD3HBFYp5SMHaR6GFRI+EIWfgutt7t76cghbvL+:LPEUIWl6PLKgpi3FRI+EJBtt7t7yhbvS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692176501, "uuid": "8d816853-9245-4c2b-a2bb-9be88c71f7a1", "value": 696558, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692176501, "uuid": "e90f74df-e182-44ee-99ef-d3775e8ebc9d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692176501, "uuid": "52bff189-0082-4dd2-94c9-6ffd48548158", "value": "invoice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "996af7c8-3c38-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1692192428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692192428, "uuid": "14e46ea9-4dc5-43b1-99b6-5b04cedc26d4", "comment": "Malware payload (RemcosRAT)", "value": "6493dea54a645edcee6a15c2f2cb3a86", "object_relation": "md5", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692192428, "uuid": "4136a13c-0ac2-485c-8a28-5b7f7c787411", "comment": "Malware payload (RemcosRAT)", "value": "e3b1152ba9991b35bcbefeb295a95be359d5ecddfefcb8e063e4020c942bfd73", "object_relation": "sha256", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692192428, "uuid": "54f8c8e6-59e7-4e41-8aec-dd767d1bdf08", "comment": "Malware payload (RemcosRAT)", "value": "6246d30fa8a2b512067c3287b627eb6921711a6d", "object_relation": "sha1", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692192428, "uuid": "ee45a4ad-9f47-43a7-9bae-314cf2ea00d2", "comment": "Malware payload (RemcosRAT)", "value": "539bb74dfa97b000ebad63e6ee877e81a92ffde5fb93ec009200bb506f77e3e31ec077778ac6d48f2c6b57744e5083fc", "object_relation": "sha3-384", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692192428, "uuid": "f1a17cde-1497-4991-8d81-1001bae3bcc4", "value": "T1E7B1F32778A6020933761791DBE875B18B27FED45A39AFFA00305A1D8FC1A49CC5277E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692192428, "uuid": "d8e681e8-066e-4bc9-a09e-8637e41c8e79", "value": "96:AmJtdEisthDmN2VwAZ4PzbowmfHvnhVqKxFCU0RQJkdbioxnQQQerfI:hUfjDl7qcFCU0Yeblflrg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692192428, "uuid": "e439fc9f-bdb3-4fed-a905-ee2ae2863592", "value": 5251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692192428, "uuid": "122ffbee-6709-4f60-a642-c815e3ecb824", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692192428, "uuid": "fa19fdbe-c5c0-4505-aa1c-02ece3c1c121", "value": "filescan99383938274873726_.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32581b62-3c80-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1692223179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692223179, "uuid": "8d788193-9433-453c-ac86-060e4484fd78", "comment": "Malware payload (RemcosRAT)", "value": "5c0c977e9713c9764f7382c0da3b5c17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692223179, "uuid": "c5dba0f5-c0c9-42bb-bf13-094b18314980", "comment": "Malware payload (RemcosRAT)", "value": "e45afde600fe6309191801a04d60dc61f43a74347de9cafc042c2ff579a69b89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692223179, "uuid": "f415ea8e-5df0-49fb-a305-0d4953c7fb9a", "comment": "Malware payload (RemcosRAT)", "value": "a38d48edefd468f5d01f9f870a3bc54941f100e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692223179, "uuid": "20975fd8-95af-4e8a-98b6-c2abda862305", "comment": "Malware payload (RemcosRAT)", "value": "c835a97fb3b391f8b384f56f4f01a4be8556a50fdc3c67a12d2c4bc3a6a5cfbb06e72dcd764d34afac3ff7f1c357bafd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692223179, "uuid": "c40f7a0f-d90e-44e0-a14d-e232349ef217", "value": "T1C855AD2162E9DFC2C19F2575DC96B1F80617EE10CD559FDB3E84BE1A34B22A2A93014F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692223179, "uuid": "27f6173f-f24b-4a27-b2ef-79bee8b95e6d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692223179, "uuid": "41deac1e-028c-4ba2-91f8-cc66598d800e", "value": "12288:T3gndrEp7MW7O3AJYWhtAdsL38MsDpN9JUNXU+wEV:T3gGp9O3AJYEtT3sDL92N9V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692223179, "uuid": "0d7bf778-19a0-498a-b8d0-5cff4f026ec0", "value": 1325200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692223179, "uuid": "ced9d234-41ee-4670-9b9e-f9bc794d3b5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692223179, "uuid": "8dfd9199-a115-4527-acb7-2137f67a8a4a", "value": "DOCX_6802_1755_02_2023FINAL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f5dc97e-3c4a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1692200035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692200035, "uuid": "fd8f878e-a692-49aa-98c2-8e71d62d5f03", "comment": "Malware payload (Loki)", "value": "287926985da7a383ea55631376276d7e", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "Siemens", "colour": "#EADC3E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692200035, "uuid": "6581271d-ae9f-4ddc-b4dd-0174feb51a71", "comment": "Malware payload (Loki)", "value": "e58fbaef90bb6f8613bda068eeda4935d020cbeaf294864bb2dd76474d2cd476", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "Siemens", "colour": "#EADC3E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692200035, "uuid": "177d7f75-40c8-461c-949b-9f83347de3ba", "comment": "Malware payload (Loki)", "value": "1cfaf20676da9317e6f48a2086428dc99d3ae58c", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "Siemens", "colour": "#EADC3E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692200035, "uuid": "3efdd039-3b39-43e1-adf3-770f784d5194", "comment": "Malware payload (Loki)", "value": "fe380efcc626965ad2f6a198709ce2f8452987e42e7b3f6d2d591a37b8335626c51759bbfdb8d449b862d4724e1b0d16", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "Siemens", "colour": "#EADC3E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692200035, "uuid": "4d4456ed-3670-4d53-aaae-24c9c80bf641", "value": "T1E68422C0CB81812573E1443ACD2BDBA345E3D74FC21BC954ED8B268729ABB89D64B5F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692200035, "uuid": "05938bed-864a-4228-865c-38a16d6112a0", "value": "6144:nZ4mdD8Ij5zJCYA4chaZBADDVF602BwDo6mhUx9jRtYEELZEJzJURKp5iHQb3:nZXdQyzMYqa3m6tWRmmzpEGuRKKwb3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692200035, "uuid": "e69feefa-8b3b-433a-acda-6902cc1ae1d0", "value": 377696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692200035, "uuid": "e0062d5f-39e3-4040-868c-772d93f2c221", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692200035, "uuid": "4a2f943f-ef30-45fd-9bf4-f99d7cb54619", "value": "Document.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6a08348-3c63-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692210999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692210999, "uuid": "5e0dd52d-32c0-4e07-bb09-793f96b2740c", "comment": "Malware payload (Mirai)", "value": "06a41d8a6efad2e1f1b23f60e35e2522", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692210999, "uuid": "5febc942-36af-47e1-b2fe-d165d29b2219", "comment": "Malware payload (Mirai)", "value": "e59c0c523a4cfbf11fd413dd922846276918a6ae2ef756b6007f4bd638b3fc66", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692210999, "uuid": "7e084fdc-e6a8-4b44-8946-e798eb76f3ff", "comment": "Malware payload (Mirai)", "value": "87ddabef5aa72b5e49e8555a65d54cfb7c34b4d5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692210999, "uuid": "adaef522-6367-4ab0-be03-b0ebdfa39b9d", "comment": "Malware payload (Mirai)", "value": "65072851a904e3e481b660e695475d81baa7962eff9547f5ab0f27a6a55bca5c1200717c0e284a3df4f438970fc8e31d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692210999, "uuid": "91176286-77e0-4e29-8535-21d252fb20cd", "value": "T105D2D1DECDE461C6C99D1CFDC0EC2B731E95E0C0226AAB9A63229D8F971095BB5540FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692210999, "uuid": "b7f8da1e-9d36-4ddc-9b89-57400b2b6342", "value": "384:d8pVWtmRsLYEpB6V8S628FpSg0BLGTDqvh/7yJRvPaURRSwRWp5lIf1/EF4Djq6X:aMYHb62cmLSqJ/eOUSwRWvlicFxWn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692210999, "uuid": "7b6ba2e7-7d35-44a0-bdc5-82500ebd0fa9", "value": 29952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692210999, "uuid": "c07d1da0-fd20-4a51-99ee-854d7fb5e3fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692210999, "uuid": "77f111c1-8ee4-4b1b-a1ad-f1f4c2f95f2c", "value": "06a41d8a6efad2e1f1b23f60e35e2522", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "327bd44b-3c3f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692195262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692195262, "uuid": "c83e4d12-14f5-41a5-8ed7-c7e4042b1c9e", "comment": "Malware payload (RedLineStealer)", "value": "e063c836d7f625542dbff037e69e5e8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692195262, "uuid": "48b67158-dc77-443b-b48a-214ff3e2f036", "comment": "Malware payload (RedLineStealer)", "value": "e644df9fb12d4f5a7fbbe88089460509153fd88160c35ff155fabf837d632a36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692195262, "uuid": "34cfb511-9d50-41fd-b966-a19df9ecd1c5", "comment": "Malware payload (RedLineStealer)", "value": "dd8b64d02635b5ff31e88d257777266bad0a9d87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692195262, "uuid": "6422d2e5-65ac-4629-8b0c-bbcba816c561", "comment": "Malware payload (RedLineStealer)", "value": "2c632da8a9690b0279c87e265d4102b0a563f0f81adf88bdf33e3fc43e0286a6d1152971d41a6ed4f9477f490612f1df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692195262, "uuid": "7bcd7403-f3c3-4498-b806-8d5622f75209", "value": "T121D4120E7AF45A33E15982703D219679C19F7CB19C1C990AF32E3E2EBBB1B829515347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692195262, "uuid": "f97e8cce-d6cd-4d08-a4a9-2e37a3ed7815", "value": "0a76d99dea1901138bcd85b485923a3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692195262, "uuid": "9e278524-7f45-4167-b30e-0ef45d913d08", "value": "12288:pIdR/L2wA8UePhz2j01+PDkRGqOBr1gIlC1DM0+c2XZbW03:0L3Afeojhtl1gIlC1DMh20", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692195262, "uuid": "d2c5d45f-6df9-4f38-b8fb-388bd462a4df", "value": 651264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692195262, "uuid": "b5e9d1cc-563c-45c0-98e9-b40b000edc7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692195262, "uuid": "473885ac-901e-4c6f-9255-947948133a72", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ca3c9cb-3bff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692167872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692167872, "uuid": "d2c97f79-fc30-4492-9e6c-ea9f6cc2353e", "comment": "Malware payload (AgentTesla)", "value": "b7ff940af4ab15c70273e3a792f417b6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692167872, "uuid": "12f8d645-4917-4f20-941d-15e4d40d60e4", "comment": "Malware payload (AgentTesla)", "value": "e6d8e312332876bde91dd2798d4642bc558d11e93b714e6aeb8c7a909cefa416", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692167872, "uuid": "67b4847e-5c83-479c-8218-eed2cff1f926", "comment": "Malware payload (AgentTesla)", "value": "987647bb949fdc2d7adbe8fbf115140dbebeb1ae", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692167872, "uuid": "2affa5a8-5dd2-41f7-b8da-7ae50e14884e", "comment": "Malware payload (AgentTesla)", "value": "8f84a1a02ad80c7e5858ce726e4e88e30d387b2b4dbec8be254d379e30f5038f5d7cf99c4d0fbed7a4b1e8cbe64c8de9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692167872, "uuid": "b770ea40-3a5f-46df-a179-d344a8340472", "value": "T12715E60059750056EF3E227D1A63573DB8BC1D53A2F2C5E9A72726D38DD3012CEA8BE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692167872, "uuid": "331554cf-ea0c-41ef-9f7e-9c8877721efe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692167872, "uuid": "2392d817-a601-452c-babf-f1f7f0e62859", "value": "24576:Izw1lNPISJpppXpppppCOopppXpppppCOrYrhOnFP3cnPDxqv:1FIBO/OUrh6J3qM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692167872, "uuid": "239cea21-7d7c-4e15-b130-c4792c1c745f", "value": 908800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692167872, "uuid": "d0c42a5f-41c6-4fbf-b165-1a9d4774e876", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692167872, "uuid": "96d68e51-7507-45f8-83d3-29b55a43d6f8", "value": "SHIPPING DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03f6dacf-3c3c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692193895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692193895, "uuid": "1a2719df-b2cd-493d-8a17-523c40966ebf", "comment": "Malware payload", "value": "93e9bcee099beb60565371ae5c1fe38d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692193895, "uuid": "f1024a0f-cef3-4aa2-bc9f-ec23aa324c7e", "comment": "Malware payload", "value": "e762f5eb7951d68fd2959c543f44681cc14a879de39b7d55eb73294b4bcdbea0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692193895, "uuid": "f04d55b1-1f99-4e67-895f-e19364762383", "comment": "Malware payload", "value": "776ce72540e8d484be2d0f7c22f8f2989625a074", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692193895, "uuid": "2b89a3f4-f807-4d83-96c1-546460e7a973", "comment": "Malware payload", "value": "ed1a03adf9045a1dd6a1624ca67f2dfdaf793131bff076652700b2e3f7b013e14692c3e3a5c1c96e6c7638ac5b06e838", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692193895, "uuid": "8c1521ff-c473-44d8-b6c5-6df2a9d6ae43", "value": "T1BAA432163D089BB2D20CF936C0EB362813B99DE62773CE0FEE4D3F95563164A9C59618", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692193895, "uuid": "8179cc01-4a12-4af3-91c7-1c0db578db9f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692193895, "uuid": "923aa71f-d47f-40e6-a02c-5e4485b475f4", "value": "6144:8gDSDFzFXHzaoMTt7JlyhRe/XChH41oW4g+Ehf:I4xCsSGJh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692193895, "uuid": "ed914fc3-6649-47ed-aae3-6c53f4f0c16c", "value": 451072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692193895, "uuid": "2ff1840e-7fb4-41ef-a967-73891714cc3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692193895, "uuid": "1932cb61-7ee2-432d-8146-2e90ce1d2438", "value": "download.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbd86833-3bfa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692165857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692165857, "uuid": "0746e578-041c-4f0c-bca6-9912d67993f9", "comment": "Malware payload (Formbook)", "value": "5087d4e132cece96fc39fff273908629", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692165857, "uuid": "ad546ce9-47bf-4b5d-8a3f-8ed398250642", "comment": "Malware payload (Formbook)", "value": "e787752ec1479dcbb4ea3c79c2214ddfdaae8abae93766b3595cb9a5d3835ec5", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692165857, "uuid": "4d332149-7f86-4070-9e80-af8fee59f79f", "comment": "Malware payload (Formbook)", "value": "419bf0363783695549f1b64e92e90fcca1c5faa7", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692165857, "uuid": "dd0d8512-b5f9-418a-900c-e2d208183b8b", "comment": "Malware payload (Formbook)", "value": "9c6371d273671b945478ef73baa8a003a8d54ec3048d0304ca07855cd6f9ad5d72e3e387395db266d401f429ecd79220", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692165857, "uuid": "7d1b128d-2437-467e-b0fb-d1f0c06533ff", "value": "T172342303C354A959331EE44F8CE094EEB3501726D716753EDC168CBF09BA5198DA4FAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692165857, "uuid": "6ff0a2b1-2e2d-42f8-831d-de2d175aaa03", "value": "3072:LPKbOWWqccN8QxAQSLo6EeII8iejBs22qA7pPmICz/fUnCMJEGSbz3hV6HFWuY9L:LPKbyQxcLo6EnPieRys/fUn9mGS2Uuul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692165857, "uuid": "66388317-9aaf-49ab-9dec-7205cc8259d5", "value": 232003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692165857, "uuid": "2127e6d8-f50e-45c3-82b9-48b2e12ceadf", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692165857, "uuid": "e51ee577-f508-4a11-abaf-3d7b57871558", "value": "Payment advice-BFTI_EFT71230809.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b77ebe4-3c2b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692186606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692186606, "uuid": "147cf047-92d4-454f-b391-feb26ab20d2c", "comment": "Malware payload (Mirai)", "value": "6f6e61bb57069591b40e25a3e7aabece", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692186606, "uuid": "c5806054-1796-4758-af3f-88c6e9206b78", "comment": "Malware payload (Mirai)", "value": "e8034e9ef8680a9e30d7eea21179fdc19750805bce4d2e20d5d450a0b2b5255b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692186606, "uuid": "b4589d1a-e07a-4bab-9c20-d8739ce45903", "comment": "Malware payload (Mirai)", "value": "68dac443954abb640e98ab1a70b4f0927dea56b8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692186606, "uuid": "a5c3a92a-ea0a-41bc-ade9-f101dcf7a8e1", "comment": "Malware payload (Mirai)", "value": "a95d4eb19104bd42ba8d89b6e957369264485fcb433e76838711139bb122f3158115d1565629feb0c07a2e3de6a00129", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692186606, "uuid": "429f10b1-cae4-42ca-8f06-304f4b1f9a45", "value": "T105C2D170A6EE2CB1C7500672E7B856C9BF530FBDE6FA2C90114197BB3841D0529EA9C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692186606, "uuid": "58b64744-f622-41f6-84e9-18f9f50a9c2a", "value": "384:ARt/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNE8GsKMehymdGUop5hs:A7soTAZ3alkXLvFh8nNE8GDvs3Uoz6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692186606, "uuid": "d8f8efca-59f8-4e6e-a503-7818f5e6a44c", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692186606, "uuid": "b12ea020-28e9-47e2-8df6-4d5468a2ed31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692186606, "uuid": "5c5e09d8-c080-4f6d-a3f3-e5fc9bb5b41c", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e2a1ccf-3c4e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692201858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692201858, "uuid": "13f018ad-0913-4974-97e0-437ad428855f", "comment": "Malware payload", "value": "10998a72def5626a9f8a84990d34015e", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692201858, "uuid": "921b21d8-0203-4110-804e-6cf60a0f9694", "comment": "Malware payload", "value": "e8f82d344bddfbbaf10e9b379744a10eae1fe9015454e2d4893dce588661ba6a", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692201858, "uuid": "fc8491e2-b6a2-4acb-b872-93043094c019", "comment": "Malware payload", "value": "19951b707aa277b25e3f7834bbcefac2f5e70cea", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692201858, "uuid": "78bdbefa-c271-4576-8acf-620797659db3", "comment": "Malware payload", "value": "aa04c8ee12d78e71aa704f57838da8bc48868437a2dcff947f93318dd84a7a028d2c8d362571bc14d9258ab11fed7642", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692201858, "uuid": "ba1c6cfd-0a45-408c-9533-585590e21055", "value": "T1F593F1517C91E1C0D8BACAF204B35D3DF6498EBEC8BA27D1541EA02D4E53292DE5C21A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692201858, "uuid": "af7a822c-0281-43bd-8822-a297178b38da", "value": "768:Rbiz/kmGcfFQROp5TLWD04WgtlUWms6DRkZhlLiorndnt8OfMb1uv:RbilGgFWO3TLI04zuRsY8iIZzMb0v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692201858, "uuid": "59b1e563-4e57-44a1-bdeb-a24b98f37781", "value": 91078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692201858, "uuid": "42d4bc25-2386-418f-9bf0-0d62fba90a4a", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692201858, "uuid": "336fb428-482f-4c6d-b64a-c501fb49f2ae", "value": "RFQ410000003438995755100004.tgz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a19622b8-3c3b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1692193730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692193730, "uuid": "249db7e5-b0a2-4bf9-b059-e754b75e4513", "comment": "Malware payload (Loki)", "value": "62163fcadf9419b19bccf836c12e3a4e", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692193730, "uuid": "31a0a356-eebd-448f-a8ec-2f6a84187a21", "comment": "Malware payload (Loki)", "value": "e943e5fef46e92ebb7bf1e4002db7354c3717a3e8c55d6cc19e3560deb951c11", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692193730, "uuid": "43fb573b-9a51-4a7d-b477-f65802761854", "comment": "Malware payload (Loki)", "value": "a087e35aafbec779fcfdf5a88f584c1c8123adfa", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692193730, "uuid": "7c7670a4-9ecd-4710-a04e-e070807702d4", "comment": "Malware payload (Loki)", "value": "e4585b530866acc77303e4479ead9f5c06b64ed3fa3388aeb56a3f32a93b3330a771aa7ca6342abbc7d9c77a22262dcf", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692193730, "uuid": "b07c90a8-4baa-4d3e-9eb6-6cac00f1d1a6", "value": "T14A9423A52BA385BF840DBFAD7382B1599C9B645E602343F0C3639124E4DBBE35972374", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692193730, "uuid": "6eec3ee3-df0d-464c-8a76-2b46955113d0", "value": "12288:I9lF0IR83X3YWpXq3kCYbIatjC6HzR6R7taNAFl:IHFp8nfaUC+I+jT96xtpl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692193730, "uuid": "cb19c3ed-697a-4c90-8a00-3c7eb8d4391e", "value": 438763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692193730, "uuid": "54f9889c-4e2a-4a3e-a40b-8da42c86614e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692193730, "uuid": "7af738a1-83c2-41df-8435-c5004650a5d4", "value": "Outstanding invoices.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fad48aa3-3c01-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692168969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692168969, "uuid": "20122b68-f4bc-4cdc-abd4-1cebfca8b189", "comment": "Malware payload (AgentTesla)", "value": "009207477ff59b2d202476ec5ee8a0d6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692168969, "uuid": "62ce6158-4144-4050-98ff-6aefb54e68ad", "comment": "Malware payload (AgentTesla)", "value": "ea276ab495e040f4be1da4aa598278a8d8f11598e3bb596972344fa8add6c3d3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692168969, "uuid": "1dbefa4b-9a3c-45c3-b35c-0e97dbf8be3c", "comment": "Malware payload (AgentTesla)", "value": "dfccac26274597463a207cc3a5aefb405bc181f4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692168969, "uuid": "1b9544b9-1269-45a3-bc24-c3f632f13f4c", "comment": "Malware payload (AgentTesla)", "value": "98ef1681da31c43abb4a169de3688bc3dda0d26415bb12be01bae5f640457b522b4d0f8b4c80914155f5f66fa05cab33", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692168969, "uuid": "4ee141d8-9a8e-420f-8e08-eccff8a8830f", "value": "T1A3942334A1F5786582C27E0F549C8ECABC8F79A621889FB1D22047843DE95D3D6ECE35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692168969, "uuid": "6268fe42-b7c1-4e04-9cce-09f1d088d294", "value": "12288:dC1AwAFUNIf5R5dkQ1Gp2hX1D4hvdC3CnEC0:Q1ciNIBR5b1uayGSh0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692168969, "uuid": "78981f71-a21c-4cfa-964c-2283104eb2d5", "value": 443943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692168969, "uuid": "aa0cc49e-8537-4428-8804-920a3d3cc3a3", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692168969, "uuid": "521d271c-888f-4259-82ee-5a0b4f349367", "value": "new invoice.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b4ec2d4-3c07-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1692171386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692171386, "uuid": "3c1d09db-38ac-4946-8870-3b671c7cd8ed", "comment": "Malware payload (GuLoader)", "value": "64d883494bf4ce0412fd5a8060506e92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692171386, "uuid": "58e83455-0912-4223-a9ce-8ab6622b9634", "comment": "Malware payload (GuLoader)", "value": "eae1675d3477318f04bd380a8529a62aa3318010c598eabc1670726d721b3606", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692171386, "uuid": "23b870a3-e54a-41ca-b950-c849ebf26fe1", "comment": "Malware payload (GuLoader)", "value": "019d22d5a863a76deb0b0d827c6ab23f7a44d6c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692171386, "uuid": "8402ad7c-b15b-4668-962b-0d76669f7824", "comment": "Malware payload (GuLoader)", "value": "0e402be06798fa1c0b458b3be443daad3fe56005b400d559930fa570c842edbb54ee8e64db7cd93fdfbfa1f4f00759ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692171386, "uuid": "85bf341d-246b-4538-bcaa-d384bc068f96", "value": "T1B254E107BAAC476FE3CA8AB2357A53318768EF5316212C47BBD4FE6E083124D59070D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692171386, "uuid": "bc3edd22-fb8b-4ec9-b1a9-cb794fc9a026", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692171386, "uuid": "960cc701-457f-4630-9aa9-76239d1ed9a0", "value": "6144:HjV29oZk64KiZqwLGrP//XUT5v9NuiOe778LLipdM/:g9oZk64KeLGL/m5FNeI76", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692171386, "uuid": "24d97024-4e63-414d-9bb9-200e0291570e", "value": 302880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692171386, "uuid": "b1fa11d1-5f13-49da-85f9-da27f4c30757", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692171386, "uuid": "1fa19ed1-16a9-4591-b62b-96b60b9ad397", "value": "QUOTATION#6789034AUG23-INQUIRYS_THANHS PHUONG_INDUSTRIAL_TRADING_COMPAN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ced0cfa-3c0e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692174341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174341, "uuid": "cecc2bbe-8165-49ff-9504-c5f45fbeb461", "comment": "Malware payload (Mirai)", "value": "041c782b18ac8b1f0a15d0af03f0595a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174341, "uuid": "67ffe88c-c1fb-47f6-9527-122e3e53301f", "comment": "Malware payload (Mirai)", "value": "eb5db7be32269345d6dd7796310f378c84dfdf8927f63e83a838bf79fc539b12", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174341, "uuid": "27f880ee-91e7-4d57-beab-a91488898903", "comment": "Malware payload (Mirai)", "value": "7d1b06619cb3354a07fdaa089fb37a540c96e4e5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174341, "uuid": "fa71afae-2fa9-4b49-bf10-1f814d9f984e", "comment": "Malware payload (Mirai)", "value": "dacdd01e569eecd1d188c3e939c9d36c16f7ce59d685c9955a8c95fef6df2ec625556fc06ad67313466f813271756ccf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692174341, "uuid": "23392b36-255b-4ead-9e34-a2114b323866", "value": "T144D2D090BE4665B5D63800F8F7AE2180B3CF4ADCA6C4712B62190A6CED674471EFD917", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692174341, "uuid": "56abb707-c68a-4245-bb42-0da38b1edf96", "value": "384:zKz8ZguPybZo8vfQbeIaIJK1rF2WkeI2SeBRCVUDcocdjVV63l+HPhPSpDPSNIef:zK30q4bklFKOHjCYcBmsH5PEPSnU3UB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692174341, "uuid": "6749c813-5c30-48e5-8f99-e79d32ac61cc", "value": 28964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692174341, "uuid": "4d0933e2-31e7-436f-b871-4abd595b7422", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692174341, "uuid": "de57625b-62cb-4042-a8be-7d54a1c7d276", "value": "041c782b18ac8b1f0a15d0af03f0595a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b572990c-3c2e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692188180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188180, "uuid": "cf8a13ab-fb9d-472b-9663-82404dd7cf86", "comment": "Malware payload (Mirai)", "value": "a393f8ec95cab43a97853d7394de31dd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188180, "uuid": "a406e236-d1ee-4c58-9a8e-030a5b6c4512", "comment": "Malware payload (Mirai)", "value": "ecc08c9e4aa4e2be84ddbba3e958c3c3ea5496ed97de526599ffbc351d571941", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188180, "uuid": "6457cb98-cbde-4bf1-80c0-770322392793", "comment": "Malware payload (Mirai)", "value": "0c76f669480bfd6eb4375951f1a5cba725d22ed7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692188180, "uuid": "620a89e7-63fd-4dac-9845-a01d2bf35367", "comment": "Malware payload (Mirai)", "value": "1a1105bd958431033d7f3754fbe1ba587aa40d30094c717b870f81a0f8f96c6cc6f02165537ff5cddc3c06370b59b87c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692188180, "uuid": "279930b0-64ae-4d10-9e42-df754b58ec42", "value": "T1E0D2E08C76D793F6CCCDC67EB20F002A70AA74A9A7B29323B305D4934776181E655E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692188180, "uuid": "e48c3965-b3a7-4e46-abda-259447bbf082", "value": "384:MId/PxEDLd2TwURz06lowYcEaqsD9aC450LQixBfE4jdlz0lewZ90BK+Z42bgNyM:blxKd21RhxEnsD16IHE4RlY990L+01M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692188180, "uuid": "5f8f8ff2-7852-48ac-aa4d-9e94d75702fa", "value": 29456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692188180, "uuid": "61479be2-395f-4ddf-a57a-d84e7a3ab4dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692188180, "uuid": "43a821f7-a18e-4b6e-9263-694a93d97ab1", "value": "a393f8ec95cab43a97853d7394de31dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "391e8bb3-3c60-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692209446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692209446, "uuid": "3b7c2ed7-6135-4cb3-a37a-77acf496e671", "comment": "Malware payload", "value": "72f1df76ae3d186638f6af97b423ce76", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692209446, "uuid": "e55dfd58-c20f-401a-87b7-8841964197e5", "comment": "Malware payload", "value": "ee54ec7e8ecaab84e0ecf130510a2f3f30463191c525e1670d407bb2fb084851", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692209446, "uuid": "b6b702db-307d-4d9d-9ed5-ac77ce237045", "comment": "Malware payload", "value": "2f46ef93c99d1c02a4df4c79bfb09d97fc9a344e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692209446, "uuid": "f4ed180f-f675-485e-b489-678356a3207d", "comment": "Malware payload", "value": "0fc6144acab945617b5dc1e24331dee20477c216d44139b169bafbeae96b0c2b95271c4bd3e50aed3b64d7273417ea36", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692209446, "uuid": "d73242c3-1593-4d40-8572-50451952b4e4", "value": "T1ED340B8085852C4457433A282A1B70F1F377265B0C98BE06BA6CA5D8EF5D92FDFF447A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692209446, "uuid": "843fce07-b5ba-4748-a021-402f1c84dab6", "value": "3072:TsyqlLEsaNGfoFCtBUZ8nmXBVGP19uN/RhNTBmD18o/sX/SKX:eLEIfoFCtBUZ8nmXBVfN/RHTYD18o/sv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692209446, "uuid": "14593c08-aed2-463b-a08d-a96e6e9893a5", "value": 234092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692209446, "uuid": "98ebfc33-e40b-483b-8b5f-79da8352c611", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692209446, "uuid": "89b14a0f-ede0-4431-b20e-4d3a6db6135f", "value": "1.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d75f1802-3bff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692168051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692168051, "uuid": "ba51ff57-e936-4881-9d70-098d2d850311", "comment": "Malware payload (AgentTesla)", "value": "f519f9bbfa396b6f88af50da46f958fe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692168051, "uuid": "fe3ebf57-6098-4b07-a1c1-14a37f300fb5", "comment": "Malware payload (AgentTesla)", "value": "eeb73653e55a86b80c9fa58f72c28c17053f230bb044115433dcd51ecdddbe3a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692168051, "uuid": "a3cf5c4d-536d-47ec-94c8-2fb9217e1793", "comment": "Malware payload (AgentTesla)", "value": "b3b17f2b22349c17788a6305f760d21faa68aa85", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692168051, "uuid": "f7b11ebb-b8c8-49db-b092-e4e56877095c", "comment": "Malware payload (AgentTesla)", "value": "12b89b9fefe412285121c74b52aa578b1b5297495d677d464f9a9d86a094df0251730afc6875264dad6a64e29ac90f55", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692168051, "uuid": "a5d49e58-c8a1-4967-a606-43fbc1e7c6ce", "value": "T1F1C423B9AC4AE5DA00832E43318409166CBB139590AC1F51E3A96E9D0E9F0FD9DFC57F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692168051, "uuid": "f6f14a3a-4250-48f4-b109-41cd8f08c359", "value": "12288:MzHuNswEOOOgaBleyjv+4Apqy3fiZfrgDbl:EOahOgSQsSfEcDbl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692168051, "uuid": "40b130b1-8aaf-424d-9576-4a0e256327e8", "value": 549270, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692168051, "uuid": "9b25ad00-8a39-41b1-ad51-8d42bc939d59", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692168051, "uuid": "f7d7ec16-d28e-4d5e-abe3-98e2892c3723", "value": "New order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5f62d71-3c56-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692205334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692205334, "uuid": "05d41a5f-d3fb-431c-a045-f74908791a4a", "comment": "Malware payload (Mirai)", "value": "e57775c29af34ea26070b69c11a25f7d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692205334, "uuid": "908d3458-a2ce-4d01-9d3a-8c87f0f17a54", "comment": "Malware payload (Mirai)", "value": "eece9ffd27aa96d336dde95f80eb8d3f52cb0d061b6a28bf3537e1a60e9e1d6f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692205334, "uuid": "f2b6d65a-3852-482e-beb1-67de7c3c47eb", "comment": "Malware payload (Mirai)", "value": "420433e9253ea1c9e823e69dcce679e47359c057", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692205334, "uuid": "2b4139b2-e789-4e70-8c56-b0949bc52e09", "comment": "Malware payload (Mirai)", "value": "e7d7a3c513e9e0704ac0b6ce3cd04bc7db8d5a80aec26fab0903ea5ac5d7c4780d366eeb766da586acdf0ecf75a450a0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692205334, "uuid": "abdeb3da-bcb3-4cba-a0c8-b23c85f77aaf", "value": "T1FDD2E12CC95DB905CA9D3DBE45CE9AB5398CB0C1A35EB58D17228848B617E8BFC070A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692205334, "uuid": "bfff66dc-25a7-4b60-b998-81acaccf12e3", "value": "768:11uUtLrVDsAp6tLkF4FuetwEub4sU/M9g36KNcMwJbiWUY:1bDs06t4BEub4sU/MbUcMwmY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692205334, "uuid": "368330c2-3042-473d-bfb9-08020bbd8f5f", "value": 30324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692205334, "uuid": "b65d1a32-9258-4a0f-98c1-2a86252837e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692205334, "uuid": "43bf39da-5125-42ce-9daa-c7ae74974da1", "value": "e57775c29af34ea26070b69c11a25f7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53fd7ec5-3c7a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692220658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692220658, "uuid": "f97a34fd-8677-4b21-88aa-731f5c55796f", "comment": "Malware payload", "value": "8e1989dbdbce50938e7e033ee1d1db1d", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692220658, "uuid": "3d81deb6-3e53-4fea-b482-0ced78d40282", "comment": "Malware payload", "value": "ef29136a51d96f92049b3870589f9f53e446317d67238fbaedb118e7f5327ed7", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692220658, "uuid": "086e56a8-24bb-4148-8f76-295741ebfd2d", "comment": "Malware payload", "value": "819e38ffff3cd9852c410d88a6e6821d4aa41db0", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692220658, "uuid": "6d823bfd-d9d6-4c73-8629-9ee627fe57ab", "comment": "Malware payload", "value": "044e9b1d0c11b633ec5644897411cbdf092800537e4d189e5d1c183d341f9334dd1c564091b93869ad1fc88f5aaa1462", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692220658, "uuid": "d14ff9db-b6fe-4a7a-a673-f62ad9a49f78", "value": "T197D42335BA5A095FB268293D9462E196C0C1274672839D302FA0A86F1FF7F92C59F077", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692220658, "uuid": "26e8fe7d-3708-4bff-908f-a54c52e13e5e", "value": "12288:4d1P2hZKL3zqRQYbPBMunY2sScG7cCgobfD4DlPWtCOoth2:81sc3znYbJMbtS1cZobfD2Ptth2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692220658, "uuid": "b5670c14-abc1-4e4a-9a00-25f46a85c0c7", "value": 607357, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692220658, "uuid": "939bbc36-213e-44c2-a25c-d10c342e2db1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692220658, "uuid": "9283c4c7-1f8b-4577-92cb-2de666e9ade8", "value": "Attached PI For Payment.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e4a224e-3bd8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692150990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692150990, "uuid": "8c5a174b-446e-4fd7-9145-713668de9af8", "comment": "Malware payload", "value": "53a8b4efd3de0d373564f5df6510b181", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692150990, "uuid": "b1418a4c-3932-4979-922e-bdcc7b6e84a8", "comment": "Malware payload", "value": "ef3255f3405c53f40f5dec2a85da2b76ee45fdf9b1ad9ae52c22f54952e8ac54", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692150990, "uuid": "56ce80b0-c483-48f3-b189-2b9b4fe12dcf", "comment": "Malware payload", "value": "d2b5f6f8abbf6d1caae06750ea6f5ed7f0ddeaa2", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692150990, "uuid": "8f1e15ed-0d5b-4b73-8549-cfc2097a6196", "comment": "Malware payload", "value": "15ecb917cb215b8c6db81232c66a542b44129d6ef69780990b9ca68ce3c7bf201d04fbe8157201de615457ab93d975e9", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692150990, "uuid": "07254a63-de67-4bbd-acf1-6a01752e7449", "value": "T1DBD6333AFA59E4482E52FD5D3A60186867901080E8CCE597ADE2DADCF9ED3C48FF0355", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692150990, "uuid": "3f10b764-e4aa-49eb-8fd4-42be4afce5ac", "value": "98304:+SSDxH8D1QxEHNSSDxH8D1QxEHaSSDxH8D1QxEHoSSDxH8D1QxEHfSSDxH8D1Qxe:wnqnnnPnunwnWnrn2nyn+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692150990, "uuid": "f97d0188-8968-408a-9d0d-8d5186770847", "value": 13251318, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692150990, "uuid": "ec7b5723-9cbd-44b7-98d2-66f073fa5345", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692150990, "uuid": "253075e4-97d9-47f8-a8f2-09317cf81563", "value": "QuasarRAT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94089288-3c56-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692205304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692205304, "uuid": "9ab01cfc-72ba-4c26-b366-916d3992ab10", "comment": "Malware payload (Mirai)", "value": "25ace521ac30d71ecf218372caed1bbd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692205304, "uuid": "4f7fa483-4c6f-443c-8c98-31bc125bb1b8", "comment": "Malware payload (Mirai)", "value": "efd8b60be3ca61bb62d0783dad2b15ce60d9e2bf7c7bbb29dc3ab12a69c93baa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692205304, "uuid": "0648d379-101c-4bdb-97cf-a613b70fedd7", "comment": "Malware payload (Mirai)", "value": "e9f4e8ecf6fc476cbd4d3d8c0f71d6ef1fb8e2d7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692205304, "uuid": "6af5a595-d2ac-4f2d-9add-23b1b18fb9b2", "comment": "Malware payload (Mirai)", "value": "6b7a0cb0abe3a6457e6fb834b087ecb3be276c9f055221b11877aa14e448a7c35cc6f2eef7a392d792753eb70dd742d5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692205304, "uuid": "375a1d04-e101-48e7-b849-6d9f91e4eaa5", "value": "T151539FA5C5ACAE58CB1441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692205304, "uuid": "18373d2d-ad1a-4f98-b856-e0189d177cba", "value": "1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwN0T0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692205304, "uuid": "181b4d8a-c7cb-4549-9f5c-56cf9e2e691d", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692205304, "uuid": "ea1db39c-9243-4d81-8301-074bccb3a08b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692205304, "uuid": "688b5d2b-0cfe-4082-9e7e-2680966d269d", "value": "25ace521ac30d71ecf218372caed1bbd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef96616f-3c08-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692171957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692171957, "uuid": "6bb45521-cafa-4b08-aff7-5f3860010efa", "comment": "Malware payload (AgentTesla)", "value": "a0f68fc3322108c9561a8783aa72116e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692171957, "uuid": "8e103ae2-ca0e-47f4-90d7-e86fc87fcd1e", "comment": "Malware payload (AgentTesla)", "value": "f0780de7079d9f0e75770111e6fe192424f73c8b931e0b6f0e45ad8b209db1a2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692171957, "uuid": "b8cee897-820f-46f2-9f76-a283e9336d74", "comment": "Malware payload (AgentTesla)", "value": "1ee5a076e5b91aaf2ae848848b801201b3bf4c02", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692171957, "uuid": "1609a4d7-b05c-4e70-83a5-26735414cdfd", "comment": "Malware payload (AgentTesla)", "value": "2a3125919e6df9ba7a2d03be95d551e722463017aa75de2ecb6f01634c2515fac12f7bf8739a3a21e59793858826e139", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692171957, "uuid": "baa1c511-fdf5-4d1e-af17-07f0b74a8ed1", "value": "T14205F726E77B645AEF19A1E84E2F857238D6DDC0F0B1C588A7E76C0385C23214D35BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692171957, "uuid": "3599fb44-fcd4-441c-a67d-9a5005c9362e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692171957, "uuid": "926b68e3-a77a-4a3c-b4f7-41ddb16d4e58", "value": "24576:TIRs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUO0UF73MC/nwZb8ehPlYt:TIRs6CE3jLbO9Rs6CE3jLbO0G3MC/nww", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692171957, "uuid": "c8ea618c-0aa2-4736-bb57-5411a1ce03bb", "value": 850944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692171957, "uuid": "c7c5d3f2-76d1-44a3-866e-d3fb7c2b48ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692171957, "uuid": "3c9b4e02-3f97-4177-82a3-c4aff839705e", "value": "SWIFT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65877324-3c0e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692174302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174302, "uuid": "900c18ab-f9dc-4c03-ba39-9ac3f0c490a0", "comment": "Malware payload (AgentTesla)", "value": "cd80b359e4458ab72c37486ea0e88022", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174302, "uuid": "b473f218-fd60-42ce-9244-a731b7f0af7d", "comment": "Malware payload (AgentTesla)", "value": "f14adf8284d2d04072445b5744da50141332a86ec1f28fd7ca6e316b1a7e0b24", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174302, "uuid": "6b43050b-07a1-4de4-a1bd-f3a4d8f50ed1", "comment": "Malware payload (AgentTesla)", "value": "d385f84a3f21c3ce4b6f42f34a4c13cae645ff09", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692174302, "uuid": "18ea0a73-6468-4590-8598-98fe1ff55fb4", "comment": "Malware payload (AgentTesla)", "value": "27ee8680c646d5ed9a79ad6b479e2e9ca58a219af2af29de867ed9918ee53a8da89b3ab6bbd0eb968f4eabed94507674", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692174302, "uuid": "797cfa3c-c25f-4091-af8b-724b7e0ffc51", "value": "T1A8D42312FA55063FCE9F69F822242A0603748236B99FEB197DF621DEC25E7F41714C92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692174302, "uuid": "80206084-36f2-4c34-866e-21ad9fc7db5c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692174302, "uuid": "e62a2d7e-5094-46e5-829d-85b229d44f8f", "value": "12288:fl0Dl+C42xjWwzzJ/OQadSpPCYOBPZVD9nVORVJ2LJvSraXY:qpzYQ/AiJ2MraX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692174302, "uuid": "4543be81-47e5-46ac-82f3-f20997029617", "value": 637952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692174302, "uuid": "4fb89eee-c9f9-4393-9ca4-7c8eab58a216", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692174302, "uuid": "5c8fba70-a521-4e6a-ab0a-7d5a73abb52c", "value": "PO--080523-FM 0655.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45c225de-3c4e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1692201737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692201737, "uuid": "d0f21520-14bc-4982-a7a8-88d211a8a52e", "comment": "Malware payload (Loki)", "value": "672c5247e57453911f5159a6e33e45d6", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692201737, "uuid": "eb8e8a30-d057-418e-9eed-31d080e1be33", "comment": "Malware payload (Loki)", "value": "f17f5661b7e77a2eb4e0ef2056bb4a620809f2ba83408c8cd1fddf7ab8119772", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692201737, "uuid": "1d81b6ed-7fcf-499b-a183-2dae17bf1c8f", "comment": "Malware payload (Loki)", "value": "1b29f296d4fd7738bd6a1a1dd1ed9fb1cdd87cf9", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692201737, "uuid": "75f92e25-7eeb-4868-a872-12b7704ec9f5", "comment": "Malware payload (Loki)", "value": "13c120adf58e34096983fd1279f1dbe37a36851118937a47243056d7526b9e6d9d83221afb300c4d0c71eb8712f15793", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692201737, "uuid": "7ef80f7a-e6d8-47d5-b0ef-471590d714d7", "value": "T1D404129E95BCEAC2D9968D740EC48340503FBF1B475D59AAEE23003AECADA213D71D53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692201737, "uuid": "71a0263b-5cff-4a8f-b7e2-cac442c54d0d", "value": "3072:opOz8IaLGIOOJs0aWmPyseHKVe44PcraifbiDz6e+oEdz+iD6dW/Zd9:opU8PLGtOu6mJeHKLUkaiDiDzadedW/B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692201737, "uuid": "de50f304-c289-43aa-ac07-602cb5a0816a", "value": 173694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692201737, "uuid": "c61dd335-1aae-48a9-aff4-fc45adfec314", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692201737, "uuid": "dda6074d-9ee4-44c2-ae7c-9b6d6b7fe312", "value": "QUOTE 705[6].zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27ede052-3c23-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1692183218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692183218, "uuid": "df69a5e6-95db-4a83-8f3d-fa84511e1f62", "comment": "Malware payload (Adware.Neoreklami)", "value": "a5723d258886f9facb72003eb97872c3", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692183218, "uuid": "704f5e87-4fec-40ec-993c-1fd4d0d51e53", "comment": "Malware payload (Adware.Neoreklami)", "value": "f1b0d3f9e198fc295dfa92e45adabbed0bc6cef94ab440ae9a4f5659a7b11ea3", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692183218, "uuid": "8594a7f6-71f9-4e0d-b803-a5de383b60de", "comment": "Malware payload (Adware.Neoreklami)", "value": "ae2a47a72fdab9b2b234411adc1c3b0365819db5", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692183218, "uuid": "fa5efeaf-1301-4aa8-900d-78fedaf9486d", "comment": "Malware payload (Adware.Neoreklami)", "value": "9d737d1ba86b416e3dc9044488c47476895d6f2397422cf9d70ca7bc2d7a46edf3843f999e2e7da354bbbe17a326c221", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692183218, "uuid": "64171982-d045-4b16-9486-1f4d0241197e", "value": "T1C576332336F0C131D64E6A36E4796ADDB764C101DD211AF33B14A72DB8BD6A3D027B1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692183218, "uuid": "e34a9451-3583-4cf0-91b3-72ef98573f5e", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692183218, "uuid": "1f49a9a0-cabb-4cf8-88f6-6a1c8e8e184e", "value": "196608:91OYI0YF3yBGxjkhc+18MEnCbYOjFIPA9eSV1FIzcxE36nm:3OYI0cVAc/MbTEhjyE36nm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692183218, "uuid": "3e5d2e82-7257-4db1-a09e-84e8b34f5bc3", "value": 7615098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692183218, "uuid": "b1906d17-78d9-426a-917c-c7886ae4fce8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692183218, "uuid": "6262ce30-05a9-4a3a-bfb6-aca734c15afe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3314b622-3c3b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692193545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692193545, "uuid": "7eec55b3-e31c-48b9-a1cf-22cb4b19b227", "comment": "Malware payload (AgentTesla)", "value": "be6154e9b2fe96234c615f28ddee470a", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692193545, "uuid": "9716bf21-4368-4dba-b36a-9b2a15c90fdf", "comment": "Malware payload (AgentTesla)", "value": "f21cb5b05f7b46ecfa1c98a209de195a2b179be8d69a4141e97cad78bdfb9063", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692193545, "uuid": "06feea86-7ce9-41b9-a21c-d69df2c7dc1a", "comment": "Malware payload (AgentTesla)", "value": "bea1c34fe46f757f72e7648bb6d05aa92085d104", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692193545, "uuid": "d4a6f7d0-d3c2-49f0-b86c-0a4264dc619d", "comment": "Malware payload (AgentTesla)", "value": "796b18a86b15fb276b7e5dfa66e914ff7bc10e312b754a9f1a06c0aaef0aa90dc14db46dad2740602ecfe96e265a9c01", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692193545, "uuid": "1f8cdbb6-941e-48a2-99e2-299406ffd92b", "value": "T16DA4233757D916F613F664E769343C46E4B2C6A5C24C794343EBAEBC302A819E8818B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692193545, "uuid": "34c7fd75-5623-4655-9f17-1ce0a977fbec", "value": "12288:HfHlGZfjWkoJFNNlFLxARRVVhFtaMc7R9vd6a4c0l8y:ujWjFlFSRRPD69H4b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692193545, "uuid": "998b1dcd-5825-4924-b533-d2eb0917f58e", "value": 487316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692193545, "uuid": "45cfa7bd-b880-419c-b4d2-da857fe1e11a", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692193545, "uuid": "0861e94e-d87a-4678-9dd1-50d58ede4967", "value": "20230811085909.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88992afe-3c29-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692185957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692185957, "uuid": "fddd8665-be8a-4638-a641-0bc02df3de1c", "comment": "Malware payload (AgentTesla)", "value": "00ccb710b49384304ba426722a0614d6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692185957, "uuid": "8d0a600d-1278-47b6-815d-421c04b8c4d6", "comment": "Malware payload (AgentTesla)", "value": "f2d66df63c94e2336c04881ef52dc601efdbee1e34c1a2f9f67057c3f78d967c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692185957, "uuid": "86e43341-3489-4695-bdc1-8b8c981330ed", "comment": "Malware payload (AgentTesla)", "value": "41c528d245830503215f22e9020e251271c11f3d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692185957, "uuid": "b31030a4-5466-457b-9ab2-e2bdfdd844d5", "comment": "Malware payload (AgentTesla)", "value": "72f21846a05896278ddaba7c6aa7c7026e7407f1fb26d8a5c75f4e8e7a427a4ca844f2d240878adfef3d202bdcfc9514", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692185957, "uuid": "0250e441-d50b-43b6-ab48-734359b34cbc", "value": "T10B24A507BA4F89A1C35D5B3EC7D7111C0761CA91B7A3DA0A798E33E90B437B69D0864B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692185957, "uuid": "c6c88f7a-b3d2-4db3-8b15-8ac0e465f4c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692185957, "uuid": "3f2bf9c7-c9db-403c-ba19-afcec2aada8f", "value": "3072:y7VIq50NdG4Vb5sVSPGWnvXSMqtFzowu55YfVBtsI8Av1Jeqgx+d1:yjUV1sV+GWnvXVqtFo5etz98E1wDx+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692185957, "uuid": "a8d2409e-49ac-43a4-9898-86b3437cccfd", "value": 216064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692185957, "uuid": "47dbd2ff-7be5-48b4-b8b2-3841a0da6641", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692185957, "uuid": "566aa3f2-7aca-4233-a5a4-daaa9f7ea625", "value": "Hkvyss.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3429a536-3c1d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1692180662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692180662, "uuid": "6f192c54-6f0e-459b-8981-b30c31a58569", "comment": "Malware payload (GuLoader)", "value": "b41dd3bd3df55870e2f940fe81373df2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692180662, "uuid": "84256cb3-8977-4701-9251-1c42f31c89b2", "comment": "Malware payload (GuLoader)", "value": "f3aa1512832e308956898dc2985062be4e57602ae28619b9760a289139943e45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692180662, "uuid": "9d9288d9-ecf3-47dc-bf88-fbe8a79f2a79", "comment": "Malware payload (GuLoader)", "value": "269f30b33075c280a050d5315d9ddaa7953b7a2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692180662, "uuid": "5ea6e47e-ea66-4e65-a557-8ad5f4cbd8f4", "comment": "Malware payload (GuLoader)", "value": "576b1b3d7e65e94ccda9881801d614681f3fda8cf998913e50641146d39d69efe6bfdbc7acd7df70fbfc1b72b6740b67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692180662, "uuid": "ec68e616-3825-453f-bf8b-7ff151a015f5", "value": "T1E5A4D062D694BD2FD163417EA09691F1B927BC11B7139D7B27843B3F98BE180C21B24B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692180662, "uuid": "d61592ae-72c5-47a2-b958-2dd5f98f4fa9", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692180662, "uuid": "f64b7501-b921-4371-9705-23f00d891a0d", "value": "6144:FmGIhJFHs4wfO1AJcmmCAmP+vYjL27rbc4Zk/4Rd5Dj0IDY:QvSJPmUPoYjLerg4egRdt0I0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692180662, "uuid": "73f81499-a395-4dbf-905d-9d2a63c5c40c", "value": 454112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692180662, "uuid": "95d30ee1-c182-4ef4-9104-806bb455f685", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692180662, "uuid": "8dce3ab7-9645-4f96-856b-a6256a7b0a66", "value": "KONTRAKT-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29c8831d-3bff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692167759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692167759, "uuid": "91211b8a-6c33-4bb8-a5c9-a2caed21d2ee", "comment": "Malware payload (AgentTesla)", "value": "3a794395ae66b339674394502aecc181", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692167759, "uuid": "51aef15d-5a37-4811-9f6c-0ec9aad3172c", "comment": "Malware payload (AgentTesla)", "value": "f43fa3268bd5d31fd1dd0f34207786c10239b21868da3a8a9c3952c371330f80", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692167759, "uuid": "88b069b7-7221-4210-a4b2-5bcb40020ddc", "comment": "Malware payload (AgentTesla)", "value": "d7fb44fa18f0e23e5579677da5b83202921ffa5c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692167759, "uuid": "5283a1ed-b8dd-418b-bf20-971a13cbeece", "comment": "Malware payload (AgentTesla)", "value": "6f8507567d1c7f077620aeb5aff82db5e2be328fc8f37468ca6b14bfb863ab08fdc007331ef8c9eb01cfb1e98170016e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692167759, "uuid": "9002307b-15b9-4221-b6c9-f5053c3f6162", "value": "T16405DFA632F806ABE02F80B656243003EF7395B76566E6C5BCCE12E59F86F401607F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692167759, "uuid": "00e34c95-f894-47d9-bab1-1f41fe82f099", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692167759, "uuid": "e0de0a48-b21d-4214-bf71-626d8fd038ff", "value": "12288:bZnDAtz92/U6NoegcDG+mWGxB7BxKnHevk3QSApSe3WPGzP:b+tJ2rScDGKG7qn+vk3be3We7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692167759, "uuid": "1ca8708c-a97d-4123-a3bb-236b78c5e40c", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692167759, "uuid": "72dd6cfb-e1f0-4ea1-a9fc-c7764834aa8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692167759, "uuid": "8ef93645-8e93-42fb-8952-4cdf57af4ac9", "value": "Maerskline Invoice_ K22TS771481.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8076e633-3c53-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692203983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692203983, "uuid": "17d19b8d-27e5-49ea-97ae-60269d9aa881", "comment": "Malware payload (AgentTesla)", "value": "2b70835d76b9926fac37efea92269cc2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692203983, "uuid": "3d120dc8-963f-4ca5-a84a-abd11feafcb4", "comment": "Malware payload (AgentTesla)", "value": "f5164d005daf4b02e234351352598aa8377d35fbdb1a4e09cd3271bd8d02e2d5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692203983, "uuid": "2eb3fef5-596b-4e10-9b44-76db45671bd5", "comment": "Malware payload (AgentTesla)", "value": "43023020a321e687f5edd3d8210776984e35dcfb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692203983, "uuid": "821dddf3-084d-4d43-8824-a89432837eed", "comment": "Malware payload (AgentTesla)", "value": "d2f608eab0df452fca0b552d7ff05d08d298279f2a08416210747d92ebc8bf0d00047639128c5df0fabfa21c7a5f4c43", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692203983, "uuid": "2ab84d0f-57db-43bb-91e5-6b51746e1750", "value": "T122D4D051BF04C552C46D1DF6CBFBA07D92B68C61190085332725BE6D7EFEF82A428AB4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692203983, "uuid": "8e83fd02-f1e1-4752-a005-1d53f8b2e6f9", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692203983, "uuid": "8f29fe0c-cc1b-4404-8a03-c864e8582d00", "value": "6144:kYa6q5+7/tQ43cmnMNmP6N533dh5Tt+a19UzMUkTkt6oICjGKQNdIVNXbE:kYoyVQ43cmMNBFr+a1IrkoIwGKcdcJE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692203983, "uuid": "cb71bc7c-7c34-4eaa-bd2a-0474a8343f61", "value": 628410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692203983, "uuid": "909ab38b-a00b-4396-a38a-899bb8eafb56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692203983, "uuid": "f193f78a-c788-4b81-b73f-cd4158445a60", "value": "vxODSBwqrEMac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecdb024b-3c6a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692214043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692214043, "uuid": "c64fb682-24a5-4882-bb68-37b2027d144b", "comment": "Malware payload (Mirai)", "value": "ff087549a44687b72969b0daff9498fb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692214043, "uuid": "02f29d76-65bb-4849-bf1b-f6c17450d816", "comment": "Malware payload (Mirai)", "value": "f519dd2d4bf2f5c399596e3c2ec731f2c1826d0de54a42a82163346d7c70b7c2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692214043, "uuid": "c6e5c42c-ae8e-4712-8c10-7ae6f782e2f1", "comment": "Malware payload (Mirai)", "value": "3d17bf0da0954203cbef6604c6ba6be11b6a84ef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692214043, "uuid": "0f258405-46e2-4038-aeb5-ef575c9db175", "comment": "Malware payload (Mirai)", "value": "efac1170ee544c6b8945d9614bd14f5e999683d68b1d9dfee1189e969c43c4ea04b0ab611f71fe7bde439a7c7fc3ef50", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692214043, "uuid": "767ebb5d-1624-428f-a560-96436c7e67a0", "value": "T1DB732A26B97A1E26C0D4B57E60FB8B11F6E1278E26B4C50A7D720E5EEF147006502EF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692214043, "uuid": "03103142-3672-4460-91a9-ee993b55c3e7", "value": "1536:hD/B6f6UD5hAS7mo0DCCAX5SKV6v3G78nN9Wh:927jqCh8v3GI/6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692214043, "uuid": "e92d832a-263f-4782-8d34-0cef0ec4958f", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692214043, "uuid": "b718048c-e442-44ec-80d2-a7a67a8861a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692214043, "uuid": "0fb69198-46a5-408c-a443-0068045a821e", "value": "ff087549a44687b72969b0daff9498fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e259abc1-3bf8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1692165063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692165063, "uuid": "c0690a0b-9473-4885-9607-28d038ba24eb", "comment": "Malware payload (AsyncRAT)", "value": "dc59769d621464161f07036b3e5a7192", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692165063, "uuid": "ddd7a9f3-d46a-459a-b464-86196eeb8868", "comment": "Malware payload (AsyncRAT)", "value": "f60c67f4a0a95edbecac6f39fdc6515b958fa11755046a1c0d6b36785bcb959f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692165063, "uuid": "9de2257e-d81b-4be1-8582-37524cece8ec", "comment": "Malware payload (AsyncRAT)", "value": "6b2a05ebe463d765653d3d4882c3b724d1cc19c4", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692165063, "uuid": "2bf7b6c8-1922-4b84-8776-fe7e71276846", "comment": "Malware payload (AsyncRAT)", "value": "b514887405f09bde3bbd8a8d5cb2ceac319ccbf1778607a6a23dcd9ae8d8b30b2882fb4ac2e141844018ce3320ac5b52", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692165063, "uuid": "7ed3318b-8b7a-40b0-b7e2-a7388c8febb8", "value": "T1FA24CF3877F3C4B5D75842340ED785E4AA23FC409E764A033546FB3E9D7B244EA0A6A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692165063, "uuid": "26b7279e-dd44-4bfa-acb7-b05d7a186859", "value": "6144:JxEtjPOtioVjDGUU1qfDlavx+W2QnA6dLbYj6hSZkwdZ5256CAxB8o7Fj:sLsj6sZlZ56ax/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692165063, "uuid": "3e616fb4-5f80-47eb-8630-9c893ac529a5", "value": 229376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692165063, "uuid": "d26783b2-a310-41c7-86f4-978ba36b1882", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692165063, "uuid": "436f2bf7-f1c6-4023-aa82-7c76720cb394", "value": "swift.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2f608ae-3c15-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Neshta)", "timestamp": 1692177438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692177438, "uuid": "f8041585-965f-4cf0-b6e4-d11ac6f196c6", "comment": "Malware payload (Neshta)", "value": "acaf921b18d94882c2a13cb1d75e0156", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692177438, "uuid": "f00e6398-1b71-4fbc-b7a1-7721fb135d9f", "comment": "Malware payload (Neshta)", "value": "f64221d3189b9501ebaa9dcd09447dc464a44602629f21bb1a8eefc3d03b854f", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692177438, "uuid": "30a2bccf-93e7-4937-b2e7-5b345b1dddb7", "comment": "Malware payload (Neshta)", "value": "4ed406d657bfba895217c47a5e1187854e33c863", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692177438, "uuid": "65f50c21-ce74-4384-b8de-ecec9c9c0eda", "comment": "Malware payload (Neshta)", "value": "f658f2c8fa8fc2a7320f5fb82ac331680b488696ed71548d5a3d9b235762e754bd0eb0f07dfe72cf4f6ea3966238684c", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692177438, "uuid": "e0cfb621-9726-4bf9-a947-da145a99025a", "value": "T1ACE42366A4EB3BF92D7075D929EDAEE4B437F012311DAF3D3C4612C4A2A72DC251B124", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692177438, "uuid": "c061a81b-d4e3-4829-8d59-5321240eb805", "value": "12288:qa41qD67Z2Do20c2NqcPygKSvAi3WJAEZ0xRQYBbryKmAjy1ouGbPTod6SwtQxAL:3s3q69cS3Wa9/kWhrl1zkK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692177438, "uuid": "7a7fbd3e-d085-4380-a0fd-b80b4b64ec6a", "value": 664131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692177438, "uuid": "45e6f029-ed96-4e0e-988e-74b630c5d85c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692177438, "uuid": "e94a7d7b-ba47-4f84-ad39-3f09a3214fa4", "value": "PL..rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b0fe12d-3c18-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692178579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692178579, "uuid": "d021cca0-65da-458b-9796-c6ff0d2c418c", "comment": "Malware payload (AgentTesla)", "value": "29169fca33e383cac482e6af33b1d695", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692178579, "uuid": "6f28ed73-fc62-41e5-8f4f-625afb55b2f4", "comment": "Malware payload (AgentTesla)", "value": "f681a2a22e67ca21bece4f62b273f424c6b784e95e64f840047db5d6246eb352", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692178579, "uuid": "3dc91345-8200-4d1b-8930-75ebe739202f", "comment": "Malware payload (AgentTesla)", "value": "2efcbaf588681b4ac1751817f8cd093dfa76089f", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692178579, "uuid": "03f310e0-6f35-4d3e-83bb-c2b9a6432600", "comment": "Malware payload (AgentTesla)", "value": "7ae4140ad7d835f5cb2503624dff81dd444e959872f6f4d5e2cf25ebbc7b5f30e362ef2bbd3e9ea52d1ab0e5e4470a5e", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692178579, "uuid": "91ec67c6-2a98-4200-bfc8-95928758503d", "value": "T1072533E058484EA00BD595FF7219F64D400447A828B834B3EA75BBC58D5FB33EAE51EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692178579, "uuid": "af60a3e8-dc50-4ac8-9207-97484dcf5f18", "value": "24576:pjhKFIoZfmdawpxV/cIJ0EVKTasxD+Pw4EoHV7bmTUdm+:5hWHmxwAKxxD+PlHVAUE+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692178579, "uuid": "e1f6fcfe-fdd7-48b7-95de-7d0e4979143c", "value": 967832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692178579, "uuid": "6b5798f5-4cc2-4dbb-baee-8f95e132ce84", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692178579, "uuid": "fedf0923-4662-440b-a103-d6b8ca532c23", "value": "Delivery Note Ningbo.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "339871c3-3bd8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692151025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692151025, "uuid": "003f03e1-812a-4411-bce3-bae0248d88fb", "comment": "Malware payload", "value": "1ab83ff93da4ce0da0fcb706f6bc8228", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692151025, "uuid": "0f26bcb2-d196-438d-ba53-1b04f02ec3da", "comment": "Malware payload", "value": "f707db5c91e9f1e70effecb99ae6d8101cb2343779df3b06eba56311bde64a41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692151025, "uuid": "d50331cd-7224-462d-938c-401f3d984d0e", "comment": "Malware payload", "value": "dfd7d3159e702772c31618f4da1ec5492f7b6e86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692151025, "uuid": "4970d506-8a36-4c47-8ee9-249b9d460a0d", "comment": "Malware payload", "value": "6127c6ffa7c85fc58f20cc54187cd05e0436b1ccde5041524170116bef72ee470e7debc3e2be6ee20476bd432c4c2682", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692151025, "uuid": "254e0099-6daf-4798-a425-92414a619174", "value": "T10D6523387689F058EE55ED3E2D20D8242AA01C405CC5E5E77DD2F7EE99723C88EA5347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692151025, "uuid": "0358fe61-2265-414a-a008-045007b478d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692151025, "uuid": "0df7d921-fdb2-495e-b4c2-4080c340922d", "value": "24576:8Z/4jDkyXlNpezDB93fHVqsdEd7N+GawXJEC8zX8bSMVAgVI8Hl:w/4syXlNQDjTe1a2Kh8+fg7H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692151025, "uuid": "6bd22194-174a-49df-9dee-5725f70fd2f5", "value": 1457152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692151025, "uuid": "3b64c225-4790-4b3f-bae6-6869197c4ed1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692151025, "uuid": "5b1df08c-fe62-4a2c-8653-7329c27dc36c", "value": "1ab83ff93da4ce0da0fcb706f6bc8228", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c572d2c-3c3b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692193533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692193533, "uuid": "08aff287-79c6-4194-8313-501c8e667dd9", "comment": "Malware payload", "value": "548d5cb90aa47b857cefca6191f4c253", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692193533, "uuid": "4b1b9818-90dd-4e91-90db-3e7bfad32c60", "comment": "Malware payload", "value": "f74a604f6b5b7303aa3b71f39a5e1514f741fbe64a55b3c5e9a949ee173205d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692193533, "uuid": "60f64ad9-7413-4fae-b11c-ad9db21dc619", "comment": "Malware payload", "value": "75fad61b12211a1ade5472f4d8909059a5160aad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692193533, "uuid": "d836d5e3-0397-4f61-a3d2-353d9fc6bfab", "comment": "Malware payload", "value": "5b6fcc78854112853f49f105efdfb9eeec8e98a970effa348d3816e01272008f9c6375ef131730f0e54a51d5a07a6464", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692193533, "uuid": "5bb619a5-f224-45c4-9ba6-3eac6dd4a746", "value": "T1A5B55B2B67A5926DC55EC13A80538E00AE737479CB3BFAD34BC10B25D7469D80E3EB52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692193533, "uuid": "9dde90f4-2651-4ba4-af0b-976a7c7f5101", "value": "636fc09a5cdd458ab78e7853b644a226", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692193533, "uuid": "1a3b5215-9c91-4315-8c7e-7c942a3f3cf4", "value": "24576:NKOb9S6Wa0S58pYEKP5OWh7JIdTNa/Fjdjbp4C1TCQgQZeR4CtD7:tbBb95uYt0Tk/xd/GaTCQH+t3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692193533, "uuid": "68d8bdfd-8103-4e29-9720-5f53c1073098", "value": 2458112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692193533, "uuid": "ea66353f-aa4d-40cd-8ac5-c32968d384f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692193533, "uuid": "a88db71d-0011-4d80-8e50-3851dd2a9f54", "value": "a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebfc3988-3c69-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692213612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692213612, "uuid": "016c0c8c-7223-4170-856d-1ee78236cb13", "comment": "Malware payload", "value": "43e75fb2283765ebacf10135f598e98c", "object_relation": "md5", "Tag": [ { "name": "195-178-120-24", "colour": "#EB6CBF", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cdn-pixelbin-io", "colour": "#D85E83", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692213612, "uuid": "92f0d1ac-c9e0-4be7-b64a-7d7c3f93e072", "comment": "Malware payload", "value": "f766b4fc1e1d81dec8d9103cefc10be9fc9d14df021b846f27c8c5c8fefbee19", "object_relation": "sha256", "Tag": [ { "name": "195-178-120-24", "colour": "#EB6CBF", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cdn-pixelbin-io", "colour": "#D85E83", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692213612, "uuid": "5f7ba9d1-256c-4f9f-a1da-e10d4c0ca25b", "comment": "Malware payload", "value": "f71c2408df933fd0b2883917d1e98c04d872a074", "object_relation": "sha1", "Tag": [ { "name": "195-178-120-24", "colour": "#EB6CBF", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cdn-pixelbin-io", "colour": "#D85E83", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692213612, "uuid": "03669a14-18ed-405e-92b5-df4875eb374c", "comment": "Malware payload", "value": "f5872cdb8138384c6355ac0f4f458116a96c0800ae84887da88d3f0a9f1eeea4f5019c69ce7d4c55fe0072db746e09c3", "object_relation": "sha3-384", "Tag": [ { "name": "195-178-120-24", "colour": "#EB6CBF", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cdn-pixelbin-io", "colour": "#D85E83", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692213612, "uuid": "5979ebf6-4d5a-49b7-ad30-3dd8ca0523ba", "value": "T12E04690263ED1708F1F32B9D56BD15658A3BBB61593BC26C00BC564E4BF3E408DA5BA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692213612, "uuid": "94a99630-c1d2-403b-b00b-10c058485219", "value": "3072:w4zhHoMVGhlhi126OxiqNB+mBX4zhHoMVGhlhi126OxiqNB+mBX4zhHoMVGhlhiM:jTT3i9LTt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692213612, "uuid": "5954d0a7-ed0f-4929-a0a1-b5625f2540e4", "value": 180258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692213612, "uuid": "b37bdb07-16ec-46a5-9c1f-cd428e07fea8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692213612, "uuid": "8ab15851-a127-42e3-853e-c1e717663c8e", "value": "\u0395\u03bd\u03c4\u03bf\u03bb\u03ae \u03b1\u03b3\u03bf\u03c1\u03ac\u03c2.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26ade098-3c03-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692169472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692169472, "uuid": "bf492b4c-2df3-4eee-a20b-fc87bd8605a2", "comment": "Malware payload (Formbook)", "value": "f86078f4a3ad448a0737e337aa553ca0", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692169472, "uuid": "9a9fdbae-e51f-430c-9c93-ce4c5b732dfb", "comment": "Malware payload (Formbook)", "value": "f780d6062c7c103021bef3a41ad94694bdb4c9eb72b32807e51facb7b56b7aaa", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692169472, "uuid": "9e575163-07cd-44d3-a473-9b56f88950b9", "comment": "Malware payload (Formbook)", "value": "508a848dce8ed99fdd2b61dc3683d8807fecd031", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692169472, "uuid": "3238ea83-7bce-48b7-bfa8-f987487dd0c2", "comment": "Malware payload (Formbook)", "value": "e19a3c822f4876d7d0487ba771068dec431794b272416182f4b26e828bcd4ad1508893a825b0cbb72decdd6e66413bfd", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692169472, "uuid": "4314a0ea-7b51-4727-bccc-94a6c9c8c88a", "value": "T17B4423B02FEE5C93C8500509BDE01650ACA6037FFABAA10C2D4CE35EFDD46497D998DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692169472, "uuid": "2ba0b387-3647-429a-a416-f0b294a4c81a", "value": "6144:xnSLgLRZeonGZIQm3I1vwp/eSGW9cxCpDut2P4efPPxz:BCgLR5fr0IpIWF6Qjf3xz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692169472, "uuid": "d8526387-cd05-492e-adbb-07706aad3d1b", "value": 266362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692169472, "uuid": "4a2bd132-d123-4671-a147-dd264b3453c4", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692169472, "uuid": "bdfd300f-5a36-4912-b82f-1fe26bd0c9bc", "value": "GWS SEPCIFICATION.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc1d1e0a-3c8c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NanoCore)", "timestamp": 1692228618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692228618, "uuid": "d8762bf0-21f5-4e74-9102-c94fd5ac89ae", "comment": "Malware payload (NanoCore)", "value": "23b88e412a55d9998fe89a31dc3a46b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692228618, "uuid": "6f8b23dc-4dae-40d4-bcf9-df687b870107", "comment": "Malware payload (NanoCore)", "value": "f7fc062f43a3515a267b6b7f979d3938d10811cd97bd985a33f583e57a11ab3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692228618, "uuid": "a623fe84-6d1b-4da3-9053-72f067681c3d", "comment": "Malware payload (NanoCore)", "value": "927bf4fc31ec559775a27255eede7eced990fca0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692228618, "uuid": "6eeaa6c0-e73d-4e4d-9589-0d4b24704259", "comment": "Malware payload (NanoCore)", "value": "e7b56c299a045f6475b5ddba346f5bf32ff3f2eba7024813c9b9ed46c1fe118cbb160d43fd351704c1d250c11d14580c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692228618, "uuid": "e7eab191-ebcf-4618-9391-364f0336754f", "value": "T13C14C02A77A94A2FE2DE8679711252139378C2E39CD3F3EE18D415B68F667E406070D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692228618, "uuid": "198a33ec-cb0b-4a3d-ba22-63e7d40fca9b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692228618, "uuid": "d51cadb1-065c-457c-ab98-004b40b4b493", "value": "3072:QzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HINj6d6+Il1c3rxbivlpfe:QLV6Bta6dtJmakIM5KXT6rxmC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692228618, "uuid": "3601beac-f01f-4209-a1cd-d0a9611c92b3", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692228618, "uuid": "d8a595a2-eb9c-4498-9a6e-78ff9df2dd2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692228618, "uuid": "c92fe405-2e0d-4c13-88c4-73b263b7a343", "value": "23b88e412a55d9998fe89a31dc3a46b3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c7bf943-3c35-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1692191037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692191037, "uuid": "6e0851b7-22bc-41d8-ba5c-cfa17235713e", "comment": "Malware payload (AsyncRAT)", "value": "6393e2dce73a42270684dc99181b7a67", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692191037, "uuid": "3b149a60-e6d1-427c-9f73-7b93ab0ffc31", "comment": "Malware payload (AsyncRAT)", "value": "f83b3d9863699ed58cdf5b05d23f984b95d2f01893c02ccef13d079b84b5e965", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692191037, "uuid": "95085491-9c2e-4051-b4a6-57466ce0faa5", "comment": "Malware payload (AsyncRAT)", "value": "b85809f13db2352a6a6e8d28ea7beb57907cf6dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692191037, "uuid": "e6533e4c-a809-44b4-be3f-b6fd98e56fa9", "comment": "Malware payload (AsyncRAT)", "value": "34d5e6f64cb69325c266b22432c6694f5d4f6f04ad176bddb6514f15884d95d7380d6642aef639b438654cf691dc916b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692191037, "uuid": "1b0a7496-ee5d-42ea-865a-65ceea44226c", "value": "T115C49E8DFD56B26DE487F27288A72D3CF78C092B8307740B513B635B195EE4AAE021D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692191037, "uuid": "ebb4a206-48f0-45b3-b373-90c26085e6fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692191037, "uuid": "b6ac0f89-6843-4e28-933a-ca0b45d0fcd8", "value": "12288:goDMPHxPXtPigb43seF6t1MEGW2htrqgUfqspkYauHRlBynaPSR4vMlHaiHROky:YxVPigjOLlHzk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692191037, "uuid": "4d51b1ac-6d38-4cd6-8da6-c72ecb2cdfdc", "value": 574976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692191037, "uuid": "8afba1a1-e6bd-4436-a31c-c6022ff23d25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692191037, "uuid": "897e6543-f2be-4107-9cd2-03105787660e", "value": "6393e2dce73a42270684dc99181b7a67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d015e475-3c0a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692172763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692172763, "uuid": "12335c56-3eff-4f6d-a777-c5046a0cc766", "comment": "Malware payload (AgentTesla)", "value": "77d63066264e8122fc344ed177439d38", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692172763, "uuid": "d65374cd-c8e9-4535-9523-25cb97f28bbc", "comment": "Malware payload (AgentTesla)", "value": "f99dfe4e9e1f9ba0f9cbcaa52d0c4c6c612bd226efb275bbf7fe72b4cf176816", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692172763, "uuid": "4345ca0c-e120-43d5-9ba5-e6b78cd02cd5", "comment": "Malware payload (AgentTesla)", "value": "27d3c16ff51f99a47b493e884c8b34c1a8d4c645", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692172763, "uuid": "00bdde2c-a529-49e9-b5a1-b501c2ccfa19", "comment": "Malware payload (AgentTesla)", "value": "e8cf14062afc60433d0f8cd61a3d8dc491ebfb5c923366def2427ccbb7a56d62e7b701a8f947ce8c60baa97996bcb817", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692172763, "uuid": "571b5d30-c2b4-4cf8-80df-4c7676dd661a", "value": "T163A4232A7222E7058063E747571A78B2578973F0F6219A9399910543F3C2BFCEB94BF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692172763, "uuid": "91cd7d23-f28f-4293-aa49-e58bd1677928", "value": "12288:plczEpY9I8B4wuqhuXDdNosNlBpFEqrnoBwg/8:7scY9I82mk5NvdFEqrnoBww8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692172763, "uuid": "e79ba553-730a-4dcd-89c8-646c2f732582", "value": 459581, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692172763, "uuid": "4c73b726-053a-4c95-a5a5-46373395c126", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692172763, "uuid": "db29db25-9b8c-4d52-8e7b-ac703656069b", "value": "PI.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e467623a-3c63-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692211022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211022, "uuid": "9a5d474f-e539-44f8-a2f3-5d794a1ff44c", "comment": "Malware payload (Mirai)", "value": "5c72124ea7da1fed90ecf9df37221303", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211022, "uuid": "32557543-06a6-465e-8160-123f385ad2a3", "comment": "Malware payload (Mirai)", "value": "fd2396c3c35f3c9dea1ccf69d8e8023f201773c2906c0ff1e1079c7da3477599", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211022, "uuid": "af806191-7120-4641-8dda-fb6aa372b58b", "comment": "Malware payload (Mirai)", "value": "2a630d28b50d17590dd5a2053ae03deadeb1ce43", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692211022, "uuid": "efa8cc60-25d8-44df-9e8b-31b69e592ef7", "comment": "Malware payload (Mirai)", "value": "7b40cd6afe38ccafb337d64e990715b5e00d1ad33dac3eeebdff6a6286fcbb353ad9be1efb2384a047afc2027d0baae8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211022, "uuid": "3dfcf141-65e5-418e-aa44-107356c023dd", "value": "T119C2D071E8459E8BFF6F6D709EB8C6C16FDB0B50E7E1CCD0618CDE5212108579B64688", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211022, "uuid": "84151e8f-7668-494b-85b9-9f243bb0e9f0", "value": "768:4KnqLiChP7gI5xbBzKSYyS7znHaI4uVcqgw09X:4KqL1hNVtYykn6I4u+qgw09X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692211022, "uuid": "04e6a0fc-6e52-44df-8ad0-aff3d6524314", "value": 26224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692211022, "uuid": "69affe7d-2275-47f3-8324-75a7b48c16db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692211022, "uuid": "8abe36ba-464a-4d0e-a308-543ca3521509", "value": "5c72124ea7da1fed90ecf9df37221303", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a40cf8b3-3c2d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692187721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692187721, "uuid": "b72ab350-f85b-4be2-b0ad-66d41c2858b4", "comment": "Malware payload (AgentTesla)", "value": "2df8b2387ea6ba881dbc4a0c5eea9389", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692187721, "uuid": "c644785e-e748-4664-9e35-d20bfef4e22d", "comment": "Malware payload (AgentTesla)", "value": "fdc6c7b8a44243f69803a689c4c4631a818d219d0d7ad0c16f4961fbb7db28a7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692187721, "uuid": "5a26a2e8-fae2-41c9-9439-e38f5d6595cb", "comment": "Malware payload (AgentTesla)", "value": "66f6db734aa81c552edb96036e677e641b431bba", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692187721, "uuid": "897ec789-521c-4cb3-971d-bda085f7ad37", "comment": "Malware payload (AgentTesla)", "value": "cb0c3894149f5720134e50fa07e1a11b28efa37fcab6134e242fc0768548f1babb94c493b9feaa93ec9b31b134146943", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692187721, "uuid": "dda72204-adef-45d1-a441-b32551de7651", "value": "T1BA150721E77B255AEF29A1F85E2F847239D6DCC0F1B1C588A7E7280385C23514E35BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692187721, "uuid": "0b153058-e8c9-4b23-92ef-b16fccf5c062", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692187721, "uuid": "c15722d5-2b19-4fc2-93ee-08775d0ab2d3", "value": "24576:twRRs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUOqUFE2XzI/pvES1Kj:teRs6CE3jLbO9Rs6CE3jLbOq0js+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692187721, "uuid": "b19ec1c0-18d4-4f74-88f3-662bb29d43ed", "value": 883200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692187721, "uuid": "acf8cab4-91fb-4810-9c39-321979fc16c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692187721, "uuid": "23704b11-3227-4347-b654-5378d02a4b7c", "value": "BL For 4704854 4665930.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a3edce5-3c2b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692186604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692186604, "uuid": "1d4b9dec-acef-4ce5-a9b7-3ab44fe28a61", "comment": "Malware payload (Mirai)", "value": "07920c08223847fea21b3894238e5a3e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692186604, "uuid": "563e2af4-7fd9-4e67-b565-24d5c179131a", "comment": "Malware payload (Mirai)", "value": "fe24cec406a8e732933cfca53d0e97c2f8d2234ad54dc2995026ed945096d76f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692186604, "uuid": "6e5df8d5-1b83-4234-a792-937ab7746d6a", "comment": "Malware payload (Mirai)", "value": "2023e00709eac0d3a974e590748f49a2a3bdfc2d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692186604, "uuid": "d473b62e-6c7e-4f43-88b4-289535e9cffe", "comment": "Malware payload (Mirai)", "value": "5c7fc12af5ffdf5c2e5584866c774f35ec42c1e4158c6850c9cfb4c7ebf598097f7ca6489438302443513538c5db1883", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692186604, "uuid": "1c1af45a-1aef-465e-bb77-7d53ad9fb11c", "value": "T1F2A2D015BF1886CBC832693555E9F6D21352FC72F2ACCC192A40C15FB4A33E96874F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692186604, "uuid": "791ab284-efa3-4892-ac89-fbae242b4558", "value": "384:Mg/Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaqOKV14b+502F2vwA9dWuMW21bAKk:598o08kxofBE+ZkXaqGbp2F2TWul0c5N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692186604, "uuid": "616d76c4-915a-4acd-b642-542585ec198c", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692186604, "uuid": "0acb7e96-2f0d-4381-8a7b-7e344e03f6e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692186604, "uuid": "953ea725-bec6-4570-869f-a42c1e10d259", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1581975-3bff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692167987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692167987, "uuid": "63cd0a45-e2c0-474a-95be-f4e8783074f6", "comment": "Malware payload (Formbook)", "value": "81e142d56e99faa92c9e38ffeafcdb39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692167987, "uuid": "706aa469-ae6c-4eff-9e93-6246fd7ec8b5", "comment": "Malware payload (Formbook)", "value": "ffee16f64401cdaf0bec1e22e9cbe4e8dc469058ed972923bd49b962f2cfff8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692167987, "uuid": "8f267f73-f387-4c35-b038-878767f4a812", "comment": "Malware payload (Formbook)", "value": "40041fcf6ecb014ec12081bc72b75843197c4ec0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692167987, "uuid": "00d57b3d-f604-40f8-835b-30f664b0ed0c", "comment": "Malware payload (Formbook)", "value": "c9d07c523a7bfb02def89206ab970dbf309c0c5c680f309f0106573a9d25bf8e0a61d2d702789669f3c66790491edda1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692167987, "uuid": "38e615c2-5810-4514-8a94-016f62e25e68", "value": "T1E254126932B1C117D8A20B71E83E63325FD1DB3015795B8FBB601F5DBD72A82914E3A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692167987, "uuid": "7449841b-a014-4ae2-9710-8c3f198d6f65", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692167987, "uuid": "a861a559-a32b-45e6-bb42-d46e7b20ebb4", "value": "6144:vYa6Bz4EMaCQBLNsoNlvlSIYfIvlXBZxwe9FEWpXvrPvcafcpz:vYzMVQ9NVNpQPKxBZxwePEWpXjEcc1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692167987, "uuid": "cb1da47d-5bcf-49ab-94c0-2d1233639382", "value": 281180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692167987, "uuid": "8b6f884c-c603-48e7-b5c8-1d18d3e864d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692167987, "uuid": "7a27b1bd-6178-445c-9c80-3271813ea8a3", "value": "NGL-V-8021-PI-QP-1803-D6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }