{ "Event": { "published": true, "date": "2024-04-15", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2024-04-15", "timestamp": 1713225781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "bb3cee70-8b72-4c67-8346-6b6b11e27476", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8b2ff97-fabb-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713139439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139439, "uuid": "c40c5af4-dafb-461f-aae5-cb7c6286d2bb", "comment": "Malware payload (Mirai)", "value": "f9c28a3ab57f680a18ded461639ba44b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139439, "uuid": "b8f23725-d224-473d-9cc3-833fa4bbcd17", "comment": "Malware payload (Mirai)", "value": "0057222f2a571b3fb9e2d63678661afaf0910e019bc96f7627d99bed97ba7274", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139439, "uuid": "b9c2914a-2426-4c07-8857-9808534f939c", "comment": "Malware payload (Mirai)", "value": "bc925e3580f307fefc6ce60bb6e12e52b38d0619", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139439, "uuid": "a8342e32-fe0a-4e18-837d-6e81a415fd3f", "comment": "Malware payload (Mirai)", "value": "1eaa22a0c4d0c615ce2c0d89c203f23cb0bf6b90093121724094e3e4c120219054bbc610fb9038a98e7487c148de4df3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713139439, "uuid": "9db419af-9ade-4690-a067-bbe5c674ae0e", "value": "T16A631945FDC2AA12C5C913B7BA2D41CC332563E8D2EE72139D112F15B3CA92F0E67666", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713139439, "uuid": "d6fd2afc-dbf2-49eb-b168-7fa4a0e58910", "value": "1536:x3PBI6NRVnTHgzuJG7uebbZ7CWFToKRkowbZn:FPiuRVLUwkt9mWFToKRhwbZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713139439, "uuid": "a8370efb-a8d3-455b-a0a6-152762b4238f", "value": 66880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713139439, "uuid": "43271002-96cb-45b1-ac9e-26fcc2b1f447", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713139439, "uuid": "db5c3a5e-31d8-43a5-9d21-0cfd41112519", "value": "f9c28a3ab57f680a18ded461639ba44b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc568619-fae5-11ee-a120-42010a9c002e", "comment": "Malware payload (PureLogStealer)", "timestamp": 1713157564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713157564, "uuid": "3983b3c5-ff18-45a2-ac3e-7365b20cb705", "comment": "Malware payload (PureLogStealer)", "value": "90420a2d239320d0ff1e38085184255d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713157564, "uuid": "f2a02c34-396e-49a3-b793-aceefb7c1588", "comment": "Malware payload (PureLogStealer)", "value": "005c2c502b7a594a7e0dfd6bc16ddeb7bc0550c804ef723a41bcf9880261765b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713157564, "uuid": "62107e8d-7366-4277-95b8-ee7a1c57c310", "comment": "Malware payload (PureLogStealer)", "value": "29febf1407397e82df52472f91e609429fb2c34f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713157564, "uuid": "6981a958-e0bc-4f5d-bd0c-c7e0205155bc", "comment": "Malware payload (PureLogStealer)", "value": "b335de5f24d973895cdf56b7d8cde159c5a6d4c2bfa856cedd56d13eda4ab8aaf7cc24c9ccd684b386da6527318ff743", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713157564, "uuid": "3c92de4f-db55-44e0-873b-4c9b8c2de262", "value": "T1C736125177F88916C0BF8A3AD1E7140857B3D5862223E71B36CA12A50E933EF5C4EE5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713157564, "uuid": "ffcfc9cd-cea6-4bc5-8da8-31c5ee9f3518", "value": "98304:atqFkTRdMClJbjovecSpnN4rnyI0nHc2piJj/EhnqVuIds/l:VFg/KSH4rynHHiJrWnfosN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713157564, "uuid": "e846eda0-3f20-4b61-9766-2297db331fd7", "value": 5073792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713157564, "uuid": "34bad21a-5604-423e-bc1e-cf6ff8b3879e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713157564, "uuid": "7398d5c5-d0d1-4253-b9a7-02c2a5197e06", "value": "90420a2d239320d0ff1e38085184255d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "722626a6-fabe-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713140636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713140636, "uuid": "2ce680eb-d641-476f-8a42-e2c469b736e9", "comment": "Malware payload (Mirai)", "value": "1beb3c1546882213db211fd5e7c218bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713140636, "uuid": "3dd16d11-b27d-43f1-87d7-f3821fb29bd3", "comment": "Malware payload (Mirai)", "value": "011427141a39fb519c11a487fb22accc368c090bf8f017b579600b470782c0a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713140636, "uuid": "b12c9ec1-460c-4d2d-bb7f-01179a584954", "comment": "Malware payload (Mirai)", "value": "740c16397aee8e04844beaaf37f212ab19d1a8dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713140636, "uuid": "7109f9c5-8624-4bd6-b9bc-d214a05bb4b9", "comment": "Malware payload (Mirai)", "value": "6669fcfcfc24b430354f0b35b16ec097dc57bcd36eb992ca1576bfe567c64e8b1154eacd62811de409260158d8261648", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713140636, "uuid": "81eeb899-a9d4-44a8-9a20-52db0840cde8", "value": "T128A2D0A855E5BF71C9642D36D82140C62A1A277CC2EAB6713B58D0AC27C2307BFFC05B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713140636, "uuid": "ad5a8bf1-e833-479f-9784-fe6fa28b5507", "value": "384:/XLipjSPrNEbcSCE0CWmJWtaI6/ZmZfij8TMvn6DOA6hfyh7qmdGUEpiaao:PLcSPNvUZmZfijQMvnIO55y9q3UELp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713140636, "uuid": "06a23dfa-8292-417c-90b7-0ec944d7042d", "value": 22596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713140636, "uuid": "f39a1234-3699-4a5e-a4db-5bf557a99fab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713140636, "uuid": "8919b3be-21f8-40cb-a0d4-577ca32a5ca7", "value": "SecuriteInfo.com.Linux.Siggen.9999.17489.13768", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ead2ecc-fafa-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713166239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713166239, "uuid": "faea3c2d-1f85-46ae-98f8-193b6902c84d", "comment": "Malware payload", "value": "42abb22edb12900bc9d0420ba8421c5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713166239, "uuid": "49876c0e-d6bd-4c8f-8353-c51b06306533", "comment": "Malware payload", "value": "02a76c88271f42330fb78ff36eaad0510330963f23504e4d126c86c31e46d5b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713166239, "uuid": "f68e5c9a-ab6e-4552-9f0d-7408bcde364e", "comment": "Malware payload", "value": "e8b9e3adfc2af23dd9e7fc1f50c7711c78b88669", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713166239, "uuid": "41194028-e06a-4078-82fc-89e78bb14a26", "comment": "Malware payload", "value": "aa43b0c0ee17bab2303ac02bea36cdcc2689f5299438b45666c13184cbc314f8eaab9497a2aba8e4ccbba9e4fc2949de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713166239, "uuid": "3a7e3617-8de1-45c9-acfa-c26de4c80695", "value": "T18594BE6235D2C47AC646403249E96B787BFAF5440B36478FB3C8CF3CAD316926627179", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713166239, "uuid": "95864ca0-1140-4704-b2ea-1a894a0dfb1e", "value": "39527421e19653ad02e31fcf8b625df3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713166239, "uuid": "aa191983-bb10-4054-b7d3-9ad9d96ccd73", "value": "6144:V8+i1XKDBMZkRhJEHEkVsWqTWVHXJTuEeJht:+9KDBnRhiEAqKV30d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713166239, "uuid": "95b5c945-194b-432d-849d-97f47eb7c6cc", "value": 420328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713166239, "uuid": "c162c31b-1ed0-44a8-81ca-706a8ddcecbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713166239, "uuid": "5bf4362a-5acd-4b7d-aa09-704a740619b8", "value": "42abb22edb12900bc9d0420ba8421c5c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "967fb5b2-fb3d-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713195243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713195243, "uuid": "84351ee7-a5aa-4762-aea3-1d84c1c858f7", "comment": "Malware payload (Formbook)", "value": "bc0376206d1c6d33bd9e52dcb81e4f09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713195243, "uuid": "fe422bf6-9241-4137-9a0c-36cf25ce6b5a", "comment": "Malware payload (Formbook)", "value": "02fcd974ed295876909c4ab68f5407bb5629649d2e56352ce39911dafa9b09ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713195243, "uuid": "d1c522fd-a5e5-483d-bb3a-6c06fc69c03d", "comment": "Malware payload (Formbook)", "value": "4249f90a5b402f4126265681d812097fe71692d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713195243, "uuid": "17591e8e-f4f5-4bbf-8bf4-c1424396de8e", "comment": "Malware payload (Formbook)", "value": "cb50b5308a1b93f3b9142ede6a0ddde0e63222e3fa96eaba53118737cb24f89cb2da0335ba6ec128c227f531cc990635", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713195243, "uuid": "d3d65738-acc9-4136-a612-fa008991e772", "value": "T15F94D01F4E307588D80496B796A10B9C0DAB2E0FFCE5566F480DBFEAE3BBDB44258541", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713195243, "uuid": "60658c4b-b993-48b7-8b44-af10a8690b4c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713195243, "uuid": "29b319ed-3c86-4f68-9cac-b07ca403e1e7", "value": "6144:MBi2YE367ONkXCHj0vjObPK2T9wti2GNHZo5JlpeVP/sBG3V+M+2P:Mt4viby2WtYNHy5JQ/5+MPP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713195243, "uuid": "4aec97c4-9f3f-4199-91de-5938d64c295d", "value": 437248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713195243, "uuid": "3950ed63-e3c3-4e84-9c11-0980c5227adb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713195243, "uuid": "d7335895-2315-4e19-85f0-7cd4590aa39d", "value": "SecuriteInfo.com.Win32.CrypterX-gen.6113.26438", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d1c6b26-fb63-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713211494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713211494, "uuid": "752d9bc2-871d-4153-a2a6-a1785c360e9b", "comment": "Malware payload (Mirai)", "value": "df6c9b3dd07fee70786265e96aaf93c1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713211494, "uuid": "c33b0d6f-fec6-412d-825b-8dbd4cf8f414", "comment": "Malware payload (Mirai)", "value": "0307ef26287615241bac792499c464cb3dee856b805ba6e273eea5c668d79b46", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713211494, "uuid": "513d48e0-6f0f-4299-8bcf-25f4f120fb34", "comment": "Malware payload (Mirai)", "value": "40508dafbeb5a9ead9d1f052431dddec7d79b078", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713211494, "uuid": "45a2a60a-4f29-46df-965c-36d549c56f27", "comment": "Malware payload (Mirai)", "value": "e927c925c8f3b5b9079a1820298fcd75837e5215416904387e16ccac9cd250cc57ab7c3d35ac994e76325d403df83277", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713211494, "uuid": "5e3a1aea-8b03-43d3-a006-67ac9a3341be", "value": "T160737DD5ED83D8F6ED170030607BE7376D71E0BA2119FA97C7699932F842A41B113A8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713211494, "uuid": "f2cecdb7-e932-42d8-8242-711e637d57ef", "value": "1536:xX6S+VvEfkyjHJSN7c6pDNZp7L0n9oe64B39eZgpCzZbuZHCaI3s:xXKV8s0HJSFc6pJZp74n9ooJ9eipIsZN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713211494, "uuid": "ad2996f4-5d59-45be-ac9e-f05966c2fc43", "value": 75308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713211494, "uuid": "cc8ab475-8fc4-4a9a-8a84-fb1ebaea3eb5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713211494, "uuid": "e5c3cfb1-f0e1-4a2e-ae61-09d9056905d8", "value": "df6c9b3dd07fee70786265e96aaf93c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc0c059b-fb04-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713170932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713170932, "uuid": "f03458d5-a581-4fd5-b8da-052d03d236b5", "comment": "Malware payload (AgentTesla)", "value": "eabbe4d4d0c4935bb9298a7182198b10", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713170932, "uuid": "2e9661a0-0fef-48fa-b0b2-91d2f1f28708", "comment": "Malware payload (AgentTesla)", "value": "03883279c4da0b030486ea0382bc3366b33f376e4a480f39ff2022f1b560e7cb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713170932, "uuid": "b89f033e-5ff8-4e0d-8e3c-0af6d7f2ce3f", "comment": "Malware payload (AgentTesla)", "value": "4bfcb06029f3a17fe767e21e0785a12d018652f5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713170932, "uuid": "da00859a-7ad4-4af5-849c-f26b3deff61b", "comment": "Malware payload (AgentTesla)", "value": "8bd88b6b0d7d368382a184dd934ab3884d2e0d674369542a325157a6b9cd12064919dd313d0b1e40bd032d31a2a9a0bd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713170932, "uuid": "9dd6ecb4-94a4-451a-9f91-6c52eedaadc5", "value": "T1A3F41250212CB673DE6E21FF09D5348673B822A47075EBCE6CD2A4D51680FE146A7FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713170932, "uuid": "18a2b2cd-bae4-47d1-bf9c-d679c8452964", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713170932, "uuid": "e9aa9d50-55cf-495c-8cee-5fbbe97640a4", "value": "12288:Ee+NBHRX3Um7Rop8GdW1WYO8YSZGHFfJ2dr9MrN/C3WoOLuqnKtF/S/gKcMd:CNzEmekYjFMdr9KN/CmHMJS/pcMd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713170932, "uuid": "6a107be1-9b33-41df-be0c-b8b5c6098dfd", "value": 772608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713170932, "uuid": "ec46a41e-08b4-445c-962c-d264cab3bbff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713170932, "uuid": "efc9a9ad-2d25-4ca4-b690-d33636846e9e", "value": "wM5ikCPtyUl2ltk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ba083bf-fb41-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1713196728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713196728, "uuid": "fb6e6f05-9ec0-4161-9f8e-c0837c30efcb", "comment": "Malware payload (Gafgyt)", "value": "aef28e44e56b93f9e045d89ba5d6fc7d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713196728, "uuid": "ff3725e1-3984-4990-a821-6cb34751f836", "comment": "Malware payload (Gafgyt)", "value": "0420951c2303fa09eb5b06825c887b7514bdee31284255fe27fef7c918267b3d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713196728, "uuid": "31694492-2758-456f-abd7-4d1adf74dca3", "comment": "Malware payload (Gafgyt)", "value": "06d0b8acb6f60ed27bc18a5d609d8970e9567088", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713196728, "uuid": "308a53db-d889-40e1-a77b-c582648387e5", "comment": "Malware payload (Gafgyt)", "value": "703cfecb1b4262b8fa2bf7ea7f846c582a3cb6b54a8d624e12a4deed5af06d07c1086971c62cf6bbd9f18ac551bc5d27", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713196728, "uuid": "f12c8742-f233-4888-a5b6-cfae91e339d2", "value": "T10CB3F801E6508767C1D2277BF79F835D37366AA897A733115A24BFF42BC27881E3A121", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713196728, "uuid": "9e1526fe-dcea-494c-b895-d40c493bf7c3", "value": "3072:1dnKvzqdIFqKtI2TjjZ7x0dcGHzm4Qn7JXSfn:Wv2oVTjjZ7edcGHzm4Qn7NSfn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713196728, "uuid": "336b7b5d-66c5-4b99-a682-148552d26287", "value": 111420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713196728, "uuid": "47b0e491-329d-4349-ae1c-bf7610419ce3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713196728, "uuid": "1654249e-138b-4e37-8158-5ad805de229c", "value": "aef28e44e56b93f9e045d89ba5d6fc7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fccb277-fb41-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1713196735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713196735, "uuid": "cc2732fe-3e2f-4fef-9b38-e249aaf6a88d", "comment": "Malware payload (Gafgyt)", "value": "3532aa4d2c47ad4c3e4779c394b86ad0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713196735, "uuid": "27d273ce-5253-46f3-932e-0f42bda79d6c", "comment": "Malware payload (Gafgyt)", "value": "0482c9ffda875b66fe8c4638c60ba184b982b69dd93b74460b6fb7340ca3716d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713196735, "uuid": "579d967e-3adf-46f9-8d35-951c9ea81395", "comment": "Malware payload (Gafgyt)", "value": "a3936728a75d630afbd9f69aac6c97437e621d8f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713196735, "uuid": "e32493a8-c60d-4a04-8cff-bd7622f732c4", "comment": "Malware payload (Gafgyt)", "value": "a8ea4743474aebb003501891bbf81bab348f493c38daeffa4a8a42738962a2ab3580e18a6b117b564fd76ce736c7291c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713196735, "uuid": "eb36415f-8b41-4d5e-a77a-0b5b6de214a9", "value": "T138B32801D5508B67C2D2277AB79F825D33332BA8979B33125A24BFB42BC27DD1E39521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713196735, "uuid": "ab819d38-d53b-4f20-8e2c-7a12146abfbc", "value": "3072:b6an17WtsWhdgYJy0D6mbPbmTQOWsXAOn:Wan17WPJy0D6ibmTQOWCAOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713196735, "uuid": "ce5d197c-301e-4b29-b6a4-0d4ec592e969", "value": 111512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713196735, "uuid": "431275e6-aaf7-4a30-bf03-edca551e4f03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713196735, "uuid": "747e6602-93d2-4318-b738-26df5128940b", "value": "3532aa4d2c47ad4c3e4779c394b86ad0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4a437cf-fb29-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713186676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713186676, "uuid": "429c4bfa-6b7e-4377-ae02-1e8c122e56f0", "comment": "Malware payload (AgentTesla)", "value": "036ab2261f2c1d02c67dfd53081bbd9d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713186676, "uuid": "d74db64f-604a-41eb-b11a-9a6b8b7d4262", "comment": "Malware payload (AgentTesla)", "value": "04905ab74af1d34a39fdb2609f02e26f5a45f9404874e70efdb9b723d7cd6b9e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713186676, "uuid": "496c3594-87dd-4c0a-8abd-3f79f6d7cc7b", "comment": "Malware payload (AgentTesla)", "value": "1020f8509f0d3e658f0f769481e800541ae3e764", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713186676, "uuid": "e1ea0a1c-9559-441d-b83f-c52140f6309e", "comment": "Malware payload (AgentTesla)", "value": "d00211d89a2aab1eb9e4ebea1607cb36242cb7eed2a6b48aa051617b7a7fe0227bd8a81b33c2e20904a29e4800c8d0ba", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713186676, "uuid": "84df5ad4-3e4f-4187-9f35-802b208ea717", "value": "T125F41240BD6C8B1AE23E6BF9D03857604FB27455E414E2CA6E8774C9F933F41461AA8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713186676, "uuid": "1de0c0f4-5044-4846-a992-40af48cec639", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713186676, "uuid": "7a9f093f-c92c-46d0-9245-3b177f22e1ca", "value": "12288:mZnNBePtI9oo1VU820ajUpZIys1qn/ZWSIJJpE6XS87u66RWPXTXRkR:unNUSX1V/FUsRWSOJT6kTc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713186676, "uuid": "0b33899e-e328-4cd0-8f14-e3750852aae2", "value": 760840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713186676, "uuid": "083f62f4-d7f4-4b13-8421-7ad9a50a4ebb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713186676, "uuid": "2a9a8efc-aee1-413f-8d8f-af8f7894e0b0", "value": "SKM_C3350i2402291223.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b198981-faf9-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1713165964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713165964, "uuid": "087fe6af-13ed-4f4f-a1d1-bb819f2080c2", "comment": "Malware payload (GuLoader)", "value": "9cca6c27ab4c2d57ffb57973de78658c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713165964, "uuid": "8d1234cb-a87a-40df-9276-572da1e405f6", "comment": "Malware payload (GuLoader)", "value": "051cb37b130a5af6e0fdcedbcbf67901e45baf9a99cf81e106b0e72e4ef2f6b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713165964, "uuid": "49d3e618-b256-4fb2-8da1-11836072c44c", "comment": "Malware payload (GuLoader)", "value": "961a879187aa8d7665cb00bbbfddcf67bce4172c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713165964, "uuid": "2c244c82-68e9-4259-bb87-c5fc03c9998d", "comment": "Malware payload (GuLoader)", "value": "f41619375c2bd04212ef91887d32546311542b484932a07bde1c731a866edc2f0cac7cd1e9b1d4bb89c85c9c564159ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713165964, "uuid": "61001be3-e76a-4ba4-8d9d-a4a793cfb29d", "value": "T173F4F1E23511E6E2F919CEB0022BEA290B5D7D173C305DAAB395FB1EDF323C1A415616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713165964, "uuid": "0e399342-e97a-40d4-a472-b86c54e60b3f", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713165964, "uuid": "8d0b9807-8ea7-4ef1-99a5-7476bd702ac6", "value": "12288:Zgf3/HvEqA4wXuyo86ii63KnVdZsfZhgZ7q+V9qKWLZrEGg29fiuhx:83/PE0weyorI6nzOfZq7S+o9v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713165964, "uuid": "2c2baeca-d19a-4205-ab26-ef97455a3ef0", "value": 779448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713165964, "uuid": "9c9ce74e-bfcc-4b7a-aa40-bb3f509bd65c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713165964, "uuid": "8100b3a4-0bc9-48fd-917f-9a426fea8b14", "value": "PO# ROSIT\u00a0MR2309040.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d4a52f2-faf1-11ee-a120-42010a9c002e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1713162478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713162478, "uuid": "8435c581-8f90-4006-938c-77ae7e57cc36", "comment": "Malware payload (RedLineStealer)", "value": "8510bcf5bc264c70180abe78298e4d5b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713162478, "uuid": "554ca16b-31dc-4b16-9b75-88e9ce635b40", "comment": "Malware payload (RedLineStealer)", "value": "096220045877e456edfea1adcd5bf1efd332665ef073c6d1e9474c84ca5433f6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713162478, "uuid": "63fa4350-ccf7-43b3-b7fb-bd915669b535", "comment": "Malware payload (RedLineStealer)", "value": "2c3a2a85d129b0d750ed146d1d4e4d6274623e28", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713162478, "uuid": "dad05feb-33d5-439b-b666-5aa2a70eb794", "comment": "Malware payload (RedLineStealer)", "value": "81c11d0d6ee84882b901b85d7a9db7a5f53cc2d8c255569951eff14ac0cc042bbf9be8c57c3347f5e795bf11bd1d3cfc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713162478, "uuid": "241b5e5b-7f65-4be8-b241-48f23e8a416c", "value": "T107646C1823EC9511E37F4B7994B1E2749375EC16A852E31F4ED06CAB3E32741FA11AB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713162478, "uuid": "0a074149-c798-428d-a44b-931a7737f17d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713162478, "uuid": "ab292a3a-663e-4200-ac75-e4dd97121904", "value": "3072:uq6EgY6i4rUjhYMLwPcologL/ejZWTACtAti0lcZqf7D34leqiOLibBOp:VqY6inwPDpKZWTA+AplcZqf7DIvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713162478, "uuid": "122f87a1-781a-4fb8-b1cb-27506d7a9ce3", "value": 311296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713162478, "uuid": "3a1bc03b-6c21-42cc-9ad4-6d582effc6ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713162478, "uuid": "a5e11910-6f40-4cf0-a3c7-a6716c3d7f8e", "value": "8510bcf5bc264c70180abe78298e4d5b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a60447ae-fabb-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713139434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139434, "uuid": "ef9a4e3c-2725-45ce-bb3b-00f3ab19a07e", "comment": "Malware payload (Mirai)", "value": "b3a513db4a91965b5f7ca610a1336b74", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139434, "uuid": "e8af54f4-6061-49ef-8c92-be1526eb4c5d", "comment": "Malware payload (Mirai)", "value": "09fc5e658c4090eb108c47631df8a7cbbd2a7a293ac7c822ea1fc3dbad20db38", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139434, "uuid": "583e7222-b2d5-47d8-89d3-6bc4290e7b26", "comment": "Malware payload (Mirai)", "value": "7821219384abee30e166955aedf17d39f1b0c343", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139434, "uuid": "8bf80bb3-f5af-44cd-8ad4-876a371389e3", "comment": "Malware payload (Mirai)", "value": "de6810ecc7d5ed17aa36c94711852325d7216e72287ba5a428490f1dd24dbe2155d3b3c7b83a4a303aa3bc58797cdd0d", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713139434, "uuid": "d3ab164e-69b7-4155-99c2-664cc808e301", "value": "T1C963191366414AFCC55DC2344B7FB03DF862797C1238B1AA2BC5FE22EE9AE210E6D545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713139434, "uuid": "501e9aa7-a1b5-488a-b9f0-e02bb9d6a909", "value": "1536:6/V92ubVO8Tzur5xLIsI663XO5O9xy7cTXJM3AsJIuIspQwkwbZn:EV92uRtTzur5xLIb663XO5O90cOAsSgJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713139434, "uuid": "98372b59-e6f1-4c92-b34e-4dd3ddfa8ea3", "value": 70512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713139434, "uuid": "4c29688e-af00-4ee6-8f49-817f25e58211", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713139434, "uuid": "4315bba3-3410-4e7b-9766-acf1ab7c30e7", "value": "b3a513db4a91965b5f7ca610a1336b74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cff85cd9-fb49-11ee-a120-42010a9c002e", "comment": "Malware payload (RustyStealer)", "timestamp": 1713200493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713200493, "uuid": "6d07b86e-8f5a-4383-837b-5bdf878e86c3", "comment": "Malware payload (RustyStealer)", "value": "1d8d71b4a0870c0dfa3468470fb28a28", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713200493, "uuid": "32ea7e97-bbf0-49af-b421-56695cd5b6c8", "comment": "Malware payload (RustyStealer)", "value": "09ffc4188bf11bf059b616491fcb8a09a474901581f46ec7f2c350fbda4e1e1c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713200493, "uuid": "e0d5e62f-db9c-4428-b25e-aec8c30e1a1b", "comment": "Malware payload (RustyStealer)", "value": "8edb7b339d957a4a1f1070a082ee8b06353e4df0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713200493, "uuid": "2bf6ec4a-9e66-4d13-b4dd-50694a042968", "comment": "Malware payload (RustyStealer)", "value": "d48a6d5d1841dc7012cb5b57617b6eb53a6a4043c2276af7cae670dab990860038e3a184af241a192bdfd0b4019bfe59", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713200493, "uuid": "bdf242f3-4108-49a5-98c1-372fc2bbad2a", "value": "T1ECE4CF61B58084B1FDEA223DDEAC555586AC9C301B68B9CBE3C43AF93C705C2FB35295", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713200493, "uuid": "9c799859-cf14-47e5-aac9-3ebf1ca29cc5", "value": "1144e101bc055d8feceee72500aa884d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713200493, "uuid": "61458813-a058-47e4-bb60-9180b547b0da", "value": "12288:zjsoDasPcFtjnHoFsR/raVRjleiUt/tFsui3Abg3qomitjWep4xr0M1:XXasPcFtjnHoFsRrYRbUt/tFsrh3qo56", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713200493, "uuid": "3611bdf0-4c3f-4b11-abe7-5c15f9f49562", "value": 718848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713200493, "uuid": "5212cb48-0f86-440a-b94f-55b6e2a0c1cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713200493, "uuid": "ef5cc3e7-c89b-4a59-a3ff-6f7b84b46582", "value": "MenuEx.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bd020ae-fb41-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713196782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713196782, "uuid": "79b6dcc2-816e-473e-a59a-3a34faea167e", "comment": "Malware payload", "value": "0ab61c6d4ae458dd3c367cee58e91a1f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713196782, "uuid": "621a946c-6ad7-4f90-8bdb-116567a44ce7", "comment": "Malware payload", "value": "0ae5f1507bb3ac39ab8414fd17c2add04e24a69242c29b4848b698b173e0bf66", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713196782, "uuid": "4e00d75b-e2b9-4eef-9e4d-41dcd60029c5", "comment": "Malware payload", "value": "a68e4a9cfe7818492c04760d3c3c9516d5e9fd91", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713196782, "uuid": "a4c9c01e-d014-469f-b5ae-ad546410c23c", "comment": "Malware payload", "value": "29b6fd5e4a6699cd1646159948447aff2d7c06277475df61f8dedbdd4a3e943960fa810d7078c64f5cf33f7321ff4511", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713196782, "uuid": "cc948e76-528e-4726-8ddf-322e15fb8722", "value": "T190D3942A6A21ABFEE168823147F39F7083D525E227E19345E25CDB1C1F7128D1C9F7A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713196782, "uuid": "f31877dd-9fd5-492a-8cca-46f1b06f8a31", "value": "1536:Ln/iF/276+Ll6Cm2rKdym4VYQEOnEVu6DsQkvjR8/fDVpLBm3+3VmWCnB65Hubn:2cu+Lss0PL3mvnBUHubn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713196782, "uuid": "f8f5815f-9e36-4aee-9f63-820734748b2b", "value": 133245, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713196782, "uuid": "0c5dd30f-85b1-43b9-b8fd-7a5e11838db8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713196782, "uuid": "8adb42bc-1c57-4477-abec-fc8bb0408ca1", "value": "0ab61c6d4ae458dd3c367cee58e91a1f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d1277ef-fb41-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713196757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713196757, "uuid": "b0dd5bcb-5808-4671-8bc6-ec4b5d1064a3", "comment": "Malware payload (Mirai)", "value": "a7102f23d56feada65c1a4db4860d850", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713196757, "uuid": "4ced2e63-d8c7-42a3-b18d-65f0f4b5392c", "comment": "Malware payload (Mirai)", "value": "0b4967aa71b08731ecebb4265985a7a80e5a381b97a498b1337e940bfa532c7d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713196757, "uuid": "44edc351-715a-486e-9478-a31254c2c80e", "comment": "Malware payload (Mirai)", "value": "f682ef619a950d42bb2e425c16ea8bc556d56e1a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713196757, "uuid": "bc69c50c-6a88-4e20-b0bf-b21e967e582d", "comment": "Malware payload (Mirai)", "value": "62297f38ef9ccf3ff90b857a4268e1feb0ba85cef2724b6e20ce05ede9f3b10c30abaf27750e43dbecdad7a5fa3ea183", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713196757, "uuid": "511171a8-ec8f-4ea8-8b44-a4dd54955f27", "value": "T189732901B7150A5BE1E31DB03B3F2FE197AA9EC221F4B149395FAB819671E321446ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713196757, "uuid": "c8cf9813-574b-4d77-b851-e7d4897fdce6", "value": "1536:kvqIcntzB7K84EwQftDxayuUl5a1ULHIrzirzq:tb6gaSUvazq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713196757, "uuid": "95f76a6d-4afd-4c07-b1f9-5febf9c67a7f", "value": 74644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713196757, "uuid": "67a2b9dc-bae9-40fd-aa46-8b82f7c526d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713196757, "uuid": "7ddf4f7d-970f-406a-aed7-7f10c75d92ff", "value": "a7102f23d56feada65c1a4db4860d850", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2ff1b4a-fb2a-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713187103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187103, "uuid": "c09dc26a-7e08-4667-9b3d-2b9add7e68b4", "comment": "Malware payload (AgentTesla)", "value": "2285a400b8f8cf31a2cdb2972fb3f0de", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187103, "uuid": "69c9bf0f-e9d4-4d57-a501-614f3184ffbe", "comment": "Malware payload (AgentTesla)", "value": "0b752fc6e766a4586b694804fede655f9a28a58a93767658b4fca03fe1f30d53", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187103, "uuid": "5220b427-e459-49f7-bf9e-dfc31cd6e3ec", "comment": "Malware payload (AgentTesla)", "value": "3502b5f7834531bccbf61c6cb3144720b5f1461a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187103, "uuid": "236b356a-ef69-4259-b28b-6465207f610b", "comment": "Malware payload (AgentTesla)", "value": "28550b9b892c2bc66cb35f20e546ab473d4c923da0a549d43cf67b97c9af77f40fcda2aca3319249cc03e5775b3a74df", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187103, "uuid": "b85d79d7-c9af-4f0c-9e9c-fb8478350ae9", "value": "T14E3559D6A7D4BD08D13F3B7438B0B14483F2E4DA8AA7820F189594EE3773745AED2652", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187103, "uuid": "f34c2403-b8b1-4581-9e18-bf0df3847d78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187103, "uuid": "58475093-08dc-4266-9547-237475295cd5", "value": "12288:pdjO/K8sL8kKR0zIYaGzp9t6Mde/l5KCuzAZeQzrjKEddyDZmdgc+W:qS8/pR0EYp9wMdM5Juzmz/dwD8dg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713187103, "uuid": "328c4b30-7633-4fcd-a25b-a51043239765", "value": 1162752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713187103, "uuid": "c17edb7e-4715-4882-bc74-c332cfb51ee4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187103, "uuid": "2d2a2ddf-f872-48ff-b173-a7e109e45501", "value": "DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "892c2349-fae8-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713158713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158713, "uuid": "668d4eb8-26ba-4528-9cfe-782b347a7efb", "comment": "Malware payload (Formbook)", "value": "13c36369e56880d651364f16aa2d1af1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158713, "uuid": "957e8486-2e3e-417e-a729-b659c247c529", "comment": "Malware payload (Formbook)", "value": "0c66f46e961d5a4f44b174a45273ac9107f8ad627cb170e0a8f995b4cfdb5b6e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158713, "uuid": "2c05bb96-4be9-4568-903b-2ccf69d9f829", "comment": "Malware payload (Formbook)", "value": "1c22cfc86ef581848527ea25f96a234977caac9f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158713, "uuid": "be9846e6-5f62-416b-8429-bfd249263723", "comment": "Malware payload (Formbook)", "value": "041b5d19a3319491e4e1c0e7eed97aaaece8961a103d3bd8e93c2434632f2b7b7aebcf5f42b24543daae0e6299e2fec2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158713, "uuid": "92f1c047-8433-44bc-8f69-ed057e86abbb", "value": "T170544BA0CFCA26394F5B2FDABD60459289FC8159021224BDE6D907AD7243D6CD3FED18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158713, "uuid": "c7fe4667-b7cf-4dc5-b629-226a3fb32830", "value": "6144:LedAYDLBLW+8A1ytW3xrbjsSFuHeEC57kdmXl45zaoGGqAP3MQ9scOSi8zzTFx1e:ynS2ImVqr13O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713158713, "uuid": "e3450754-e699-4450-847d-5a07d1a1ab45", "value": 285729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713158713, "uuid": "e5f317ae-7da5-4136-9614-9f4ba98f5716", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158713, "uuid": "b11b369f-0032-434c-8f89-0950334baf00", "value": "Arrival Notice.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e94e27b-fb33-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713190773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713190773, "uuid": "d4b1a861-5c24-4b4d-a76e-a63cba8dff8f", "comment": "Malware payload", "value": "9882c553537d910ab52fa50aab24cfc2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713190773, "uuid": "3baa0092-2022-4298-a3c3-5c42292f66bd", "comment": "Malware payload", "value": "0e52406d93b9c75927a111a214e8f2d95ce6ad0f3abc76a9a78b300c62edca65", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713190773, "uuid": "ea8f63c7-de6f-4302-aedc-f6a020a72d15", "comment": "Malware payload", "value": "564c5cd422a279dfb999f8e4be062f4dc35733ba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713190773, "uuid": "e057f0bd-c215-4691-84aa-3fcfc0cbba62", "comment": "Malware payload", "value": "10d8ee9f309159255f4ac928a75e74fd267d9a2c0aae59f25c3d6da6d36360e2ab8af07c545ebfb2b8ee07728a61e85a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713190773, "uuid": "d48c2dd8-4657-49f1-9ed6-0b5fa636a0f6", "value": "T13EF539BDCAC91788F597C4E4131EB7E761392E32682F98906F8F6D55BC31612B274A03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713190773, "uuid": "0befceb6-e7e3-449d-bf8a-04602f6d5f7b", "value": "a97dbb87337fa7dd4de029554f7047b4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713190773, "uuid": "86458eaf-41d9-43dd-bfec-220221848563", "value": "98304:rBrIJukIjbMK3WlEmVGBuhZ0lEvAsIY3WRaAVzT+NYTSVyTBtmMg8k54eD62:RTmVGuH0lEVIY3WRaAd+NYmVyTBgMHkA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713190773, "uuid": "bc9f7bcf-9cf9-4672-8733-db75dd311edb", "value": 3407360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713190773, "uuid": "329d8d9c-2147-4d79-b181-04356a28ba6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713190773, "uuid": "0e7604f1-efe7-4de6-ab73-16424d2fbc7f", "value": "9882c553537d910ab52fa50aab24cfc2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a60ad2be-fb2a-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713187108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187108, "uuid": "deb17d4d-b7f0-4782-bfe2-3f7e73aaaea7", "comment": "Malware payload (AgentTesla)", "value": "6b62e0a4feb35178f7c22ae86c048772", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187108, "uuid": "8c8dce75-7ea4-4177-bbc7-964cde3de3f4", "comment": "Malware payload (AgentTesla)", "value": "0f3ef87a67bdf65c62ff5ef448fee9582964febb2732d9e21e6143f7dbc84660", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187108, "uuid": "67151bf0-12ba-4f94-ba6c-c217c37b8606", "comment": "Malware payload (AgentTesla)", "value": "20e874cb026bbab514aa364a3be586304ab07437", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187108, "uuid": "f00bf2ab-1577-47c5-a3b6-091245541fe0", "comment": "Malware payload (AgentTesla)", "value": "56b50ad4ca6a40241183dce93a45f1043d911d6e3f99d8de91751df916790eb218f948d6211d88cb3704df207edffb7f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187108, "uuid": "e639268f-4e02-40c8-9c75-eebd66eb5afc", "value": "T12BF4F12A37647713DA7653F0E45E20C11B7D641E6260D3A8DCA1E2EA2DE472DD2C2BD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187108, "uuid": "f03cee3f-f324-4848-b02c-d5deed8fcc4d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187108, "uuid": "ee6444b3-899f-467b-b5ed-d9a1b2b87232", "value": "12288:Y2hNR4EoOBKMNHlgMPO7UnmGo3M+u1eUtZiiIfpnJOq4Bi56VUJJfSORGoQY4:Y2poOBrBlqAUNubsjOJiRV74", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713187108, "uuid": "13138884-f11d-4d1a-90a0-5f0caa377244", "value": 794624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713187108, "uuid": "a8db7ab8-7576-46b8-94c4-b9c112781ada", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187108, "uuid": "c0dfc87f-2e79-4498-afeb-fb48dc100d2b", "value": "New Order 0048757.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78b9accf-fb2b-11ee-a120-42010a9c002e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1713187462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187462, "uuid": "0d6583fe-0c18-4eda-8492-8115a7bcfcd2", "comment": "Malware payload (Rhadamanthys)", "value": "ee4eec197df42dff11692359a4919aec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187462, "uuid": "1d4b1ede-f28a-427b-84c4-2dc5330802e3", "comment": "Malware payload (Rhadamanthys)", "value": "121e900d1efc6d9e537471360848b333bfbbb7e08ecadb1d75897882ce2dcb20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187462, "uuid": "68461633-5f22-42f2-9037-b595d448c33a", "comment": "Malware payload (Rhadamanthys)", "value": "f377e2da4f0b6eedfa8e4ae942f29056ed73cb00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187462, "uuid": "e26cd5d6-0caf-42f4-b54e-d947ea6ecbf2", "comment": "Malware payload (Rhadamanthys)", "value": "ace70b374e31bc8754cae4fc55cf1608424615ab2032797bf1b03ea3731a20c2c2841ed646c7b21d25edbbf4b62e21ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187462, "uuid": "7cf99186-5c97-4a20-a2b9-475d3ceb3879", "value": "T104741290AA405865E31D0F308B06E5E885A8EF3D51D1E18FE4BC3E36AD761975BB318F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187462, "uuid": "5ca6e33f-9227-448e-b7ab-21fb922595b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187462, "uuid": "2155ec25-e40f-4dc5-a634-d9ea58ef4f3e", "value": "6144:II4ypBt/6bC6p/8jJkJaVnQUKRnazBrRYJs3mb2stMK39V8s98ix2p:II1t/6+6pWG8aRna9RYSQTXtV8s98E2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713187462, "uuid": "f91d7754-ec85-407b-ae7a-217ce52945cc", "value": 361984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713187462, "uuid": "1345eb73-b2c9-4139-9940-14742ec03d1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187462, "uuid": "ac8c2e3e-aa67-4a04-927b-3abe97fc9d17", "value": "decoded-20240415132315.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3607bc9-fabb-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713139430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139430, "uuid": "dcd41c4a-82df-4dd7-9a75-6a2433ee62a6", "comment": "Malware payload (Mirai)", "value": "b473443557f33439ab5fe86c3b450e94", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139430, "uuid": "abbfc4a8-6466-4ba6-91bc-edf3ba25abe9", "comment": "Malware payload (Mirai)", "value": "138b245a4466a0a3f251914442bafed5be9b4f0c3dda10a897f7b6233f77e155", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139430, "uuid": "23267f23-81c2-461b-86c6-d7906448b289", "comment": "Malware payload (Mirai)", "value": "66e0e86503eb60d96fef8992a655240748cdee33", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139430, "uuid": "5f381a0a-b519-457f-bc7e-339e514b5b5c", "comment": "Malware payload (Mirai)", "value": "f1bf8558e1afac1e792d576345db1396bfe3162a0d781b4a107e3597799bdf264e6a140e91f4bbd0fc16f2a68ce820cd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713139430, "uuid": "4ce0ac92-c2ca-4048-8969-956ecd0e4698", "value": "T137C34A46EB414E13C4D5177ABAAF01493323E764D3EB730699186FB43F86BAE0E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713139430, "uuid": "7c31bbba-cbef-420f-9612-7f3b2f267385", "value": "3072:xR7CokaeFBECXDBb7xcr4o2wbZnVzU40M/9nyK:xRVkaeHECXDBbOr2wRVzUnM/9yK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713139430, "uuid": "f9ff16c6-4574-438f-b4c7-481a344ccb57", "value": 129782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713139430, "uuid": "274ae059-eb02-4741-b45f-a4cd8a5dc363", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713139430, "uuid": "50063559-2765-448d-81e0-09be9f3166b7", "value": "b473443557f33439ab5fe86c3b450e94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "076b0dce-fae6-11ee-a120-42010a9c002e", "comment": "Malware payload (PureLogStealer)", "timestamp": 1713157636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713157636, "uuid": "373a0f3a-7f14-4261-a43f-92865b499536", "comment": "Malware payload (PureLogStealer)", "value": "e22c72422768eaf5d0dc0967281b9c86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713157636, "uuid": "d9377fb2-05e5-4591-959f-538dbe9a8045", "comment": "Malware payload (PureLogStealer)", "value": "14b15b3e7d7fdbc612e747c0dce07fb97b49a6ebb9e412752bf1c2e33e4b1f46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713157636, "uuid": "2d601ffa-bcfa-41de-9777-1051eb4ee2cd", "comment": "Malware payload (PureLogStealer)", "value": "67834cf32ae8916afabddf61682f90c33cee72ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713157636, "uuid": "70df1c91-1fb4-472c-b72c-aed55eeb8115", "comment": "Malware payload (PureLogStealer)", "value": "6f9145824a76b869aa3bbe7b62d0ca10c0ee730cefe5f81666dbc7538cba3ca9bb2db6d821cf7c6e774e8a817d9facf2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713157636, "uuid": "6d7f328d-0a92-428d-b3a3-af93bdafda74", "value": "T1D546225577F88916C0BF8A3AD1E7141857B3D5862222E71F36CB22A50E833EF4C4DE5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713157636, "uuid": "6c9a678e-36f7-41e0-a175-c65b235d9f87", "value": "98304:atqFkTRdMClJbjovecSpnN4rnyI0nHc2piJj/EhnqVuIds/EDbP1N+:VFg/KSH4rynHHiJrWnfossDb9N+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713157636, "uuid": "9b4a94ea-9a96-4377-8302-efabc9d3f026", "value": 5532808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713157636, "uuid": "dbcbf74a-d636-4a2e-bb6d-ac0b88713684", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713157636, "uuid": "5a515316-3fb9-4d5c-a7ca-c0b0d2c9da77", "value": "e22c72422768eaf5d0dc0967281b9c86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0afd818-fabb-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713139425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139425, "uuid": "d9c3264f-e991-4881-a61c-105d76941404", "comment": "Malware payload (Mirai)", "value": "fe0c3976616de79e31a87a205940e3e9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139425, "uuid": "2d60d4de-bcc1-4b36-84fa-865e2dde62b0", "comment": "Malware payload (Mirai)", "value": "15b8274897d947092989084c99a46121546423cd5c12f39703614c1e0ca2fda7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139425, "uuid": "6d0c2cee-d39a-4d3c-943a-95d3f30441e4", "comment": "Malware payload (Mirai)", "value": "9ab62916c39455d7758a7fc7ad511167119a6b21", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139425, "uuid": "bb00b2cc-c4cc-49af-920e-f38d27afa097", "comment": "Malware payload (Mirai)", "value": "2007478eee98e5de5d57f38d57bff26a49c4005b93f944cd18d8d18ed87d86e36bae277c8e3401fb046458d45027a374", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713139425, "uuid": "3aa87a76-f31a-4c6b-b96b-66bc6700219e", "value": "T15DC34A46EB414A13C4D51776BAAF02493323E764D3EB730699186FB43F86BAE0E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713139425, "uuid": "728bacd0-cbdc-4b1b-be1b-98c6e56f80bf", "value": "3072:xR7CokaeFBECXDBb7xcr4o2wbZnVz3InV7nyK:xRVkaeHECXDBbOr2wRVz3InV7yK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713139425, "uuid": "0cdbc0b0-7ef9-4283-9417-158a086757bd", "value": 129782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713139425, "uuid": "417e050f-37be-4452-9b6a-f6ce12657672", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713139425, "uuid": "544b6bdd-fdca-4793-81a3-fd607211166c", "value": "fe0c3976616de79e31a87a205940e3e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2037a742-fb41-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713196762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713196762, "uuid": "895209c7-fe22-4048-b427-38f9f33887e9", "comment": "Malware payload (Mirai)", "value": "a2d12bac9bc204fe0f11fa288e8951e2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713196762, "uuid": "3c0b093b-0590-4e62-a3ed-6e08e83404a0", "comment": "Malware payload (Mirai)", "value": "171a25444b9353ec323b6c5cfa58c09b6e8cdd51cc6c8dce6ba077c8579e6457", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713196762, "uuid": "faa45a95-4ff3-4a37-94d2-ae2fbda55cdd", "comment": "Malware payload (Mirai)", "value": "00260f8366607dd00373a585fa4a51c5c0920672", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713196762, "uuid": "179b9e51-966f-4735-8fb5-e9c3b58a5752", "comment": "Malware payload (Mirai)", "value": "429bd367d4e6273a78eead81cb3f67708226ece9abb82c84c047434824ee38122c013d31c71d5e075b48ba58720839b3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713196762, "uuid": "db39064f-2c66-47c5-9054-1621744b2236", "value": "T12CF318C7F901DAFAF85AE7370C430809B230B7E145921A376267767FED3A199142BD86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713196762, "uuid": "f6d39a31-ab7c-446c-948a-5770ce06d970", "value": "3072:pZqzDvOkbUqZ8QeuacWjcW0JcWcBzf5NBRz/WKiRyVdUjLlK0e8kDqr7:PqzHX8QeuacWjcW0JcWcB75DRqKULzew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713196762, "uuid": "1ceb4a78-07da-4724-b1a7-e3f5e56390c6", "value": 164680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713196762, "uuid": "2dee9b15-d166-4f25-b752-05ce648218a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713196762, "uuid": "ec6ac331-4c37-42d9-bb7f-d9b500184dca", "value": "a2d12bac9bc204fe0f11fa288e8951e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c75eb289-fb64-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713212075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713212075, "uuid": "609ecd4e-12a7-46e5-bb4d-c84b55841950", "comment": "Malware payload", "value": "9c08ecacd600b058473723fb5a5c0535", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713212075, "uuid": "56049202-b29b-44d6-a813-1c253347e2c5", "comment": "Malware payload", "value": "19ecb268f014739cc0babdfad5a9a3c5cdf6655188d4396da1b9310d11e5e36f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713212075, "uuid": "d518da62-5df0-4641-a70f-983b4bfda15b", "comment": "Malware payload", "value": "d2417f2cc22f95699ba3cbbbecf97b7a5a46e4db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713212075, "uuid": "a8156780-464e-47f3-a9e3-896bc81c338d", "comment": "Malware payload", "value": "ae256cae0a28e94ea2b7ed04409e10aa3caa8999ab05ebbee8556927ce4efd2aed5371ad1d6a03c6be8c23dc7865e348", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713212075, "uuid": "44bb8ef5-4416-42f0-bf57-bfbbcefc15b5", "value": "T160735C22BA761E17C4D4697A61F34764F2F5578A25ACCA0E3D720E8EFF3065032936B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713212075, "uuid": "48130067-4e1d-4ace-a4af-33b711957eec", "value": "1536:iDTmfZatavAizKjY92syjYZZlM5RlutAC:iwNvSjY97GYTl8RlRC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713212075, "uuid": "fe75b304-8842-4077-81fb-8adadadab61b", "value": 75280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713212075, "uuid": "29ab9735-575e-48ba-81b9-932c8d7c42d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713212075, "uuid": "92d3cdee-dd55-471f-9615-55fe85199417", "value": "9c08ecacd600b058473723fb5a5c0535", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "234a9d8d-fb2d-11ee-a120-42010a9c002e", "comment": "Malware payload (DCRat)", "timestamp": 1713188177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713188177, "uuid": "e1eff167-ef1f-4b8b-b919-e168c5906f8c", "comment": "Malware payload (DCRat)", "value": "9a2e5bc6c40c511849f5f436f42170bb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713188177, "uuid": "a78bebcb-1f83-40c4-9ea5-1245ab60f964", "comment": "Malware payload (DCRat)", "value": "1d8ca66f0826029f05772eaded76a364ab31de9e0ca07c4d8f5fa68636adedb9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713188177, "uuid": "e1f095b4-8f3a-4217-952c-1dad78ac5e52", "comment": "Malware payload (DCRat)", "value": "d087d26a1f5190a72cf119deb32192a01398027b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713188177, "uuid": "d10b0001-0051-4bb7-a5ef-c94c405d5dde", "comment": "Malware payload (DCRat)", "value": "0b68567d45bd99aef167b3cdb3fc66ef81044e91ce2c64b70eff846d6af4eafcfb797fb269da51130629d6294caf268f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713188177, "uuid": "e531a46b-5479-4f54-949b-df43d711669c", "value": "T15BB56A283AEE5019F2B3EF799AE475A6DA6FB7733B07A05D1051038B4B13A40DDD0639", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713188177, "uuid": "ba9b3668-38ec-47fb-be8e-7549e712336c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713188177, "uuid": "da8c939d-6a5c-4ce8-825b-5044a7e476fc", "value": "49152:aphJWp58VkibWRkT8rHasAIVuOdi/9BIa3K+mPd7bQ:aB5VkiKkgHajEFilBIu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713188177, "uuid": "33bebd08-edd0-4904-a959-7473fe1feb5d", "value": 2356224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713188177, "uuid": "92c33d55-1b2a-456b-b0f5-331c30aba7e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713188177, "uuid": "1d3a828a-56d7-4aa4-a042-7e214b2a6541", "value": "9a2e5bc6c40c511849f5f436f42170bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ddd166c-fabb-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713139420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139420, "uuid": "f8593f99-32bb-4e58-92ca-443861335542", "comment": "Malware payload (Mirai)", "value": "1680dd4f1a51b254f5064b599bc84ce3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139420, "uuid": "6bf4676f-c9c1-4683-8a3d-5c57f17c32fc", "comment": "Malware payload (Mirai)", "value": "1e804df03580471889183261b3f3f4bb891f63a440e0dc780d619ae252a58e2f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139420, "uuid": "197ffe77-732b-4f78-9284-475f5dfb862f", "comment": "Malware payload (Mirai)", "value": "d3a1ae81bbcb515cb19a5f821ee27ce33492246c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139420, "uuid": "8e5803e3-d66a-437f-9da2-a5164090a4cb", "comment": "Malware payload (Mirai)", "value": "d74a0c264b0c20a31b94682b6b856e64866ac52757331261e806016955c1a8f64bec408ec72a3ed1f7cc9b6695e91a06", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713139420, "uuid": "d7e64add-0ef9-406c-a1ef-2d89cb31aeb1", "value": "T14AB3D7162F218F6CF68E923547F74E31669837E22BA2D144E15CEF001F6138A785FBA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713139420, "uuid": "18f6604c-6c18-423c-9e1b-c063706eec30", "value": "3072:tWPP8ElUZxhjzJIFNIQx0ojIeLwbZncu7:t+UElUZxhjlENIQuIJLwR9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713139420, "uuid": "6fa380c2-0387-46cb-8259-7ade36238efe", "value": 113950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713139420, "uuid": "ace0651c-3de1-4ba8-b4e2-7ed267d08a7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713139420, "uuid": "4e1233f2-baa8-458f-a08e-bd3c95070143", "value": "1680dd4f1a51b254f5064b599bc84ce3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5754c818-fb49-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713200291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713200291, "uuid": "7c6b3c1b-1d3f-47db-bcda-978e918dcf2f", "comment": "Malware payload (AgentTesla)", "value": "5ece912886f6c17cc6dbbf57ad9e6b09", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713200291, "uuid": "848164f2-acb3-49d1-963e-83681ac90961", "comment": "Malware payload (AgentTesla)", "value": "1fdcd91233a882bf833a62bca1e4dcf3421caf6fb38096b8f462a67c767a6173", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713200291, "uuid": "bd5f9f3b-7a8f-4bd0-9e50-f95e8ed6dfd3", "comment": "Malware payload (AgentTesla)", "value": "778358bba0689b8bc57fba339de82112628a8c1c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713200291, "uuid": "f07a66df-7dc0-4836-b274-52e2bea454ea", "comment": "Malware payload (AgentTesla)", "value": "e71a4d940fc40d8d2e7743b64fd6a405d7e7b51a193cc842aa9859e0dc910b49494c9e80e97e0f0df209d84e0da2044b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713200291, "uuid": "9772e8e2-a1ba-41c3-b79f-37211348513c", "value": "T11B259D0273D6C036FFABA2739B6AF64156BC79250123852F13981DB9BC701B1277E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713200291, "uuid": "3c16d61e-c0d1-4428-884b-63b39a5adf47", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713200291, "uuid": "b4eeab0a-0f24-4bb9-8b00-297ce04a438e", "value": "24576:mAHnh+eWsN3skA4RV1Hom2KXMmHaACJ2ulI0vOLNL75:Bh+ZkldoPK8YaAS2OOLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713200291, "uuid": "da30491c-57b9-424b-a169-a2d34bb144f7", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713200291, "uuid": "0bf6ed93-dae7-4ff3-bf74-49dc4ce67746", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713200291, "uuid": "135af1b8-86c2-47a7-a366-4b6dbfa6a616", "value": "z1TW987654569990.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3260dd3-fb09-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713173011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713173011, "uuid": "51b38dbc-7c96-4cc4-8007-b68d02f2672b", "comment": "Malware payload (AgentTesla)", "value": "442a642a697710cd68502b9fd1ccc739", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713173011, "uuid": "d06e1d0a-2b38-42fc-917d-5f484a41984e", "comment": "Malware payload (AgentTesla)", "value": "2309ed8be5fb2a40dc85075e7929e295790b47e1153439c85f571107b738ccd5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713173011, "uuid": "61953255-372f-4b0e-a51f-74634f3ad3ad", "comment": "Malware payload (AgentTesla)", "value": "cffd2f3345dc81771d3d2a51e6d65c9409339a3f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713173011, "uuid": "6e7fa20b-a2b5-4c14-8553-27600c493aed", "comment": "Malware payload (AgentTesla)", "value": "914a921d0c5518764a04b703e81567ce5931f03388cee74b398a7213dddda3bbae015b1cfb914e0e64ccafce64ac0db1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713173011, "uuid": "e0f9cfe4-8683-4120-a95b-27882a240825", "value": "T1D4440E037E88EB15D1A97E3782EF2C2413B2B4C70633C60B6F49AFA518516925D7E72D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713173011, "uuid": "3456be30-35e6-408e-b173-5c83fce016fa", "value": "3072:abDf+myuyGI6NZyH1YbmnhmJN1fD1Fv5tABDJY:AWmyuyGzZk1YbmGnf5FYBF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713173011, "uuid": "e9c5aa3f-6573-4391-af8f-56f965561256", "value": 262144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713173011, "uuid": "2db2464c-fe14-45c9-a522-735ca172fc51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713173011, "uuid": "53436ea8-e474-4881-a475-1f566ef2c506", "value": "442a642a697710cd68502b9fd1ccc739.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cb3d85c-fb4f-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713202930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713202930, "uuid": "322c51a4-39ac-437e-88fa-8b02cabe838c", "comment": "Malware payload (AgentTesla)", "value": "116f87a740ec023011fd0121cef37284", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713202930, "uuid": "6dacb932-4e94-4175-af12-227f7bc3cb42", "comment": "Malware payload (AgentTesla)", "value": "2485d8acf5190b7e3818dcab8745f2d9ebfac7f40c2dcbcec9d6b1ab7cc6608c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713202930, "uuid": "b3e4887b-7c3a-4a42-96ec-725e8fb0a7e5", "comment": "Malware payload (AgentTesla)", "value": "141874b356c8da4972f42efce28e7ee059fc11f8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713202930, "uuid": "108b7a5a-38e0-48fc-b6ff-aead39f71674", "comment": "Malware payload (AgentTesla)", "value": "b8d9bd394b3d338c5fe6dc13b587d723e617f4745ce2454e1ca8345d63e1e6494ba7b161eaa29cb39ea3dea8df607c40", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713202930, "uuid": "8acc17e5-1215-4e14-81c8-1653e3ce0285", "value": "T1C035AD0273D1C032FFABA2739B6AF64556BC79254133852F13982DB9BD701B1263E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713202930, "uuid": "93ba5718-b60a-490e-bf75-c55dda13e8ce", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713202930, "uuid": "58646622-b96d-44af-b171-deddcf2fa55a", "value": "24576:SAHnh+eWsN3skA4RV1Hom2KXMmHaAAxcAzHdV2hZN5:Vh+ZkldoPK8YaAHev2hl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713202930, "uuid": "8249f436-33f5-43a4-b1e5-25326e40b04c", "value": 1075200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713202930, "uuid": "e2360fe5-0feb-485f-86b3-0976ea8ce382", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713202930, "uuid": "4c66a647-a45b-48e5-9d28-edb06ce83274", "value": "z1RFQ20838_CMC_RITM50736681.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d46343e-fb51-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713203763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713203763, "uuid": "5ddb742a-7f9f-4941-807f-c2501198f5bf", "comment": "Malware payload", "value": "6ee57170c97a234889ec1033ddd87b2c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713203763, "uuid": "e534145d-cedf-46c9-b1d7-2208acf8b0c8", "comment": "Malware payload", "value": "24b115d46047cc2d3388d04da60fef95d9c7a955ee478fe53b0c7a539c4c8c86", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713203763, "uuid": "84439956-c0fe-4169-b14d-0a81669aa0c5", "comment": "Malware payload", "value": "a1991f2dccf2169e67973fbfb8b6555f84da46ad", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713203763, "uuid": "be74ffdf-12ea-486d-902f-e54612b5eb75", "comment": "Malware payload", "value": "b3be423bc60f9cf890e4423efdd36648c8d2bed91935745303ef4f78de525fe84a1bbccea3b339af92bfe72c5f598f42", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713203763, "uuid": "fcc660cb-2a97-4cd3-8900-a71e1c7d8e49", "value": "T19C95334AC2AD3152B5F304FE36BC0F9133A1F6D82A7806B8EF5EB50717947684857A1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713203763, "uuid": "7dfcbe7a-9700-4ba9-97ac-45310c53e034", "value": "49152:aeBc8q0irrvgTuciLyGQAzJ6kk3DRlE9A:xBc8q0iZ0nES", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713203763, "uuid": "34ead2b2-6e3a-40d5-8589-7b5660050e0b", "value": 1890379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713203763, "uuid": "39b2361b-77bb-4c6e-ae92-4bf841a6531c", "value": "image/gif", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713203763, "uuid": "7d8a5a42-75b7-405c-bb7e-ca7c387e5978", "value": "dito medio.gif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a9eea55-fb64-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713211812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713211812, "uuid": "06682e9b-7c92-49d0-bc32-de5e94ee97cc", "comment": "Malware payload (Mirai)", "value": "47a3cd198841a92278604242d9762dbd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713211812, "uuid": "82ffaed1-418e-4824-a38d-5eaa0eaa13c3", "comment": "Malware payload (Mirai)", "value": "2637e4fb0e8d0003c0d250446f69e4c430a8233cb065c0075fa474c0608059e1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713211812, "uuid": "2ceff9f8-8716-442d-95e2-620da9448d49", "comment": "Malware payload (Mirai)", "value": "dd91a1149055efe7fa624618359532e9366ae15b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713211812, "uuid": "0f7704fe-c462-42c9-af4e-5cf247d80013", "comment": "Malware payload (Mirai)", "value": "bd6cb01da3eca6e4927a7afa5802fa4588b987c0e451b9d9bcd5c1d4686a15ad4bb53773ddb2168eefabd04579281960", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713211812, "uuid": "cdf8995f-4271-4df3-9b05-8d0c4df3cf92", "value": "T1E2431781BC819A27CAD423BBFA6E41CD3325639CD1DF72179D22AF20778681F0D67652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713211812, "uuid": "4d9d55b5-e5ad-4c18-848f-47526f6556e6", "value": "768:DYKsQTUCTIVwHw6hpFH0aflKmx7ESj4PgI82SsDp5/Cqo5MqZR2/NOPhhRp/fKI6:sKM0owHDpF/0Ebj4DYI/sR4KnKIo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713211812, "uuid": "36149de4-236d-4870-9715-51a4efda802b", "value": 57104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713211812, "uuid": "667e948a-1f01-427e-b5b3-3d3bb6c0e20b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713211812, "uuid": "492afd3d-6aa7-488a-877a-9505b0608d2b", "value": "47a3cd198841a92278604242d9762dbd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "394bdc79-fb76-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713219568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713219568, "uuid": "d018abdf-4fce-455b-8501-f0143c40d40b", "comment": "Malware payload", "value": "ede760a4c20a81d5daa34f23e9134c40", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713219568, "uuid": "f1c2aade-1c41-4545-91df-fd247c3d809b", "comment": "Malware payload", "value": "26f99094b2b3bc2f02da9002d342b25517d663a0d7ca06aec665a2311bf3630c", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713219568, "uuid": "7dc251f9-4b66-4331-ac3f-ce299e0284a5", "comment": "Malware payload", "value": "ffdae6420b46c07f84b36bfda9e54f147ab3386c", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713219568, "uuid": "dc53714f-c6bf-4995-88fd-b8ef10281722", "comment": "Malware payload", "value": "fd1819c3cd9f4be0ed9c5f340ecafe52defd197c9dbe15996adc5165d9e17a7197da400e111a9a4fc69472ffc769d089", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713219568, "uuid": "e35525f7-1217-4a06-8cd8-178624b88c94", "value": "T1C3A63314F3841EF9F8AE823D86A5D876A77374119764C69F4B7823700F039E2B436B66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713219568, "uuid": "b7de444e-76e8-4e9b-a252-4afe7263188f", "value": "1af6c885af093afc55142c2f1761dbe8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713219568, "uuid": "c7f7ee05-355c-436b-8d1f-a76810845fc7", "value": "196608:7hib8+7f5Con3dDTbLjv+bhqNVoeLSEsucFSEXIBHwa51PxRf0:c8g5CetHL+9qzTLSJHc3Hn5fRf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713219568, "uuid": "409eb7f2-e41d-411e-8773-45327499423d", "value": 10361655, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713219568, "uuid": "916142e1-7e21-498a-98e5-b66224853a32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713219568, "uuid": "13fe57cb-5207-4e93-9bad-b25c7d087279", "value": "ede760a4c20a81d5daa34f23e9134c40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a160cbb-fafa-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713166258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713166258, "uuid": "16ba502b-17c2-4631-b51f-ad6df21f9202", "comment": "Malware payload", "value": "a1540e487c10b7c2b10b085cbb381b9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713166258, "uuid": "4dcedd8a-0a6c-4d0c-b246-dba72714dc81", "comment": "Malware payload", "value": "29add7d75cdf20bc9fc0e8a86e444df9d9aa05c61950412eb0309cb36eb3adbc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713166258, "uuid": "ffca49cf-518f-459d-a53b-9575726ab56f", "comment": "Malware payload", "value": "85f2addcaa52ea9e8a893fd5c4cdd7dd5d979ce3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713166258, "uuid": "9510645c-0b09-4d9e-a0dd-8920364d831e", "comment": "Malware payload", "value": "b0dbf2a7eb93652e2bf79e1eb2c2d1271adcdadb7492cca8c962aa768c25ed0d97f49029c488b8ac16f49936ce9daaa5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713166258, "uuid": "8413a838-4668-4fc0-870c-26d691283843", "value": "T110456E41B480F3E8C51E0C71AB85AF72A8B9B5FB036E5585A7F50D1A9E20CD35235F63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713166258, "uuid": "a5a208e1-4ac5-46e4-a3a7-38767f2c945e", "value": "12288:oqDEvFoEqDEvFoyqDEvFocqDEvFocqDEvFoZ:oqDEvCEqDEvCyqDEvCcqDEvCcqDEvCZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713166258, "uuid": "18b3e394-65b4-4c93-91da-83f09e01e9a4", "value": 1167172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713166258, "uuid": "e7806fa7-ecd9-4920-9b36-a0e2fe8ea050", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713166258, "uuid": "e68b766d-9667-416e-b2a2-6862772179e1", "value": "a1540e487c10b7c2b10b085cbb381b9f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c65ec1d-fb69-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713213963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713213963, "uuid": "d50d3f07-d14e-455f-b652-ce7d24e93760", "comment": "Malware payload", "value": "2a717ffc1021442bd1091fd2b9a53a10", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713213963, "uuid": "cdc27c20-beab-464e-9cc3-6802e89e2b96", "comment": "Malware payload", "value": "2bfbdcbfb1f1fc1c0d0dddd6bd6cf0d9182ea6993b34e9438af0a10162ecee6c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713213963, "uuid": "c42c04ad-8140-4f00-97d2-e45e1b6ecefb", "comment": "Malware payload", "value": "36451b5aa1881f2ab1f819955079bff2075f6240", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713213963, "uuid": "96764e4a-20b6-4392-aa4f-b44d4c850152", "comment": "Malware payload", "value": "1bf952c5dd235b38f0f8ed71e0ecba9378dae26c387fa6d66d025784874c8d8a9f8ad4672532076f0875e22ce3527a6a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713213963, "uuid": "8fd7d5e3-04df-4e49-be1e-bbc789b9468a", "value": "T164C48E2174E081B6DDF221FA02ECB53641ADE4F4075566CB17DC0BFAE6306C1BB3669A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713213963, "uuid": "cd8accee-bdd8-41e4-8d20-211df162c4fa", "value": "0888aecafc5029669ce9c3a92f0aa565", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713213963, "uuid": "8d3d0025-5834-4a93-a5e9-4d833e27cfcd", "value": "6144:MRs2DA1oDSw/2zstStobPwQvKUeBG8uyqduJ3Y+uHwqGK7Yxqp:Mu2ewSzzstSq+uyqANY+EfGAhp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713213963, "uuid": "9b3dc59e-a8ef-455c-9d77-56a7020440a8", "value": 594944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713213963, "uuid": "c0d48df5-4412-4175-94c5-735444b64757", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713213963, "uuid": "f77981d1-78ca-42d4-8fa4-e7f84eea3347", "value": "2a717ffc1021442bd1091fd2b9a53a10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1e43716-fb2a-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713187128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187128, "uuid": "2ab5715b-01f3-4d5b-805e-d3afc9e34769", "comment": "Malware payload (AgentTesla)", "value": "2cb429d144a84ae31ac8ecf48fa862fb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187128, "uuid": "6d0cc6ad-3740-438e-bc08-fbc4fbc77b3c", "comment": "Malware payload (AgentTesla)", "value": "2c06313c7db4b165b18717a7998239c5e64a9ddfbd7f3b57fc5cc11a973ac07f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187128, "uuid": "8eeb4219-7e45-4909-a374-7891596ed132", "comment": "Malware payload (AgentTesla)", "value": "379f1f62d047fa603ea0b933b526ed8ce9388be9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187128, "uuid": "7fb79f1d-4dcb-4a11-88a0-c46cb5218b09", "comment": "Malware payload (AgentTesla)", "value": "312c378faa54ded7fe8ca231971f3f9103f95218c456a431c831e76f9b66d733479e367ca2198683425616e607bb02c1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187128, "uuid": "2609ff8b-afda-447e-afc7-b813cd4bec13", "value": "T11DF412007679EF33D6BB6BFD183658A00B35367AA054E34D5CCA20C626A9F425B90FD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187128, "uuid": "45efdb32-718f-466d-9ce4-f224f11785a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187128, "uuid": "08c7e2fc-3e29-4f24-a877-50b8f2a67ea0", "value": "12288:FayNBwyr2HPWyd3eOC6hcO+JeQB9B279Avons1puKUoeRSs39:IyNCyrePWceOC6P8v844oer9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713187128, "uuid": "28d1afce-f639-41ec-98a2-58fa8373f95a", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713187128, "uuid": "7bbe9985-762c-468e-a95a-0942e95f5cee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187128, "uuid": "0396e017-6233-458d-b10d-dce1b1a62006", "value": "ungziped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aa09241-fb4f-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713202900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713202900, "uuid": "11295e44-9192-4eb2-a8a8-4cbcc500e1b1", "comment": "Malware payload (AgentTesla)", "value": "a17c89475866e9e4e24f39258622fee8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713202900, "uuid": "753bf6b0-7e68-4454-8de2-8c20297e7229", "comment": "Malware payload (AgentTesla)", "value": "2d1c64598140082e07e53faa378e281d001fd28013b4f89847d4ee238f4cdbf6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713202900, "uuid": "0a8316d5-77a2-4f04-8e1a-071e5239f60a", "comment": "Malware payload (AgentTesla)", "value": "1a24b9642d60f9077813b83b8e53b05cb9aeeb1c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713202900, "uuid": "b2589bec-68af-4da7-b5ff-70514c6d3d72", "comment": "Malware payload (AgentTesla)", "value": "62699bce81029fbf37da35a5e70c9bb29caedf65ec778b5511c43178d1e77d0bc2e57cd9eaac0dcb28fb46f246be0bd8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713202900, "uuid": "f27994bc-214d-4eb9-939a-b920e03fc2d9", "value": "T198D423ABFEB8B151283A0C5DC781CE4C8591B4B945A2C5370F92C9B4233D5DBA36DF98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713202900, "uuid": "ca2482f3-308d-4238-b4a3-3f85a31e0332", "value": "12288:OmR9+xYLMzlwU5JIEP+4qf/ANl1C7etlmOT7GGdCh34XIcchyz5QsM:Oit0v+ANSy/maZPGQz5dM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713202900, "uuid": "c21ed476-da22-4563-9983-3d103b6cfc61", "value": 642253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713202900, "uuid": "a28aeb92-1453-4193-89f3-6f472c9e3366", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713202900, "uuid": "8ed61dbf-5290-436b-885b-e59d54448706", "value": "nRFQ 20838 %28CMC.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4363d67e-fb33-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713190808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713190808, "uuid": "0debb423-a9f4-4579-bc2f-d7e91609c2c9", "comment": "Malware payload", "value": "1b5e5aef92ec2abee4ead163588ed5f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713190808, "uuid": "dfbb0f08-6283-4300-ac83-2a8c25fa9780", "comment": "Malware payload", "value": "2df04adde08942d591c44448d6ab2e5b228735969297508eff68e44c39beb934", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713190808, "uuid": "9dcdbad8-0b90-4833-8a76-f49fd6e821ae", "comment": "Malware payload", "value": "c98114c141986f6bed377eedf93bd6bb29878aef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713190808, "uuid": "0c449907-2f42-4fbf-ac80-f921cf97a506", "comment": "Malware payload", "value": "ee55c6c8e3acc6b669ecae87547ec247e832b8d4de7fc7b8dbc0c97c74bff35879573f5af69c998acbe8bef531005cd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713190808, "uuid": "7b4421fe-cd98-4412-83c2-019dbca8829b", "value": "T19A33BE60A7E80AA8FBFE0F71AE7229504D3BBE53AD50D65E118C110C1536795CAB1F37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713190808, "uuid": "472ca577-dbbd-4a3f-86ee-1b25513d52c0", "value": "1536:KkrWoQp4AIQO6Lr8KHZvLiowOszHJk+1uKg:KkCIQO6bH1YTzdUL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713190808, "uuid": "9714d9a8-02ca-41ac-98c9-3a51537ef31b", "value": 53248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713190808, "uuid": "d17a4f84-0c9e-4400-954a-39a453d1381b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713190808, "uuid": "5dcbb827-cc40-4828-baf4-4f55f72e0a8c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "076da01f-fac0-11ee-a120-42010a9c002e", "comment": "Malware payload (DCRat)", "timestamp": 1713141316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713141316, "uuid": "b4b00642-5f64-4f68-b926-16053d095287", "comment": "Malware payload (DCRat)", "value": "2384855ef566166e75c9ff240764b204", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713141316, "uuid": "5e621540-c622-4d8c-9d69-14a3c2d9ceea", "comment": "Malware payload (DCRat)", "value": "2ec983b4653f6a5ee028e9ecfa37d8cf2404a10e9691bb8ed39023be643ef55e", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713141316, "uuid": "8fb8d735-719a-454b-9759-99eecb6e9195", "comment": "Malware payload (DCRat)", "value": "c526437c83271c8b61533894b5eaaa693ab09295", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713141316, "uuid": "65ecdfbb-e193-42d9-8a02-58446b634ac3", "comment": "Malware payload (DCRat)", "value": "5c0f358250e9651cadf8e9182a55c1b5ed705cba83d97b0a91dee6f9371fe8f979bc6b4213973a720002d0ec32e203f5", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713141316, "uuid": "42b7afd2-399d-469b-b87f-77d2a992f5cd", "value": "T18456D0B5D3C9CC79B58437229C9A5CA7E8447D2F651830AD3EEB4C8AA50F3F97920463", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713141316, "uuid": "ad1b9099-8bfe-41a2-9ee6-9ae3b9e0d820", "value": "a9c887a4f18a3fede2cc29ceea138ed3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713141316, "uuid": "9de10bfd-ee37-43bf-9cfb-76d4fe19842d", "value": "98304:ECYm72m3liyEn7qZDDDTpayP8Vz1+qk01+dMvPg+/Z4F8FcwiXewZbCpXK:ECB2MVZPk1+g+dMvPgW08Fco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713141316, "uuid": "49bcc814-38e8-4ebf-bc22-0efd642cd778", "value": 5990400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713141316, "uuid": "0c43b6ec-64e9-49ac-817f-077dd2b8dcff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713141316, "uuid": "b2a8b2c8-3f17-4cc1-b374-9887706c2457", "value": "2384855ef566166e75c9ff240764b204.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "086c3dc9-fb41-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713196722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713196722, "uuid": "ac1ee627-a596-4fcd-ae21-9e000c5aa319", "comment": "Malware payload", "value": "2d21f2572b5683dc97717ca5ad25b18e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713196722, "uuid": "6f51a94e-8b19-418f-8a1b-f3d0aa06b90e", "comment": "Malware payload", "value": "2f02ff9ac9e6989aca7b56f7aa164d83e3c90df2c5b2d519de4da14944a53664", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713196722, "uuid": "122b7f0a-a88c-47e0-8d0b-08f1f11d3f27", "comment": "Malware payload", "value": "dbd72119a4b4ba5cc2deb62b8cde26d07a75c9b9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713196722, "uuid": "3b5eba85-fa6a-4137-ba82-8ffd5c9d656d", "comment": "Malware payload", "value": "d79b11238619baad66b6fe0f1e5c20445596338571196caf21082977640cbb07018239608a326221486cbc4bfb8625ec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713196722, "uuid": "e89c2f90-1f94-413b-a716-7ff5be4467fd", "value": "T15F834947D0649EB6C0976EB66AFB4A700323B8514B0B1F59722C9BF8074F9CDB94A721", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713196722, "uuid": "db662c3c-0344-42ae-beb9-3eb3e63a7621", "value": "1536:aGw/3IA6BJ6oYHEppfzlj1YQrHwCSRuALen+dTPWDzAmS0Tx7LHYjn:a9/3v6X6BKpHYQ7wCpALiRMmrTx/HYjn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713196722, "uuid": "7cd617a9-6987-4ca9-bf17-d35c98221a9d", "value": 88118, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713196722, "uuid": "2bc27bb4-2f28-4c90-ba33-f18523e68fca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713196722, "uuid": "715a8ffa-4ba2-4c10-a4de-99590a146a2f", "value": "2d21f2572b5683dc97717ca5ad25b18e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f698df3f-fadb-11ee-a120-42010a9c002e", "comment": "Malware payload (DCRat)", "timestamp": 1713153313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713153313, "uuid": "0e535308-d2d3-4189-9192-6a016121c00e", "comment": "Malware payload (DCRat)", "value": "07a65a281e3a31b89208977cc737f326", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713153313, "uuid": "e61d3b96-507e-4e4a-a2bd-b10e104efc8d", "comment": "Malware payload (DCRat)", "value": "2f43a0237a11941dce64aa7d4608b0eb0210487af9ff9d1d8823b0a0d8cf9812", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713153313, "uuid": "16e6a45f-ee71-4269-8b24-5a0076a79e7c", "comment": "Malware payload (DCRat)", "value": "fa8c80ca064c505bc2de5b03ee146e4b73a1e9ff", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713153313, "uuid": "25a47ee3-2daf-4add-90d5-7cf4ad6c9219", "comment": "Malware payload (DCRat)", "value": "3e588b4c134ea987cfba71848f3a045a60339807d011ea907571b34ee48b84aa77b3b25806d7b86dfe3cd2b59bb32fd1", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713153313, "uuid": "17f5c9ab-19e1-4b62-97d0-832cac38b494", "value": "T11D06F11A65924E32C3A41A32C697153D52A5C73A3512FF1B351F15E3B80BBF29F622B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713153313, "uuid": "1d7683d3-a0b1-4aac-8e6c-00809718eedf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713153313, "uuid": "1edad8a3-09b2-4fd5-8ef7-3abd7b49e34f", "value": "98304:EKeCKC61rXOw8MWg7HIuBJwLPczPbLMjkq8nUSC:EKeCKCkOw8y7H3AcLq8US", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713153313, "uuid": "76bec76e-836f-41ac-a41c-9835b78d3dc2", "value": 3701760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713153313, "uuid": "6afc641f-3f25-4cca-bfb8-6523d53fc711", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713153313, "uuid": "3e4a867d-45a9-4292-9e3f-220ab52f9a9f", "value": "07a65a281e3a31b89208977cc737f326.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca151b1e-fae8-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713158822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158822, "uuid": "d5b44f51-783d-41dd-ad15-e89330654a39", "comment": "Malware payload (Formbook)", "value": "9ace1a7da8b9a7e7bee7e7ac97b7d3f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158822, "uuid": "b36a7c3e-c207-4dd5-9f5a-0c54efbdbd98", "comment": "Malware payload (Formbook)", "value": "3003d6e6c58def2f4857cac3e566049f95985bced0b50a6ca537b493bb72de73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158822, "uuid": "d15deab5-208e-421c-846b-ee8ae7346c02", "comment": "Malware payload (Formbook)", "value": "ab2437e9b1e3aa8fa7d1850cbea10330be70e6a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158822, "uuid": "f7b2b313-2b18-4956-9fc4-49e3a304fe64", "comment": "Malware payload (Formbook)", "value": "ddcafa0520eb1ad6fe3def4585b11aeb10f8e8bd4077cd2c0ecbcd66f8442528c2d868efaba2aac36249422f69cb2f4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158822, "uuid": "8b9fb443-a299-46a5-ab23-a44c0eda787c", "value": "T10EF4234072BCFF63E26F5BF8543864910B30769B786AE6C99DD990DC2895F408AD0F4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158822, "uuid": "e8e8e274-2f15-49b7-a10d-0329634072a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158822, "uuid": "626ea7dc-e637-4557-a055-abefaaa09a07", "value": "12288:BjoVNBAt+h2QdoWNeuMvIqG/h4B+wKKkISjchVvl7f3TtoQFnqikR:WVN+tBGocyIqGqn5+697f3Tc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713158822, "uuid": "ef879721-195a-4940-b242-a90f144d5988", "value": 725000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713158822, "uuid": "53b071c4-bf91-4826-a45b-e3e530107d9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158822, "uuid": "587ddc05-fb28-4ef5-a252-6bb44fbc379c", "value": "narud\u017ebenicu 0BH2024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80072c7a-fb5f-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713209808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713209808, "uuid": "20c1cf23-6de5-4ca9-92c9-538c027eda76", "comment": "Malware payload", "value": "3d3fce34e2092be6629eb75cee97ec69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Ryuk", "colour": "#C903C6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713209808, "uuid": "da9fead9-1a94-4d2e-96e6-ac6cbbe5d517", "comment": "Malware payload", "value": "302fa0883fe21e4d0b56c68574a8073edb05b20325c41ea41e6d4e4005d0f9e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Ryuk", "colour": "#C903C6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713209808, "uuid": "fbc20b50-208d-4fc4-a822-5a903fe4bc84", "comment": "Malware payload", "value": "be425af8cb93f58058d9bfb5ca71c7d0b6ba8672", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Ryuk", "colour": "#C903C6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713209808, "uuid": "a919af75-3a92-435d-9ae3-3802e6d1b862", "comment": "Malware payload", "value": "e2773df059ef4875fa225ee9f07b18771052e0ba7cf2650c7987f2ebff51930f20187fff8f4b733630579f84e6ef80e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Ryuk", "colour": "#C903C6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713209808, "uuid": "6fe71961-5f99-446f-9daf-219e1ec11e56", "value": "T1D9357C0AB36505ACD567C538C9278A07EB72B49A1731AAEF03D086392F237E55F3DB50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713209808, "uuid": "cb23ff13-cdaa-46ae-a6f7-81b0d32bb358", "value": "c067401cbd3f126f1190c6fb3d8055bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713209808, "uuid": "fa21e142-d750-422f-a469-6100f9aa4225", "value": "24576:H49ofzs1dTWhVk+zBu7JY8wWyiklHNsSQI:H494Q2Ogu7JYGWlpQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713209808, "uuid": "128e5f56-2a49-4651-81db-65848f9f30da", "value": 1080832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713209808, "uuid": "c38782e8-0601-4c42-ac9d-31b8dc171d5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713209808, "uuid": "4a507412-43fa-4edb-a339-72421531cd47", "value": "3d3fce34e2092be6629eb75cee97ec69.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18b66412-fae7-11ee-a120-42010a9c002e", "comment": "Malware payload (IRATA)", "timestamp": 1713158095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158095, "uuid": "351d644e-227d-49ec-993b-3ea74c11f8aa", "comment": "Malware payload (IRATA)", "value": "3f776bbc39508213d2fc07136296f93c", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158095, "uuid": "25382a7e-2587-4780-8a91-21debc63e5dd", "comment": "Malware payload (IRATA)", "value": "31e538c9b8941a44cc711270e2f7dc38ff44760d16b788f25c2e177050217c77", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158095, "uuid": "be9f28a3-f15e-4084-bce4-93c242a8c4e1", "comment": "Malware payload (IRATA)", "value": "222a59e8de586ff7619be496612fe13489266690", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158095, "uuid": "129ff103-cd8a-4763-b74b-eab9ee595c9b", "comment": "Malware payload (IRATA)", "value": "9a02abe4ea95732eec53499100fe36b6af38952cd27317a349470a9bca1eed81a5886ff21894fb129f19ad5665af42ce", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158095, "uuid": "58a142f2-6ea1-4079-8cec-501fbcf19ddc", "value": "T133D52313F736A95BC876C1732904123A50125E298A57EB463A493BEE75FBEFC0B847C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158095, "uuid": "fb9bdced-ae3e-4591-b95c-70e669ddb424", "value": "49152:IomTakeKRfmyvhfhyXVxAsPkkvht3Srpc3ZOuQowNe0VuxeWYmAWJv0KWf:STPbmyvhpyX1kkZV4O3ZOu550Q4WDzuT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713158095, "uuid": "1bd8bbb9-a714-46a3-92c5-5792d87e0963", "value": 2866397, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713158095, "uuid": "b530b19e-2177-49f8-8753-ac9f87598d77", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158095, "uuid": "ceb013ae-eff5-47d3-b125-ed74c60ce3db", "value": "\u0645\u0639\u064a\u0634\u062a\u06d2.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21ab4289-faf9-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713165841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713165841, "uuid": "62de7795-5ec1-4c61-93d2-82e70e5f4b0a", "comment": "Malware payload", "value": "64f067242918d9dde41a1f23a8153ab1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713165841, "uuid": "7838fc17-ebf6-4410-a0e2-dd898e96bcd8", "comment": "Malware payload", "value": "33c4391bd061d561a37a0628d161f25bd59401b07ea06ddc16eb454714a61171", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713165841, "uuid": "20182315-cfb5-4db7-be02-7225595957b0", "comment": "Malware payload", "value": "b6a2b9010320fb74c209045e7df0e98c9853d9c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713165841, "uuid": "7c0b7afd-4c5f-42e5-8a07-c6dffee317ea", "comment": "Malware payload", "value": "6896f6251e9533eff703fd5db20337e1cd87d88391f11a59b3d8e0e2b2576c3e2ec7057a4cef98ba9bcc43f87f989bef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713165841, "uuid": "fbfadfc7-9eb9-4743-8558-93a4bb00a4c1", "value": "T14CC5331829BA94F3F9D3CC784892E573D9B02E598278E1C7E0D12F5F70C4A86B9B5709", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713165841, "uuid": "7f94e2ae-efba-4a51-9bcd-94893ddf2731", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713165841, "uuid": "4df067e0-ee51-4161-87b8-050f71c976a0", "value": "49152:9rm4L/YQCyJCxGlI9Jfti60zV+WkplEmv+xP2aIM17Ok3YdM/TOmW:Rms/XEJl+4rMxP2aB17hIO/TxW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713165841, "uuid": "39ca4b8b-9434-4ebd-aec8-2c1a7841deee", "value": 2532960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713165841, "uuid": "96aa3977-e5d4-40ff-88d8-98905b58176c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713165841, "uuid": "1a878cc0-3bab-4f09-b30c-9b68b0fda2b3", "value": "SecuriteInfo.com.Trojan.MulDrop16.31681.16839.11507", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91dd122b-fae8-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713158728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158728, "uuid": "59144e2a-0c45-47d5-aead-6d04c62a0076", "comment": "Malware payload (Formbook)", "value": "8b4c1f3a637b3efa0d3bc02cdc7f857c", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158728, "uuid": "df3dfd9e-8e53-4400-8ee5-892f2f37353d", "comment": "Malware payload (Formbook)", "value": "34245ac31eecce37a903c6f3c48c1cd9caba7750cc92d924e3ff95a26f252bb4", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158728, "uuid": "fa75bce9-c695-4bbf-ab23-a6fd730062e7", "comment": "Malware payload (Formbook)", "value": "9e0e40e561cab7c527e6584ebb3db34ba175e6a9", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158728, "uuid": "899b27b1-1394-4a5f-a3f8-84562bc950b1", "comment": "Malware payload (Formbook)", "value": "46fdd898819b174f8ab12a9f025def25e33234029a21adf2d3d14a2b0fabd6af76a74e814cb864d7993cd93e5579d5da", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158728, "uuid": "7cc1734a-9127-463b-b11e-a20232152ede", "value": "T1D7D42251EBF2E45BEBF7A3702CB3C61920B6B456D79ECB2E461CC115767222885E0B31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158728, "uuid": "682057c0-7bc8-4f68-a7a1-bcd8d163df3a", "value": "12288:8AomoQ++IEqTgKKqYYWd9Oj6JDS7McoAP4dNVuuAlxk7HT7V2:Fo0tiXFYYWzK6ZS7NoMly7HY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713158728, "uuid": "36895a67-4a25-497e-b2b7-9ac21b394678", "value": 625812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713158728, "uuid": "0e7ccf64-3dae-4f65-afca-2e2909540039", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158728, "uuid": "b6ef7287-38d9-40ea-bf91-34ac66e3c872", "value": "DHL-7654544CNT Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0b634f2-fb61-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713210722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713210722, "uuid": "4fcf8acc-6808-4288-a881-64f509795c97", "comment": "Malware payload (AgentTesla)", "value": "ee1238a4cc54b1a47b2068b695593341", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713210722, "uuid": "c3267d17-0324-4ce5-b5ac-8e41c7839926", "comment": "Malware payload (AgentTesla)", "value": "3545201f518bc9bc8e5150985cb204b4ab27128b5f8f977077abdcc1c9621450", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713210722, "uuid": "203965fe-cd29-4db2-94ae-ca555669fd1f", "comment": "Malware payload (AgentTesla)", "value": "3f1483f7e9ce8f8815367fcf9b1222aad4871e41", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713210722, "uuid": "ba4c436d-bd5a-40a3-be18-8ef8ca1b6a6a", "comment": "Malware payload (AgentTesla)", "value": "2284ca8893bcba1e8e740c24030c16d981246d631a983e58f532e359eecfb7499fc03ebdafcc112310301ef7dc46d783", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713210722, "uuid": "43e6ce0a-bb14-4e5a-9d90-3c96072c51c2", "value": "T1BE25AF65A3F95D2BF6FB4B7868B814446C3AFED97641D33C4054811E0C62B688EA13BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713210722, "uuid": "712ea155-cf8f-4b96-a79d-1d55e8e2a1cd", "value": "12288:7SW6GIm7CVh/tRukNp6MARWch8kLW2HFoKrRiu2niv2DZmEu3QIr8UK4tupjGujm:7SW6jdQzW2jViuRQIQUmpKujCCQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713210722, "uuid": "bb2faa68-1fca-4d44-89ff-271c1a936e26", "value": 980628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713210722, "uuid": "ae43b931-d569-450f-b7db-d0728d7b9fc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713210722, "uuid": "9db56fd1-7592-4768-94d0-70f3d05324bf", "value": "Transmiison Remit.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "117edef2-fae9-11ee-a120-42010a9c002e", "comment": "Malware payload (Vidar)", "timestamp": 1713158942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158942, "uuid": "8dfd3be1-5805-48f8-9c69-557d3fc7b52d", "comment": "Malware payload (Vidar)", "value": "e711af31f46952beac53b3c25dde5e9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158942, "uuid": "5532be22-b83e-4f71-b58a-26391087e9ef", "comment": "Malware payload (Vidar)", "value": "3867daccc1b24b18c85e32326062ab84b53f3ef78a000966a0e0e95c40a20953", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158942, "uuid": "a7b34d10-786b-45d0-a83e-f3664847b00a", "comment": "Malware payload (Vidar)", "value": "cad932a4e2b204d39cf0458fc727875e7b7f31ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158942, "uuid": "586d3164-b480-4044-86d0-8740de795972", "comment": "Malware payload (Vidar)", "value": "57caea0a755eeec28677fb08ff2e978af75bd1448db91061027fd9f1d9c55697e51df9b4f3357ad720af2ff69e661c4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158942, "uuid": "e22057e2-566b-45d9-b652-6738107299d9", "value": "T13864AE0272D06871F53387729E6DE6A4667EFD614F697B2B374C4E1F05B00E0E622762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158942, "uuid": "d325ef0b-7a25-40eb-a27d-cf9cf35b0d97", "value": "e6697f156c41f7600008dc14374fb4de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158942, "uuid": "0688d3de-3dff-4f57-bce1-86b7d8d52ffd", "value": "6144:yjdRoqfHRhWERXhVjGFpWOxd2BTub9l/:Iddf3WyX+xd2Ba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713158942, "uuid": "f1e87e8c-9a05-4fcc-8c02-99b207d6d532", "value": 321024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713158942, "uuid": "c56e6f60-32ba-4106-b89b-93cf62bf6887", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158942, "uuid": "dcb0d4ca-546f-4415-a8d9-ae4ad3d63f8d", "value": "e711af31f46952beac53b3c25dde5e9c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac36abda-fb7f-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713223626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713223626, "uuid": "78b4b4cb-188f-4cf9-8a58-a13b4742547e", "comment": "Malware payload", "value": "df1847152e31a2c130fc66eaf49e757d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713223626, "uuid": "5ecf9d2c-e87a-4dee-a3dc-fb2a24d37b42", "comment": "Malware payload", "value": "39d953c3a7a07ccac490d3286fe0c1a079fa2e5041bdc9bc74585b5beae6de7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713223626, "uuid": "53c881e7-c5b4-4d2d-9e04-ee6b24e4ed10", "comment": "Malware payload", "value": "9c248387be405e2ecd929069395a2c6da9c10745", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713223626, "uuid": "2de3781d-2051-4c83-91b5-31575612b335", "comment": "Malware payload", "value": "cfb0f12ccf3ab578f1355fb475ed2cd1eb89b69b4c22caa6b859a568853f4242a04097649bd6d5c00750d89d864e17c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713223626, "uuid": "19d0b8b3-57b8-48c7-aeb3-9a5a18130c33", "value": "T10CE42311F2A99366C57E87FED832912917F1D1360E79D3868DCB70DA22E3B018665F0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713223626, "uuid": "2eb2cd4f-93ce-4e8f-a751-b9ff95db8757", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713223626, "uuid": "7db3f8d5-2ddb-45aa-87ca-fac67116e465", "value": "12288:2aAvUzT370OQfOCFjiXlXJUOVZNyWRfCiivEg1yJ/2DKMA+IJKRSjk:2TTm1XJUOV3yU7ij4B2DKT+xM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713223626, "uuid": "f952817f-c213-46c5-83a2-0d3e9b543626", "value": 694784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713223626, "uuid": "2fef090b-8085-48c5-a1cb-5c7d1d42fc42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713223626, "uuid": "c392ddd7-a0ee-4b6c-a90c-4455e4714292", "value": "SecuriteInfo.com.Trojan.Packed2.46654.20750.14267", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2b7c310-fae7-11ee-a120-42010a9c002e", "comment": "Malware payload (Vidar)", "timestamp": 1713158380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158380, "uuid": "9a4f2a97-e28c-40d5-8105-e48412f8c262", "comment": "Malware payload (Vidar)", "value": "ec77667bbaa89f7a34954eb93ab214f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158380, "uuid": "8825445c-2a15-4547-9a92-83e6f6452dfd", "comment": "Malware payload (Vidar)", "value": "39f3698e7359c0a93122897138c050ecb0b71d71843f68ba8d05a9ed7e7cb67b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158380, "uuid": "0334ca93-caf3-4a61-8f7d-12ce16866812", "comment": "Malware payload (Vidar)", "value": "0c87141e4c8a050d4ed47b67486d33b72db8e63a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158380, "uuid": "15e96187-f7a4-4fd6-abb5-53bf734bdd1a", "comment": "Malware payload (Vidar)", "value": "4d0ebe4524b89bf6d050eb050c3a2f12656e26bf794fc92db615c6aaa57ccf0a2442d7063506dbdff98e2f705fab3cee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158380, "uuid": "a29b9e99-38d5-4715-ba49-832d84893c9c", "value": "T1AC052382E184C8E2ECA35972153583265FABFD5185E2CEC39310FA50F673BD6560F62B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158380, "uuid": "322b083d-a2b1-4243-ae4d-f50e61b5a8ee", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158380, "uuid": "88d188e4-d73b-4339-86c1-de2bb7dcff22", "value": "12288:CfLpJp1IsmfvFA+UpdeM4ImXbbBxlxSlDJ5lLv6xwMmzPZEwzwQJPhU8kfh8:CfL7p1IsovFA5vxMBxlxmHVdz1nrkp8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713158380, "uuid": "0f86e92c-75a7-4d35-8499-6962366bd504", "value": 795910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713158380, "uuid": "57d7be8a-9f8e-4f9d-a8fb-bdcfe4d0ae9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158380, "uuid": "2b251897-2c6d-47ae-982d-fc6fdbecdc99", "value": "ec77667bbaa89f7a34954eb93ab214f3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5ca3c2e-faf1-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1713162680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713162680, "uuid": "a302d0fc-c395-4893-9dd7-f2bafdb8129f", "comment": "Malware payload (RemcosRAT)", "value": "b911aabed5c23d6b6a81b73b3f9ea276", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713162680, "uuid": "85fce1c8-c092-4d41-a52e-38cb4abe5bd3", "comment": "Malware payload (RemcosRAT)", "value": "3f53f3a28e79ea998d4409ec60aaac2211eae583d9ac88c937853937f7f0cb4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713162680, "uuid": "fe8308fb-6078-462c-89ad-34122234cd7a", "comment": "Malware payload (RemcosRAT)", "value": "d59284a247ffca56696cccdfa211b558d30e92ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713162680, "uuid": "a07a7554-8578-4536-a7c1-567fe7460f28", "comment": "Malware payload (RemcosRAT)", "value": "6d398ccc215e40d5bbec3e0c36d92e04b57982b03b52e6dc0f1248583d85631d9f39ef7df6425867871128784efa9c31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713162680, "uuid": "14ff3574-335a-408a-bf9b-f154654c704d", "value": "T1C0E4E03B2C21744DFEC61C3B66297AAD52050E0C7EE97F635B4C7A48F2B36198A43D58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713162680, "uuid": "dc89de47-8293-48ef-a243-52b99177f9eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713162680, "uuid": "ba75c33d-8e1b-40c8-aa12-53f05e63aa9f", "value": "12288:UAQWqVKyqeiBa3gNGkso1egplA5ZaWR1JEEQSHQO9pdgxxIhDVy:U/Vtq/Bawxs6egpKnaWzJ79QAgIhg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713162680, "uuid": "3ab9ba6c-78c1-4907-9ecb-f1ec5df84dbc", "value": 668672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713162680, "uuid": "721bf585-bac4-4a81-a6b5-5acd18a29903", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713162680, "uuid": "19345de2-ffe0-469d-b230-30dffd4a9608", "value": "QUOTATION#30082.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "180bd4ca-fb66-11ee-a120-42010a9c002e", "comment": "Malware payload (VenomRAT)", "timestamp": 1713212640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713212640, "uuid": "596cd809-c3dc-487e-bd86-c26c89fc0718", "comment": "Malware payload (VenomRAT)", "value": "28de2826893ab7e1f2c97521e8fb8ef7", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713212640, "uuid": "5287af13-954b-42f7-8342-fa77138e2c41", "comment": "Malware payload (VenomRAT)", "value": "40949bfd50832f026a1f9f6797c0bfa1f8b16698188fc42ca06b04340ba562c1", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713212640, "uuid": "3df9250f-d672-489e-91d8-a009e2f2237d", "comment": "Malware payload (VenomRAT)", "value": "50a03746f808599f6ea91b176bc1621c21911eeb", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713212640, "uuid": "2cb9d585-71f4-4320-bc87-3f903276fd7b", "comment": "Malware payload (VenomRAT)", "value": "5c844c14a9356bc14342a68322043a2b066b6e2bcf97b7bbc4acb8b4e30933dc63c71458eeab1570ff879c064fb0e728", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713212640, "uuid": "55d43edb-466d-40ee-964a-c9f4827ff44d", "value": "T10A53D15135540AA37DF7C728B23B8CBF52637F80A38B357D0934CB994B2A006AA16DDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713212640, "uuid": "9d7f58aa-0570-4bc3-84e3-7604fa1dee87", "value": "1536:NkwiNwg9/Sdqu+PZuFehHoCWryzg8jLVJTMdqEpo/LBfG:PiNw60+PZu+ICSXGxJTE8VfG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713212640, "uuid": "9791a497-84c9-451d-89a4-b058034ef289", "value": 62485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713212640, "uuid": "420c00ab-1b87-4bca-9b02-14c7bf670a26", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713212640, "uuid": "faf515ed-7118-422a-b1d8-d0103a2ad3be", "value": "xxx.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4ee25cd-fb01-11ee-a120-42010a9c002e", "comment": "Malware payload (PrivateLoader)", "timestamp": 1713169551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713169551, "uuid": "74e45e55-6b06-4f44-bbe8-4556a8cada0f", "comment": "Malware payload (PrivateLoader)", "value": "be94b480184550913c269e35a13ad28c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713169551, "uuid": "c048075b-6406-46a8-b72a-4126e64e15d3", "comment": "Malware payload (PrivateLoader)", "value": "40e1c85adecccc0d02b09681a421ba0457962bfd1a035a5bd234ec13c55ad2f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713169551, "uuid": "5b55d503-65ca-446c-b007-9489a2b529b9", "comment": "Malware payload (PrivateLoader)", "value": "57c2f9cbeb17f80a540a6aeafdd61f28443418ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713169551, "uuid": "3d60286e-6056-43c3-9d24-7a7bb2b2ec1a", "comment": "Malware payload (PrivateLoader)", "value": "53d0b1b1b3da4b314dc842aec82133703ff2525a0e84cdd372978c6f6519beef5ebb894f20f6bad96bff0346141883a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713169551, "uuid": "6b7fd57b-57a6-4941-a65b-ca8295b89787", "value": "T125566CA7E7E6365FC47DE4F28102766E8B0EB8554F35F88758B5A2348A6FD0CA20C741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713169551, "uuid": "50fa405e-1d76-4f72-a756-25e86e3d6fcc", "value": "bedb96d8a71f9004abf64308e680fcb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713169551, "uuid": "08db2349-1a13-4602-a791-6d734085008b", "value": "98304:mkpa5UKdCrbpaah6k5u6yA6nE0w5jjvjjjjl5S/hdIOrd/ClFkydIy3rBld3:m3fdCxaah75uUSw5jjvjjjj3dOr5TLyF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713169551, "uuid": "9f12eb42-d3c1-4b4e-a12a-7550b2f6504d", "value": 6132736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713169551, "uuid": "523ef80b-b299-4711-91d3-dfd61fa4f83e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713169551, "uuid": "2beef197-f3f0-47d6-ae62-028ee3936fa9", "value": "SecuriteInfo.com.Trojan.Siggen28.25504.27914.23637", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d3fbf8c-fad1-11ee-a120-42010a9c002e", "comment": "Malware payload (Loki)", "timestamp": 1713148815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713148815, "uuid": "a45e293a-435d-4088-9942-d905d676cb2e", "comment": "Malware payload (Loki)", "value": "7366fe55f804decd140f2f09dd2b8e9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713148815, "uuid": "9175c20b-4098-4d1c-aa0e-656c3811c853", "comment": "Malware payload (Loki)", "value": "43c9d2ce7dd27609316480a0995af447903a6c9bf6dd64e4ff2ae666062076ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713148815, "uuid": "3519b39c-cc24-4d15-8d0b-fccbf38a9b15", "comment": "Malware payload (Loki)", "value": "dfcc22167c3ad24d1def8f2c19dce63643d40113", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713148815, "uuid": "e3d7dab8-4739-43a0-a8af-25e1db12d6c5", "comment": "Malware payload (Loki)", "value": "b81e5e89f7311c22b2886b04f0ad0546ec560637e14d7df351c0a53bddc7a87431ced397d3b0c109f2a5a5e5065e6459", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713148815, "uuid": "750778c1-7d86-4d6e-a5a2-6d4ee1ebf993", "value": "T1D9D4124032EDEF23E7B627F25874144207B473ABB968E38D5EDA40D91950F854AA0F9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713148815, "uuid": "e365fefc-f0c4-49ce-be96-cf10da6775af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713148815, "uuid": "4fc9a82a-9011-4790-bb04-80e88aa6a8f9", "value": "12288:BHMNBhncmaAXrCIlve2pjkDO6uBZwlIs5bhq7ckR:lMNdrCGeCgvuBKGs5b4v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713148815, "uuid": "7f5025bc-8bd7-484f-99f6-2d58d6a34b92", "value": 632328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713148815, "uuid": "5d311a0d-bd57-4907-b6cc-048c23df661e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713148815, "uuid": "f1f65668-4444-438e-991c-45b08a41a389", "value": "DHLAwb#1294404291.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2196af45-fb33-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713190752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713190752, "uuid": "6f17e4be-bf04-4606-bf89-eade8272f2b2", "comment": "Malware payload", "value": "a5e4bdcb9e4e4e5f84bbddd18e4750d5", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713190752, "uuid": "8183ef08-8972-4b27-84cc-4fd4fd6eefcf", "comment": "Malware payload", "value": "44a45c396516a3f2705eaf9751a06d346fcae1864f5521356349ce85e78fd386", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713190752, "uuid": "e0719c2d-216c-4418-b99c-478e58d583f3", "comment": "Malware payload", "value": "a57a3e0dc8be0ae96dc0d116da65c2ec2fb1262f", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713190752, "uuid": "d595c61a-06f7-4b9a-be6a-f6b2d57c4504", "comment": "Malware payload", "value": "7e4fa3935b804193723b37dc545f70c4494d40b7b5a4a43f28936eae1bf83d1f469ef978e8ba8de0c4d96c309b620524", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713190752, "uuid": "7def052f-0e54-486d-be27-8ea3c5a5836a", "value": "T179C217E3678807EDA6944CE94218761794F6D17B3C2E228DEAF25653F43EE20F825770", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713190752, "uuid": "1170756e-f279-4455-aa61-1868969cba82", "value": "384:98jGqHqP1oXLTGvZfBCOjOua26jeaXeWoBNEYHnNa471Iw8CLD8ZsnaNc:69bpASoIdMDja6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713190752, "uuid": "bac04bff-f9db-413b-a7e4-81a00637a127", "value": 26002, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713190752, "uuid": "e3ec4ebd-012b-421f-8a5e-0006926f87a2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713190752, "uuid": "c6da0ce4-a6a2-4dae-b334-cf0d13c46e1e", "value": "tt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd71848e-fb35-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713191899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713191899, "uuid": "16b4099b-f32c-4e43-9da4-8d384d2b51a9", "comment": "Malware payload", "value": "a588d2688221b50307a7f32fafdb2304", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713191899, "uuid": "64e7829c-82b3-4e60-8ff9-04771ab16a76", "comment": "Malware payload", "value": "44d1220e445a21163775f598a6e61a0c34029284241bcc0388fa2199a8a9b15c", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713191899, "uuid": "91556cdd-1a2e-4b7a-932c-4eb14da320cb", "comment": "Malware payload", "value": "8e8833dad664a83192eae32e33cf8e4694c97bd2", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713191899, "uuid": "9423e392-f82a-4d90-b7c9-bdd20c600839", "comment": "Malware payload", "value": "ae127f2b4ca89fc76dfc660e7d68ed788740125eabcd5bc0b43cc34df07d1e5d9c2ac70191be4d25663cda234c03895f", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713191899, "uuid": "a24fbab4-e236-45a3-b5a9-f97874fb45ad", "value": "T16CE533FABD6140E03D6628F9CE42B35AD587CD65EBD6430A82055AFC8E9A31C1CF50BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713191899, "uuid": "dba3cf5a-02e0-4635-8ca8-8415d5cf80fa", "value": "49152:TQjdJ+pkkdXSG/fGyTL7fhNnn4fL62XBh8BXzbFcb7Wagv+SiGVcsbMWsrVxlwBi:T+okmXScGGbnKL1Bh+XPFas+SPbbw5w0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713191899, "uuid": "b98b8bcd-a1e1-4976-9c43-a63a0fa9afb3", "value": 3103109, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713191899, "uuid": "75f3a44f-1e4f-4514-987d-eba2e6849a8d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713191899, "uuid": "c25b48e5-6495-4f80-b831-f339cf9c483b", "value": "Register.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "719ac249-fb00-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1713168981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713168981, "uuid": "47227bbc-dfda-4f56-982f-ee83d36dadfa", "comment": "Malware payload (GuLoader)", "value": "3b79e70738ecf345b76c480871eae21a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713168981, "uuid": "be382550-e9e5-47c1-9e7e-c5c50244ec3b", "comment": "Malware payload (GuLoader)", "value": "46ccb3436fbd93182c0196510c4b8451e539560d2d68e1338db7720676e0b637", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713168981, "uuid": "b776dd3b-e851-4f95-80b1-560fdf335959", "comment": "Malware payload (GuLoader)", "value": "59d757ac2f00110c674cba53cdec00bba551b31f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713168981, "uuid": "85011b71-f981-432b-8626-d916ba701a10", "comment": "Malware payload (GuLoader)", "value": "a568c1f7c3b0ed24748b3661fabd477f44d012e7cee61f9c7c89dec7530ae35f00bb6738733161d9b9828b6ea5205de0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713168981, "uuid": "b76c97c9-437e-4cc3-9857-6a98c940a3de", "value": "T1E2051250EA88944FC852687049ABFF38F2ECAF133E02CD6767563F6FAD3C549950A502", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713168981, "uuid": "8284c4c0-06b4-48f5-883b-98b4f04fb8b2", "value": "076b06e6a65c9b7cca5a61be0cd82165", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713168981, "uuid": "14c924a5-d50a-4cfa-9849-762156a2234f", "value": "12288:TOyBItc6cCKcKub6fD0GPlZY9urv+Uw/8zXIn1Z7OuintP2iYZ367TCIhhDu:5W2zaKuk1PCuCrUzInOnCyh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713168981, "uuid": "1362644c-3e3e-4ddb-9289-52f98297e0a3", "value": 795541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713168981, "uuid": "8ab8b0dd-6327-47c8-841d-c0d2ba79853c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713168981, "uuid": "28445256-9386-48af-babc-cea193abac71", "value": "zamowienie_002523.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad741971-fb2a-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713187121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187121, "uuid": "508bef60-e20f-4ee4-8f2f-a43772d6cb0b", "comment": "Malware payload (AgentTesla)", "value": "39da1005b4c719762452347ad9605155", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187121, "uuid": "75430bd6-73f6-4c4c-bea6-7186a0233f52", "comment": "Malware payload (AgentTesla)", "value": "46f903112e133bc567c54392a876d768001a1934e75d17ce219ec41a1063d1aa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187121, "uuid": "47061e71-4fac-409f-8709-cff3262868e8", "comment": "Malware payload (AgentTesla)", "value": "c6cbe18872d202cbd1aa7a2d0b2e2d163731aebe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187121, "uuid": "bcf41f5b-07fc-4bc4-bb61-f73aadc6d433", "comment": "Malware payload (AgentTesla)", "value": "8a63d51fba6c7b33dcba151273d8f94974503290ea86db1f3dc7a2d08c416fc5c1481698876bafcb2932e99b938d9b8d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187121, "uuid": "d80dc909-c071-47fe-b2b4-efa2e2c1ab90", "value": "T16CF4222472EDDF33E3BF6BF8887859104B7179E9602CF28D5E8680C91129F415A61F9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187121, "uuid": "cad305d1-3245-4b9e-8dfa-eaf313f9b882", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187121, "uuid": "cd4c9ce9-f41f-438b-a494-4331b32a8a4c", "value": "12288:nWONB6AqpLDakfduUG7KbkKQPfA7cXxDhFC0Wd:WONFkLGGIUgKIKM47ehFt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713187121, "uuid": "071b93a2-1225-4c52-a8dc-771b554275f2", "value": 768512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713187121, "uuid": "c77afb6e-2b77-4302-ba38-dacbb627d695", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187121, "uuid": "8456dc44-385d-4c9a-9c32-da5692957344", "value": "receipt-73633T36X90N.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "205ac0f8-fb29-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713186455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713186455, "uuid": "1ba33050-3fd8-491b-b8a8-bce00f40af86", "comment": "Malware payload (Formbook)", "value": "0484380429dab2529d7aefd1341b27ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713186455, "uuid": "0c4c7d8d-4eaa-4103-92c5-a4cb63e4c722", "comment": "Malware payload (Formbook)", "value": "48e27e05da2697751c4de6a8d5d32f9de30c5be86fd5c2263624f6be1e25ac87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713186455, "uuid": "37888389-d9e5-4b0f-9194-b01895b107bb", "comment": "Malware payload (Formbook)", "value": "e0ec8cb5b4d95ac9e2576a8d17b24a6a923d385f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713186455, "uuid": "b7797602-e6c6-4157-9c60-fc11de42575c", "comment": "Malware payload (Formbook)", "value": "9c402911e4f75c4aa9aefc8991cce76d769fb60f35c5b858b631639ca4dd4ebdc02b83c5355d4d75b4882d6ef3371c9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713186455, "uuid": "da75d3a4-a94b-4c36-91ab-bfa86da1fee9", "value": "T1B6B533596DC1476DD3D9C772BC4A2AFA0356EF2BA221D71F854C15224C04BE3723ABA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713186455, "uuid": "73f4c04b-5e58-4ec7-931d-e2e0fff67fb2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713186455, "uuid": "3304e2a5-c6d6-49f7-bf79-40d485b06fdd", "value": "49152:/cftm1uw9GCzlZJ/o3IZ7bjH+oLDlbwswl5Xhj1eyh5/:/SmFBlPHJ/XL5ajB9h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713186455, "uuid": "2273990d-19b3-4e97-bd71-e5651b5af51f", "value": 2306048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713186455, "uuid": "36779215-842b-4701-8ca2-fc03f99b9b0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713186455, "uuid": "a339377f-02b8-48e3-88c8-23be4362745a", "value": "Dekont.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fb31b2b-fb2d-11ee-a120-42010a9c002e", "comment": "Malware payload (Stealc)", "timestamp": 1713188171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713188171, "uuid": "0d7b5f6d-c35b-42fb-9978-ba7cccd5ad2d", "comment": "Malware payload (Stealc)", "value": "7ccdc641efe0d68558816f1f7f3487a9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713188171, "uuid": "ed35843e-5f2e-463f-baa5-c878e1ce9c9a", "comment": "Malware payload (Stealc)", "value": "4a36753681d3f8531aac9ea0fa363a30a9f323070395a197f579a595c445284a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713188171, "uuid": "f2652f5b-2479-4f89-be66-8a909f04c13b", "comment": "Malware payload (Stealc)", "value": "c63bb487f778e84c0cf14e909272ca34dc201731", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713188171, "uuid": "5b5adfc4-de4c-444a-881a-a3d0a851f335", "comment": "Malware payload (Stealc)", "value": "581c32f52c7d716c5b83ef906fd2fe9adba1a8042af7ced0bd0f252214a9849dec579e0ae1499badaba571a9430c5ec6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713188171, "uuid": "ede58fbd-44b0-4736-bf3d-b61c9d4ae70a", "value": "T1B7648D0272E168F0F67346324EAD8EA066FEFDB15E599F5B23CC491F05700A1D626B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713188171, "uuid": "2c157377-af79-4844-87a8-592ddcab532c", "value": "ec4b404d0de4b3477a6cb59791522c47", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713188171, "uuid": "c1cc6d6f-f0ec-44db-af73-77969b547bb5", "value": "6144:IeNCtWxtkZlLB7HMkCaOodcpl9hAQJOu8a:IsEWXkzt7HMkCafKcQJU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713188171, "uuid": "dc220642-63a8-48fb-8f1f-21af06641c4f", "value": 311296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713188171, "uuid": "4f9db2e7-1327-4290-9d77-c096aeee2f6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713188171, "uuid": "7df9a471-7637-4b05-8c19-4f23cbd968f3", "value": "7ccdc641efe0d68558816f1f7f3487a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e464198-faf9-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713165862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713165862, "uuid": "88e01a49-95ea-4e29-86b6-6579839a8e17", "comment": "Malware payload", "value": "20b40977bf8e122a8c255bbf834c508e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713165862, "uuid": "7982be07-3ba0-4c67-a9f1-734e7a84044a", "comment": "Malware payload", "value": "4b67e78d69a4cbf5a02b9f58a6c7b8cffae83e44962d3b714eb8320b1f2cf9bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713165862, "uuid": "bd124c16-b8ac-4ec4-822b-bf24b729f7c4", "comment": "Malware payload", "value": "040d50aa314019169c190b4776e0767e1748aa16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713165862, "uuid": "5fd01d44-b64f-4c82-8e82-cb7fb98ef5de", "comment": "Malware payload", "value": "eb882efb9ebef9905f8e40096b8c36bf624d10c594ab2ef9428dd9d5c2ee9db11c288f9850cd74140109ff8434260644", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713165862, "uuid": "13342054-d93e-4a85-b1c4-5c6f1415fd21", "value": "T11F6612D622D111EDC49BC138CA12E51FDA7F742903249EEB229CAA657F239E13E7D701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713165862, "uuid": "319d34c8-a326-4a3e-a728-81a86f77fe58", "value": "e66c49a07225d9021b12b3e7c693af31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713165862, "uuid": "5cd2c10f-3870-4138-a409-536831ea401b", "value": "98304:zzRK1KwMbUR67uRzxOYeQH69kfGhZnlRzmOpttXRB9miXiLBU5QvggIPOFep3JnU:zkcwJwu1OYo86Dp9maKKEgsOnb6D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713165862, "uuid": "4bbf7d5e-bbf9-4111-8221-8168ff42f83c", "value": 6648173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713165862, "uuid": "4b82bc20-1da0-4f4b-9e7a-a8eb6c8c5462", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713165862, "uuid": "2db0743a-e0a7-436b-9ad9-eeedbeee54eb", "value": "20b40977bf8e122a8c255bbf834c508e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2d7a50b-fb07-11ee-a120-42010a9c002e", "comment": "Malware payload (STRRAT)", "timestamp": 1713172151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713172151, "uuid": "8ec201ca-9b19-43ea-a6fc-074c79d23a6e", "comment": "Malware payload (STRRAT)", "value": "e61ec62c05f24d878432305d47cf1a72", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713172151, "uuid": "a6472afc-b93c-446b-ad2c-aae1119a021d", "comment": "Malware payload (STRRAT)", "value": "4bc8c38b1c2d3e12e8c0dc9c799737a01a4995489252a93d4d52d5d2ea9bf1d0", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713172151, "uuid": "bd895d0a-0692-4c1f-a331-43aeea6e2041", "comment": "Malware payload (STRRAT)", "value": "6c1be0e2462b9c6ebe76f2580197165cb06f0eca", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713172151, "uuid": "f6a274b7-8631-4b2d-a357-4bfa77d0360e", "comment": "Malware payload (STRRAT)", "value": "49fbad6ff501964d265b60f3b35e5d5767597e8b5042d23152b3971b1271108a5ce7026df8e167e375115c58c90e40f4", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713172151, "uuid": "7ca65328-117f-485d-a6fb-0ac0915da941", "value": "T1F3C41A91D2A764E65E1A9C72028DDA3A26DBACFC531AC60FF05CDE604C0156CDED4FA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713172151, "uuid": "7e88a9da-1eaa-42f0-ada5-17f8045b01ca", "value": "6144:5GhdqqRLKBdgqVtKINC5c9JWaa6KXoQhTstZ9eMfM1CiQsLjHfwp8byNVhiktrCT:fvgM/ioJBa6QhTUnfMxb+VhZ8h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713172151, "uuid": "cd5a4daf-9030-46b4-884c-1f72243a92bc", "value": 554251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713172151, "uuid": "899d9c5c-ba3f-4671-aaff-2a473b1cb24e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713172151, "uuid": "de3642cc-9a0c-4eb5-8c3b-a8983be0f44c", "value": "Transaction_slip_pdf.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b78643c-fb4c-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713201667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713201667, "uuid": "c8ef267d-9d3e-4b3e-a2cd-89b848c51cdc", "comment": "Malware payload", "value": "ba7445dd6438c2097c1c5b2ce173c064", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713201667, "uuid": "6abfc19b-9a44-480b-b1ec-d7ee8d6fc89d", "comment": "Malware payload", "value": "4cd8586d09ba9e97b4e50bb2d9d1e671a50bfe79bcd29ebf851ae6defc8d1768", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713201667, "uuid": "24fdcda7-9209-41a9-9e54-05c848bed0ea", "comment": "Malware payload", "value": "24873c5c09152806caa71b6bb990ef0797e626ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713201667, "uuid": "8f72b960-5d79-4037-b2b7-8d244b46f04e", "comment": "Malware payload", "value": "283e5595cdb4c3fb8e9f76834de5de6b33d65df0fc6fece14c2822ebb3f217d0679c8a29b6865516d4858f473cc295bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713201667, "uuid": "fd8fa7d7-b65f-4bf6-ada2-1a9ef4e0a589", "value": "T1E5B533427ADDC2BBDAC155700486B6920ABDF230076D5ED3AF914A0B4F3A1C257B93BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713201667, "uuid": "d1360a95-2133-4e81-ae49-d6fa2416bb55", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713201667, "uuid": "8bcc8597-6a2b-4392-86e9-2f44967531ab", "value": "49152:zgwRBNhWLwbYdMsr37tl5oaSeaduub9vdcOMigvOQowQEJHQJPT5NuEj3uWNtiT:zgwRBNhmwbirt02q1r4PFJwJ1fjeWNk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713201667, "uuid": "cdeabffd-317b-42ea-af3c-a9132c90de16", "value": 2469175, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713201667, "uuid": "dd0f5889-63d5-4300-ad9a-4def61c7bd07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713201667, "uuid": "51895f1d-123e-4080-a0c1-598ebd0a6d44", "value": "SecuriteInfo.com.Tool.Nssm.5.578.21752", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5aaff22-fade-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713154493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713154493, "uuid": "7b143ecd-ffa9-4275-9c5a-235c20c83441", "comment": "Malware payload (AgentTesla)", "value": "8e78a626ba8d14119c6a357a54d9fb84", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713154493, "uuid": "87e2d392-a85a-4239-8e61-82fbdd3cb2ce", "comment": "Malware payload (AgentTesla)", "value": "4ec8f72bf35c4a1de223b92521d3e0c996809eaf52f50960d8580e89be6152e7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713154493, "uuid": "ee073111-4445-49c6-84c0-5f0ac58f6caf", "comment": "Malware payload (AgentTesla)", "value": "fd178b1e129adccdf8e2fd2d7935edfdee31854d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713154493, "uuid": "77d6dd07-7de2-41b1-bf60-4d21c5825c5e", "comment": "Malware payload (AgentTesla)", "value": "08133c16cfb64d0af16d86257cc47b691ac25423e21d902e0990c52be9af899739690937bd5b38ed64cffea05e41b784", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713154493, "uuid": "9a02ada7-1f3c-4f1b-b2c0-21e5c987dd29", "value": "T19DF4128031BC9F32D6B75BF9586855901F7271AAB638EB8C1DED40C43660F809BA1F5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713154493, "uuid": "63ee009f-381c-4c61-9e21-416bcee33f5b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713154493, "uuid": "28c94448-8d4b-4140-868d-044abf679933", "value": "12288:7pkNB9QsvDw+sqoz/4U6/rKFdIJHeBmJMiKnoBSxwg81WklOnZhaB5gZAFakR:VkNH5D1e4UCrWk+B6PKUSZBnZ4B5g6D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713154493, "uuid": "cb0e4917-d6a8-4625-9514-c96bcfca3472", "value": 784904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713154493, "uuid": "ddcdeda8-3edd-4003-b08b-e51139c520b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713154493, "uuid": "d2da8877-138b-4a66-ac3c-8a5b9f9b9962", "value": "SecuriteInfo.com.Heur.5917.20015", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cd1ed98-fb51-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713203816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713203816, "uuid": "f77105a6-0b9b-41db-a2d9-7bd292edc575", "comment": "Malware payload", "value": "e17c6937d8ea9b318a683412e5758671", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713203816, "uuid": "f72bfa23-5d24-40f6-acb8-606bd28de5e4", "comment": "Malware payload", "value": "4ff05e2759c1064cbc852586c9c97ecc29c68468b453d75687d73a9de93083ac", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713203816, "uuid": "a7b22dfb-7b51-4466-9693-63c271a05024", "comment": "Malware payload", "value": "cabbfbf26865d256ce87eb46a02a1b6060648a71", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713203816, "uuid": "4205d157-fbf8-4b40-bc7b-36b5942fe34c", "comment": "Malware payload", "value": "4220860951df589315d620029d277c52679ae7062b0b554b14cc786a2e83a0e0ff91905cf60d9afa9d8c18cf42f3b9ba", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713203816, "uuid": "41f100af-244b-4481-9b93-6c25df623101", "value": "T1FC85332A99738932D85436631043941D3E3A498E28301CF97E75CDAF8992FDF79B74AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713203816, "uuid": "daa23c44-ed2a-4e73-83ec-1a078d356e8a", "value": "24576:pDez/UvSyM/sGbRcT1SW/p9Jv60c/4LEy6EgtfR5NN7mgv55BcvxPwdDdWH5JHW3:zvSBbk1TLcGAA6/B+ZMUXMp60", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713203816, "uuid": "e6bd3742-9341-4e31-bd79-7d78aa8d77e0", "value": 1764774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713203816, "uuid": "9b9f9c8a-ec3b-47e0-9d44-7dff99470edc", "value": "image/gif", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713203816, "uuid": "e13d7615-3634-45ca-9509-b225b5f97dde", "value": "giphy (1).gif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "062d488c-fb6e-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713216046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713216046, "uuid": "db68b940-382d-4fc2-b54c-a59c059a9c08", "comment": "Malware payload (Formbook)", "value": "ade450c7a2b33ca4502e5aadc1cfdfea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713216046, "uuid": "1e3ffc99-0482-4fcc-b080-5fbb96e0af42", "comment": "Malware payload (Formbook)", "value": "522df31fa6822a48a743918cc4371daaa6ca5aade2713ddf6e4a7726c78d54a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713216046, "uuid": "5c1438e0-728d-41c1-82e2-1cfbcec8de53", "comment": "Malware payload (Formbook)", "value": "8bbfb32ae8e014f72ce8e984ecf4f314a6438a76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713216046, "uuid": "b45534f1-5129-443b-8952-020eaacdb1db", "comment": "Malware payload (Formbook)", "value": "43bcf02cb240adee7f4b59989d0f6156a01e322148b67e9909f9eb9f2d083686d44a503fa297639becbf7a088fbf3ef8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713216046, "uuid": "4edc8b50-392b-4f8e-9d18-b93d7b922c25", "value": "T12EF412407BD54750C63C8BF4902389612BFA6D0F5C69F7AA8CC970D59AB2B10866FE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713216046, "uuid": "96bed2cb-63bd-42d2-9da0-d924947947d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713216046, "uuid": "045d4af3-ab4e-4a15-94a3-3d72dc54a05a", "value": "12288:HaAv6zT370leSjE36mzvMzoM7aVRqvuDBb+Gp7c4fokd+74ep9Y8sbYBDg/iixa:Plxg6mz2o+aVRqvmwkQ74wDssBUqixa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713216046, "uuid": "5790d763-c5a4-4261-adbd-7d71acf426b6", "value": 730112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713216046, "uuid": "be7e0e8b-13f2-4e00-93ed-3f305a21772d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713216046, "uuid": "0934daf5-d9e8-4549-b839-54d38b21abc5", "value": "rSHIPMENTSHIPPE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7dc7016-fb7c-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713222411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713222411, "uuid": "81272b82-3d35-4dbf-b9b6-28e78ef602c5", "comment": "Malware payload (Mirai)", "value": "7d44dcddfb7b57c777ffa55aae9c2427", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713222411, "uuid": "98bf9f4b-b909-47b9-a31a-e429a5ea3601", "comment": "Malware payload (Mirai)", "value": "5234086aff9cd88b6b25fa068a860e91f5faf8d457df60cb207b329c69c27c0d", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713222411, "uuid": "7537831a-8dbf-49f8-916f-771dc4aff25a", "comment": "Malware payload (Mirai)", "value": "c860f361ff4531332809ac7db2062e01a64be672", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713222411, "uuid": "a56b6fae-58ec-41f5-b648-ec0178c88cf5", "comment": "Malware payload (Mirai)", "value": "4550f7511ee2946141b21e4c8deebdd80a3fab157bdae383fbb7536d4bdfdc1bd73f67f8a7b80322f639063e2eef54c2", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713222411, "uuid": "82d83f4b-c650-4ed9-864c-7fe437a833ce", "value": "T122F35C07B5C1C8FEC899C2B44F9AE236DA72F41D5134B1AF37D4EA261E4EE205B2D650", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713222411, "uuid": "05fe8977-6325-4ce6-9bec-121f0502a2b6", "value": "3072:Nbtfq7S5bj+fIM7fENFhk2cRY4QUsQM/xmFd8ch:Nbp2S0YEeNUmzK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713222411, "uuid": "4566b4ee-f5f0-47ff-b3fc-d756e16e328b", "value": 159752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713222411, "uuid": "73472966-516b-473a-b913-afd54afa8d2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713222411, "uuid": "39926cf3-359b-4367-80bd-534f7eced545", "value": "7d44dcddfb7b57c777ffa55aae9c2427", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28f0234f-fb41-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713196777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713196777, "uuid": "fa2bd283-7d0f-4888-a7c2-8ff4473188e7", "comment": "Malware payload (Mirai)", "value": "65ef9263a7170ca1888f7605ace0d4af", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713196777, "uuid": "af2019ce-d307-4597-8e7d-9573c1134611", "comment": "Malware payload (Mirai)", "value": "52654ad318793fe395685b74fd774126bb6f51c242c29aa7475857f4b74bbbc2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713196777, "uuid": "1db828a3-88d4-487f-bbc0-a1216d20c4d4", "comment": "Malware payload (Mirai)", "value": "a3caffbc1ddaa29aadd5006a72b587b87db91088", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713196777, "uuid": "a31d5309-ddc1-498b-8d00-01d43d37ac63", "comment": "Malware payload (Mirai)", "value": "e2f345dcc4e555cefe6238c8908c7c2ec56bff0ffc81791fd2f62ea2a87fa8224e2278d53d1e8936882ec942b9b18947", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713196777, "uuid": "d0f5efcd-7496-48ad-b18d-46fe221f64b4", "value": "T158533A94F743D4F1D8470930119BFB3A9A31EEE11160ED2BEB98FE72AC729129116B5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713196777, "uuid": "c3dc00d9-5cd8-47f6-8405-100066f91e60", "value": "768:lXlW6Ur9L39tzOL1++vLoxK22mSAeao6fYkeUo6LEz3BvyPwXnVrU+M31g2yXMDc:hqL399OQsKYmSn9UoIwrUz31g2y7Rr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713196777, "uuid": "c451e005-27f0-4aeb-b75a-77dfb1fd0d73", "value": 62316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713196777, "uuid": "08606850-7ee1-409e-bf62-f0f7fa26e6d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713196777, "uuid": "25b66497-f9ec-4354-b4a5-4a03c0e05669", "value": "65ef9263a7170ca1888f7605ace0d4af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c154c1d2-fb76-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713219796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713219796, "uuid": "b3696d3a-0ebe-498b-b003-1c04ad6ee64b", "comment": "Malware payload", "value": "606dd77823076a151448704d36fc283d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713219796, "uuid": "df3893a9-3416-4637-87fe-468e21bd4efe", "comment": "Malware payload", "value": "52986679e8cbbe78f3d377a8584106a8765604034d4b1efd28ccd28ddb8310c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713219796, "uuid": "c6edac49-b07a-4f5c-90e1-9dd0197e4120", "comment": "Malware payload", "value": "71b6c77078d3f6ed954448e770df1ef2e5081776", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713219796, "uuid": "aabc5fbe-6d07-4eaf-8029-04e2c6f9e605", "comment": "Malware payload", "value": "ad5c473b2fcde1f1c30312778d288ca13a3082ae0ae7d997d6856317155d155fd5d00aec53d14837b29eddecbeebc839", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713219796, "uuid": "b6c16607-513e-44ab-8fb6-c9947506ae1d", "value": "T1FDF4BF6178E481B2EDF620FA02ECB13545ADE4F0071556CB17DC0BFFE6246C1AB3669A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713219796, "uuid": "8ab0232f-db62-4234-a95d-ac511b26876f", "value": "0888aecafc5029669ce9c3a92f0aa565", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713219796, "uuid": "4b562dbe-9930-4335-a728-e6b9950554d8", "value": "12288:8u7Ord48zsWavuWqhCF1Kf3FopytrT5fpAp:CnsoCF14uwpXAp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713219796, "uuid": "d7ee04a1-b9c7-4fea-a94f-656b62d1382b", "value": 739328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713219796, "uuid": "e03469f8-85ee-401d-b9a1-c1b8dfb92039", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713219796, "uuid": "f5c65813-02c7-4d9e-b4c0-2a68d9fead5c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a86948f0-fb2a-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713187112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187112, "uuid": "273011cf-45b8-461f-9977-5cea2bd22a86", "comment": "Malware payload (Formbook)", "value": "f50c954d4bf97335f18c10d75b08939b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187112, "uuid": "d488826f-9fdd-4a90-b694-9cf8d05de038", "comment": "Malware payload (Formbook)", "value": "542b342741087bb6c40a67f690c328925893b34b2aef1acc8dc82aa63579b293", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187112, "uuid": "9c3da42e-23dd-4bd9-acaf-336d71397d39", "comment": "Malware payload (Formbook)", "value": "0b89a92d8771a14520fd462431569969ab047f96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187112, "uuid": "6c2df0a4-cc4e-4cd4-ae00-d400db093873", "comment": "Malware payload (Formbook)", "value": "ef767bbd54d9935819698e23031d22e4a93dd177605be161dd5582a51779999087cb1bc8c1587ee6ebbb65685872e502", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187112, "uuid": "9e374f89-8686-4a1b-9c0a-382a0f14b4e2", "value": "T15773A3D1CA073456C925AA3C9D2A7CC80D2F5EAAEA34519673427D773FB33821CB9903", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187112, "uuid": "863dc6bc-ca48-4751-8a61-582700b8b8ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187112, "uuid": "79a10e8d-42b0-4f4c-a02c-dd719adf7ae2", "value": "1536:Dx/1TLFFi3K00000000000000OfZ0p000000V0t0p000000I0a0p000000u0p00M:nLF8+mepCvMwjOnB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713187112, "uuid": "e7e5e930-1317-4b85-afaa-84ec6e4ecf6b", "value": 77312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713187112, "uuid": "bd594bf8-d12b-408f-8b98-dfca55044529", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187112, "uuid": "4333f792-71cb-45a4-b70b-0762e20c7273", "value": "Ordin de plat\u0103.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31dae7f7-fafe-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713168016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713168016, "uuid": "26ba3603-5ef7-445f-8c60-92b673bbfe6f", "comment": "Malware payload (AgentTesla)", "value": "f9e56da52bd36bcfbef05a5383bfbdb7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713168016, "uuid": "28553fac-43d9-4d3e-9436-f32a2da3425b", "comment": "Malware payload (AgentTesla)", "value": "55de94cc3001d77393ac02d39de125f6f2ff97fec9d4d520f4a5357372747753", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713168016, "uuid": "1e2dc53a-7767-4ca1-a659-5faad64a6506", "comment": "Malware payload (AgentTesla)", "value": "32cac706705cbb11747d5dc63ec7561911adef7e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713168016, "uuid": "2ac87d12-bff6-40c0-931f-76e640a9918b", "comment": "Malware payload (AgentTesla)", "value": "3877a992b8095e39195ec66b1d98df61645195ca3c934b1043d5704696786bb4831e72aa26c8b4c9190853da9d57428e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713168016, "uuid": "e9e010ef-2597-4634-94bb-888347b50e8f", "value": "T17F63792EE70F0925DF55A6BB434A4A4905FCB33DB38540B179BC973437AD82E4A6287C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713168016, "uuid": "04fbaa8c-a61e-4a9b-84f4-ea90d0c17494", "value": "1536:zTblOOWLqwKwsF+RX0DOnqSa/8wqmO4Ni5GNa9i4xf4Aj8meTyxhR9BDrddYImFw:bjWLqM0Dik0wqmO4Ni0Na9i4xf4Aj8mJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713168016, "uuid": "ce4658e8-3e65-45f8-9d13-951ced4e9207", "value": 72708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713168016, "uuid": "ba095bc5-40b2-4fd5-8f7d-8c5c80bf8df9", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713168016, "uuid": "96d40dd0-fa80-4419-a7f4-0a7b2362ad73", "value": "f9e56da52bd36bcfbef05a5383bfbdb7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72b380b7-fb4f-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713202914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713202914, "uuid": "d8e47945-a97f-4607-bbd9-d5ad5d60d0e6", "comment": "Malware payload (AgentTesla)", "value": "21ccd3cd2251bbc5bcb25c937762db7a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713202914, "uuid": "9a679cd7-544f-4e9f-af76-fbdc351b60e8", "comment": "Malware payload (AgentTesla)", "value": "56dc031aa91579dc52c287554375c2cbea9aa02601ec4a50ecb3ad7af014dead", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713202914, "uuid": "bd510155-3ef5-4e43-8ae7-a96cfbd552cd", "comment": "Malware payload (AgentTesla)", "value": "9caf759f4e87246cd8bba7ea5caffe8ff95cb232", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713202914, "uuid": "4a6d6fee-edef-470f-b4b0-636672f7ad8d", "comment": "Malware payload (AgentTesla)", "value": "b327155df461d45d5cb39b8ba84f062c76cbfed87cb43d6fed1297f208d83f3a1c15592ae94a6758cf0588d1d4f75cd7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713202914, "uuid": "3f0de0b9-601a-48de-a5c2-1da91a4dfb71", "value": "T1EE25AD0273D5C036FFAB92739B6AF20556BC79254123852F13982DB9BD701B2273E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713202914, "uuid": "0e633330-0498-42e7-a7fa-745a36ea5a5d", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713202914, "uuid": "552bd885-6c7a-4a55-9534-f9b64930bbd8", "value": "24576:1AHnh+eWsN3skA4RV1Hom2KXMmHap0/lalVM5:kh+ZkldoPK8Yap0N60", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713202914, "uuid": "e989e130-53d3-4e33-996a-d33754f6993b", "value": 1050112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713202914, "uuid": "da79abb6-7104-4fdb-b3cb-8044424a94cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713202914, "uuid": "c0df0399-0a74-4849-917c-89a68b18b12e", "value": "rConfirmaci__nt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b34c770-fae8-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713158716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158716, "uuid": "3624c931-fe7d-4834-b1b0-b672261eaa51", "comment": "Malware payload (AgentTesla)", "value": "4b90135004b9e30ae10a6cafb25c5a02", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158716, "uuid": "d001e900-48de-4c6e-a08b-79ee99eebf8e", "comment": "Malware payload (AgentTesla)", "value": "5873b8e1265e84cf48ec3d9c0d6caf772c3453cb82191a0cf0dfecf2ea3d3bb2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158716, "uuid": "fe70e46b-67d9-4af2-87f7-6d669facc1b1", "comment": "Malware payload (AgentTesla)", "value": "0397063c767d6db20f1a74b003213ca929a0c500", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158716, "uuid": "b7f54090-cc87-4bf4-8b86-a36e299875c1", "comment": "Malware payload (AgentTesla)", "value": "636651dcaf67ad8e01a866f63191e364534b7c24f4d633b7e4a6042cb95203b5f3d9ac47cb6abf38fa55f1ffd431775b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158716, "uuid": "28b5769d-0b70-4721-bcf3-6c643a1f3e6e", "value": "T11454F1E18E172F8B8ECB724175429C79ABEAE5DB00E1596D113D34DBAC4F18CD6E920C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158716, "uuid": "d5635425-3cba-4ec9-bf85-78dfb441cbb4", "value": "6144:XuBnEIbL0ZAm56d7dSXp0QjXwxQgsmYMOaJiBMfGCF81d7m4Vt:XuBEhb5YdSOkwQBMfT81xm4v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713158716, "uuid": "e48284f0-f137-411b-a157-c0b4d3fc3d4a", "value": 298770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713158716, "uuid": "5e9ec1b2-128e-4c4f-9e80-0ce4d2b46be1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158716, "uuid": "e9646c0b-8951-4097-940e-a4ad3198f261", "value": "TTC 041424.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7cabfe0-faf6-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713164804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713164804, "uuid": "cf2f4e0b-95c9-4347-a960-3416a71c3395", "comment": "Malware payload", "value": "069d87a136ed4278cbc7db0642506d68", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713164804, "uuid": "1c40ef92-d4a5-4f49-bf96-582aeb925545", "comment": "Malware payload", "value": "5a9a53b5cd9ee22387c4b4eeabca501b5d7b104810f2a60aa5d4bf9b98396bef", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713164804, "uuid": "6b71e465-bd09-4a37-86d8-5aa0474b0e2c", "comment": "Malware payload", "value": "17a876355fd6308f4877da2cf369ea6b9d3cde68", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713164804, "uuid": "eb6cd0b9-b33a-4e35-9028-f5d28a49929e", "comment": "Malware payload", "value": "8e1fb8b9c0deed069dd40b6a45fb8b8c4893dc0dcbec865d05843df06d3f93aac9f525f6e3d50289d6fc959e28036f0c", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713164804, "uuid": "71103bef-bd99-470d-ba72-a9097d83c91d", "value": "T15011AF62F9A80D8CFD03CF8A648E3F49055DB1175FD938D101AC6B046559E2CE7869B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713164804, "uuid": "ec9de0db-f33d-4f76-89a7-a6b4c785c5ef", "value": "24:1KZl55CUsWVukrUROc9AvaRYTe0rTemHbfqXXyc2K0bFuth1:obCWV5rHauzBbzczdth1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713164804, "uuid": "b50b7686-7386-412c-980a-fbe53bff1d0c", "value": 880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713164804, "uuid": "79585f53-3732-4617-9fcd-b9466aac69db", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713164804, "uuid": "64a301af-02ab-45e5-9320-56a0f0870af4", "value": "RFQ#1045.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16dfd7ae-fae9-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1713158951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158951, "uuid": "ef9d6c85-496b-416d-a34a-305c9637d5dc", "comment": "Malware payload (RemcosRAT)", "value": "fb48757c1c222bf6f6680de0c89b8439", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158951, "uuid": "ae29a9fd-e0ce-4656-897f-d9f623555a0b", "comment": "Malware payload (RemcosRAT)", "value": "61d36494c0c51a0c0a1fcad1f36c901a6debcc3c0061f2544a01c65c688e5c03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158951, "uuid": "c4dcc9b6-7e99-4adb-ba9b-cf318eaa464f", "comment": "Malware payload (RemcosRAT)", "value": "c006bca0b64b23ff8e609e3ab86d01bd8e473c75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158951, "uuid": "56c48024-bee0-4b99-991e-a978164924ae", "comment": "Malware payload (RemcosRAT)", "value": "61b2516d3312379990c0c090adda5b77d9a84109d458b3be4bf20c1bb2e1894211bc31b944e31f8ce3535f3ca70138ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158951, "uuid": "9fe2baa4-682c-4006-8ed2-52cc56fbd898", "value": "T1CA2523590B80D91ADEED17BBC6BAC655E3B143592905DBD72ED8A2DC1AC336383213C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158951, "uuid": "8b2b6b63-7f82-4a54-bac7-f22296dc3f4a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158951, "uuid": "c4960da5-30a1-4089-ac11-eadc0621f77f", "value": "24576:0OwcVmnaIGq/A1jCXpjXLK5tCXEUYjZM3L/whc4alXY/dnR:0S2GV12j0tCX2j4xdYpR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713158951, "uuid": "5dc5ac15-5c5d-41f0-9dc3-8d3d273106d2", "value": 1016328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713158951, "uuid": "1cb32b1d-3e52-4239-a2a7-3ee3c2015e6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158951, "uuid": "dfe49bf3-b11b-41c2-8152-dcb25a7b6658", "value": "fb48757c1c222bf6f6680de0c89b8439.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0773c569-fad7-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713151194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713151194, "uuid": "3baff3b8-e585-4028-b425-eff9c1a5ab56", "comment": "Malware payload", "value": "a25e2a5da175218841fbeed5f3c77324", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713151194, "uuid": "bb9d1e4e-d29b-4378-9786-57c181fd87e0", "comment": "Malware payload", "value": "64878ab75cd6548d7dfb7f824d9b926c7ff0e30318c6c8af0bcafe9a159b358f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713151194, "uuid": "3fb934fb-5018-4596-9f7a-f8fce218bbb2", "comment": "Malware payload", "value": "0431a669d682c2af76732f2c0d24ebb49766ad86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713151194, "uuid": "51189a43-65b9-4e82-b127-0bd62d1e1074", "comment": "Malware payload", "value": "aa00523093a22f2c90b41aaacc1044fee218b0026e443850d06fdc748dc5a97c787502c7fcbffc134debf2281deef451", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713151194, "uuid": "70fe6052-d359-443c-a3b1-c3913093ebfa", "value": "T1E56633B7289C85CED810CD77DBA539827ABC3C6503806183A924FCD79FA3256654EF27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713151194, "uuid": "998cbba8-2c25-4140-b2cc-83473281abfd", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713151194, "uuid": "4d2d9951-58d4-40ab-a26d-33607249c83f", "value": "196608:fa2hdTMw4f36hhHxJZ2aCzMRcXHvjBQIDhIalSkQtdcvcLUSD:f/tnZVwMQHvi8E11D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713151194, "uuid": "5cfc59fc-d834-46bc-8cfc-008b3fc4de7e", "value": 6738024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713151194, "uuid": "c7e62e6f-b0da-4741-92bc-dbaeb16199f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713151194, "uuid": "9861f075-9b78-4d4b-890b-19c8e684adbe", "value": "SecuriteInfo.com.BScope.Worm.Mytob.4760.11059", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b86eb15-fb12-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713176568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713176568, "uuid": "76c67f2a-09ba-4df0-a321-ae3069105c5c", "comment": "Malware payload (Mirai)", "value": "20d263bd6e0552cad17ec45eeff1844b", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713176568, "uuid": "e84cb494-4437-4f23-a112-5dc85bded23d", "comment": "Malware payload (Mirai)", "value": "648fcb9bac190539eda0026332834bb94f935c3c2817864d8d26f21bdd35989b", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713176568, "uuid": "6f531dc7-c9ee-4306-b6d5-e733923b666f", "comment": "Malware payload (Mirai)", "value": "67a23901d5f3276ba4e8c95c21aeb79ca584a36a", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713176568, "uuid": "c0495f71-aed8-4f67-80f2-fea2c99dce36", "comment": "Malware payload (Mirai)", "value": "07bb7af835f453ec3a2e7c98ab11307a8a0259fb9a34975d7ed98bfe56ca300d5f285608e0c51b4eef98fcb3631b6198", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713176568, "uuid": "aba311a1-4089-4eff-9583-c928fcce4387", "value": "T101734B13B981C4FDC49AC1745B6AB63FD973B07D0238B2FA6BD4FA12AD8AD601E1D540", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713176568, "uuid": "d89c0606-9df3-489b-8acd-6657b52f7d0f", "value": "1536:EUPldq0TJFnqXKvdo7DYZXjs56tbWuhyN/XemIdRI1R+5vY1SLq7wTVVi:9NdDznqoK7D4s5UWxem0I1R+JeSOcTf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713176568, "uuid": "2d01f2d3-cc83-4370-900a-1d7cdbbda0fc", "value": 76368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713176568, "uuid": "7abac939-1ff2-422c-ba42-b687aab68fb2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713176568, "uuid": "aafe0749-58d8-48b6-a07d-5885b84a3560", "value": "20d263bd6e0552cad17ec45eeff1844b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98146929-fabb-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713139411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139411, "uuid": "5db5c2c3-d59b-4350-9153-4630ef89885d", "comment": "Malware payload (Mirai)", "value": "ebd129e0c226285269fc9b76959abe2e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139411, "uuid": "dc9df335-244e-431c-a73b-6893e222abd6", "comment": "Malware payload (Mirai)", "value": "64e8ad7bdd21fe97552c76c50fa910c2dc37a3cf9311c087d8fd8cd8f7f48cf0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139411, "uuid": "d59570d0-8036-4f0e-b3cf-35d04ffcf59d", "comment": "Malware payload (Mirai)", "value": "00534451bd674427e15b86cfef6105a1625549cf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139411, "uuid": "97db0be2-54ab-4814-8941-878ae1f4be97", "comment": "Malware payload (Mirai)", "value": "d2d23c9a649d8bebbfcb527dbb44e6d8fd65ec6874704c2b221e1814d9e3ae43faf8ba135e480d4775db36fa312022f7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713139411, "uuid": "ed0325cc-5f6d-419b-886c-aaf7fc10c07e", "value": "T1DE835BC2A262DDF2D8861B7101E7DB363171F8762BADD606D36CBDF2DD02684B08925D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713139411, "uuid": "347ca706-08dc-44b4-855a-be24757676b0", "value": "1536:DEds2rsO0+F7mxN3iEgm1v4/fUZ0iVsZr8wbZnezSpo6x:wds2rsc7mb7gRfUh8gwbZnTh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713139411, "uuid": "b8595aeb-3f55-4d76-9758-499bd55012af", "value": 81040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713139411, "uuid": "a7ccb5b9-0bd3-46d4-a62b-2ccb6bdfe8b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713139411, "uuid": "f88c4a1c-46a5-4cea-ae00-b19dbed39a51", "value": "ebd129e0c226285269fc9b76959abe2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7584b759-fb4f-11ee-a120-42010a9c002e", "comment": "Malware payload (Loki)", "timestamp": 1713202918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713202918, "uuid": "30543505-343b-4fef-866b-0b02a57e1cea", "comment": "Malware payload (Loki)", "value": "7d429931b4028877a01bc1b8af131394", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713202918, "uuid": "341533af-970b-42e3-a46a-4c0ddb00fafa", "comment": "Malware payload (Loki)", "value": "6682d4c801b131d5de5810898709e48f858f7204de3fbe9eedd08d7649202a4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713202918, "uuid": "0b0c596e-7dc7-4aa7-bef2-1cf96c4d2241", "comment": "Malware payload (Loki)", "value": "237319bed39b32aa4878479043c74ef958f75df5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713202918, "uuid": "cedf5f5e-eea1-47b3-9d52-ddf6f4dcf049", "comment": "Malware payload (Loki)", "value": "8b7a792835fde1a6863df0639029acf79566391194a9068795cae40357b01f812b40fbd854870152bf8a52b0e89e9ca5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713202918, "uuid": "82337de8-f466-4ae6-899a-a5dd78f39b26", "value": "T14C157CA12265537EDCBC44BCB02090B6CE66BD570A16D4AD8CC13D9B3D78AE27570E3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713202918, "uuid": "c7561e5c-d364-4073-a083-7f03cf361ee7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713202918, "uuid": "b98ce87d-4cdb-45d3-9f07-1ac1a65464d2", "value": "12288:v3n4NBHPdHG2Qj8M+hFJHW8265co/G/DEl4MVonUp8p:f4NZJo4hjV5jJSiouU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713202918, "uuid": "bc757e97-5a6f-45ab-8868-08281f328d1d", "value": 876032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713202918, "uuid": "333ace4f-805b-452e-8246-a6a356f6044c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713202918, "uuid": "62e582c3-163a-4d09-8cd0-d7ab98280e18", "value": "rPaymentadvice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0495b196-fb36-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713191991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713191991, "uuid": "03fe09f8-3d65-4990-9d90-a796d20b368c", "comment": "Malware payload (Formbook)", "value": "3fdac5be870ce5d0c30c06854203624a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713191991, "uuid": "e4be60ce-f432-4d33-ad4d-d600cf70984f", "comment": "Malware payload (Formbook)", "value": "66e4e0b05fbe673afbd9f23ada369eaab823c2ce0285b5004068d6b03e3449e7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713191991, "uuid": "e9472ccc-311f-4837-a2c9-cbc956660db4", "comment": "Malware payload (Formbook)", "value": "616317b2de7a62935c0630439b4bd884e8c79f3e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713191991, "uuid": "f194b31b-acc3-48ee-abc0-79098c00847f", "comment": "Malware payload (Formbook)", "value": "13afee0e607a2eb7e8e0aacc928b3fb9e4087efbeb7bef9444f6649f87c3981362e3b0fcfc1ef51ac062dabe11f8ec43", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713191991, "uuid": "e74f762c-4f56-4384-bf1a-1a8f09908e5b", "value": "T154259DA12265533EDCBD44BCB02190B5CE66BD67060AD4AD8CC13DAB3D69DE27470E3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713191991, "uuid": "b827476c-be23-42fe-8fae-1d824aab1e88", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713191991, "uuid": "54910594-bb6c-4302-902b-f2cc72030d83", "value": "12288:UJ4NBFTi6/LSqFb4R7u59FSIogAHpXBoftbQleal:a4NH/LScb4Vu5aIogIpXe6lea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713191991, "uuid": "027b152b-cff0-4e40-95e0-d3ba33391161", "value": 1031680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713191991, "uuid": "bc73b846-41e1-447a-ae1e-39d7ca6151e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713191991, "uuid": "64ca2943-a8a9-4309-8aac-459764479ec5", "value": "Doc Inv & Packing list 04015032024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd6bbd5d-fb04-11ee-a120-42010a9c002e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1713170880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713170880, "uuid": "3229d1e2-4ff6-402b-9333-037d016b0cca", "comment": "Malware payload (Rhadamanthys)", "value": "e4fbe0286a7802d4a7cd91a3d55d9f3c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713170880, "uuid": "51417093-33c5-4dd2-b509-9c3cc2728dc3", "comment": "Malware payload (Rhadamanthys)", "value": "66f138849b45ba75c5e99484739c990056387b676eeadf66e32f1f27dd6b9c6d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713170880, "uuid": "e10a9e88-7e31-4d00-8dde-981af620d5c6", "comment": "Malware payload (Rhadamanthys)", "value": "320869f193d91388ae4c2337a91d7545ca0a201a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713170880, "uuid": "2d0a4309-9b35-4d36-add6-0b9d64f2b006", "comment": "Malware payload (Rhadamanthys)", "value": "46b7f32096555af055d7e3cc2a2804f7e16794343719f233161e76dc2e507d7ac9c3caf8a70ceead180b06e0d65ba7af", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713170880, "uuid": "798d49fd-f3bf-4fbb-be5e-30928e92d28e", "value": "T1991533512D81A027F5A347F9047589F73B76492F64E53E07E3801E097AB3EB2FE5A890", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713170880, "uuid": "a6c7b0ae-7efd-4096-80bb-8f2b9806e321", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713170880, "uuid": "1c03730e-639a-4c76-99e9-5a2861634dab", "value": "24576:GbTeCswwSe/fDyBvSGy45nJtYsf8J7f7VvgWncL3f5llrINn9Ra7I7:8vdwH/LyBvg+JKsf8JzFgWcDf5m9M7m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713170880, "uuid": "8390eaae-3cdb-4999-a0df-e7fab10c6d3c", "value": 957570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713170880, "uuid": "e60e99cc-c9ee-4ee8-9d54-ecac04f38386", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713170880, "uuid": "a95afa3a-a9e2-4eef-b7c1-6cd6c2d12e28", "value": "e4fbe0286a7802d4a7cd91a3d55d9f3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f097e1e-fafc-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1713167125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713167125, "uuid": "74d41319-9d64-4c8c-8ce8-b056c41bcd99", "comment": "Malware payload (RemcosRAT)", "value": "12da9c502930dfc874020456c0f3d5a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713167125, "uuid": "cade51c7-e151-4ba0-9b69-e83d5543575b", "comment": "Malware payload (RemcosRAT)", "value": "6905a9d5ffefb1d0c3f85002263c13698fa664f5d95a110263057880ac05ca1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713167125, "uuid": "81b0cab9-de09-45f9-8a4f-254176207ff9", "comment": "Malware payload (RemcosRAT)", "value": "21c9aef2eaab80436924719a4597bc04aad40086", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713167125, "uuid": "4aeaec34-b83c-4c05-a9ac-eadd874657f6", "comment": "Malware payload (RemcosRAT)", "value": "1ed4b45b14c1609c3e02ca317bee2c71453109c2141ae62a8cddf66c2cca52cc9b3df5855f7cd0a82ba76311f558ebb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713167125, "uuid": "9ecf9d4b-53b2-4265-8c3d-699301f6fd20", "value": "T192451202B9C290B3D4621C769A69A620693DBD210F748EDF73C07A6DED721C1D735BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713167125, "uuid": "9cbe0ac6-fed7-4127-8760-0dc5d67fc560", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713167125, "uuid": "59a0b287-8fb0-4df6-bc80-4490f80611f2", "value": "24576:DTbBv5rUDwcywgY7nOTBNcF/6IDbB8Ww+tihbD4FGa6mPcyGJml:dB1cLNnW4lBfbtiJNoGO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713167125, "uuid": "bf6d9391-f27d-4817-8be3-d89a7fdf8104", "value": 1271396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713167125, "uuid": "6a3c6379-40b6-4bcf-ae6b-58b90c8f9db7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713167125, "uuid": "768ab467-44dc-4c9c-b940-6e24d5b0b30f", "value": "Vessel Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e1855fe-fae8-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1713158694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158694, "uuid": "4f3dc1e6-6fde-4318-bb6f-560e65c94eca", "comment": "Malware payload (GuLoader)", "value": "19153d63aa2875e0842d3b38eec0e058", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158694, "uuid": "5097d4bc-a617-40ea-a8fc-af0a4e28ebc7", "comment": "Malware payload (GuLoader)", "value": "6a9912f3b705033f28e851d1ecd7e6dbdbf07296594c6a01e35df9950f9de0bc", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158694, "uuid": "9c6c987c-74ea-48d1-8034-06c1804715ad", "comment": "Malware payload (GuLoader)", "value": "abbccbefd5612f49488fd556359b5f44b28b8f3a", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158694, "uuid": "e8218c61-89e6-4c07-9f29-c13b80a2ce65", "comment": "Malware payload (GuLoader)", "value": "d48d05bcfa590a61efc8c734e79899f167b17ba0c71205729a4bec1939ec7f9af8596a072ad337f738cbe9ec27b55ab3", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158694, "uuid": "94f7d9b9-1b04-4d59-8c55-0c42d388488e", "value": "T15324032ED34B02698F520372AB1B1E95A6BDBA3EF39051B0346C433533D9C7D52266BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158694, "uuid": "2551ba5d-f2bf-4975-859b-e79b14a88428", "value": "1536:6f0Xvx3EMERsf0Xvx3EMERsf0Xvx3EMERudUlpiG/lKN:6sXvKMEesXvKMEesXvKMEQUlpzlKN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713158694, "uuid": "2a617011-acbf-46ab-a122-dab94f8ca50a", "value": 224228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713158694, "uuid": "3e24f9ba-446a-4c00-b13c-e191c916b8b2", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158694, "uuid": "12837758-e92c-48de-8521-c0cfcbbe56d4", "value": "NEW GRACE- RFQ .doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80dd48b9-fae8-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713158699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158699, "uuid": "425ffbde-8418-4e58-8b89-ef71bd40d79f", "comment": "Malware payload", "value": "6e74f3450b6a5719b9e71f6ea32295ce", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158699, "uuid": "cd60b3f3-4c9d-4368-878a-9c414f15164c", "comment": "Malware payload", "value": "6c0c6d699be7442dcd1e34507ac5f9103fcf2a220b032e2e7159805c820a0483", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158699, "uuid": "411dcf16-4e7d-406a-b647-42de406239c3", "comment": "Malware payload", "value": "790344f4225b4a5e904f3e06de6aac6fa9fe58d5", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158699, "uuid": "0786185a-0feb-43cd-8580-1da798de0f66", "comment": "Malware payload", "value": "e0906059613b23d2aaa3282a2c28dba35dfd557c5efe301858a7069d351842e0ad582a8a4f8ce2841575262d8f4768c9", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158699, "uuid": "9f24a58e-a31e-45b4-b6d2-025ed2e626f0", "value": "T1FD8428E2CAC52A298A461AB7ED230B338DB4815D73131F3897BDC65D604395C86BFBD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158699, "uuid": "39140db6-3a1b-4182-b8f6-71980aa9c37d", "value": "6144:ixRLaVfs2VTA05zBWJKJqDv9WlmDg6bMiaNb3rczF9V4I5Btg/zRoFTC4vSUUkPX:0GInOiOi9PIM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713158699, "uuid": "0c013213-e8bc-4e5c-9857-bf9fe6494819", "value": 371107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713158699, "uuid": "7a730119-07c3-4806-a9e2-e2560c329ff1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158699, "uuid": "a2be5e1a-6070-471a-b482-ba3183a4064a", "value": "(\uc804\uc0ac\uacf5\uc9c0\uc6a9) 24\ub144 \uc548\uc804\uc791\uc5c5\ud5c8\uac00 \uae30\uc900 \uc548\ub0b4 (240415)\u00b7pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d84da56-fb2a-11ee-a120-42010a9c002e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1713187094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187094, "uuid": "833f7e63-2e01-4bbc-b833-d77ce78a8c1b", "comment": "Malware payload (SnakeKeylogger)", "value": "908016eddd0dc90bb69c0ff9f8560d68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187094, "uuid": "797daa67-8656-4c61-a085-4b0624e50c9d", "comment": "Malware payload (SnakeKeylogger)", "value": "6d3b249ec17de0b830b6d21a2a5bc6b4b15c99cc78c05d34ca414e09dea1d9d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187094, "uuid": "60ae117b-fbac-483a-a85f-59892c244f16", "comment": "Malware payload (SnakeKeylogger)", "value": "60e6f9e8bd5e71eea2bab0c636b91b0d800e17bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187094, "uuid": "65a69dd5-ee2d-4c5e-bf6a-9b250c6577b4", "comment": "Malware payload (SnakeKeylogger)", "value": "25395a246591064da659a0ff859675bab5b9bc1b6df4bb9735cbb200bf230e183d6638a2d4355bfee9609588fb88d757", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187094, "uuid": "65a6ebdf-1a8c-4871-9562-0bb3e76a5a36", "value": "T1C8D3F85937E88814E2FF997302316101C7B6B8430A27DF1D1BD2A5692B7DB91CE1AF93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187094, "uuid": "67b91d3d-9e50-463c-91ea-c8d416409f22", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187094, "uuid": "d166e81f-26f3-4a64-a9e0-76e9819de583", "value": "3072:NhBlNh2vWoAQomH/ehGkOFo5bljsX8wv8Lw4LVgbY:LNh2eoAxh5bO4L2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713187094, "uuid": "bed79599-6472-4ae4-9660-592a907be32e", "value": 133632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713187094, "uuid": "97426b3c-caa1-4846-bf4f-80f4e5284fb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187094, "uuid": "15826a65-5dc5-4496-a00d-d11a5a43385b", "value": "6d3b249ec17de0b830b6d21a2a5bc6b4b15c99cc78c05d34ca414e09dea1d9d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34f176ad-fad2-11ee-a120-42010a9c002e", "comment": "Malware payload (DCRat)", "timestamp": 1713149123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713149123, "uuid": "743e7c39-413b-4b6d-ba03-4cc9f35b6659", "comment": "Malware payload (DCRat)", "value": "10c968ea2523a8e4bb2b2e15f0372fd7", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713149123, "uuid": "3b83d298-5967-4da6-b488-9c0d26225d33", "comment": "Malware payload (DCRat)", "value": "6d8ce4bec1c309e5dbb0bb97b5432e8a7897c4a6c1243c485113aa2a8ef788bd", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713149123, "uuid": "f7f29d5e-3b54-4b7a-b845-5776b570ae7c", "comment": "Malware payload (DCRat)", "value": "3e468ba0407f535c55f25aeb2ae3263ed90fc6b9", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713149123, "uuid": "5ae75077-f033-458f-810c-00d2aac0f453", "comment": "Malware payload (DCRat)", "value": "e59c575b3a31b1dedcd0c8acdc2cd6262d12069b27d815cc109bf21f543d352e4cbd874d4732434fce810552561ff69c", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713149123, "uuid": "b6da52f0-5912-4ea1-8c17-ac249268285b", "value": "T16475AE2A56914E77C360577544A7403D83D4C7723EB2EF2A394F14E2A803BB5CAB61BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713149123, "uuid": "1d8a8015-550f-4b18-9c84-c22593cf8b54", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713149123, "uuid": "0529be8b-f88f-4ce7-8bef-b86bd050733c", "value": "24576:p+0yh4ZlXc1m3zijUFLmRZedvY8yFebs8Lv0qiDAFsuKiyIf:sOf7iZRQdvYLFw/L07DaFr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713149123, "uuid": "d814111d-e29c-4571-a609-089539a4f12f", "value": 1679872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713149123, "uuid": "373fd7aa-e320-4482-a639-2b785180eeb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713149123, "uuid": "4868e32f-7a13-4066-83ce-cad51c82fc0c", "value": "10c968ea2523a8e4bb2b2e15f0372fd7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d80ac85-fb4f-11ee-a120-42010a9c002e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1713202905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713202905, "uuid": "c5638c1a-42c3-4157-9806-071d288229e0", "comment": "Malware payload (AsyncRAT)", "value": "40e7f9319d64559c2bc3ab6595f419f3", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713202905, "uuid": "23dd9280-17a7-468d-8ed5-36a5412f570f", "comment": "Malware payload (AsyncRAT)", "value": "6dd41bfc65feff17a243f97340729b3472f519c1029127c5e9fee03bafcde338", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713202905, "uuid": "fa797c3e-7e6c-45c4-a05f-4222b89a8dc3", "comment": "Malware payload (AsyncRAT)", "value": "4f5da8030b4dcc5774d7e8bd967614e77510dfb1", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713202905, "uuid": "a902f7ed-14c5-4e78-8e60-180934a0c491", "comment": "Malware payload (AsyncRAT)", "value": "332e730f30a3d9334769e4a149de9eba47da5a5bf062eaf3801987be543e32dcd49195d98a961c321f31b833ff7f4a57", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713202905, "uuid": "1de7ee5e-2103-4ad2-bc5f-20613857a45b", "value": "T1B0A4231462ED87E6C4B5877A6E637B2007B0A65D24D9C6099C822DDECF62747880FFD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713202905, "uuid": "0e7ace45-20c6-4888-a43b-3fee3868c1e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713202905, "uuid": "2712aa11-0da9-44d6-85c7-46e1446756d8", "value": "12288:hkvq31eoWDu5ysKCxGSY1gMGYkR2mf62q4KkrkDFAdq:heqFCu5VKsm1gMGYHmiWkDFAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713202905, "uuid": "de6f449c-b84a-46fa-b852-ee10de27aa28", "value": 456192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713202905, "uuid": "9b54d824-e0bc-4ef2-aa34-6c938704bb99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713202905, "uuid": "cc66514e-135b-4461-9cd2-f85753e5539d", "value": "r414SHIPPINGORDERETC-0313SO6432TW102667003.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af849885-fb2a-11ee-a120-42010a9c002e", "comment": "Malware payload (PureLogStealer)", "timestamp": 1713187124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187124, "uuid": "e680e88c-8442-422f-ad4f-700c1482b2ba", "comment": "Malware payload (PureLogStealer)", "value": "ad189bbc6661c26e5c5383e256356e18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187124, "uuid": "84428d07-c579-4975-a1a3-1e25090b2936", "comment": "Malware payload (PureLogStealer)", "value": "6de7285d0cc15c6a4e265c57c3fb973b4751acf8c8dcb3c9271b3f73b3178cf1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187124, "uuid": "ce2f7fac-648f-4918-b77d-f4761c8d49a6", "comment": "Malware payload (PureLogStealer)", "value": "09a0779fbd3bd6c4c0afc0bf306ba5c6077f23d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187124, "uuid": "3bdb9102-15d7-441b-bd33-04bd14040b77", "comment": "Malware payload (PureLogStealer)", "value": "cb96b72e3220f415ed62b209a86f402800b3ad2688f8b4b6755d06c8fe0e57b1ad5c2b05cf256eb11f8359ac75b1e151", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187124, "uuid": "6a2b7c7f-d99a-4a2c-bfca-3514a4527a27", "value": "T1DEE52304AF88C639DF8987F8AC5B4D84EBFCC1A5A0D3E74BAC6564E55C0778B09062F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187124, "uuid": "271dc8d0-e3b6-40ea-a082-43194d39b8ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187124, "uuid": "541b8aa8-abd0-430a-b691-1b7f198ba2ac", "value": "49152:IT8K6GsUWfM8hYsZ/PcR3VOIzj2k30Pjb3bNlW5cJGqHbeMUisI8rhVa:ioG62sZ/0UKj21PjTRU5cgq7eMgrh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713187124, "uuid": "dee55222-a504-4777-aeff-a699104c45b0", "value": 3262464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713187124, "uuid": "8b3454b6-565a-40b9-a67f-e0cd74ba4dbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187124, "uuid": "98a3fc66-f75b-47e7-84ce-417efea0ff0c", "value": "S2990471194789300749 2024 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "130554c8-fb2a-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1713186862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713186862, "uuid": "45a9be3a-b204-436d-9004-e30ede6ab498", "comment": "Malware payload (GuLoader)", "value": "703313812e7eb2ae5f0fd8e57d3dd125", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713186862, "uuid": "7b9432e0-0cf8-482e-8818-3d980dba031b", "comment": "Malware payload (GuLoader)", "value": "6e8330fa5453528965d563426bdc2e03d6d36bd860da8aa6499675dcb80f9d35", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713186862, "uuid": "490bbb82-caf7-4994-8e10-097d22f8b94c", "comment": "Malware payload (GuLoader)", "value": "fc8bff9090347b291d37fa579e8edf02c1bfe01e", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713186862, "uuid": "e69663ce-e62d-4b46-9563-4c28f37cd565", "comment": "Malware payload (GuLoader)", "value": "8f69e93555805c89a3e83be71a6286f3b0a586aba0763251f9ba57ede2c769d5dac79f3cbfef81fe84cff93a41fae4bd", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713186862, "uuid": "4cff2252-7ccc-452e-97dc-8eeee061ed87", "value": "T12A946D60EE68066A0E4B279AFC911A92C5FCC219462710B6FEDD074E61075ECE3FE71D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713186862, "uuid": "298d92a6-36f9-4f15-8f3b-df0062ad11b3", "value": "6144:ltrc0iH9QXg0Ip+QUJFUWtBVkmqtcECDGk8FD3ZGGBXMV7:lFidQ0AzzfZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713186862, "uuid": "b33d4f52-8480-4cb7-a016-ec81bde477ad", "value": 412662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713186862, "uuid": "aa0561b6-6cd8-4698-b53d-382a22b9d310", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713186862, "uuid": "52baa3f6-81d9-477a-b247-7956a39780f9", "value": "PURCHASE_ORDER_SHEET_&_SPECIFICATIONS_0000000.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16661c41-fafa-11ee-a120-42010a9c002e", "comment": "Malware payload (PureLogStealer)", "timestamp": 1713166251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713166251, "uuid": "6089dcbe-710c-4112-9811-6c82ea153617", "comment": "Malware payload (PureLogStealer)", "value": "faf13222570e0483055345c82dec07da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713166251, "uuid": "0ff2ae7d-9c9c-4956-9e43-ed07379ba84e", "comment": "Malware payload (PureLogStealer)", "value": "6f2eefd23e33e862207e4b9e91baa29a34ad63aff6e5e76f6aafc747f1b97768", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713166251, "uuid": "865ae0b5-bcfc-4856-a082-09751b5b3b7c", "comment": "Malware payload (PureLogStealer)", "value": "e7fd20c5290201d144010850e37285f09b592dbe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713166251, "uuid": "6a7c4962-86ac-49b4-9d8e-feee132b10d3", "comment": "Malware payload (PureLogStealer)", "value": "f7d6f1a713f68f2f43813ca3592faf4dad8d9384ffcf3df141d5d60f41c072438069b7e7918d977457b84c2138fc6a9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713166251, "uuid": "9bd020a7-80a2-4a3d-95d9-0eac1c6284e8", "value": "T1AEB4E11123A1DF39E5B739305F27EAECDA2DB991DB6442F7231722AF2D702908623355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713166251, "uuid": "94f35a7d-df62-49fe-ad18-82be708fecfe", "value": "73d78b8912724f8acfba9df29f4a49e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713166251, "uuid": "5edfd223-320a-4420-a0bd-dfc54e5d1b34", "value": "6144:RWSicFcC1yNLlB7N/o+BJkp5QtBfwvUGSx/J1AopaFQve1P2FCLjH:VTFcC1yND7NrcPuBfwvEx/UdR/fH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713166251, "uuid": "94dd791a-d50e-4358-abd9-91addf313eb7", "value": 509441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713166251, "uuid": "dd4b146d-ca0c-4cf6-9974-d45eb1bc4c15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713166251, "uuid": "241cf4c3-750f-4b24-a8f7-26a5762eff7c", "value": "faf13222570e0483055345c82dec07da.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "263193be-fb41-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713196772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713196772, "uuid": "ad737ef6-2ba0-4b23-a7f6-8cf4c2ec0ed7", "comment": "Malware payload (Mirai)", "value": "82f2350dafca3e00154ad15ea3b27011", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713196772, "uuid": "6cfdd2c5-8bb6-46d6-8b18-8c0004c5ba46", "comment": "Malware payload (Mirai)", "value": "6f4cfc689ae1cccfdece570ce8c7ae511844688186590ec4cadbed32313db5cc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713196772, "uuid": "4a7ec98c-0f22-47da-8fb1-1ea7df314b8d", "comment": "Malware payload (Mirai)", "value": "bafcdabbfb67a62fa9c9f1aae43739f0a07c9bc4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713196772, "uuid": "a25aa7a4-3fd9-48cc-a86b-ebd4165960f5", "comment": "Malware payload (Mirai)", "value": "9944d016c861f3974728c6638d0e12fade9dbe9d27b3c11514758c3f853c87061b0e0e86d7983594994efb5034b5d560", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713196772, "uuid": "c6f57fc4-7c09-4c0e-bcb6-89ea74ffa7d8", "value": "T119730896F8415B26C5D012BAFA1E128E33231FF8E2DA32029D116F6477DA95F0E3BD45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713196772, "uuid": "d32e1cc6-682d-4b91-9c17-e6baae4607b2", "value": "1536:nhn+gJJ026cdZEXmTbkQMy4txbX9afHOHUXKexNnhUYIDN2qc/zVr:U0ALFyc7HFexNhUhXcbp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713196772, "uuid": "a28c5e15-cae7-4d64-bb95-44266469d98a", "value": 79504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713196772, "uuid": "b32c2930-034b-435f-a4b5-dce1844a272e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713196772, "uuid": "063bbd0b-cdf4-4528-adeb-10e7be7c6784", "value": "82f2350dafca3e00154ad15ea3b27011", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "792cafc6-faf9-11ee-a120-42010a9c002e", "comment": "Malware payload (STRRAT)", "timestamp": 1713165988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713165988, "uuid": "62100252-5964-41e2-810c-71c01688d516", "comment": "Malware payload (STRRAT)", "value": "dcb37b22b5c183d453cf14174a0da609", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713165988, "uuid": "f83615ab-f262-44bb-b983-36f5a25bd2af", "comment": "Malware payload (STRRAT)", "value": "728b5d6caf9ca9ca12700aa46ab59dc04813f7d9e94595504c81199504809a1b", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713165988, "uuid": "035c3d91-a0d4-43d2-acaa-3192b20b5b56", "comment": "Malware payload (STRRAT)", "value": "2fa832b818eec6ffa59bd10696e0415f4ec417f8", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713165988, "uuid": "36922dd6-d51f-4cbe-9e30-8bd3733fe579", "comment": "Malware payload (STRRAT)", "value": "3a96a4a8cd6a8cf8539d8579b6d86c5b8e3360fb35fd09d308936aa6a8de38d5122dc024c79f3c474f2c12e5dc0bab0c", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713165988, "uuid": "be52136f-8943-4f19-b6e0-462634d4b76a", "value": "T1B2B4123E7BBFE168E007A93109498B65FB0E222AC144915BF2EC15551E34D4EAB13BDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713165988, "uuid": "6830d325-7d9a-4b70-9852-291b035747ea", "value": "12288:7RKa+SLa3ZIMwyL6dfsoKMlBynA0YCTcEkVm6E:7Pt2KjyL6dXKMaAu6E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713165988, "uuid": "f1238bdb-25f4-4984-85c4-a254f8300e48", "value": 533568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713165988, "uuid": "0a3fd606-807c-48d0-87cf-2f6300aef915", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713165988, "uuid": "b5c91958-d92a-4d9b-9de0-de7d5c4bd9f6", "value": "RFQ Img_Quotation PO 202400973_pdf.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59fa911e-fac9-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713145320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713145320, "uuid": "8e16b73c-c42f-4afb-adbe-9ac87e97a895", "comment": "Malware payload (Mirai)", "value": "72abc6882490bdcb780ecd74692009ef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713145320, "uuid": "43abfb68-2eb9-4baa-a9cb-13bdf672f43b", "comment": "Malware payload (Mirai)", "value": "729a0d3da1e35f78c85fe85a72bcc3cd37272a0653894747e7ac526d3055dde4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713145320, "uuid": "bd79a271-8f29-4f17-84c4-a5e6f189a855", "comment": "Malware payload (Mirai)", "value": "303a2fcc93f713bfcec6c06310ca7f97a5abf057", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713145320, "uuid": "a39409d2-ca06-4ae0-a1a4-ccd3944d237f", "comment": "Malware payload (Mirai)", "value": "b53210d002dfc771c2e9f8d9d545e93cccf693fd3353562b9cd86e601932a72a250555eef2ea3c1eed17881f7aef972a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713145320, "uuid": "f6e051ed-0977-484d-8043-aabfc0cb756f", "value": "T1A0534B32BA761D2BC4C4687A61F74364F2F6474A25ACCA1E7DA21E4DFF20A4022577F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713145320, "uuid": "0459ed05-e7b7-48dd-bcb4-6207b17e02ce", "value": "768:8bocq9iWH8OO2SrjvpsC0DRRML8Oj+Ceq73O+YM5VptOrYT1tmVITHW:8bJSiWH8OO3rjbeAL8Oj+8fYM5ft66HW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713145320, "uuid": "b537e3d1-3e4b-4004-a49e-cfcfb58f16f6", "value": 64956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713145320, "uuid": "d51ffc20-e6d1-4d2b-b1df-08782d2550c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713145320, "uuid": "d6c43a67-07bd-49ac-a1aa-6703079bb61c", "value": "72abc6882490bdcb780ecd74692009ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61852708-fabc-11ee-a120-42010a9c002e", "comment": "Malware payload (MooBot)", "timestamp": 1713139749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139749, "uuid": "442e29fe-1179-49e1-821e-c1f1bfed9ba9", "comment": "Malware payload (MooBot)", "value": "3e440297b5c3faa0d713ab57ca3d6ffb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139749, "uuid": "d533f846-722e-4c80-b04a-497151fd55ac", "comment": "Malware payload (MooBot)", "value": "733e3ff7390f47d5ef9b9ba5d48eabf8d1010c50d46c4b3785fc75735d478114", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139749, "uuid": "ddb1410c-4d94-4ac6-9034-351b98d8fa60", "comment": "Malware payload (MooBot)", "value": "d57f71d834df3b3d954baa5e25e0526a9fa61b95", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139749, "uuid": "a27c25b3-ad6d-4f8a-884e-94494e8b78b3", "comment": "Malware payload (MooBot)", "value": "c9c4d3e94f8e861dc6322ffec002c05408fc2f409ad089d1f3ddcba19f2b077d095852fbe819a0fc5e1e1e15251d48b7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713139749, "uuid": "e00770a4-d76f-47ea-82c7-0535fac68dcd", "value": "T14F6318C8EA07D4F5DE0B0E300167F23FBB72A265C975DCAACF956D02EC57812540A7A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713139749, "uuid": "28acefa1-fc6d-4082-93be-553b3ffaf3c9", "value": "1536:YrtV6ju4Rsndrpk0LfRDXwceoWBSkjrwbZn:YrtV6/RIdrpkkfJXeD7HwbZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713139749, "uuid": "ebff196a-e0f3-470f-820e-695594d3254b", "value": 72444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713139749, "uuid": "24628b36-f83e-4e30-bc72-5afd5d339bb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713139749, "uuid": "9eaf9130-d7fa-4dad-8a07-4eb91897f6f4", "value": "3e440297b5c3faa0d713ab57ca3d6ffb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ccc83f9-fb36-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713192086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713192086, "uuid": "8d13439c-ea85-4db3-9982-8c42a63f6401", "comment": "Malware payload (AgentTesla)", "value": "3fb2feebe61aacc6e252cc319edb7a54", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713192086, "uuid": "dbb9f527-5d27-4bd9-84ff-7b1cc90329ab", "comment": "Malware payload (AgentTesla)", "value": "73e106e9e2c84c0c0d045e5d368c09947e052f793a1deca61af93fda63d507f3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713192086, "uuid": "eab8c131-16a8-484c-b649-c798fe50ab3a", "comment": "Malware payload (AgentTesla)", "value": "18c96e0d1abcb1480234eb69507e9c645dcd1290", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713192086, "uuid": "66d9a28b-7847-4db2-8112-eb4fb6962fcf", "comment": "Malware payload (AgentTesla)", "value": "83ab8770476092ead4624134f14d48675255ee6961b291f8fc19e3f7ee6cab3366a5ff8c5456236b28857a17d480d3a4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713192086, "uuid": "cfaaf0a0-4b4b-4f2a-8a73-e66470e59ccc", "value": "T1A0259D0273D1C036FFAB92739B6AF24556BC79254133852F13982DB9BD701B2263E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713192086, "uuid": "2ac14c4c-6fb5-47f7-bda1-41368b18dfed", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713192086, "uuid": "b457b95b-24a8-4125-a330-dc91e42144a8", "value": "24576:cAHnh+eWsN3skA4RV1Hom2KXMmHabEZoN2YY+IJ6ZH5:7h+ZkldoPK8YabcUsS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713192086, "uuid": "6fd66619-c5c4-497b-810f-32900c38ed45", "value": 1035264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713192086, "uuid": "7e799960-48e5-4447-ab19-ee953c75f9db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713192086, "uuid": "33241d7b-8bfe-4b30-b991-4a5bb05a7077", "value": "Comprobante9104693309876003.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c6e07ae-fb2d-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713188246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713188246, "uuid": "a0bb5d33-68e8-4bf4-8710-83926019a644", "comment": "Malware payload (AgentTesla)", "value": "cbb451271c8f94000c3722cf737d0468", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713188246, "uuid": "075e6825-5910-40b5-bbbc-e4a626696c09", "comment": "Malware payload (AgentTesla)", "value": "753bbb7228606df1a0d1553f437bf748070783a7c630686f12e66c0ed0e02253", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713188246, "uuid": "f6b091d0-2bf9-4d8a-a210-6301fae66679", "comment": "Malware payload (AgentTesla)", "value": "29a94ab7f7fc64e6fc57173e7e7088a4fb1241e3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713188246, "uuid": "36e4dc92-d2bc-46a1-bb5a-67b9f743f093", "comment": "Malware payload (AgentTesla)", "value": "0de8896de4283e25b8a032c77c189619b6dc5124de309d38a8e897fcd5700c8944cfbffaadb2499ef712f49bb0a76af6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713188246, "uuid": "091ee3dd-d6a8-46a7-b419-c6daf2ffb238", "value": "T1FBE42310BAADD717C27A43F4586041112BB3945B1927E3CF4DCEB0DA66B2F34927AE93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713188246, "uuid": "2b1c55c8-8064-4db3-a526-8f4ce546eadb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713188246, "uuid": "24de90aa-85ae-4428-bf56-9a7c7aacd0ac", "value": "12288:waAvEzT370osf+xaCSmNVl7GL/KVI3dw8FQX4DZ+SKLlAprgOxJ3i8fpz:wLfDCS47e/sI3rDqLlAprfCmz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713188246, "uuid": "b557771d-800b-44b9-b1fd-7f49cd427492", "value": 667136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713188246, "uuid": "a28032e9-575c-4004-8736-e124de67b00c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713188246, "uuid": "3d177057-4e7d-448e-bdfe-142db557d263", "value": "PO24-0626.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b21485ef-fae7-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713158352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158352, "uuid": "21d5c0ff-99a5-4cc3-b68e-e2bc771d126a", "comment": "Malware payload (AgentTesla)", "value": "33a57e36b93588f026574b4a3f748443", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158352, "uuid": "627c3d4d-3a48-40f8-8a57-576685377264", "comment": "Malware payload (AgentTesla)", "value": "75c96c8d4e720fe1290200707fcca94188b4525dcc8ae2f1dfe49068b7bb3e83", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158352, "uuid": "388f5a23-ca90-43e2-942e-326ce295fae0", "comment": "Malware payload (AgentTesla)", "value": "5b29dc2969a512aaf8ecef5bae9c10ab1c9ca571", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158352, "uuid": "506cb87f-794e-434a-9357-5c40fc6d33c6", "comment": "Malware payload (AgentTesla)", "value": "9fb137e2978dc968ddbb047dc76f400839b7cb9091d779b1f3d9ba0b2644465ad8a3d11c021bbc30aa1008da5e066fbd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158352, "uuid": "58a71844-ce30-4ffc-9301-b80a611f65fd", "value": "T10DF4126076AD8B77E6AF17F9882D206007B0B776B136EB0D4CCA90C91564F019ED1EDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158352, "uuid": "bc413e76-43f8-42e4-84ee-1e7b8fb1321c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158352, "uuid": "2667784f-fbcb-4910-b6a2-3f688ee74b48", "value": "12288:ca0NBK+gv85YJ25t9WA02qgwx5zZZ4mIPlcx4Cv1/BBs0i/7rhLl:z0NDAJmh02qgwxzZ4sXBs0IF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713158352, "uuid": "2cc2a184-e569-4ba8-9e51-22589e0d2a3f", "value": 766976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713158352, "uuid": "95f9b21d-d25f-4bc1-9ccf-f2d79f7527ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158352, "uuid": "fa80cac9-f609-4769-aed9-15de6c86752e", "value": "SecuriteInfo.com.Win32.PWSX-gen.15705.12320", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79505582-faf6-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713164699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713164699, "uuid": "4ca2191a-7b4b-42bf-a394-dc64b6d991c5", "comment": "Malware payload (AgentTesla)", "value": "b83a6713728f46f6355c75d05bec7211", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713164699, "uuid": "f084bf34-52c9-4534-babc-56c837b8e35b", "comment": "Malware payload (AgentTesla)", "value": "7845739be7bf4d602cbaa0f0a900bea3c631c439eb57fe53d92b3686c49c4b80", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713164699, "uuid": "3d57d7ef-d922-4762-bc4c-eb93af0bd036", "comment": "Malware payload (AgentTesla)", "value": "a6d9a0f262596cc59b7e5c68743e766045a20fcf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713164699, "uuid": "6fa415f0-7ff1-47ad-97ae-9e71b37369f9", "comment": "Malware payload (AgentTesla)", "value": "ef2622de68bfccf22c50608a282b3b60e4f85bbd0418babf84340f1809cbbc6993b1b119d772b62148f127a39e113d20", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713164699, "uuid": "aaf1c7bd-dd55-4c40-b9c4-4f736b240057", "value": "T178259DA12265537EDCBD45BCB02090B6CE66BC270606D4AD8CD13D9B3D79AE27470E3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713164699, "uuid": "4ae6ef35-36df-4528-9c85-812804f86167", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713164699, "uuid": "85c13a24-8cf8-4a71-81a8-b58eeecc9db7", "value": "12288:dFY4NBNuZ0XXWm67PCXZIj5MFqyHivmRykwCck0p:U4NeeXYrCXZc4/2p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713164699, "uuid": "e86fc7d7-4f73-44ce-81e3-0da90d3fc95e", "value": 1024000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713164699, "uuid": "8975dd49-b9d0-484e-ae08-bea9bcd7b8fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713164699, "uuid": "e922abd7-76a3-4991-9660-a9a083fcab6e", "value": "RFQ 1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "076da25a-fb06-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713171380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713171380, "uuid": "52047522-61f9-466b-8c73-a4360f004f85", "comment": "Malware payload", "value": "3b79755738d8b8cbefb3e70a622d8089", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713171380, "uuid": "b1e308b3-ed34-4732-b0a2-2e6d3dd455bf", "comment": "Malware payload", "value": "7a9da7d10aa80b0f9e2e3f9e518030c86026a636e0b6de35905e15dd4c8e3e2d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713171380, "uuid": "2cd8050a-2c71-4c3c-a785-ce8d1857f24b", "comment": "Malware payload", "value": "a0f5bcb64291b174c3ac2ab1da0a9ecdacefe1cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713171380, "uuid": "9665bd76-9534-4b92-afe0-9c0fd37d24ee", "comment": "Malware payload", "value": "1ff95771913f5b147bab6fa3d1c2bcef436b43c53035eaef012db2e2441e60b1158599c1fc56898e0b96648e2983c46b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713171380, "uuid": "a6d118e6-93de-4d44-a4ea-775b54b77dd2", "value": "T101B67C73905324D8E1A889B4D51416527DBC3C8B5738A3C7BAC471F66BBABE48E39730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713171380, "uuid": "50ec33a3-b2a8-42ce-873d-1f93dda0a2c1", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQf:cqYUQuVDt0TZE8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713171380, "uuid": "f14dc0c9-ee9e-4bd6-a632-833b69c147b6", "value": 10485760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713171380, "uuid": "5d0dc34c-89cc-4933-82e3-725176da19bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713171380, "uuid": "5831e161-0199-4da4-9792-3cf2177e9658", "value": "7a9da7d10aa80b0f9e2e3f9e518030c86026a636e0b6de35905e15dd4c8e3e2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1332080f-fb41-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713196740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713196740, "uuid": "d65039c9-c9a6-4ed5-86d6-52a17ce34934", "comment": "Malware payload (Mirai)", "value": "907573d66197e60c0d60f8035fbda5da", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713196740, "uuid": "5c15c497-54e5-4922-b0ef-f06e25ffb0aa", "comment": "Malware payload (Mirai)", "value": "7b0605533c6ce7ffa67f2644373733c73fc5c3c9897ca5211b012b85b10ef4f0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713196740, "uuid": "4d0ef771-8e82-4b0f-9f3a-b4e3ba40bbe3", "comment": "Malware payload (Mirai)", "value": "16049f8153adfdfad5d69a03bcf99d9315531e22", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713196740, "uuid": "8cc6f6e5-db7b-4fd8-9da6-d2568688e6e1", "comment": "Malware payload (Mirai)", "value": "86a22daacac8334ead4cabc218d1893cd2c2b3fbfa413333276e2d3b7a5557682f89c4f5d7732c94e8bd13ac53814280", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713196740, "uuid": "086fb07a-7954-4f9d-8528-139b98beca28", "value": "T1F5042A46EB404B13C0D627B5F6DF42453333AB9497EB73069628ABF43F8679A4F22905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713196740, "uuid": "83b73153-12c0-44da-8547-d35cdadafd47", "value": "3072:nS/NsuhjlvbAmfkIaboVSyckpj/HS0BpGi/hJjogM/RXC/Ht6:nS/HlvlcIaboVS7kVdBEi/XMgM/RXC/0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713196740, "uuid": "ef39a83f-d499-4244-9c85-82e114ffd3cd", "value": 179797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713196740, "uuid": "7eac0e5a-7d69-4a64-b6d8-d017fe76ccf3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713196740, "uuid": "b9783083-8ca7-42af-b48f-0d30256870f2", "value": "907573d66197e60c0d60f8035fbda5da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d8dfe94-fae9-11ee-a120-42010a9c002e", "comment": "Malware payload (LummaStealer)", "timestamp": 1713159016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713159016, "uuid": "3573127d-eccb-4853-9e6e-50dae523ddb9", "comment": "Malware payload (LummaStealer)", "value": "36f9e06e144b2c3094f2996e2c9547ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713159016, "uuid": "8cfb92ff-a2c0-4818-94d0-997b3cb5fbbf", "comment": "Malware payload (LummaStealer)", "value": "7b40df38252a0aeb2050fe919565fe573d4766552a86570f9fdedcbfa9f8abcf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713159016, "uuid": "c91ced3f-8dce-4a48-b9a0-7de462d52f34", "comment": "Malware payload (LummaStealer)", "value": "a425a1c82065bb277c7e4e9cfcd58e92cd2ca805", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713159016, "uuid": "e6296320-1747-40f1-8ca1-5c18508fbc31", "comment": "Malware payload (LummaStealer)", "value": "30bb5911b3dd07a90a25e0d2954f03bfd7a245ba759c057f637385bca3e04d7362d27a3ab6fec2ecebf65c57ee1937c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713159016, "uuid": "2c73bb79-c6ee-4e21-af8c-56f132cbfd0d", "value": "T13694F15136A1E43BE55719705D39CAF12B3EBD21A660868B7360FBAF5F702E1C123346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713159016, "uuid": "3f0df12d-91f4-4604-96db-a06a4bd8cdfe", "value": "d0eb7b8c702cd1b9d76bcc539912ddcb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713159016, "uuid": "f1c3f684-37fc-45fb-8157-1a72d7aeec2b", "value": "6144:0LahtopnrKYAR6C4gxjXf/G7frAktDm+Z7UgjleiXkkj:0G4prWzDJ/GBEUlr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713159016, "uuid": "3df80578-d5d3-4070-b286-ce10f940e8a6", "value": 425984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713159016, "uuid": "bfc78c3e-1510-4980-bdc7-40a009e82deb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713159016, "uuid": "2cb5468c-9442-49ef-af14-809c334c74fb", "value": "36f9e06e144b2c3094f2996e2c9547ee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8578bf7e-fae8-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713158707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158707, "uuid": "37de461c-64d0-48db-bad3-003a41f90135", "comment": "Malware payload (Formbook)", "value": "8fc1cf13c19413d2c40d8857097c9dde", "object_relation": "md5", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158707, "uuid": "47b2d7ee-4354-472b-a195-e228c673f11f", "comment": "Malware payload (Formbook)", "value": "7b46e18553596108a5934361810af8e1746ed73935229b2f4c14011860dd5be8", "object_relation": "sha256", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158707, "uuid": "8569cc81-a45c-463a-a0a7-dc6d8e5b0272", "comment": "Malware payload (Formbook)", "value": "4d9864a94cf47f0f8e7bf43371cf209fb7ba9685", "object_relation": "sha1", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158707, "uuid": "c9f18b51-c166-46f6-9cfb-9f7c7df83e2b", "comment": "Malware payload (Formbook)", "value": "ea5e8780835ef468e34c82c5288f32f59582216f4beb473348849b5c1a6b109e84477765a18f9a3a73b05f47b1e844a4", "object_relation": "sha3-384", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158707, "uuid": "7700562d-cdb9-4a69-bb39-31a9c39f9083", "value": "T14594AF5263ED5008B2B33F04A9FA91258B3BBEDA9C79C54D058C5A6E0BE3940CD757B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158707, "uuid": "2267e75d-dd8e-426e-980b-bd1f42395fc9", "value": "3072:vHGR7cSYFEhNe4VTdRnTT8w4TWXZqc4gsdpe+og0S7wQzS18f8d6bb/g52r:27cSYFYZqx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713158707, "uuid": "bba2f53a-7634-423b-b181-ea415fb65bf8", "value": 409068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713158707, "uuid": "c9be154e-aa7d-42d9-a8ff-2548cb52009c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158707, "uuid": "26206126-f996-442d-80f6-e0a9d68998db", "value": "fedex awb &Invoice.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d969c4fd-fae8-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713158848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158848, "uuid": "377ccf91-19d9-4bb5-a066-d34410825f9d", "comment": "Malware payload", "value": "57ecbc8eff99548a5c31e1f60ea86fd4", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158848, "uuid": "64d9710a-b1c7-4566-9b29-ca12cb16e2a4", "comment": "Malware payload", "value": "7b6c757afc9a67f8bb23c2ea6a057434f242a4651935d73d6ad9200643608646", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158848, "uuid": "3cfef267-fdf1-449e-9fd8-48a12faf6ad8", "comment": "Malware payload", "value": "32a4cd77b9313fabcd0c6db6281dc06ca6bd290d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158848, "uuid": "38573d71-f4ec-4a7d-975a-af82c2a51552", "comment": "Malware payload", "value": "b2cc2dc735c6e9ea6ae4f566aa8b344848ebf83bd21f24072927af33cd342cf8b94da052e78bf59f8d3acd9ab3923666", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158848, "uuid": "adbc75fa-877f-40b4-9ba8-98ac522a0678", "value": "T18B53CF9AB68B4E43F0694EB240D3C10A7529FD6DED515A635B8C7F1DFCB12B24921B08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158848, "uuid": "7c842463-1ec3-4d00-9783-c7291905357f", "value": "1536:OMnHpuLpv8jbBx5Ky4Kln5wHXG6aLoEsQk:vJuLR8jtDf4Kln5wRaLoEsQk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713158848, "uuid": "1ed8fc3f-c0a6-4f0b-bf18-484802b33832", "value": 60928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713158848, "uuid": "998b4d8b-5b65-4551-81c9-1a7e3e636c5c", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158848, "uuid": "f095ffa8-09cd-4fb9-9025-534306b77caf", "value": "2024\u5e74\u8d22\u653f\u7b2c\u4e8c\u5b63\u5ea6\u52b3\u52a8\u8865\u8d34.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a845ecb-faf1-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713162473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713162473, "uuid": "986849a3-b2cd-4175-9878-da6d6f76c92b", "comment": "Malware payload (AgentTesla)", "value": "48a9554413e1893bd21a8e1b31d42d7a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713162473, "uuid": "6d3edd83-c306-447b-8ccc-ebf5d3641325", "comment": "Malware payload (AgentTesla)", "value": "7c7a8c8c4c2bcc488c2eaff4baad7d097118b3127deb59c8726f7e4f4c2dcbc5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713162473, "uuid": "05f925f7-5b17-443c-aced-9b54a57d461f", "comment": "Malware payload (AgentTesla)", "value": "fec047f7b1c0a04666969c3413dffb48bdcade53", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713162473, "uuid": "99d41961-5ebe-44da-a2f3-c894159cdeec", "comment": "Malware payload (AgentTesla)", "value": "325cbb39f8c6df3a7cb766fe2c8aabadada4f34e8b1f529fd3c6bac81247d6d198c924dd8c2b3749b5eeab7b1f888461", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713162473, "uuid": "57f92f92-4ddb-4ac7-9532-4ca25d9cffea", "value": "T1B763CC6AE34F0915DF5596BB434A4B4A05FCB33EB38540A139BC57743BADC2E4A2287C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713162473, "uuid": "b1f251d5-1547-4d61-ba49-b0ab2180b172", "value": "1536:aG5d5pXKc0aGmXb+VlVmcCJFnxvHbOmt1YJt0oQG5J6qQty8mbNhqfWgqOwz2RL8:aGX5pXb0aGqbIlVmcCJFnxKmt1YJt00L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713162473, "uuid": "64d7f776-0ae4-47f1-b237-89959842731d", "value": 73315, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713162473, "uuid": "37ed502f-b37b-44bf-bb73-57db1c21543c", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713162473, "uuid": "b12f4b0e-4fb6-4f02-b931-26d8d7300e6c", "value": "48a9554413e1893bd21a8e1b31d42d7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8aec427-fae8-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713158820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158820, "uuid": "014e2ef5-44b2-4937-9787-7f5257b685cd", "comment": "Malware payload (AgentTesla)", "value": "6a4c52a86dc20679d836a4cc5c9e7280", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158820, "uuid": "ee22dc07-6e56-4bc9-bc37-1358f9f3e0c4", "comment": "Malware payload (AgentTesla)", "value": "7d17f84cab786296bb3ac7001e3706f112db5b69c82789b709f6cec2ea0fd116", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158820, "uuid": "f58adb3b-2a64-4939-8792-87b47b753136", "comment": "Malware payload (AgentTesla)", "value": "de5060be89dd653226a8251b04c6726ce1d7e846", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158820, "uuid": "0bbf1e03-136b-4bb9-b8cb-413946e5b6f4", "comment": "Malware payload (AgentTesla)", "value": "ba62896db08dc2e7bab0183bc664d8049972a7cea979f9deef71bffd2763048937645404cc80d790d475798ff4ff813b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158820, "uuid": "042a8817-c3ef-4bad-a192-1f702bd34638", "value": "T1E5F4235432BEEF33F25B5BF8183894A017B275BA7568E3898DC650D93024F815BA0F97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158820, "uuid": "163811ad-1e0c-485d-9520-9eccbae4e0e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158820, "uuid": "4341d9d9-2eba-4715-9de2-870ed44ce69f", "value": "12288:QkBNBxgP5SKmY/Q2jVECsa/xhwK8/vXKKJfhwzRogC2Aff:FBN/gPW2VE0w/v6YhCogC2g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713158820, "uuid": "63e8b1be-b008-49dd-9ae6-b0ccea209b2d", "value": 780800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713158820, "uuid": "df9e93e8-2633-4ea4-a46a-1494d0808854", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158820, "uuid": "90d8ce01-0d31-484e-a596-353c0b406617", "value": "AprilOrder.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58f999ce-fabc-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713139734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139734, "uuid": "899a1cb8-93c5-4626-ad9c-af76ee6481b8", "comment": "Malware payload (Mirai)", "value": "95d0fdcf1804d2d0c637a8e7fc06beba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139734, "uuid": "1495c9ba-8b97-46d3-bad8-057037c57122", "comment": "Malware payload (Mirai)", "value": "7ef94d009dc63e28502cbbf798e2a3663cba1c5ca25a156e85a67838fe932813", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139734, "uuid": "6c2827bd-46a5-435c-86fa-844953255203", "comment": "Malware payload (Mirai)", "value": "115201c120de3908ddf57505b8234c663e319314", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139734, "uuid": "6f007e60-82c7-4e49-8527-559ed8adb8c8", "comment": "Malware payload (Mirai)", "value": "be0dbf99d242b3be003179c1dbc08d69a41d670df262c0797a04e24290963554da3ca3390fdfab16f9445e62cbb4db91", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713139734, "uuid": "12038eac-41f5-45ab-b9ca-8b7b565a306c", "value": "T1AC835B17C1215DA3C4861FB916BB8A383353A8525B571E35571AAFF84A43ECCF8883B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713139734, "uuid": "9c7d8d19-224d-45a2-9c86-c31681ef3596", "value": "1536:YZief06wWr+Va1bBuQPQDLLAdKw1ToBMSTpAl1YwbZnh7+4Quf:Bm0b+11t1MCowbZn9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713139734, "uuid": "8dc21647-9ea0-4b1a-9bf7-e0dc9ea20d84", "value": 85372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713139734, "uuid": "68add31f-59ec-452c-a156-442a54f2d1b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713139734, "uuid": "3c46beb9-37ea-433a-b166-d70508d0cec4", "value": "95d0fdcf1804d2d0c637a8e7fc06beba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "543bbacc-fb49-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1713200285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713200285, "uuid": "4015b4ef-cd3a-4001-9d2a-d716e954305f", "comment": "Malware payload (GuLoader)", "value": "62b1851f873f61b401baa6e062b4d510", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713200285, "uuid": "bf2f707b-be5f-45ba-9bf5-b216431c5928", "comment": "Malware payload (GuLoader)", "value": "7f26ebf0414031ce3dcdfeb435cd97877f13a0d23a5cb48fb0407ea64a277086", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713200285, "uuid": "34f24224-fcbd-4133-9ec0-85ce99b3ebbc", "comment": "Malware payload (GuLoader)", "value": "034c0bab6019c37e273f48d40b46bd513532f877", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713200285, "uuid": "41b049ff-9261-43c3-a037-52e646d4a68b", "comment": "Malware payload (GuLoader)", "value": "3cc48e65d2e1a4d43a5e67d00cf78bcce282cab652815acb59e334fb8f93251fa87d6df007660c6f04b1625df0c5328b", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713200285, "uuid": "60118c22-4669-46ed-ab35-044e30bd1165", "value": "T1A02409F0CF0B36199F4B3EDAAC6445928AF48195051638B5AAD817EDB283D2CE3FDD14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713200285, "uuid": "1d774155-4b9c-42d5-94b5-531630f1305d", "value": "6144:SYBgIjQvrMbWSR4WHUJJs9E87Fy4lZrUChpqKmjum4QlNVrDjXR46cCPCRJflKq9:H2dOeq56C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713200285, "uuid": "737b6696-72c0-4209-95cf-3135477c3d53", "value": 215985, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713200285, "uuid": "2f276165-9224-474d-accd-2df41d01c577", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713200285, "uuid": "5c574be1-4e80-4968-a179-548f1f41de56", "value": "rRFQ183494.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05beef7e-fad7-11ee-a120-42010a9c002e", "comment": "Malware payload (LummaStealer)", "timestamp": 1713151191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713151191, "uuid": "6f250e21-8f34-4bfc-b37b-7ce6b2549c68", "comment": "Malware payload (LummaStealer)", "value": "945b79b0cb128f7a270cd4b793c01491", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713151191, "uuid": "71d20909-5d67-43e7-9acb-be24734872bb", "comment": "Malware payload (LummaStealer)", "value": "7fea54a29707260f6d2d02534a8c4b1c2ea2fb43b98a1125cec28b7b0a430df3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713151191, "uuid": "f49eedc0-02af-4c4b-a2c3-086a7c46baa4", "comment": "Malware payload (LummaStealer)", "value": "e9b14f2d7de74478fb4469c9022a5f346a01c273", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713151191, "uuid": "1a407b24-5173-4125-9d2c-4c46ad4f7377", "comment": "Malware payload (LummaStealer)", "value": "f1d92a8b15322de4c1241979d3f8aa7d33ebae137ab599c58bf39fb51324159790da3b538858b084e53b2f11eda5412d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713151191, "uuid": "0d0a5e0d-59b8-4a7f-8406-c821dbeebf90", "value": "T1B474F1127A50D873F4420570852BCAA07B7E78626ABB514FF254277F1E33291EAF6732", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713151191, "uuid": "b0d3bda9-eceb-4a10-b4d2-fe28591ad997", "value": "98af45fc1e3d04388a273c7f97e712bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713151191, "uuid": "db4a38f7-0672-498d-b5af-aaf53ea10b80", "value": "6144:MLjsoc8qfLllfHNpjwKL+D9ruHjw9unJ3W:M/so03HNpk4OxuX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713151191, "uuid": "09760320-4255-4ca1-b2b7-b9a099cb22e1", "value": 369152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713151191, "uuid": "34663240-d9c4-4142-b605-7fcb3de21cae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713151191, "uuid": "34fbadf1-9cf7-403b-a94d-d269dfe6465e", "value": "SecuriteInfo.com.Win32.PWSX-gen.3511.2089", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f644ad8-fb41-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713196788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713196788, "uuid": "677ed280-f68f-43f9-9cfd-7f2a4779c79b", "comment": "Malware payload (Mirai)", "value": "69c5e67bd86c9f1462cd9d968c05bcc5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713196788, "uuid": "b2d30908-a092-4c3a-988c-6048469ed9a5", "comment": "Malware payload (Mirai)", "value": "812ce0dd81b38aa0b2f9fe8a8aa53bb46091b4c41ca006853e2c1d9cc3791f0a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713196788, "uuid": "26f08e80-4bc8-4bc8-9ef6-c075053297e6", "comment": "Malware payload (Mirai)", "value": "318aed0c96f782d304c60e70efea86ee1c121932", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713196788, "uuid": "9fd4d5d2-6fab-4f6b-b2c4-63940aa7d4cf", "comment": "Malware payload (Mirai)", "value": "76a819f06f4e72d3149ee4852ef44e988eab4b98795f66d2baa33cf7fa91fe752c5db679ed5dd5e816800da74751f3fa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713196788, "uuid": "fabbb9a2-2020-402e-8463-11395dea05ec", "value": "T11D537C31F4142CB0C85215B4B438DEB40B1368F552D92CB25EADDA9518A3EEEF58DFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713196788, "uuid": "972beeaf-0934-4030-ba40-f9141e6ee8d7", "value": "768:xBENyYufhyHBJym3xigB8nK7S54H/uYIFrLVOhBimhl3a1cZI1QEw/zFIEr:2y+BRL8Z54H1tBicZGQl/zZr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713196788, "uuid": "3020eea9-9d00-4a69-865a-0d6b1fb7a6be", "value": 66468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713196788, "uuid": "3b33a574-b4c7-40d0-aaaf-309d12e13389", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713196788, "uuid": "05920d5a-f035-4c90-9ba8-598704ea02e6", "value": "69c5e67bd86c9f1462cd9d968c05bcc5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64c6bd5b-faf4-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713163806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713163806, "uuid": "3d45497f-5689-4c5a-80b5-51b3c6cb9fd0", "comment": "Malware payload (Mirai)", "value": "6cc3041b0f9b56c38e92d7634d41cdb8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713163806, "uuid": "c93ba96a-ced0-441b-a4a4-ea9375fc031c", "comment": "Malware payload (Mirai)", "value": "81d9234f062dbdcd55de4e2e9a8889fb3af3fd907a21cb149411b0cd42dc24b2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713163806, "uuid": "7f53e22f-6977-4b29-b138-6fec80f405cf", "comment": "Malware payload (Mirai)", "value": "86c1f27b1e6cb7d79db16ef62a6a9f49d2f4f3c2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713163806, "uuid": "d516f624-075d-451b-8240-d3228a4f4c96", "comment": "Malware payload (Mirai)", "value": "26cbd7e7b05b38a139aa93910c842592f59a8638fc1cff0d2f89abe29ff835e12019d043abe28890582724065e79ec0c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713163806, "uuid": "223fe68a-829d-4f02-8f4b-3fd682200a22", "value": "T12FF2F1AE522CC0FAC5EB67B02358560E9EF2F9963F6CE7134551E2112E011B465B367C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713163806, "uuid": "cf0b89db-0841-45f3-8ac2-97beec0f0e6e", "value": "768:5zHlw3giGjYfOdJT7E7dfbnhVsP3REYNNaO4tiNN+YQ+yDdR:hlwVGIOTI7tn/svREuNaO4t/22R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713163806, "uuid": "010e0ddb-fabb-45df-8b84-40606016af48", "value": 34512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713163806, "uuid": "7cb88337-3126-46c0-8b7b-ee0ff1c9e0df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713163806, "uuid": "df63fd9e-852c-463e-8c2d-972d4dbf9efa", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab80670c-fb2a-11ee-a120-42010a9c002e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1713187117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187117, "uuid": "8b58d7af-e271-4ada-aa46-d30b0c6a84b9", "comment": "Malware payload (RedLineStealer)", "value": "bc650b75fe10b6db04e257eb03cac6e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187117, "uuid": "b028c52c-66db-40a5-809c-bc109f44a5cc", "comment": "Malware payload (RedLineStealer)", "value": "8212c8a599c1b2f86767d917116331092dd721c408004743bba406c2f80270da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187117, "uuid": "2a83e47b-5e1e-45a5-a560-6304136677b7", "comment": "Malware payload (RedLineStealer)", "value": "aa9c4ecfc7466b1f1cdc5b7457d3bc0090784b64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187117, "uuid": "e8f0189e-317b-43f6-b417-a4628d98a293", "comment": "Malware payload (RedLineStealer)", "value": "91d25a6206f12570a3fd93c0702afe0b81eb574488e6bc6278561a6c8f773119229917dd14f386159d21e6d37bbaaa00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187117, "uuid": "40fb8966-092e-4895-a40c-db4d17793d5e", "value": "T13E55BE0273D1C076FFAB92735B7AB64946BD7D294133842F12983D79A9711B2233E623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187117, "uuid": "b46d6b88-1357-49bd-98d7-bc372a523b3e", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187117, "uuid": "5ae18d1c-d9f9-4d3a-b2a4-7b1d5b32136f", "value": "24576:2AHnh+eWsN3skA4RV1Hom2KXMmHa1VglI8cKHn/5:Rh+ZkldoPK8Ya1Gi4HR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713187117, "uuid": "005dba42-8743-4b57-b1cd-2a4fd8c20a55", "value": 1342464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713187117, "uuid": "dac99306-b147-4dc2-8863-d79af758ada5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187117, "uuid": "73f78d49-86ee-42d7-869c-fa7a6b5187ab", "value": "PO50332011.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc921adb-fb28-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1713186341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713186341, "uuid": "85095a18-4aa2-4f64-ad96-e7c18138b289", "comment": "Malware payload (Neshta)", "value": "a40f32931f347c2a295c3169a0d90049", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713186341, "uuid": "1f05a762-b7f3-434a-8ba1-3ab631c4e1cd", "comment": "Malware payload (Neshta)", "value": "849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713186341, "uuid": "8d1a6d3f-64c0-4bf4-b06f-3293b49dae55", "comment": "Malware payload (Neshta)", "value": "ff3cd9ab41aefdc39297041ac22a279bcb6421fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713186341, "uuid": "6ecfeb5d-ae7d-4727-8e28-4c09a1066141", "comment": "Malware payload (Neshta)", "value": "e3b985645370b499296877b60d30490e2caa57466c736741e09aa3e0f40df8ed7365da19dc3da50353d8286f84c3e01f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713186341, "uuid": "1f0aa5e9-3b9f-4357-9825-5b51f61ddb9e", "value": "T144052304B2B9EF33D37A6BF0986D14B013B235DA7228FB4C5DD850D52671B818AA1F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713186341, "uuid": "d4c20c40-0de2-425a-a8b8-2830eb9c68c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713186341, "uuid": "8a1d4017-a37b-453f-bb80-1cbfb9d34f7d", "value": "12288:rVcNBnF9MerEqHIXgR6pMWDZFSKrL38OnabJufBPr7T4n6+p:pcNFjMtXEvKv38moJuZD7T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713186341, "uuid": "685ca0fa-f3ef-46ec-bcd7-77cf1ae0decc", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713186341, "uuid": "240d02e3-9ea4-4507-a8fa-abd947651ac4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713186341, "uuid": "109dd551-e585-4e82-aa41-1ba040adf08d", "value": "Order RFQ-HL51L05.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57f6f7a8-fae6-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713157772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713157772, "uuid": "d4aee636-ba35-4e83-ad4d-0f1736e836cf", "comment": "Malware payload", "value": "9851fc217f9111e67559fe70926e7f87", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713157772, "uuid": "a75913e4-43e4-4485-a50c-70c7c4152b4b", "comment": "Malware payload", "value": "867b5ce94a5737612bff3244d4334180382a439f0a8c8b4c59570c7fdf370929", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713157772, "uuid": "113a8439-7593-48d1-98cd-bdda2814915a", "comment": "Malware payload", "value": "aa5a1dfbbb7fec5a3ae80e3fe9ea10cfdd360cc3", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713157772, "uuid": "84d617a9-a08f-43de-a419-0895abaffa18", "comment": "Malware payload", "value": "4a28b4717498ba9e7fb655674ad155c1b0debb24e34e35f09900f080e45ee4361a463db3c0d015010eb1acb337cf2b5e", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713157772, "uuid": "7d9fefd5-ed98-4e5c-bcaf-4dd48819162b", "value": "T19D577C13B344A53AC06A0A3A9D2BE7749D3BBE612E664C477BE43E4D5F345807D2B603", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713157772, "uuid": "555e05a8-68c0-4258-afe2-63390de85da2", "value": "196608:Iqy1uLevgoiAFK6W1WyaO+D8T7TRpg14elkPiGH5RsFnmCmw4THR/Bn7BT:IqygvA46UXaPK7TRpg1mH+Uw4TH1VBT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713157772, "uuid": "5b342c98-71d1-4b8e-9176-889537b4b8c0", "value": 29163520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713157772, "uuid": "728c29e5-6478-449d-809b-93c590452e8a", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713157772, "uuid": "95dab00b-3d92-4999-9420-1fa9f8bd2274", "value": "windows_defender.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "046365d7-fae6-11ee-a120-42010a9c002e", "comment": "Malware payload (PureLogStealer)", "timestamp": 1713157631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713157631, "uuid": "c8fde63a-078c-4721-997a-c121227a2fd4", "comment": "Malware payload (PureLogStealer)", "value": "d47ff83d6279a36b72152ddd26c730fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713157631, "uuid": "7366e16d-2975-44b3-bfcb-e00f4fb80376", "comment": "Malware payload (PureLogStealer)", "value": "86c08a6295902da36cf1c53118c25c54e0d173125b9b1c3fc105aee417068006", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713157631, "uuid": "62b1d91c-5fcb-4649-9efb-b6709b0c595d", "comment": "Malware payload (PureLogStealer)", "value": "2cae2c167f46c24bed7847cc2568362ea172c0aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713157631, "uuid": "70a098db-ca7c-4b3f-8af3-963c3369b58d", "comment": "Malware payload (PureLogStealer)", "value": "280f39dac68a70bbecefb20ec4a787b16fbbb66006a940b1e6bb9cb25f7a0511c6c3bd77df697c0cffaf56866e8eaf70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713157631, "uuid": "0bfc0a10-e8ee-4e2e-ac08-b97f08419674", "value": "T1B3A623553BF48926D0BF9A76D2E7041857B3D5827222E71F32CB16A50D823EF8C0DE5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713157631, "uuid": "9e32d214-317a-493f-b924-7a8953bc3075", "value": "196608:VFg/KSH4rynHHiJrWnfossDb9NfwSdcvTP5AUewGUeF1U:VK/ZH4OniJrcOfwSdcv1A02U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713157631, "uuid": "1f0e432d-b184-4788-8343-4b240f789949", "value": 9564040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713157631, "uuid": "8c4d802d-0205-42fd-a4e8-c608c2f25be1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713157631, "uuid": "8ba4c42d-79d8-4e93-9ede-b2a214d9cece", "value": "d47ff83d6279a36b72152ddd26c730fb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e47d4e9-fb2a-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713187095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187095, "uuid": "b1e0f690-e5e3-4216-9534-700853f07b91", "comment": "Malware payload (Formbook)", "value": "b716123faa847a82b25a61bbe38dda7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187095, "uuid": "95719d3c-725c-4354-a336-841824f999f0", "comment": "Malware payload (Formbook)", "value": "87698c1e19d65ae8f35f18b98690093601458944fe6317009f884c4e3b2a4842", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187095, "uuid": "ac8ee688-fdb6-46e6-9239-94c9b74eac5b", "comment": "Malware payload (Formbook)", "value": "b44161fa0dc87563213ce547b3cc5c1e22b5c2d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187095, "uuid": "8b62dca6-cc78-4fb6-8061-6f221e02f9c4", "comment": "Malware payload (Formbook)", "value": "d2a5a5d848f774bbbaa453d55c940c457b887243206893cfe14b4d8186b4675ba587d1afcc50ed1018a308052159c32c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187095, "uuid": "e925455d-71ef-4a4f-a026-8be8dc3f8126", "value": "T11304AE36E642C071F2B252B5F67D0B7B883D0D347254A4AAE3F11AE12EA44E5B53931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187095, "uuid": "f976d7b2-196c-4adb-baf3-3041a5a41ba1", "value": "3072:uyywkMnWhzmc3GX6qiqj9llXQ9hEzyhMObKXKbfNdIjzpPZOj49swN:FXSGq/qj9llXQ9N2ObxbfNd0zpPZOj4R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713187095, "uuid": "e9c51649-34aa-4872-aadf-7c361cf817a2", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713187095, "uuid": "97c962b5-1b28-40c8-90c0-5168783ce310", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187095, "uuid": "401e69fa-9bec-4716-93c8-a0825d1f1fc9", "value": "87698c1e19d65ae8f35f18b98690093601458944fe6317009f884c4e3b2a4842", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82cfb287-fae8-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1713158702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158702, "uuid": "aa6821b1-ba6e-4a66-8549-b6db1c51f0ef", "comment": "Malware payload (GuLoader)", "value": "7f1d2a0c81593d980b0bf54bed2874fd", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158702, "uuid": "fac4d444-90d1-4ca9-8232-5c3556a77832", "comment": "Malware payload (GuLoader)", "value": "893d9e764590411436c20d10fbd1cba2f3708affa9c2d5e182c5f10cda9384a7", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158702, "uuid": "0f6a00ed-408a-4606-9e70-eaeb12da5fdf", "comment": "Malware payload (GuLoader)", "value": "f5d3fe0677b6045227739bc82dab87d3604d0c00", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158702, "uuid": "d88a3aa5-44ec-4e3e-80e5-4d0a1dab9417", "comment": "Malware payload (GuLoader)", "value": "b9d3f907363248f55f487bf06e85f3d34b6fa98aed2ee31cf30e88b53a923a6f4bf2bc6324b08f83d2d20700692525b5", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158702, "uuid": "7e9dd80e-e09f-4543-a8b8-8762e4464a63", "value": "T1EB8418E3DAC526288A461AB7ED230B738DB8419C33131E3897BDC65D604395C86BFBD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158702, "uuid": "2bd35a15-7a90-469c-a0c2-b2afc0221597", "value": "6144:UrRLaVfs2VTA05zBWJKJqDv9WlmDg6bMiaNb3rczF9V4I5Btg/zRoFTC4vSUUkP0:gGInOiva0vRds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713158702, "uuid": "5c0766a8-a31b-4a1f-8ab3-5dd7f0749028", "value": 371025, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713158702, "uuid": "ad4c9f0f-02c5-4696-91c4-6d90fb453eef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158702, "uuid": "4f376425-6896-4ebd-b083-f8891529077e", "value": "8341598449_invoicepdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebe28370-faf1-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713162744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713162744, "uuid": "94cc2d3a-81d9-4594-a813-0e50b927478c", "comment": "Malware payload (AgentTesla)", "value": "db5a06e5fb1553a24338648941f58281", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713162744, "uuid": "90cced72-4660-41a8-9000-14fdde5bd075", "comment": "Malware payload (AgentTesla)", "value": "897199ac29d5d1bd3a92f0cb0f8be6f3575dfcdc8ded7d73da2900ced9c56669", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713162744, "uuid": "e50c706b-d942-4a68-8275-9e3cc21b04a2", "comment": "Malware payload (AgentTesla)", "value": "20ea69c3420ad62b1ef4423370ebeb8b326a50b9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713162744, "uuid": "9dbf5fac-4b88-4d3e-8930-156de7aefc52", "comment": "Malware payload (AgentTesla)", "value": "368b8ac3d288e5f4c022a3b69ba3414a402b75f16e905ee8cb1f434f98f9d81c3e51926e293f150e99751e4c2dd216c3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713162744, "uuid": "c496fbaf-8dd6-4a0c-a82f-78a747081f5d", "value": "T13E741238A3888B7FCE1DAC35B161290D21F01D45B8BADFC9CEE071A688157C5CE56A5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713162744, "uuid": "1752c499-33d0-480b-896e-dd706a36e43c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713162744, "uuid": "74b3fbd5-8691-41aa-97ae-5ff1b49daad2", "value": "6144:3J89OaYXcheo68PB8+V5hLI2msxbvuDqPNxuklLb46oanY3eoFXntD40eopoG:iOPXcVP+YLYwi2PNxddcenY3eIXntDts", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713162744, "uuid": "a18611f0-8bdb-478b-8aa7-b4f4bd4953b4", "value": 352256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713162744, "uuid": "332525b8-a6b9-456f-bb42-387e8896b036", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713162744, "uuid": "60e5c077-50d0-4d13-a47a-8bf64fe96d3a", "value": "Cotton dreams Purchase Order (s).scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23aa5e79-fb0c-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1713174005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713174005, "uuid": "d5f9ce27-af0e-4da7-aa2e-f661e1893e89", "comment": "Malware payload (Gafgyt)", "value": "79a215cdd117f77b77fea55eddb8e42e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713174005, "uuid": "445a58a2-e43f-41aa-8824-0006c6e17cd9", "comment": "Malware payload (Gafgyt)", "value": "8a107f741bd77a3474a917cfbc04e4e7e8a59a9b5d3047e456969a0c6acccc8c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713174005, "uuid": "03f04c48-26db-4042-b8fa-21a86a2ff7a9", "comment": "Malware payload (Gafgyt)", "value": "44e253dc4c992542c5ec806c74b1ca37f7b8381a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713174005, "uuid": "626e8402-653e-4cbf-9324-274c2af35399", "comment": "Malware payload (Gafgyt)", "value": "0daa62eb9ffe9ab60dd58619822dfa78ba0730f9b7e0d363b9c47f50dc9b1b42d46c811eae345d3fd0ac7093799d4744", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713174005, "uuid": "5bc2b40b-a7d0-4903-a9b0-3b01e62a9943", "value": "T1A4E30830E454465BC2D223F6A79E825E3F361E9743B733115B387EB02FE27991E29924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713174005, "uuid": "eb1e39a0-6b4f-416e-abb2-797f6065f407", "value": "3072:WTxTpV3ncHvm7LnFbYB7rRNMXHCDrpLm98r/S8mnoQhJUI3Nu:WTl6v2i9RNMXiDrpLQ8mnoQhJUI3Nu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713174005, "uuid": "f647fde9-4acf-4931-98e0-11cd15989590", "value": 143415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713174005, "uuid": "01a425d8-4305-4ede-857d-799cd5b1b1eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713174005, "uuid": "bf38d9e3-82b5-4c31-93bf-c74a741cc8aa", "value": "79a215cdd117f77b77fea55eddb8e42e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4b1e777-fae5-11ee-a120-42010a9c002e", "comment": "Malware payload (PureLogStealer)", "timestamp": 1713157524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713157524, "uuid": "6408c562-2e25-4124-89ed-05def5a362a8", "comment": "Malware payload (PureLogStealer)", "value": "760b7d365c5cad24f27e76bde85d2b80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713157524, "uuid": "d262d07a-bb5e-40f6-87fd-9b2ce243b6fc", "comment": "Malware payload (PureLogStealer)", "value": "8a64ce1698986ab03a3804b830224c3969899a03fc5a8ffcc2fa4ce553754f16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713157524, "uuid": "a5110d34-0e38-4f0a-9bb7-21a4b2cc0614", "comment": "Malware payload (PureLogStealer)", "value": "5fec10891c2549db9ea680216d5a6bf1c0f3a4f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713157524, "uuid": "03502f7c-53e0-4f83-8bd5-dbc117ed78d9", "comment": "Malware payload (PureLogStealer)", "value": "7ef8332fa3daf2339e92c100f70ac5fccc4745204be90e7040d648be65af87e89a88446d4c2666a48e5f953f7f8d7f1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713157524, "uuid": "f6c0c139-25f7-4452-976f-c3964fc067a5", "value": "T18866235137F98915C0BF9A7AD2E3041857B3D5862223E71B36CB26A40D833EF9C4DE5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713157524, "uuid": "7877ce72-79d6-438f-86a3-f3a510d5b484", "value": "98304:atqFkTRdMClJbjovecSpnN4rnyI0nHc2piJj/EhnqVuIds/EDbP1NfhOSdc3:VFg/KSH4rynHHiJrWnfossDb9NfwSdc3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713157524, "uuid": "476ce317-68d7-429d-9e22-26e8f3b6dc29", "value": 6675280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713157524, "uuid": "cd1f7b29-3e9c-42e7-acc4-48fd9d0df4cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713157524, "uuid": "10a6346d-6b42-42e8-8c52-753eeb12fb1a", "value": "760b7d365c5cad24f27e76bde85d2b80.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f4768e5-fb54-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713205002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713205002, "uuid": "44551ad4-c7b9-4784-a480-ebf21ded2611", "comment": "Malware payload (AgentTesla)", "value": "16e70fcf3f5dd42787eeb19de11a149f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GRC", "colour": "#0EB570", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713205002, "uuid": "9aa53b93-ee5e-4ab4-a58f-379564259531", "comment": "Malware payload (AgentTesla)", "value": "8ae053d9300b897c0009559407842f893ca81461f707172cc42a324436839a56", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GRC", "colour": "#0EB570", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713205002, "uuid": "10e1612a-c89b-4621-aca0-fa2b8bbc447b", "comment": "Malware payload (AgentTesla)", "value": "b8f4f61172e131d19da66a3dc5583df007bba1d5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GRC", "colour": "#0EB570", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713205002, "uuid": "e7f45278-2c5f-4df9-9c70-6df37da78af1", "comment": "Malware payload (AgentTesla)", "value": "c84adb60b2f2db57ab1531a3fd2eb6bc906dbbbaf4a9bdbda1dc1fc6ae01404bddd4dff976348c34449a0232c80b2e78", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GRC", "colour": "#0EB570", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713205002, "uuid": "3574cffd-ef16-4a33-b069-2af3abf08bf6", "value": "T166E42318F1AD634BD7398FF824F1011853F2899F027BD6DE4ECA70C9A615B12492AF97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713205002, "uuid": "4ef6495d-f0eb-4a10-bc25-a8e21c801978", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713205002, "uuid": "ef5157f8-d4b3-4068-8f8b-c1ff2e2f9812", "value": "12288:maAvszT370kTncfYUfNBypmTGgPDxpWa94q/M4NIflT:Sw2rMmJDuaw4NI9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713205002, "uuid": "c751ee60-9441-4ccb-ae8c-ba8613902413", "value": 667136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713205002, "uuid": "bf0a475c-25a6-442d-8015-5ed76551e5d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713205002, "uuid": "6074baa6-e0b3-4e1d-964a-76748ce39e86", "value": "\u03c4\u03b9\u03bc\u03bf\u03bb\u03cc\u03b3\u03b9\u03b1 \u03ba\u03b1\u03b9 \u03c4\u03c1\u03b1\u03c0\u03b5\u03b6\u03b9\u03ba\u03ac \u03c3\u03c4\u03bf\u03b9\u03c7\u03b5\u03af\u03b1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbecd2eb-fae8-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1713158798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158798, "uuid": "8db66458-d1eb-4097-8dc8-eefda4505f79", "comment": "Malware payload (RemcosRAT)", "value": "86b576a9f9499877827232a8e6bf11d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158798, "uuid": "a9f958c1-d2f5-4c94-90e7-4c755bee15d1", "comment": "Malware payload (RemcosRAT)", "value": "8b3e308bf8008d70c9993b67aed96d3c0b0e472efd9e8335ec8e6e4f1b7b6e69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158798, "uuid": "c421c13f-f63e-4546-aa51-bbf2040971cf", "comment": "Malware payload (RemcosRAT)", "value": "9744a5db6285f36321f45d82079a07abb310b747", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158798, "uuid": "68bedec5-40ce-4438-92ee-025734f0fa98", "comment": "Malware payload (RemcosRAT)", "value": "ec607abaae724fd44ce2cb032100ac91bd509f7a5a621d1642321b64b6815d7bd964a2f8f802403a6e9466d7bc6c4a03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158798, "uuid": "a3348ff2-8a13-4ad3-bcde-f80439076494", "value": "T13B25231132F9AF63E7BA63F565BC701107B1609AB031DB8D5DAA00E51A38F44D7A8F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158798, "uuid": "d92ecbb1-c70d-49ac-8f95-8e1f72a5b0ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158798, "uuid": "47c8f3e3-be9f-429b-9db2-38e0b517499b", "value": "12288:fjpTNBTW0Gr3OdID7gk2nqbDR2NXgFQkZEqeSHWdY3PkpnioxiuS6RugWL6:dTN5diD7L2q4XMEqeSHzZMS6RWL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713158798, "uuid": "74d573b1-71a1-48fc-b522-ad4d32dfd43d", "value": 1024000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713158798, "uuid": "316ea618-07f7-4421-b75f-c1394a8676ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158798, "uuid": "e7221eb3-2986-496a-80fd-552a6f2ac919", "value": "Proof Of Payment PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e108037-faf0-11ee-a120-42010a9c002e", "comment": "Malware payload (LummaStealer)", "timestamp": 1713162050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713162050, "uuid": "ed7407db-2c47-46d7-8218-5ea265a8a327", "comment": "Malware payload (LummaStealer)", "value": "818b475b766c54df6d845cb10b6eedcf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713162050, "uuid": "8db20af6-7358-48ac-84fb-9d082d9e6897", "comment": "Malware payload (LummaStealer)", "value": "8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713162050, "uuid": "3b7e580d-9e8c-4bb9-a29c-0fd4e44686b7", "comment": "Malware payload (LummaStealer)", "value": "69ba418b84f5eb0930ba483c8fb1d8416b0b8749", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713162050, "uuid": "ae1983ad-5a91-4913-b38d-5012ac849240", "comment": "Malware payload (LummaStealer)", "value": "8719a8535a45ec290a905147cedc87728e34cd7043fb9954ce91e6a9a198d28ed7522976fed869706ef7d8b3e7017a2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713162050, "uuid": "983ac80e-2a93-44c9-a989-f0d565d22dbd", "value": "T1AE64235ACDE7027AE87A68FC6BBA3731496E51949C10E0D20E64E4173DDF79C5322F22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713162050, "uuid": "326203f6-fc1b-47c3-ad48-55206a3193b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713162050, "uuid": "dbbd677c-1e12-461d-8b9a-c421693a1498", "value": "6144:YsFFiBD/2f50sJknDeebx5pAsqL3N8MYk7ZA9k+AEGYeBTNEV:0ghHunDeebx5U2MYkZDEGYeBTiV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713162050, "uuid": "028b8a98-bbd4-40ea-ba6a-d644a854c98a", "value": 315904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713162050, "uuid": "d4e1d775-49bb-441a-b1ea-75b70d69e767", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713162050, "uuid": "0af0822d-07e9-4384-8b40-8c3953ecd733", "value": "818b475b766c54df6d845cb10b6eedcf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f40b6309-faf1-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713162758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713162758, "uuid": "a962554a-fe37-4b1b-88fd-9acf8afee467", "comment": "Malware payload (AgentTesla)", "value": "98016e7c7245a0353f309df27480f303", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713162758, "uuid": "36f99e70-1ee6-4476-aed9-ad5d0b76c9ef", "comment": "Malware payload (AgentTesla)", "value": "90c59fb77a0df45ca3c0266ffb9bea55efd5bfd671643ef16d81ba8742b79567", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713162758, "uuid": "c8bdfff0-2323-48a7-83ee-ca493e960e59", "comment": "Malware payload (AgentTesla)", "value": "b22b3c03cc740796a50db52b2629707e3f436d23", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713162758, "uuid": "a8785f06-5bbc-410e-b017-b7cebbe61158", "comment": "Malware payload (AgentTesla)", "value": "2030075134916dd4a410de9b4066cd0873f24eaf35999ff38307804a137beb0e0ce766891fddae85e304887189c17016", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713162758, "uuid": "2c90766a-6df9-4924-a7e3-2c71b5ae6d13", "value": "T1BC741238A3888B7FCE1DAC35B161290D21F01D45B8BADFC9CEE071A688157C5CE56A5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713162758, "uuid": "3687b199-3752-4206-9228-5e3ad7b43720", "value": "6144:eJ89OaYXcheo68PB8+V5hLI2msxbvuDqPNxuklLb46oanY3eoFXntD40eopoG:3OPXcVP+YLYwi2PNxddcenY3eIXntDts", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713162758, "uuid": "95d0af5c-ded9-4cb9-94ac-159a69cdf800", "value": 353792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713162758, "uuid": "4f9f39ef-1456-479c-acbe-584c2ce7ae39", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713162758, "uuid": "2d37eb56-3fa9-451c-8660-0e693d40ef4c", "value": "Cotton dreams Purchase Order (s).tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9081fa3f-fb47-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713199528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713199528, "uuid": "28d45a5a-60e5-4eca-b37b-40f281dee3d6", "comment": "Malware payload", "value": "8894b952d2c41177d2c14c64695bdce9", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713199528, "uuid": "2c31c40a-9a7a-445a-a1d0-4b6f15d79587", "comment": "Malware payload", "value": "90f1511223698f33a086337a6875db3b5d6fbcce06f3195cdd6a8efa90091750", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713199528, "uuid": "0dc5068c-3330-40b5-9801-f1bbc593c787", "comment": "Malware payload", "value": "e70e0056f72dbfe7a3fcadc2d80fe843c5c73681", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713199528, "uuid": "03c5c7ec-c190-498d-8e28-4beea6997743", "comment": "Malware payload", "value": "ca7641f853dbb35345fac711111e5d2997a4cb60ad71f74613cf8d70d34045f5ee8ebe6a43de055ef3f48137f8da8002", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713199528, "uuid": "00388e23-f03a-43ea-aabc-db79652cc8a8", "value": "T13A85D0227386C537C96E01303A2AD66B5579FDB74B3140DBA3C82D1EADB44C1A639F93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713199528, "uuid": "a24fd446-ccbd-4157-b117-a97b9046dd44", "value": "49152:PS8vYpW8zBQSc0ZnSKeZKumZr7AIq4SM/uWW:HYQ0ZncK/ACL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713199528, "uuid": "41c23dc0-034a-4176-8bbf-5167644f78b4", "value": 1725952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713199528, "uuid": "51126d67-65dc-4e81-934f-38c7b41240e3", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713199528, "uuid": "cf83c396-40cc-4971-b3fd-4d990ce90540", "value": "sharepoint.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fe8bb74-face-11ee-a120-42010a9c002e", "comment": "Malware payload (Loki)", "timestamp": 1713147584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713147584, "uuid": "940bf8c3-59ba-4630-b16d-61fb1193a4d4", "comment": "Malware payload (Loki)", "value": "60c8e751c1caee5b01cc878231fea5f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713147584, "uuid": "4ceb0237-cb9d-484a-980e-9d7ecdddc77d", "comment": "Malware payload (Loki)", "value": "913f2f9a1131b26bb6afcc715fc914b5ead5c2a4ffc91a3d19e51292ab3be1ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713147584, "uuid": "17eaaa01-cba9-4f90-abeb-6ed8895c3cbb", "comment": "Malware payload (Loki)", "value": "d7bc61e04f58e428658d3ce86461ceadf2019548", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713147584, "uuid": "65af6f6e-64d4-47ef-b947-03c8bda829ad", "comment": "Malware payload (Loki)", "value": "72feb504a31f4f25fba1bc2520855321930045fe3ce8e6e42d57ee09d49be86dee01220a368704f32937854326290f5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713147584, "uuid": "1d47fab4-d817-4648-a7aa-bbc319382c57", "value": "T1FC84CF112BA9BB0AF1F917F75C7228005B70759BA59AF32DAC9191C908F0F42DD66F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713147584, "uuid": "ca8b6ecb-fc7f-4f9f-bf08-08a34e7c5e13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713147584, "uuid": "10cf5fe5-fc00-4b86-8e7d-59ad0db2f0da", "value": "6144:WmijPECZwxTMr79U+dykVFJvMDxvacgN2DPAXhPDKdJsd7uUQ0KDOSrrW4iAHlZR:Wmij8w/Mkxv8Lv8Xorsd71Q0IO0r/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713147584, "uuid": "8eb2ca71-431c-479b-828a-8ca6c3520da5", "value": 404480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713147584, "uuid": "8bdf9243-460a-4020-b9af-d30efb8d2fde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713147584, "uuid": "fad32161-f2b8-4bd2-b7be-c829bb4d261f", "value": "SecuriteInfo.com.Win32.PWSX-gen.25023.20637", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c84233af-fb7d-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713222814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713222814, "uuid": "52a4c20b-8df9-4523-905c-f77f1d339ae1", "comment": "Malware payload", "value": "17ddfa04cb6e35065c35e9e582326ace", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713222814, "uuid": "b30c983b-c989-4564-98c2-64e7b03bdb7a", "comment": "Malware payload", "value": "91c7f954914ca313308973ff5a97757d9400563113c4c85bcc5aa3fa0705129d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713222814, "uuid": "ec511928-7f12-4626-9080-df8157004abb", "comment": "Malware payload", "value": "fc0d02621c485b5ea234e3facc5e74abdb724e29", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713222814, "uuid": "082b6d69-0651-4ac3-9b27-d3233041c18b", "comment": "Malware payload", "value": "7c961c28d9a2b3fa4c29b07bbb3d1daeb460dfaeef05b0e4d90e6d162227045fc0b41d9c6dc2a5ad8410a9427f276d9b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713222814, "uuid": "10ee2f92-7ed2-4e89-b713-19cfdcd424f4", "value": "T160552391F374429BEE6217F5D8FA0B18BA31E5FAA743458FCE4427250C12BD92DA71C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713222814, "uuid": "6691993b-5563-4e87-a050-3e7253118042", "value": "24576:D0IFGSpZ/xR6DpRdsAnbeNDg9qilE/6bDAi5ZwrQmNL2viw9MMpf3y6WFQv:D0+XpR6DpYmb4g9qilE/kDBOr4iw9MKR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713222814, "uuid": "db32c689-ad03-4c94-af3a-e0cdd91bf05d", "value": 1407961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713222814, "uuid": "15ba1c54-9fe2-40a5-ba67-92e62b1f428c", "value": "video/mp4", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713222814, "uuid": "fafe44f1-2dcd-48ae-a300-64e00b8232ba", "value": "021 voc\u00ea quer ficar rico 1920x1080.mp4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f67376b-fb2a-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713187097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187097, "uuid": "6fc92a1e-2bac-4bd4-91e9-0fd480e7d650", "comment": "Malware payload (Formbook)", "value": "f51b1f97be7d198e266b158870609be7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187097, "uuid": "c13088c6-3016-46ba-8b59-ddcead81b0c3", "comment": "Malware payload (Formbook)", "value": "923a51c8fc40e0e02a4ca807ed7cd5042f1e59e52abea20c44bf88f7f7b78d6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187097, "uuid": "3ebd90cc-48a6-485e-a4f2-73ab6e224beb", "comment": "Malware payload (Formbook)", "value": "cfb586605d5e8399c8e730e13c088d1760b5964d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187097, "uuid": "435476d0-7878-42f8-8805-234b0cade6e1", "comment": "Malware payload (Formbook)", "value": "ccdd81b0c41636349f5e28efb09a0ba620a7eae8bd349c597cff6dd650a555b771a9d5e12948147c8a3a70b20c07c824", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187097, "uuid": "506bbfa4-375f-4b0b-ab6b-5c1a58d39c30", "value": "T13CE42325399C272FC1BEBCFAE168478D43F1626959EDF3DD0C86B28E57C63819104297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187097, "uuid": "20590199-ef6e-4c07-929a-1fbd3a2adb6a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187097, "uuid": "d28e3527-e3a7-45ee-82bf-db54348d090d", "value": "12288:pUA+/5z0siycBPoW5UeRu2RPjZPQ+d+bHEtCIL2W7QBpqfzIcKsWWT:L+/5QZyOuw7j5ZgotCI6W7A4AsWW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713187097, "uuid": "5bdb7106-a239-41ca-b34b-3c1ac4796a72", "value": 685568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713187097, "uuid": "ec5e90a9-723e-460a-b863-16e0d6697fe2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187097, "uuid": "574bee0a-bfbf-484d-bac6-a2450ac771d1", "value": "account details ptgd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d003a1e-fac9-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713145325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713145325, "uuid": "45fbd4fc-8413-401f-ae47-ed124f057f2c", "comment": "Malware payload (Mirai)", "value": "0ae9a1d5a3cec2dddf29d668bbccdd91", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713145325, "uuid": "065f38a3-e418-451a-a856-2a718da110d0", "comment": "Malware payload (Mirai)", "value": "939439af838288c9920a7a9f00ffa75820a0738bde76530841a6a924e7516d25", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713145325, "uuid": "6266dd6c-cedd-4b60-a3f9-8680406d5737", "comment": "Malware payload (Mirai)", "value": "48f565597ce60aa5a518365b6a84fd71a1424b61", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713145325, "uuid": "f47eb48e-e4b8-4a6c-b060-fcbaf8702d33", "comment": "Malware payload (Mirai)", "value": "45454a52d1879553c73ec1f5e365d69764b10fbd0e42fed32242e34c33e0ab052d1b613d55682b412a3bc41824545a51", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713145325, "uuid": "f81856c2-7935-42ae-a9f1-562db52bca29", "value": "T1D33339C1FA4F90F5E4070A304177F33FCB31D92A4061DAAEDF5AAE36EA63645921624C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713145325, "uuid": "9c0a23d3-8aa9-4e9a-a059-230e4a3499f2", "value": "1536:FsaCIiIE4/mOPEyOZ8Rq7RrC9wlcW5bKa473oGPYSU:xCIBE4uOsyg8Rq7RrCCrMa473dPDU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713145325, "uuid": "addf9885-8c80-4ca6-919c-97c87bd6ec1a", "value": 54896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713145325, "uuid": "afd38dec-8eed-4193-857a-0ec2dc1d99ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713145325, "uuid": "19f9ccc0-1ee7-4a39-8e23-afd0694325eb", "value": "0ae9a1d5a3cec2dddf29d668bbccdd91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aa90874-fac9-11ee-a120-42010a9c002e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1713145213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713145213, "uuid": "10860467-5252-4ee0-b2d8-31f6a683c78e", "comment": "Malware payload (AsyncRAT)", "value": "114dca2f9cbdfd0bdddb50737b3ca5c8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713145213, "uuid": "e1b13e8e-e3b7-443e-9a19-a731c4195480", "comment": "Malware payload (AsyncRAT)", "value": "94282999a214a071df7bb5bc079b5961dd57b01b2271c0aaf415519bf00a1e51", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713145213, "uuid": "9bbaff71-c73b-4233-85f5-df7f7a1cbdab", "comment": "Malware payload (AsyncRAT)", "value": "0059ac4a100a467d6853a7b1a7f0002056ccbeb4", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713145213, "uuid": "2cc75284-b806-411b-99cc-d4c7e5093622", "comment": "Malware payload (AsyncRAT)", "value": "f120350d6e55a2f20cc774ce37e2371538d798cb0a72b10c008f535d56aebc6f6e664ab41a2a2d5d9a0b78bab4b6cf07", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713145213, "uuid": "4ab0a1b7-d80f-4a65-b93a-f987a40a6654", "value": "T1995308003FF99525F2BE5B75ADF2614446B9F5632A02D94E1CD4228A0A33BC59E01BFF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713145213, "uuid": "459883ce-7b9b-44b5-bd2a-6638d734eaaa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713145213, "uuid": "84196e3f-b001-403e-be09-efa45247d1e2", "value": "1536:rzSx0rLwwrpvIxG5hOb7XBLsnlBtaVnkZqYxbx:rzSx0PFru2Ob7OnlBkkZzZx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713145213, "uuid": "edae69fd-4b02-419c-b64a-cda210278c82", "value": 63488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713145213, "uuid": "ff86aff4-9e9b-45a1-9fd4-93e02d4b3068", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713145213, "uuid": "d0f0762c-4b41-46fa-a6e3-7c3281cb2839", "value": "114dca2f9cbdfd0bdddb50737b3ca5c8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a100e495-fb28-11ee-a120-42010a9c002e", "comment": "Malware payload (STRRAT)", "timestamp": 1713186241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713186241, "uuid": "8b0179a2-22ec-4f51-970b-5a7782c4887b", "comment": "Malware payload (STRRAT)", "value": "a7cf5340aca609439b04d8bb75d7fc2a", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713186241, "uuid": "728d6a9c-e940-4bb3-bc93-0204b28490ee", "comment": "Malware payload (STRRAT)", "value": "948f8628937c51d7697a89401dbebb5c3ad434f8e9d09c46c48c328cf0374456", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713186241, "uuid": "e06e776c-8be3-4bbb-ba9d-557c00ad20e1", "comment": "Malware payload (STRRAT)", "value": "fdd933fa940c9f98480ca52702bf67c3258c55c0", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713186241, "uuid": "c77bb809-a752-4af2-a220-ab5d5a21c787", "comment": "Malware payload (STRRAT)", "value": "f38f5d08ad3eec8e3f9fd745dedbf897f56678f836e438b02a8fe0eb927485390a066ad06362dec53df0c17d38b3d158", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713186241, "uuid": "5ab36d7a-d89d-4ba5-99ff-46ac6ac9f177", "value": "T1A9B4123E7BBFE138E017A53109498BA5FB0D2229C144919BB2EC54591E34D4EAB23DDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713186241, "uuid": "647a8825-35dd-4c8a-83f1-26393823b70f", "value": "12288:8+KaxdH9WfATwPrU5Kq4KMYwyl/bY7Tc6kVP68:8yTdF0PrU5+KMq/d68", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713186241, "uuid": "0ddc21d6-2ab3-4524-851b-2d92cff23bcb", "value": 533568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713186241, "uuid": "6b8047ea-ad1d-4e2b-ba69-78e4d58ff683", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713186241, "uuid": "02e63ffd-5e2e-480e-855c-f22385d4e2e1", "value": "RFQ Img_Quotation PO 202400973 - ARQUILUZ IMP. & EXP._pdf.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4239be59-faf9-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713165895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713165895, "uuid": "27eabad9-45f9-46f4-b29e-f70481b5a66a", "comment": "Malware payload (AgentTesla)", "value": "ef8b6e69d4a30d74aa624cfed2d1d4da", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713165895, "uuid": "7556df96-a93b-4a34-958d-56a4b3150f88", "comment": "Malware payload (AgentTesla)", "value": "95c2a042a467f97460c93273fcf64bd426ba85de05c8d92f568c9c3bf1b54a91", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713165895, "uuid": "7b907b88-f0e9-4ec1-8c0e-905f65189d62", "comment": "Malware payload (AgentTesla)", "value": "4dd2b50bbeff0f53c58754657f06f7df7c43ceee", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713165895, "uuid": "6eb01a72-cd65-4295-8756-08cdc22bbe01", "comment": "Malware payload (AgentTesla)", "value": "c432eeeb241522123dbc6255369c79c8e083011a3e90115217035816ad52536b7459129ffc91f2c51e196ec59094b59f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713165895, "uuid": "d45facbd-0074-4e97-a1b1-e0c1b6e995bf", "value": "T1B464E041BE918746E85607744DF78BAA6325FC415F924B0F325CB71E3EB03E45E2BA22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713165895, "uuid": "89df0002-0196-4cf2-814a-85519f8bcc24", "value": "6144:1sunJ18Y35qAOJl/YrLYz+WrNhZF+E+fgL+0dD8ivSbVPVMIwVOIJYXdUfk9uu36:1lJ1R3bVPVMIwidDH39u+xgKJc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713165895, "uuid": "cb6a11b0-84e9-4ab7-9829-bc2caf2fc1ba", "value": 326656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713165895, "uuid": "d31ae64c-1b48-4179-9cbc-82d6e30a0c0e", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713165895, "uuid": "3285253c-be76-4d1d-96da-a975b85586ca", "value": "org.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a7a26d3-fb49-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713200296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713200296, "uuid": "b3d3e2ac-cc6b-41cf-82c9-3ec1b8825888", "comment": "Malware payload", "value": "38398c850fa0264f3a04728b13a2647e", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713200296, "uuid": "3bb7c529-0418-4224-b42f-628240204e2a", "comment": "Malware payload", "value": "98f16c910be3c5846ec2af6411e4cc34dbd6e87c923c92f8c4a2af595e0a25d7", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713200296, "uuid": "a5e1e5f8-130b-469d-92bd-60aa6e8943f2", "comment": "Malware payload", "value": "e9aa98b59822996b74fb396fb642c2818b92a3d6", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713200296, "uuid": "50c496e6-6816-4c90-8d30-22dc24ea5a4b", "comment": "Malware payload", "value": "9d086a09151ecf994946d085efa1cd9adde081591d85bbaaebdbd5dcefd2d296f260894a6a883f2b704b2cc8561f0f96", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713200296, "uuid": "64daa3a6-30dc-4313-a95e-683bab44ad57", "value": "T1CD260212B3C3C12AC15D02BBF55DFE4E1974AF63473101E776E9396E58F58C2A2B9A02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713200296, "uuid": "1d2fe8ee-e15f-4601-b1ca-30cbd2b698a9", "value": "98304:jMtRY3ui9+PHp2YGJ0RvNPsux26QECJIMaFYdmRrn:YntfsY00R1PNM6QRJIRY6r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713200296, "uuid": "c76421b4-7a04-46e4-b237-0f34271fb16b", "value": 4613632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713200296, "uuid": "6e04fe70-58d0-4886-8809-d5627b3c613d", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713200296, "uuid": "9561ee2b-1b63-4767-9023-8230d1a66e03", "value": "z37Nfe-Faturada-14042024.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7b02322-fb2a-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713187111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187111, "uuid": "4fa6304c-2a68-40a3-99ad-e03c1d41050e", "comment": "Malware payload (AgentTesla)", "value": "ac65634e50c536774f557e918f5773c2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187111, "uuid": "dff2b107-073b-4865-8d01-513df6e4280d", "comment": "Malware payload (AgentTesla)", "value": "98f2899f33ffff7bc8591fbe33e8e8696feaaffa89901e570b8eeba2374fee52", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187111, "uuid": "9ad97fb1-447e-49b7-802c-b518325baeab", "comment": "Malware payload (AgentTesla)", "value": "1543ad4e076b82286a036795fbc15ab3cb0a8349", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187111, "uuid": "78e88e83-11aa-4a0f-8d01-5bc8afcd00e8", "comment": "Malware payload (AgentTesla)", "value": "678a08fd8cadafb7196c74b5dde0aae75eee8cc619b0d337717387ca014d94097d38c528b51be1192088af0870958f42", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187111, "uuid": "25e9fe48-5003-4121-b27b-26816dfb24cb", "value": "T16F068D15F3D802C8E4B7C274CA6AA723F7B1B85B4732D64F1626124D2F77A914F6B212", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187111, "uuid": "1fa3f433-b4fd-4e66-bbe3-a8ff0dcda7cf", "value": "0e9dc1b983880b10378bec9074da3f57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187111, "uuid": "631e1766-0da5-457e-9edd-f94172a0e1ed", "value": "49152:8XmM3+IVJiicn3HpKoQyvf7+2MgFlFJUlaeMuGomqvvn:ldVjnaF8xnqvvn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713187111, "uuid": "85cb8537-f716-4175-85e1-a5d81bd73a2c", "value": 3742632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713187111, "uuid": "d8cbc30a-488b-4738-b372-33ad5565afa4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187111, "uuid": "a7a6e00a-264b-4376-b119-cab0dd3cc0af", "value": "ORDER SPECIFICATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24e017c8-fabb-11ee-a120-42010a9c002e", "comment": "Malware payload (DCRat)", "timestamp": 1713139217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139217, "uuid": "3e0e9443-2314-4df4-a5d2-d709ccdb8f79", "comment": "Malware payload (DCRat)", "value": "17e9f72145ff1fc2442d7e30f665555b", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139217, "uuid": "d66ccf72-572e-44f3-82be-25452c2d5a99", "comment": "Malware payload (DCRat)", "value": "9a160592080e75a6d21975eec5044d138a40b375cab07f65048bd7667a06b936", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139217, "uuid": "cd3fd0bb-7c3b-41e4-9120-2c946962f3be", "comment": "Malware payload (DCRat)", "value": "9a50226b1a9c32bce1aacede2ff0e39280a3c75b", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139217, "uuid": "cf3a7207-13b0-4202-9694-d87b62b81b89", "comment": "Malware payload (DCRat)", "value": "95532b199d79427ef33c29417a8b06900a7cfba1b10dc7a4a0f111d495b1636947c43ca66f760779b0cf614a80a8b398", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713139217, "uuid": "eea922c0-d0ba-49b6-a847-dd7ea4cfbf27", "value": "T1BB95AE16A5924E37C374573146A7013E82A0C726B612EB5F391F21E3AD0B7F18E626F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713139217, "uuid": "eb5b76fe-ec49-4403-a56b-207064ecf510", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713139217, "uuid": "c3b236fc-8db9-400c-a40f-07739f5e1583", "value": "24576:Xqr3u4THSw/6u8AhJJLjq4khWR7QK0KIv0mebLN5FWC5Nc:av//+AhvOJWBItMmqv5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713139217, "uuid": "6f8d5638-c267-4061-b73c-c4140ee516fa", "value": 1956864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713139217, "uuid": "83428f55-ba63-4e58-b543-22f4914100bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713139217, "uuid": "956310f8-5f12-4997-8a07-5f937c0e1c7b", "value": "17e9f72145ff1fc2442d7e30f665555b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98ef6030-fadb-11ee-a120-42010a9c002e", "comment": "Malware payload (TiSpy)", "timestamp": 1713153156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713153156, "uuid": "fad7e9a2-d8f0-4514-af03-0d5035bfff48", "comment": "Malware payload (TiSpy)", "value": "ddebce7ea1fd91f0e6063634e6ce6657", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "TiSpy", "colour": "#DAF384", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713153156, "uuid": "fed79ebc-e5d6-4816-92d9-b4ef3ddd116e", "comment": "Malware payload (TiSpy)", "value": "9c1b26882bc98a363924db4e5b35b4b5253fc859dfcb4402ca3eaceec3f1a5b7", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "TiSpy", "colour": "#DAF384", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713153156, "uuid": "82c725ce-4fb2-4ef9-bf70-4b0c65d14f9a", "comment": "Malware payload (TiSpy)", "value": "ec7c90cbee8b675c8d4eac2e7e2037b6473acb49", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "TiSpy", "colour": "#DAF384", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713153156, "uuid": "229e6b5e-6546-4a2a-a076-99f57d230707", "comment": "Malware payload (TiSpy)", "value": "11765716d397d5cab4c631c288df277cbd8cc7fbd38cc82392459ce3f2a2438a483b0212d8ff9026a838e30c62c970ba", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "TiSpy", "colour": "#DAF384", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713153156, "uuid": "2ddc7d87-537c-47d0-b5da-d69d8a96e2b4", "value": "T1A5E50203EA62956BE4FAD3721A71712920364D1447839B5A382C3BFF62BF5DD4F866C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713153156, "uuid": "4eecd313-98e2-498d-b81e-b3a28af6a8ff", "value": "98304:JLD+vno2jPm6A5WxlrLrc2mJ8oy7UHFog:t0o2ju6IWxNZepHF/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713153156, "uuid": "b4fd4747-19bb-41d3-ab26-6ccf977c666f", "value": 3259319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713153156, "uuid": "b5e58fe6-8394-487a-a312-bd336e548eeb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713153156, "uuid": "dbd4b272-7b75-4156-b56b-66432eedb4b3", "value": "WiFiService.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33048494-fb69-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1713213974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713213974, "uuid": "bcbf62e9-d7b1-4822-85a9-937c16db9cd9", "comment": "Malware payload (Gafgyt)", "value": "2c99182bafffccaef0d446df4269080c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713213974, "uuid": "0d01c8bf-aa94-4dfc-9b12-de4849e0db1b", "comment": "Malware payload (Gafgyt)", "value": "9ea46b8d5ba2c7230946e54f8fd3c6171402aa0a8309422062f57f7e03270ea6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713213974, "uuid": "6aba9341-139e-4dcb-b8e8-0a1f638283cb", "comment": "Malware payload (Gafgyt)", "value": "279089642f30a71d51eb1bb5f680c5eb0ec3e5f0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713213974, "uuid": "89f7b665-9eed-4137-9d95-6e45316fb382", "comment": "Malware payload (Gafgyt)", "value": "51970a44e4e2f32ccd525195f4bc89d04a49defbd8d90503d916c4b5150e614768141d07f42e27838bad625be391d841", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713213974, "uuid": "30eb0192-9227-470b-8417-fca56b6cb76f", "value": "T109F32A06E4504663C2D22BB6B35B524D77231FB997CB3311D9287EB02FE1B9E1A399D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713213974, "uuid": "c987d693-706a-4851-9b64-95817b0cc977", "value": "3072:bVBFp9jACvm/PmumivalWq3EyGwrXnYPetJ8add9Qzhsmqm0L9vCvZALomyLQ0Lw:Ymoalr3E6nYPetJ8addQ/qmoLomyLQ0k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713213974, "uuid": "04db0f2f-cc18-4b1a-96b2-c5df99f537ce", "value": 164214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713213974, "uuid": "f8965bd8-65b6-40b8-8292-5b7cc86dc884", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713213974, "uuid": "023b8316-ad0f-4a3e-ba89-367faae419ec", "value": "2c99182bafffccaef0d446df4269080c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a21450a-fae9-11ee-a120-42010a9c002e", "comment": "Malware payload (Amadey)", "timestamp": 1713159037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713159037, "uuid": "0fc64ddc-ff63-4fd3-a969-43fa3be1437d", "comment": "Malware payload (Amadey)", "value": "b9a582f60e89571526c4a6dacbb6a576", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713159037, "uuid": "b9ea4b8a-5188-411b-8363-8f491a7748ce", "comment": "Malware payload (Amadey)", "value": "a02549a343b100949c013f1c84927136e8c8f6e23110ae1d025c9733d5ad712f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713159037, "uuid": "6e34493b-be16-4afc-99dd-c10189f0e156", "comment": "Malware payload (Amadey)", "value": "0fe5061a1a4aa43d2ba13e954813746cef08292a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713159037, "uuid": "f0d5774e-a763-4de7-a4e2-2ff6bf62d468", "comment": "Malware payload (Amadey)", "value": "0781d7c0d6550c06b52672ea04806bd7c717e9827288d33e14b9ad89a318e8ed44775d566a18512094307b2c9542cf36", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713159037, "uuid": "ce84bab1-ca47-4a81-b4e2-8f4e8401e29b", "value": "T14A85330C7CE3D19DE51A5976E78BEE6EED8931486D911228249F03A1FA3C32BD65603C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713159037, "uuid": "fd136cbf-d790-4828-9473-65e0e433bbaa", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713159037, "uuid": "bdc85def-14c2-40b0-b35b-95e1744d444a", "value": "49152:eTVytZvQtZCv34v946oF0E0TPBtjQk0xyCf:YV25i9JxptjQk0xP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713159037, "uuid": "f1b024e3-cc7c-4d9b-a312-f8e281184c0f", "value": 1858560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713159037, "uuid": "70eb7bd2-dd6e-49ca-8b3a-2955984733be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713159037, "uuid": "a8badcc5-4f03-46f4-a4c7-dae96c40cd6a", "value": "b9a582f60e89571526c4a6dacbb6a576.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11c04c4b-faf6-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713164526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713164526, "uuid": "8abedfff-dce8-4284-accd-2ac5439244e8", "comment": "Malware payload (AgentTesla)", "value": "62407e6f5de13fbf40c50cfb124be93d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713164526, "uuid": "75d54636-9256-4ebf-9136-c157f19167dd", "comment": "Malware payload (AgentTesla)", "value": "a1475a0042fe86e50531bb8b8182f9e27a3a61f204700f42fd26406c3bdec862", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713164526, "uuid": "caa13d4e-e37c-4362-938e-49ce98878364", "comment": "Malware payload (AgentTesla)", "value": "637480244e32904d6cadb2e35b6e70746bad588e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713164526, "uuid": "c3cea119-4994-46b5-a73f-291c5c2ae03e", "comment": "Malware payload (AgentTesla)", "value": "37984ec7445a81f27395900b49b88ddbf91c29741b53229b966cf29ada2cb9df8f47580521a91085f15604b013ed1cbd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713164526, "uuid": "6e14bda3-fb69-449a-87cb-c7a837f2ebe6", "value": "T1D7340F037E88EB15E1A87D3782EF6C2413B2B4C71633C60B6F49AF9518516926C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713164526, "uuid": "f59f82b2-751e-48f1-9aed-e4d4c5e7cf50", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713164526, "uuid": "51a43291-7263-4495-a085-286c9bcd76ec", "value": "3072:R7ID/bPDvhKMcaH4qGUA6giz+OBx2nlPVk75haiE3ode:eD/bPDvhKMc44qtpBx2lPVkeiC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713164526, "uuid": "64e99383-64b2-4d22-b678-74e5d3630a79", "value": 244224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713164526, "uuid": "683fe0a3-fbb1-410d-af72-cf373e144202", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713164526, "uuid": "97bbbb15-ae42-4d05-9bab-1fdd2e1ca18a", "value": "1713164523a062b4519d6328fd61d7748fe4b8f0a98258627e54ebda1af20d5be5c89a4950646.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f46d626-face-11ee-a120-42010a9c002e", "comment": "Malware payload (Stealc)", "timestamp": 1713147583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713147583, "uuid": "bc1a1411-e1af-4451-b35b-5abf5f9b1c97", "comment": "Malware payload (Stealc)", "value": "04d39eac1b5f7cdf1bf48fe31073f1a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713147583, "uuid": "2014c904-89f0-46d0-a620-6dadc47dac70", "comment": "Malware payload (Stealc)", "value": "a16a269613b2fba53277bdf23cee4dfb87754329437a7ea468cf4fe8ef656b09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713147583, "uuid": "d273fa47-ce53-484c-b570-a51f1ca0f9ad", "comment": "Malware payload (Stealc)", "value": "2f8cd1c64ac352dfd4100b4ef43ecff1252656d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713147583, "uuid": "1bead2ae-aa9d-4190-89bc-d9794ba5fc58", "comment": "Malware payload (Stealc)", "value": "f58078471c1229705756d484c3ae2b5fbd2566f2de100dc37bdd04f7835758a8e1c18a23c2bf127e86377afe50217df4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713147583, "uuid": "146190f1-2ea2-4b22-8212-49b382ae7948", "value": "T13344CF1A7A70DC73F55628744A67CA94F76FB8314968A24732502F7F2E703D1EA22336", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713147583, "uuid": "1df9e22d-9ab8-4f5e-8e50-f2be3f223841", "value": "98af45fc1e3d04388a273c7f97e712bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713147583, "uuid": "3d63ac82-df5b-4035-bc65-c4f1c330467d", "value": "3072:+LvGr+PDU4bouGjjx3CdwI4p7D8njaJ7dN5+GBg5L93CB44:+L+4r/wjxnIPnjar+GwL6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713147583, "uuid": "4b538edd-55aa-4d7e-9094-400d0247939d", "value": 277504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713147583, "uuid": "69c94803-fce4-4b2e-b121-daf3e96fb039", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713147583, "uuid": "0b9d5217-8706-449c-9fb9-fb990dd4f6cc", "value": "SecuriteInfo.com.Win32.PWSX-gen.19014.16440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d399ad3-fb68-11ee-a120-42010a9c002e", "comment": "Malware payload (Loki)", "timestamp": 1713213615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713213615, "uuid": "78182c7e-cfae-41c9-8d1b-0fd07a7970e2", "comment": "Malware payload (Loki)", "value": "22ad27b1d4c7f684891838006c2677ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713213615, "uuid": "1b480975-d2e3-4bb9-9ff2-c2e86d524ce5", "comment": "Malware payload (Loki)", "value": "a3957f3092901d0466410d0d2413137243c905c67ac957524336060d3691d253", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713213615, "uuid": "78fe2891-6857-4593-9b0b-9706a0ddf82e", "comment": "Malware payload (Loki)", "value": "6192aa617f94ea520a144677145fc9e87578760d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713213615, "uuid": "2edf6d4b-a92e-49a7-a539-a7456f040d8c", "comment": "Malware payload (Loki)", "value": "5aa5527563bcf6813adf04d9d7f0da741fe9e4e0c695ea21c794dd190bd1cb0fce39beb06c568c705e08e1ba5f2e2cab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713213615, "uuid": "1a91d795-9279-4a33-a2c6-32a119647bc3", "value": "T1CC74ADAC766072DFC857C476DAA82CA4EB50747B831F5203A02716ADEE4D99BDF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713213615, "uuid": "33b424dd-70ae-4c23-be20-ce57a5281d6a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713213615, "uuid": "79ccc74c-3de2-4a87-abeb-78d5c77b340d", "value": "6144:SWmId59QEj2mAYA23q0cRKz9Pu46HZRoxRowHrG9JUwoedW/NuKLoI:SNITxj2mpxPcRu9X6HZWswHrcJrzdW/5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713213615, "uuid": "57d5f2eb-fc2c-43e2-8abc-4b27496d4c44", "value": 368640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713213615, "uuid": "1b3dc46f-a80a-4b98-8aae-9c9706b48e83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713213615, "uuid": "2919c758-01ac-4aa8-a5e5-c0e6670307bc", "value": "22AD27B1D4C7F684891838006C2677EF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce497fe7-fae8-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713158829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158829, "uuid": "b54cf235-8d9a-43d6-b6e3-3668f877f32a", "comment": "Malware payload (AgentTesla)", "value": "0f161f314a88dcf290e67101001aa385", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158829, "uuid": "828b7430-b19b-468d-b671-43353025e46d", "comment": "Malware payload (AgentTesla)", "value": "a3a6bfe5a3988d524fafea932f3c02cefb58c149a99900ff9bde8c4c9f317723", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158829, "uuid": "890de8f6-69b4-4a69-8bc0-7ef22d42304e", "comment": "Malware payload (AgentTesla)", "value": "40800bed624d2ebde133a23b6d121d498974e42a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158829, "uuid": "96152234-9842-4de6-9118-cc5f0667d7a7", "comment": "Malware payload (AgentTesla)", "value": "33db178d1e6e13c6aa79fbbe99f273c911d436b39619a65ac95f0aa27ccc8a971bc4e211ed09c11627e04790e5b6afdc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158829, "uuid": "8f6b4cf0-37b2-4317-8666-d11949482726", "value": "T19BF4221072BEEF23E3BB57F95130557107B028AAF121FB8A6EDA51C806347918A61F5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158829, "uuid": "08f62cc9-e3cb-4b14-91d1-d291609f3237", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158829, "uuid": "96a538f1-46e9-4205-99eb-14270b62961f", "value": "12288:EvWmNBM9IIHWKFNrLftulRLl0+RfK8Sy4vX0z4GUTu6FXy3vmZ:DmNi9IZKFVftulc8liX0z4NjFuu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713158829, "uuid": "c35e0609-31af-41c0-bb2e-1cb2e38a5f3f", "value": 766976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713158829, "uuid": "6885cbd2-b21d-4ce2-8d0f-2d55b76ffbe5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158829, "uuid": "ddac7c8d-8749-42b1-bf3d-270898f6c399", "value": "Purchase order .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "006aca08-faf2-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713162779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713162779, "uuid": "7be1e902-0770-4f1b-a5ae-48119c206811", "comment": "Malware payload (Formbook)", "value": "249c382387f592eafab7e20a55560280", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713162779, "uuid": "41015012-8386-4864-ba29-9fc25a8c0c68", "comment": "Malware payload (Formbook)", "value": "a40b613bca52ec196d6be4ac375d9076922b41cc4742c15a2ff1137bd6400eb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713162779, "uuid": "067d272a-714f-4f8e-b701-02a82d269fbb", "comment": "Malware payload (Formbook)", "value": "364c13a8ac03c9708d92fa01e5d9d442c94f75dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713162779, "uuid": "683ba344-3b29-404c-86ea-d54ea72d2381", "comment": "Malware payload (Formbook)", "value": "4d9cf6e721e210829d6a30be46dcaf7c0236693426eda9da0a3c2e905b69af9c597e944bfdecbee8d8f65531c6dc0a4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713162779, "uuid": "ab599d16-c938-4916-9964-a4a1c39dcc79", "value": "T159258CCBB3E4AD05C07F7A7075A1715082F2A4CA8E26CA4F0DE195DD7F73242ABC159A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713162779, "uuid": "42ef33a7-2303-4088-82f5-79a74afb1988", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713162779, "uuid": "317587b3-5927-4a80-9abc-96f918193981", "value": "12288:X3/p8sL8kKR0zIYaGzp9t6Mde/l5KCuz65cgOGsLNaYuPjIG4Z6jf:n/p8/pR0EYp9wMdM5Juz6INKPjR4q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713162779, "uuid": "e04e3400-4c9d-4604-bcdc-17ebebddff19", "value": 1004544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713162779, "uuid": "7f70bacd-4c59-4204-9624-407f7ffa502b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713162779, "uuid": "43fd0867-781a-4309-9efd-815bb3c61622", "value": "ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c28bb9d-fb4c-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713201668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713201668, "uuid": "f33ea261-8928-4c26-9a96-6dacf05ff77b", "comment": "Malware payload (AgentTesla)", "value": "b8fe14464c4016717c1e0e7c52cbfa06", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713201668, "uuid": "7ee2a821-7f82-42b6-85bf-a3eeb4bfa096", "comment": "Malware payload (AgentTesla)", "value": "a4cc43c1a6f7f1a92a70e1a9b0ee4157682ca2e22a9c038400c90f4e0053d298", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713201668, "uuid": "48933ede-ae29-4539-bd69-98397d522832", "comment": "Malware payload (AgentTesla)", "value": "1765e18c84d17ef0d6dccdbbab789bb306be2e73", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713201668, "uuid": "288b09f6-db2f-4707-883f-8c586ef49509", "comment": "Malware payload (AgentTesla)", "value": "4bb13df22b96ece71d3642f81437603639f93d5ae8928dfcb6be9d92fe494eefda6fc7b8b9c09e9e8774f5169e27b118", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713201668, "uuid": "6efccfba-857e-4b6c-b77f-8b22526e8454", "value": "T1C50568A933465496C046BAB74031403522699F1E0F7ED1BB3999FF999EFBAC0CF23116", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713201668, "uuid": "426df6af-328a-4609-8b92-eb933b3693b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713201668, "uuid": "36e56978-1929-447d-b337-d80355956534", "value": "12288:MDzT370ixqHKEXRs2KoL8OeczJDYjVKJSXMSXOG/RC3B9D9ecC042:pixR8s2KRZV1LXOGAnR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713201668, "uuid": "f1732635-c33c-4125-8089-caa678f386c3", "value": 839168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713201668, "uuid": "46d9e9e6-94b0-47e4-be82-1b671faa9053", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713201668, "uuid": "a6aa52ac-d2e9-4340-a8ea-4a3861d2db3f", "value": "SecuriteInfo.com.Trojan.MulDropNET.68.28054.3825", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11a46a89-faf2-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713162808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713162808, "uuid": "329097e4-ca92-4abf-bbb1-1794261c3ab1", "comment": "Malware payload (AgentTesla)", "value": "e1aa8a6bb389c967b39170b49761e179", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713162808, "uuid": "84ac52b3-67b2-4555-84be-3861331571da", "comment": "Malware payload (AgentTesla)", "value": "a59ad7114a88ee9119336b1fa950c9d0407c59afe33c13aeafdda5126172f432", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713162808, "uuid": "f9b007f1-2ca5-4f7c-8646-4ca4fa980b5d", "comment": "Malware payload (AgentTesla)", "value": "71775dfd0f7a2f2472a2488644cfb7f035acd714", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713162808, "uuid": "dc5b8611-1054-43a0-8779-5d3c36a595af", "comment": "Malware payload (AgentTesla)", "value": "acc92c29ca34655da5c6ee17b1120a716efb768b8f87595932878f9bc29c12598deae1dab895595ffa552001c7545f37", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713162808, "uuid": "8fa705db-aa5c-4e4a-abe1-246a052cdf33", "value": "T103E433B848DA7811314CB31C955DBEB582C93A820E56BA505E5AE8FBDEF1D100B36F3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713162808, "uuid": "34d6b3a7-58bb-4e74-8c74-3cae4887bd24", "value": "12288:NSpFF1EqKGky2LSAB8py7YnP1he/U1ZBsXRxpOOdlesZKefQyrWdqTiJVVfAfCJU:+lX7k9tT74ZfOd79QyrWdnFJu+2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713162808, "uuid": "a0fd140e-aa96-4ea8-9764-7c3bcdcb42b3", "value": 691673, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713162808, "uuid": "3e104f0d-9bfd-46a7-9f1b-265b26077e7c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713162808, "uuid": "5cb4875b-5c2f-428f-8027-0fbfe3f8478b", "value": "AprilOrder.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42a054a6-fb50-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713203262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713203262, "uuid": "abadc029-5612-484f-8034-94d262321d30", "comment": "Malware payload", "value": "9ff3405b401aedd9ab84c522e7286bb8", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713203262, "uuid": "7880d490-ba91-4ced-a837-1be9873c8971", "comment": "Malware payload", "value": "a93fd3980b0842e2ce7b1faf0ed52a207f10a7e00a1c8367ee568a64811d4ccd", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713203262, "uuid": "46bd5fff-39c8-4248-8820-d5eeedff25bb", "comment": "Malware payload", "value": "2d01bf0aa89e3cd2912687f6eb39ccb60ab71013", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713203262, "uuid": "b41b3f32-be16-4e56-a477-85b527b80a87", "comment": "Malware payload", "value": "2524fe7e8440b48c6c251410b1cda4a1bb1e4fd3222132cf75357216dbe500e33f6f7453baaf6df1575ff69b84de425b", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713203262, "uuid": "f030e794-1207-4283-b450-47accbf6f171", "value": "T1D7F3E31227DAA108B5F22F941A39B6664B6BFAD55E3DD58D018C194D0FF3F80C864BB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713203262, "uuid": "068eac23-6f20-4c39-8a65-4cd28956fbe9", "value": "1536:CkkR/r4f05jC9p9l3wMLky854mI/FlEZ7icK1PYqcKYq7jYqcKYq0aT6QKEawqM/:Cl4fKm9h3wMLf1GxQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713203262, "uuid": "bcddd74e-2e85-4034-9355-8599413d1a1c", "value": 169016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713203262, "uuid": "f469b126-1156-4d32-9fbc-a51ba1c68268", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713203262, "uuid": "e83a171c-c6a8-4603-9d8d-bd611fad4bb2", "value": "z15ORDERBR2024-B001054840.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f56ed65c-fb28-11ee-a120-42010a9c002e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1713186383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713186383, "uuid": "07630585-cc84-49e5-be2e-50f9134d3b55", "comment": "Malware payload (Rhadamanthys)", "value": "bbba3e6950747eecc32c43a965bb062d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713186383, "uuid": "d6c4ff1e-7d9f-4f6c-bb09-425eda9cc457", "comment": "Malware payload (Rhadamanthys)", "value": "a971d9bd579a97e0965b3af7fb6c1ec15b9fe4bc46f86735692f4f59356f9938", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713186383, "uuid": "15b6ab8f-6d68-4e5b-964f-1bac3a2c4af6", "comment": "Malware payload (Rhadamanthys)", "value": "e0d9051fde5f2edeb40de6c5cab44c14eb9e3ff8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713186383, "uuid": "07d4b093-c958-487d-89d3-38b91b7c61ca", "comment": "Malware payload (Rhadamanthys)", "value": "3a584a41dc6584f8dfafb3f1c7837304777e6011536b5980980494c8e23b8fe99d73fdabf7fdbb0bafe10b994998807b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713186383, "uuid": "fad9ffb7-f348-4e7f-a5e6-c8249a2539a6", "value": "T1DC338588B6C178D9234B2F777B2BF0DAE96E4CD8B8C40816D154FC94F876A15EAD1834", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713186383, "uuid": "ccde65fb-f34d-440c-8c71-1bb22ce57388", "value": "1536:Z60gjo6aMpQvCqTk/8J55p8Z2bacqzZnJ3Rsw2561e2I:aQxTZ55pm79nJ3Rsw/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713186383, "uuid": "3890043c-f1d2-497e-8a63-f7b3c681d36e", "value": 51193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713186383, "uuid": "4a67dced-8a73-4516-ad58-258e1b60623e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713186383, "uuid": "03b4791a-7aa3-4dee-ae49-270ef973f0f5", "value": "FRS3587.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a413d368-fb2a-11ee-a120-42010a9c002e", "comment": "Malware payload (Mydoom)", "timestamp": 1713187105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187105, "uuid": "6cd60f53-752f-46b9-a8ba-e19d2799b466", "comment": "Malware payload (Mydoom)", "value": "ec9e58951bf3e0ff91c5f86cae637dc4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187105, "uuid": "52b97944-fec7-4ae9-a965-7922c82de0fd", "comment": "Malware payload (Mydoom)", "value": "a9a89ed0d139fbc436794f5d3a8e58c547247039d8c86767b1e2f2bce40e390f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187105, "uuid": "7d7f5090-31a6-4099-86b1-b7fc0c59cab4", "comment": "Malware payload (Mydoom)", "value": "8f2e5fce00e3f5265deabaa71a9243d1b936395c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187105, "uuid": "95759e9e-b373-4ee1-a231-1b0331d0ecf4", "comment": "Malware payload (Mydoom)", "value": "6526dad97882a8ff555c9024d62eafd4217bbe6e2153a287fb0dc5c379966414300c3cf9f271b96c874c874da8e93f85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187105, "uuid": "dc05c7ff-a085-4203-b935-41ab1e7a41d8", "value": "T19213D0983E4FBA41D2850C382A03EE7BB952FD444E09268BB5747F0BBCB1F964558C45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187105, "uuid": "dfa2a162-8e8b-4762-8d32-420b94c95a58", "value": "98cd465c2ab2841f9fd90d5e847563f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187105, "uuid": "9e823f1f-a10f-4a72-bd72-432a6337c74e", "value": "768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/:AEwVs+0jNDY1qi/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713187105, "uuid": "8b38efa4-b479-4366-a9f3-023567e737c6", "value": 42966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713187105, "uuid": "d093e1d1-2cab-4c4c-9123-90a380c664ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187105, "uuid": "7854f679-a20b-4524-9c4d-16e5ea30d44f", "value": "gildong@hongs.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b29844e2-fb45-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713198726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713198726, "uuid": "ba067b31-40a4-4f76-b8e7-727eba1e249e", "comment": "Malware payload", "value": "f5b360cc31f55fe1e2e553cf21d9d635", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713198726, "uuid": "0944d8d1-79c2-44e5-8207-75061a2b02aa", "comment": "Malware payload", "value": "aa19b0f389af88f8df748742e3eac19f5a0c70acc6ed7932ad2890915739ee03", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713198726, "uuid": "a77260a1-a171-413e-94fc-cb9462f6680f", "comment": "Malware payload", "value": "4caf70e964fb3422e6e5d1e9b1c3e67511bb3302", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713198726, "uuid": "1a395338-b28f-41ae-a9e4-b4dde577b599", "comment": "Malware payload", "value": "cda53d20d3c4987a6f24452f6c218d9a575da4de8491c6ab88241d33be7ca876d8aa040f934a8adc7eee331c568548b1", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713198726, "uuid": "01f9ef9b-7355-4047-aec7-0b20c6883fce", "value": "T1ED3135141EE60324F7F38B39BCBA6225C9767C41EA728F8D005046882875221E5A9F2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713198726, "uuid": "8ea33055-173b-466d-8684-6bd140fedc9c", "value": "24:8Z/BHYVKVWXr9FN+/CWgIJfKx+QxTnU5ZUarab/zgb:8h5aXr9FXx+QxTnU5ZU4ab0b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713198726, "uuid": "01a0780a-d3d9-4a2c-aaef-2b3836ffa1ac", "value": 1470, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713198726, "uuid": "5d13cebe-63b2-4959-af7a-95e5bb0c4d9e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713198726, "uuid": "a4e8240b-3419-46f7-a2fd-1095087072ad", "value": "12YearoldFingeringHerself.mp4.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d88b4240-fb80-11ee-a120-42010a9c002e", "comment": "Malware payload (njrat)", "timestamp": 1713224130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713224130, "uuid": "f6eb1a05-81f7-422e-9f74-c53ab09cccc7", "comment": "Malware payload (njrat)", "value": "0c2672ab64b9a27db6ea9d7fad042cac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713224130, "uuid": "53af85e7-1ae7-4a71-a0c2-e56f8a8e6c5d", "comment": "Malware payload (njrat)", "value": "adc32806bb56fd0df1d594e6274ff3c3735fb588e79a721033cef322c01b65be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713224130, "uuid": "9f5b8763-1b1c-42e4-810e-b5aaba2bf046", "comment": "Malware payload (njrat)", "value": "cf5359241c6a9dc7f823663b3f168556cd9f06ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713224130, "uuid": "51a772bd-46a5-4fb7-ac1f-8d6db4ea24aa", "comment": "Malware payload (njrat)", "value": "f71782364d5bea0cbd23aca910804c3911ca655150a3e86a7acde20bbbba5aad5c1d6b9865835124aced0bc4b69e7d56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713224130, "uuid": "86c73c68-27df-4993-a2fb-96ca184c1e93", "value": "T164032A4D7FE181A8C4FD067B05B2D41207BBE04B6A23DD0E8EE564EA37636C58B54AF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713224130, "uuid": "420ca6f5-9244-4277-bfc1-13a599c0cd53", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713224130, "uuid": "d898edd3-1d54-4f81-a9ee-a3fec68e248c", "value": "384:HmOs0IiejvCVLO309QmykrtG+dA+VfwvOSiKrAF+rMRTyN/0L+EcoinblneHQM3z:9FdGdkrgYRwWS9rM+rMRa8NuUgQt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713224130, "uuid": "dd868893-0672-4fff-9f0e-e35c2a48e7db", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713224130, "uuid": "5d73096c-92b7-491b-9588-a07188cc9387", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713224130, "uuid": "86e85f99-1e62-4a09-8edf-d653c2ddfbb3", "value": "0c2672ab64b9a27db6ea9d7fad042cac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b34fc90d-fae7-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1713158354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158354, "uuid": "d7b8f4ff-4f1a-4bd9-85c1-3f8f19d04d8d", "comment": "Malware payload (Neshta)", "value": "5d84f160cec1c7b8e83d6d9f90a612f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158354, "uuid": "61306bb0-de90-4317-8aef-fcbfebc16703", "comment": "Malware payload (Neshta)", "value": "aec8415d0972e902d53d348ebc7beaf6c575f9ec6e12791173ab1d84e90a1109", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158354, "uuid": "22824bfe-842e-4156-8c37-d76b4be0879c", "comment": "Malware payload (Neshta)", "value": "58f2e9216d4b29073376f6f607c16d03ba1c200f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158354, "uuid": "e416acb1-307b-4e19-a666-ff1e5c3298ea", "comment": "Malware payload (Neshta)", "value": "a18100ff74144e030ed666e3568286f826dbd443915c5811a71a1d4d7b03f833ee54a0188112851f267b068e4519c668", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158354, "uuid": "9c99a398-c7f7-4742-a231-88bf876a64ed", "value": "T1A405120473FDEB35D37FABF5393811604BB2766BB624E64D9E9600C80522F811692F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158354, "uuid": "6a441503-226d-4e95-8c9d-fbcf7602735d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158354, "uuid": "c8fb64da-20cb-49f9-befe-ad174ffd8d1b", "value": "12288:0YdNBRpXKLo9hkHttxOpoyk2/VA1kzxFrTffQ/CvaY3D6o3Jotq4xzVtf4Bbro:9dNnpa4kNRI/VtXffjTFsVd4Br", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713158354, "uuid": "835a01f2-d524-4c96-886a-ceaa88b98889", "value": 808448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713158354, "uuid": "c508838e-584f-40e0-958e-07f6100ef413", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158354, "uuid": "de83b272-4a44-4be2-b1f1-af92c546ed33", "value": "SecuriteInfo.com.Heur.22008.21824", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "054ea94f-fb41-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713196717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713196717, "uuid": "9dcf0b3f-711f-42c1-8f1c-bc8607fe7bb5", "comment": "Malware payload (Mirai)", "value": "30d2ae4e3ece93510739214f0f049c76", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713196717, "uuid": "5a498ba7-1a1b-441b-8585-90c0fb3358ed", "comment": "Malware payload (Mirai)", "value": "af96fdfa22b52d584be143a20c9eab26d55f90bf1e63c6baf3139a0438dd93ce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713196717, "uuid": "71cdb362-276a-46f1-9367-a5c79934652f", "comment": "Malware payload (Mirai)", "value": "feb1c3bbca5afc822f73d46db151c9f5632f38ed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713196717, "uuid": "51e24d8e-bf19-4771-b804-2f488bbc64d1", "comment": "Malware payload (Mirai)", "value": "c01f8b4b3b228a969c19b26b2ff036ca3f09261f468fb029247f07df9f4efea42e3bb67d2b8ec874ac3c6fcd2a2ff160", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713196717, "uuid": "804a10d3-d6c7-4513-aa7d-d3658e7409e2", "value": "T1EAE3426BBE109B19F65C973106FB6D28834A23E72AE5E54AD19FC2002E7131D5C0FEB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713196717, "uuid": "3a4b4aed-4ed2-4b5b-833b-17e453e1ddd8", "value": "3072:mC1zHgj7BqRNegrUp2yNzPnqKyVixix5Q4h4xF9aFb1lHW4bdbg:r1zA/BqRNegrUK/iE4xFUFb1lHW4xU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713196717, "uuid": "a660956b-f728-49b1-9a91-ab6f785a298a", "value": 153752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713196717, "uuid": "a9f115f5-7238-4088-ab4e-6e84b567c7fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713196717, "uuid": "fc31f5d9-1fb4-4b2d-b7e2-bf3ec2563b37", "value": "30d2ae4e3ece93510739214f0f049c76", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fe36ff3-face-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713147504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713147504, "uuid": "95243402-7723-4894-ae96-eb3773ab9b31", "comment": "Malware payload", "value": "3bdc36508d4af3b225f1be75ee23dde6", "object_relation": "md5", "Tag": [ { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713147504, "uuid": "88107008-7e03-4416-805d-917a192909c5", "comment": "Malware payload", "value": "afef4402cc609af37904956ec62a161238e22d9fa89dedf02652476e7ec4b4d3", "object_relation": "sha256", "Tag": [ { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713147504, "uuid": "08284ba9-425a-429a-81c0-f82cc2aa0aac", "comment": "Malware payload", "value": "3abd57aacc6764c1a8cd63f5ba7aa41a6f24d32b", "object_relation": "sha1", "Tag": [ { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713147504, "uuid": "319b6875-5c53-4d1c-9433-5f91da3d0fe2", "comment": "Malware payload", "value": "878fe032689fc8ca4aac00b6bac3a154e39bf0401a9686fd72341a9633bb23dd7feb1f8680c9804e36d08a482dc3642f", "object_relation": "sha3-384", "Tag": [ { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713147504, "uuid": "b9d10c8a-3da7-4126-80cd-3682a1753848", "value": "T1C2663379998D321476EA22EF17A9EC08709E4B0485D3CEEFDC797588F2D250DA3C7606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713147504, "uuid": "97bc6b9c-5f7f-413d-84f5-d96d6b2a73e5", "value": "98304:qy4Z/WSDdmEtGfE1bftMhb8h8LNFnnC+5mZ77QfjTNOnb73g4g14YDpD:q2SDdmEowtMhTLNFnCTZ77Qfv0M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713147504, "uuid": "a084637b-64f4-4e29-85d1-825e990b7808", "value": 6538328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713147504, "uuid": "33717d4d-6f00-4913-b288-0baea6fbe2ae", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713147504, "uuid": "36ff1959-604c-49aa-b8f0-2044e0b45bed", "value": "\u65b0\u5efa\u6587\u4ef6\u5939.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccda3260-fb1e-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713182019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713182019, "uuid": "68d76d38-17ab-4ce7-b1ee-8daef8a91929", "comment": "Malware payload", "value": "57f59d6ad2fb3216ed769eab61939e73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713182019, "uuid": "85e799f6-303a-4222-aa15-ae2e705021b6", "comment": "Malware payload", "value": "b1a6bf93d4ee659db03e51a3765d4d3c2ee3f1b56bd9b701ab5939d63f57d9ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713182019, "uuid": "64680949-8cce-4935-a42c-68d4a6a543a8", "comment": "Malware payload", "value": "4d51fc3508bd3e2d772c7052867b88d941ce8d2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713182019, "uuid": "fb4a1496-4e2b-4a8c-8a5f-626664b8bb37", "comment": "Malware payload", "value": "489a44524f4be38cbbbf53d23d257d734e90ddc524ba84052302fbbb1122c5ca3ef7e43d29d9d99801212894e0196351", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713182019, "uuid": "e8afa4dd-b9c8-4887-87b9-3e55e291e5e8", "value": "T16A04D647A2A760F9D5BFD07992977626F9B134104334DFAB86408E231A33B74B53E728", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713182019, "uuid": "03479cf2-cd35-4f80-a517-faa045068f02", "value": "941a6da3f373763714c1b753afdae3c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713182019, "uuid": "90a269c5-e236-4042-97df-404e14124a9e", "value": "3072:4qlP0y9JOVmf4tW40xDu6QGDQTnhf+0zlCJ/R5bFcEXaajSDfmS+5jw7mSEZM94k:4aP0sEYPA6c+0zi5bF4+SCa8MaA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713182019, "uuid": "737c0968-458f-468c-a64c-f338248a002a", "value": 183808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713182019, "uuid": "5756e7ac-aff4-4e38-af8f-8acc37389293", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713182019, "uuid": "e13edb7e-7216-4feb-b66d-84b97c4ce0c7", "value": "b1a6bf93d4ee659db03e51a3765d4d3c2ee3f1b56bd9b701ab5939d63f57d9ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "686d594b-faf0-11ee-a120-42010a9c002e", "comment": "Malware payload (Glupteba)", "timestamp": 1713162094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713162094, "uuid": "7d6c0aa0-c5cd-4441-8660-1595532350cd", "comment": "Malware payload (Glupteba)", "value": "81f2e982687c695ee0bbadf147feca3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713162094, "uuid": "c491ca88-edd7-46fd-8e6b-9a675d6b2caf", "comment": "Malware payload (Glupteba)", "value": "b1bf0f6717341cb605ebf48e85805282b77e5a3d610f211b90e4ec726b448331", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713162094, "uuid": "3e22832f-ac96-4999-b1e4-fd4da5969478", "comment": "Malware payload (Glupteba)", "value": "b33a15b47c3b99c65f2277562a928bf9ce9dabf7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713162094, "uuid": "84dc7071-016f-4450-9836-a99efa29ca5d", "comment": "Malware payload (Glupteba)", "value": "c6e15ea586b99d30c883f6175d1d7f4804cd4f78c0aedca1a2e4f6f75a8f1581ef8e4ae5dfb85ce2eea4bf164201c1cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713162094, "uuid": "00973aea-60e1-40ce-88b0-6d7f2dd1e995", "value": "T1EF842202EBF5A01BFEF75B3488FA8540067FB9A751A5E33D15D4E1280A717A6C4E2B43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713162094, "uuid": "bf2946fa-eb43-4136-b228-30f0af7bcbe5", "value": "6144:kz00wubhcFv7g9X7wkDStegoIG2sJnuhLvdHVpHBm/F0kpJVdVpftj7XfLT:kzhBqFv7g9kBVG2ACLvd1pBmN3pJ5plX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713162094, "uuid": "ccb3cf6a-5505-421d-9ac4-0b50bb8dedf3", "value": 392888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713162094, "uuid": "160b03e0-1d0c-407e-b29e-2d0ab385179a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713162094, "uuid": "f579681b-736a-4858-8930-9f44adc54782", "value": "81f2e982687c695ee0bbadf147feca3b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6d24b99-fb2a-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713187110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187110, "uuid": "a8b6b402-765a-4b4a-b704-c059425e2c0a", "comment": "Malware payload (AgentTesla)", "value": "9a87300066edcd42c6a53f1af9f04aa5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187110, "uuid": "20c320a4-3a91-47f0-a148-00bb43ac6d9c", "comment": "Malware payload (AgentTesla)", "value": "b221fbbba9145479c60a63b77da5c52785a2f11ae697a6eb7224f930bbda9cdf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187110, "uuid": "90d8df44-d150-453b-b027-ff3727df1646", "comment": "Malware payload (AgentTesla)", "value": "2b1a96c79151bc1e9d8e5d87fab6c84d55b74ac1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187110, "uuid": "0c6df85b-1a39-418e-b01e-705e2fb55628", "comment": "Malware payload (AgentTesla)", "value": "91b7914a2d8a7027e5c0fc2ac4e6c4e59c4d2927f85be0c0a65088a76816cd355e6ea0784aafcb18f5b99a622de8c44e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187110, "uuid": "07955ecd-d11d-45bc-b563-8382dc8b76b8", "value": "T1BB741228EBDC8739D94D5A38A4654A1D03F10C447AF2DF86EC9893857613FE0DB53A8E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187110, "uuid": "1f0f1cbd-1a30-4680-bcb1-306f49712687", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187110, "uuid": "fcafd1e8-21a5-4254-9028-1a9d5c9f67c6", "value": "6144:bRSEAhZalpfBcl7UqXJSbs+6ucHac1jACZ/rYcPdqbmodhATW7qrMv17eysNc:NSnHpSqXJn+6ucL1nrYc1qKu4W7qgv9C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713187110, "uuid": "eecbea91-4653-4f45-89db-3cc73a627e8f", "value": 353792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713187110, "uuid": "eff6da54-f838-489e-9b81-432f7ccaa770", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187110, "uuid": "7d2e6de0-2130-4291-9c3e-62fbdec98fdf", "value": "order Depeng POORD20231109001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a99da55-fafa-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713166446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713166446, "uuid": "9ea9edb6-a9ff-4726-a49a-a6d7532fd811", "comment": "Malware payload (AgentTesla)", "value": "004fa989a557f709f1c918f8ddefe566", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713166446, "uuid": "c5755e65-bfea-4c10-b67c-02bcb281b4d2", "comment": "Malware payload (AgentTesla)", "value": "b384eaadc17e9417f7c4055d35475941c08f0c78bb86eba4b21e6883fcaf43fc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713166446, "uuid": "009fd321-0ded-4b77-8716-6a1c7da5154f", "comment": "Malware payload (AgentTesla)", "value": "13a77cad5f3857e06a93626ff2ddb22de222e3e0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713166446, "uuid": "99cc5670-939a-49dd-8b2d-159346f0e46a", "comment": "Malware payload (AgentTesla)", "value": "5cc0f3017e98bc0cdb508185fa19251ba77f0b561dcdfa3aec4e7f8d03f8f58a62864a090a6fd43e68f1745f640e93c1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713166446, "uuid": "0cf60146-1b05-47ca-a3f5-a28ad06f7a84", "value": "T1D2341F037E48EB15E5A87E3782EF2D2413B2B0C71633C60F6F49AAA514517826D7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713166446, "uuid": "78f1ec97-a20b-485e-ada4-75957eed116e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713166446, "uuid": "b9482419-215c-43b6-a396-e41ecaa2cbbd", "value": "3072:gwoIjPQv3nffr5ikRRboPRqNJdndyOcsYS8N5jXBCF1DM:/oIjPQv3nffr5ikRRboPRzB7BCT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713166446, "uuid": "6e7c9496-a57e-4c56-a79d-60b75fabd527", "value": 247808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713166446, "uuid": "e384e907-f19c-4591-ba8b-89cbe00846c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713166446, "uuid": "1665b645-a93e-42cd-8006-5a65ea9ee9af", "value": "17131664440dd00fd6922b1959138427bbaa2fdf5eadefe903194a46ed2d146bfcb79ec509916.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a02851a3-fb2a-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713187098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187098, "uuid": "ea78ffc6-8ad5-4d09-8b04-2f1b7f730343", "comment": "Malware payload", "value": "7ac24c0805a81828aa9a54425f3b21bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187098, "uuid": "24da75c2-1cd9-4b8d-bf50-367697d4d223", "comment": "Malware payload", "value": "b547cae6c6af74e63884b8745af668b32c0b8e1e0969819421f471f88d35170a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187098, "uuid": "1f9f157e-6e2f-4db1-a86e-a19849f187c6", "comment": "Malware payload", "value": "ee8e1fa77b514262e2c4251dfd4405a61b447bcb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187098, "uuid": "fe8ce541-dde4-4bac-95fb-79a7dae57161", "comment": "Malware payload", "value": "b62d6aaf3c9f25576b05c3aa2251f016982eed3145c97f65886f77438b62c2c25fa3022b75430085a14fd819ae0e0e43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187098, "uuid": "1bf6e638-c148-413b-b090-a6c13253c051", "value": "T1A0649ECCBCFA86C7FB745D71BCE2C26415AA41BA44E017077AB427246B73F4A1D0B61A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187098, "uuid": "ce93c50f-9999-42f0-bc85-e4e153ebce84", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187098, "uuid": "75bf70af-a227-4b22-81c3-b3cb97b7fa9c", "value": "6144:vMm4CcCZOfcnHHLQLSm4NY3JO2j9gxMyO6qSPcJ5Sbe3yU0Ganm2b9D:vMw/MLPygJO2Jga+fx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713187098, "uuid": "78f44d36-f4fc-42e0-b64c-da58297d2071", "value": 333312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713187098, "uuid": "79adac02-54a3-42e2-8407-1e58a307dca0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187098, "uuid": "bd093c47-674c-4bc3-8b49-ad854b8ee0d3", "value": "b547cae6c6af74e63884b8745af668b32c0b8e1e0969819421f471f88d35170a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5dee401-faf4-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713163996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713163996, "uuid": "5c7dcb1b-6026-4b75-a6bc-1a6261e38cfd", "comment": "Malware payload (Formbook)", "value": "37160defa313df0185f3c4b863d10545", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713163996, "uuid": "b8df4226-2095-4b2b-ad06-5cfeb6b4e7df", "comment": "Malware payload (Formbook)", "value": "b6c252883799568c28a1af098d7f1fd835181d54c3098bbd1dccacd40a23873a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713163996, "uuid": "8ae161f9-18fd-4564-8ff3-51501e8ed3b9", "comment": "Malware payload (Formbook)", "value": "09c142f27633ea0071ece961d8680293a92039f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713163996, "uuid": "72152fc6-10fb-4803-adb0-c6917221b954", "comment": "Malware payload (Formbook)", "value": "0e06935152acb7d2952286f7c8ae93d207e6193cc0de78c442ebd80d433275f78ae1b33640a9949bf17621d4670ce474", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713163996, "uuid": "056410e8-f951-435c-b95e-bc9867002948", "value": "T1C8F24B2013ACD727D87D57B9A461110317F2B216B012FB9D6FE660DA2F67BD14A80FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713163996, "uuid": "72732f6e-0aa7-48fe-ba7d-84270120b359", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713163996, "uuid": "8f67a51c-097a-464f-8f7f-e51dd7df510b", "value": "768:X8dJtMfDFqwfQrJ/XG2Xuf/BXHFoaXcQ95+otMmEIbfTuZNJwa:fqwfQsDf5eLGMmsv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713163996, "uuid": "d897894e-15be-4efd-9571-16efefef3751", "value": 35328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713163996, "uuid": "f7e37897-d8f8-45b4-a210-3bb3f6c9c1cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713163996, "uuid": "68aaca2b-bf03-46d1-9f4a-33123f5b59dd", "value": "alhadani Aprilorders140424.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cb7e570-fae8-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713158692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158692, "uuid": "f00b35c2-f2fe-41f5-a43d-9574619368cb", "comment": "Malware payload (AgentTesla)", "value": "ab8d37015f44647431a538a25e0b0a1f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158692, "uuid": "c721333a-63d4-4b93-be8f-be5e6c5c492c", "comment": "Malware payload (AgentTesla)", "value": "b810eb14acebc55075e198279bc938022c9ae92e3cc58091ac1dc61eb1e4b30a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158692, "uuid": "05041a79-3e4e-4c43-a6e4-b44e5b1c72cf", "comment": "Malware payload (AgentTesla)", "value": "d846c468131792521d01983a69fe18146ed85f7d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158692, "uuid": "9f529931-babc-4714-ad25-160de5a58151", "comment": "Malware payload (AgentTesla)", "value": "09646e18895f1b3d1244f19ca088f8cc479bc3833d6c3cdddbbfd94667f9fc638d0c5a44462ff331e9edb98bbf714802", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158692, "uuid": "263a0f61-1352-408f-8718-a64d4f5e6f28", "value": "T1C433BD2532C5E58AD157CA780ED8C1DB6611BC66AE93CA0F7190FB0F19792D28E9370B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158692, "uuid": "c0f56db4-ef11-48a8-ae65-fde976c0675f", "value": "768:fyBP0S6kQatpTKrQ489wQ+C+IoBjzYAJ4aMETFI3fhVmO+6L:f68S6RatpL9SgSXJs3fh0O+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713158692, "uuid": "432f9dec-aad5-4849-b17d-91616fba5df2", "value": 50688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713158692, "uuid": "483f8a2d-3566-47c9-ae65-91f943c9e691", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158692, "uuid": "509c8e7f-3359-439d-b171-53d14ca8126f", "value": "\u03bd\u03ad\u03b1 \u03c0\u03b1\u03c1\u03b1\u03b3\u03b3\u03b5\u03bb\u03af\u03b1(purchase order)_765347897896786454567653.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "237009e2-fb41-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713196768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713196768, "uuid": "13bcacc6-87e6-4a28-97cb-eb15d559364f", "comment": "Malware payload (Mirai)", "value": "ec14ca8f1f927b50a7bcec5dae6d2a41", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713196768, "uuid": "2e76cc37-0825-4add-9e03-aa147d87c900", "comment": "Malware payload (Mirai)", "value": "b854ef71e8b28682260cf3b5d33e93ba5e7c73afb41160c9bb2379b7341f93a9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713196768, "uuid": "2876432c-6ea2-43ce-a69f-aaba0c417b89", "comment": "Malware payload (Mirai)", "value": "c195d7b67474abb27d4196a99bd7137dcc25d622", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713196768, "uuid": "e626221e-b8e7-42f3-97c7-b76819d4301a", "comment": "Malware payload (Mirai)", "value": "791c0a8133aac20803820c805bb8ff3cc1ef1f1c7ed7a92ee0ba41844e539849065137850f23e5872e19ca5bbacff9a6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713196768, "uuid": "6b8bf4e5-b5d4-4e3e-95ba-c403104ca2fb", "value": "T1C7D31A45F8808F13C6D652BBFB5D428D372A17E8D2EA72039D206F61378B95B0E3B546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713196768, "uuid": "f8a0969b-171a-419b-b217-a5c53f288dff", "value": "3072:zHhoehdkQCa9IDzv6BNFn5d0wXqSjjRfnpru:5cQCaav6bOwXZVnhu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713196768, "uuid": "7be403e3-a19c-4ad4-81da-0de8335a9a12", "value": 137516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713196768, "uuid": "923ea6c8-6311-4562-88d4-f340a15d3648", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713196768, "uuid": "a435c308-86a6-444c-a4c9-af4bb63a34ef", "value": "ec14ca8f1f927b50a7bcec5dae6d2a41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e671c41f-fafe-11ee-a120-42010a9c002e", "comment": "Malware payload (STRRAT)", "timestamp": 1713168318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713168318, "uuid": "3ab96815-84ee-4f90-9f5c-20c77b864ab3", "comment": "Malware payload (STRRAT)", "value": "e90c707d25633173dc5a0983d9dc932c", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713168318, "uuid": "9ebdb249-2d52-4301-870b-58ef5d6f0464", "comment": "Malware payload (STRRAT)", "value": "ba164db62a7b9c2ac27ed6a3913805afe1f72ad2c63dd25524e99d23dab9c007", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713168318, "uuid": "f685e49a-dc67-45c7-8980-dbf5e3b91e78", "comment": "Malware payload (STRRAT)", "value": "a20c973823a60f2c5d64cef8d5a359be2e3a8173", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713168318, "uuid": "50e6669d-8054-4b38-9c13-b569e6120a6d", "comment": "Malware payload (STRRAT)", "value": "7bdb71d83a7b4029644d5e1fa38a18cedc77e7090bdbfffbee45d338b21ce894c7b650c8b7443928671ce291305ad090", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713168318, "uuid": "2d9c1c08-b866-4726-ada2-c7a887e5d174", "value": "T1F5B4123E3BBFF168E007A5310D498B65FB0D6229C144919BB2EC14591E34D4EAB13AEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713168318, "uuid": "212b69a8-71fb-49b6-9592-424cd9669b8c", "value": "12288:bxKaeyL6XZIswSL6d/soKMFhyngUYiTcEkVG6a:bvtWqDSL6d3KMagO6a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713168318, "uuid": "db100d0f-3084-40bf-9f6a-91bc28cfc216", "value": 533570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713168318, "uuid": "8fcf9f66-9c48-49cd-8f5a-c742a9e26c35", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713168318, "uuid": "2ed90267-b410-4c0e-9dfa-a9be265545c5", "value": "CS TSA Inv-#90071894202300415 jpg.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d74af1d5-fb6e-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713216397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713216397, "uuid": "6a5a7fab-3226-45b9-a758-4e2eb0396390", "comment": "Malware payload", "value": "23bbacc8fae4f92daadc8fa665228cd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713216397, "uuid": "b9b03db0-4a29-4627-91ce-ba3cafd76fb1", "comment": "Malware payload", "value": "bc13f460e8ae556288cb862a2b222a5d89e77870e38c1fd43fc66cd2bcf3bd50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713216397, "uuid": "fe7caaec-4e5e-49d2-a549-0f5c1cf96cb6", "comment": "Malware payload", "value": "d5978a12a9550d00e76d4c0cb835710614f0e572", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713216397, "uuid": "26dc197a-e3fe-4ff8-b344-930820fdb88e", "comment": "Malware payload", "value": "13b997276cb47d3a15493fc2ddbbdc116fe721506c5b9348368e95763eb740011efee01709680fb5cf99d5cec319688d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713216397, "uuid": "962ac345-801d-4c74-af2b-fa0556d31dd0", "value": "T16C354A4163F88F2BD5AF6B35F4700A1547F9F807A6BAE78F5A44D8AA1C537808E50363", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713216397, "uuid": "3e6117f1-1d48-4d3f-9498-ff7ea15fad25", "value": "24576:dzCJ3x7Bjk38WuBcAbwoA/BkjSHXP36RMG:FCJ3JCSA/Bkj0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713216397, "uuid": "bed1ae36-228a-445e-a1fa-588da74654fe", "value": 1076736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713216397, "uuid": "3a2b57ab-63a8-46ba-83a7-63dae15b11a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713216397, "uuid": "a300ec62-f085-4dd0-8c2e-818f2ec87ef8", "value": "SecuriteInfo.com.Win64.MalwareX-gen.31881.4381", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63a1ab52-faf4-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713163804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713163804, "uuid": "aa462807-1d68-4dbd-8865-e8b2548c2122", "comment": "Malware payload (Mirai)", "value": "8e570cd01b8d4dadf8c5daa6ff8bbda3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713163804, "uuid": "74aa5b6e-da92-405b-9cca-1a7866c27a63", "comment": "Malware payload (Mirai)", "value": "bc2782d990e80f15409cf5b32b5804738428b97069111765f639ad56b11c0627", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713163804, "uuid": "3874ac9b-5e04-41f1-b9e1-df252432f777", "comment": "Malware payload (Mirai)", "value": "27832278f9e5b19172bf8583efe22700394e94a4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713163804, "uuid": "5fecbc3d-88ad-428b-bc77-232dd9226572", "comment": "Malware payload (Mirai)", "value": "f9b5f7d6d605270a8f7bd6f43739de81f86c640aed9faff251dd9bca3de9b5c6dee9311a3747e09ce0b11fe6d048e0fd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713163804, "uuid": "ee288123-9594-47a3-98a2-de5920e7d10a", "value": "T1CD33F26808713C4AE0147DB6673BA39A75F08F24995616F9D70B1CEF0C02F815F7A15B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713163804, "uuid": "b0aa1ec6-8791-42cf-9ad6-ce9f97e6d95d", "value": "1536:ndPSMI2wny+Y3N7AnCYs2ZekM3v7p4szK:dO2wyrpAC72Zej3zyH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713163804, "uuid": "5d10f2e5-2468-4f38-8927-83d0015e0d2e", "value": 50620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713163804, "uuid": "d4b1e13f-6d13-4e39-bd73-e158eb303573", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713163804, "uuid": "540eae0e-45e5-4999-8979-aaf34a677d7b", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6c97644-fae8-11ee-a120-42010a9c002e", "comment": "Malware payload (PureLogStealer)", "timestamp": 1713158790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158790, "uuid": "bde7495a-87e7-423e-981a-334b935a8e4e", "comment": "Malware payload (PureLogStealer)", "value": "b2fcba90cad8e02690f59cd95e610a22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158790, "uuid": "9f3776f5-83bc-4eaf-af63-01366cf6f8d9", "comment": "Malware payload (PureLogStealer)", "value": "bc8e5c7e7dacfb3ed91a8fb6aa5c878bdc52e39ce1c4c797ec39862a53345ce4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158790, "uuid": "2e844f30-87b0-4bf6-8f0d-69068cac444b", "comment": "Malware payload (PureLogStealer)", "value": "c3815ccdf56bc63c6ff505795c023aa21597f958", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158790, "uuid": "720888c5-88e6-4ebd-85bb-2e0a3cb0173b", "comment": "Malware payload (PureLogStealer)", "value": "c32a1991d57eceffc95606406db2d046456a2092d2e5299c0d262b4811d164a3e8bbac009ccf1e591da21c9a739eaae6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158790, "uuid": "7640cbaa-1292-4cd7-bf18-95a50022385b", "value": "T1E46501AD7690B6EFC857CE36CA941C64AA2164B7930FD207901309ED9A0DADBCF141F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158790, "uuid": "96cf0dc5-7521-4816-9903-2feb60576ec5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158790, "uuid": "8625926a-45df-437c-8327-4b3843a10c8e", "value": "24576:5nANPHxfXqOPoEBsnCYtvR6o6ZPNMQOnbYiepqlAjbFaygRgEAwlNTnLRKvs0NEp:Ryx/qOPoEBuZtvR6oGifbYQAPFaoXwXr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713158790, "uuid": "7c7bac38-4e03-43d4-9f70-062753d1f010", "value": 1539080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713158790, "uuid": "2a89daac-5ea9-4bf7-b43f-23ba23e9451f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158790, "uuid": "3bc16855-d5be-42a7-9e89-18db2356d60b", "value": "RFQ List 20240415.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f28eb6b7-fb25-11ee-a120-42010a9c002e", "comment": "Malware payload (Stealc)", "timestamp": 1713185089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713185089, "uuid": "6071270a-dbfe-4467-a232-3021234a2999", "comment": "Malware payload (Stealc)", "value": "e5772cea69e55a46fe47eafd4d8fb652", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713185089, "uuid": "5f99c96c-c2d6-479c-9682-0607fca9b0db", "comment": "Malware payload (Stealc)", "value": "bd3e7b833225e8cd094599a1980aca4f07aec1af7501020b1eb2fb94314c4eff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713185089, "uuid": "e787d0c7-d357-4124-bb43-c71cddb3be85", "comment": "Malware payload (Stealc)", "value": "78e2ade67aae20494947d725f344778f3675eb9c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713185089, "uuid": "c99f539c-f4c9-46d2-82d0-013728cd1ca9", "comment": "Malware payload (Stealc)", "value": "89ffdc031ca830f301194d7d33f82dc0f977dffdf354399404f78ee1b2d19935801811dd3cbf0dad642623530db004c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713185089, "uuid": "6a023c84-69af-42ac-a185-25a94cc9726f", "value": "T1D0745C0362E17C68E72787765E6EB9B4763EF9604FD9676B23088B1F00B0072D663761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713185089, "uuid": "20077381-c1ef-4a1e-9e8a-87236c7abaae", "value": "22b013f0fa71f4c2291b734eaa2d7615", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713185089, "uuid": "719036f4-942d-4631-9b37-08ef59d1cdc6", "value": "6144:Pt6w6QdagGXY/B3/vM7dEl/9l1ZeeLN33nGV:0xo53/U7dE3ZjNM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713185089, "uuid": "6bcb8bbb-9a1e-498d-8c3b-38470b1dd80c", "value": 352768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713185089, "uuid": "7ef2ff57-24f4-49ff-a250-7e6004c6e273", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713185089, "uuid": "5f7d1b6f-5423-49f5-8716-85a306afa71c", "value": "e5772cea69e55a46fe47eafd4d8fb652", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "561bea77-fabc-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713139730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139730, "uuid": "6d29c091-c117-42a8-8374-c2f4e27267f7", "comment": "Malware payload (Mirai)", "value": "0170d1472ad8aa779bddc90c72957486", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139730, "uuid": "dfcdb890-0853-408e-8105-c3cb0d53e316", "comment": "Malware payload (Mirai)", "value": "be4ddde8429b2f8fd2179d7b09dfea57d7133ffba0942d25aa4a54622bff6f32", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139730, "uuid": "46e21028-d83d-489b-840f-dda0632f2014", "comment": "Malware payload (Mirai)", "value": "86f40ee397ecd74bb4800bcff45be00f88403d73", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139730, "uuid": "7477c047-6d46-4c5d-b80d-b8db9c101a17", "comment": "Malware payload (Mirai)", "value": "deae816cc935f6ced67d276332e43752447d5f7b74b961ed6e2f01e9d21fdbd3d21cf1de4300210c25854893f1485f56", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713139730, "uuid": "18fb54a9-8cd1-4c1c-9c84-947a110326d1", "value": "T16EB308066FB11FF7E85BCE3702E61B15318CE91A27A26B36713CED18F64B24A15E3464", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713139730, "uuid": "2e76f8b7-80c0-4b24-aefd-25a007543b16", "value": "1536:UDr6LH2EoY11d6NzrvU9KGdBZSrKRBgkEAYunF9MLGvwbZnduu7TSR6ct:Un2os1d6prvUHS46uF9MyvwbZnHSRx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713139730, "uuid": "ff28506c-593b-4ed7-807f-11d39551b590", "value": 116878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713139730, "uuid": "da562093-42c6-456d-a7af-6822ecb0c67e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713139730, "uuid": "613ee642-57f7-43ce-9b61-0e56a4826903", "value": "0170d1472ad8aa779bddc90c72957486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20abab04-fb0c-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713174000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713174000, "uuid": "7baeb6bc-74cd-4738-8a85-42aae55b005a", "comment": "Malware payload (Mirai)", "value": "8704dc30048b252b286dfe6b60f854f6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713174000, "uuid": "46d1df35-0d9f-4db4-9570-b1bd22dd8dda", "comment": "Malware payload (Mirai)", "value": "beaa28e38ee315dc2a8359589df55683d50b629d3b4ba35e7d610897a4271fa4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713174000, "uuid": "3d88f822-5696-4143-bc6c-318b97208ca2", "comment": "Malware payload (Mirai)", "value": "7740ed8f34a9b28f52f156480bfb848df30ab22b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713174000, "uuid": "fc2a2efe-856c-4a68-bac3-e33108641bae", "comment": "Malware payload (Mirai)", "value": "97071fa4d8eea4ada7c40ac1de2889dd1251de793946a7381de6690646ec8a4fe6cdf229744d03dbd84f175cb1eb33b1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713174000, "uuid": "e0366315-3ce7-45b7-a531-0689825ba9de", "value": "T1C0C3087394649EB2C041A9F125FA8D710F236D930B6B0A94623D77F04A7F5CEB48AF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713174000, "uuid": "46c06d21-67c5-4e60-b700-a27cd18209bd", "value": "3072:X0Y1SpZ1XznZ4NrxXGIE5hBvmrLzZYerNu:X0gSpolUhJmrLzZYerNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713174000, "uuid": "fa09add3-13aa-4956-a3de-0ad6f6e5c8bb", "value": 122392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713174000, "uuid": "db8d2c77-9aac-46ac-b97f-59e4f3830857", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713174000, "uuid": "a726e4b1-ffa3-4a06-868d-76515e45e0a2", "value": "8704dc30048b252b286dfe6b60f854f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e9f55a6-fabc-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713139744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139744, "uuid": "afd67612-08d9-4316-b9e2-b0f7140415b8", "comment": "Malware payload (Mirai)", "value": "280ef6e3646f13f14e01dedd14f346da", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139744, "uuid": "9287e5da-49c8-4f9f-922d-0035112e0606", "comment": "Malware payload (Mirai)", "value": "c0219b1dc2d5f8ef665d06ae9feaae657ec4fec2832d3f7185d48b7065877a8e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139744, "uuid": "f6620337-e27c-4f60-b14d-cba83cff754a", "comment": "Malware payload (Mirai)", "value": "4e7cc80a91118fcb407cafe45a3c64ce574e2c16", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139744, "uuid": "b86193cb-ad0c-423e-923b-509830c0511e", "comment": "Malware payload (Mirai)", "value": "9a49c2fdeb98142fd8c49655ca923650b101f61ff079be4c0f606ba61426b76a507ecbe2cfa667460bc95e7a5c0f1857", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713139744, "uuid": "c796c68b-4e17-4897-a67e-6e11ccec9862", "value": "T1F4B39D8BB7076990C86547F50BCB4BDD3A6332419F27C8E76D0E397AC9391CB49067A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713139744, "uuid": "a0b6c011-6dc8-41da-b67c-566207ba2828", "value": "1536:28+KF1dQFWagrZ7GnM4U0yrsYtY+RUubiZgnwbZnU/LWP:2ZK7OFWhxJh0WsYVRUubiZgnwbZnUq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713139744, "uuid": "a904b010-451f-4a44-91d8-fbe15dd1a1dd", "value": 107804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713139744, "uuid": "d9c8cdb0-c957-4240-b6b5-7aa55f68d297", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713139744, "uuid": "4ee56ed7-7e91-4a36-ad6b-57d1f60c88a3", "value": "280ef6e3646f13f14e01dedd14f346da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a24d2ee7-face-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713147588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713147588, "uuid": "b1df191f-d96a-4733-81f1-9cb10d5fb6fa", "comment": "Malware payload", "value": "f9f28c0d09ed93edda545bd623dbd620", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713147588, "uuid": "0c4dac62-03a1-4088-81b3-b87d193859ab", "comment": "Malware payload", "value": "c03e746710f445d89b73b548a87054f2eb299a5235f27842bcb949632550571d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713147588, "uuid": "1396f709-78af-447f-8094-6420e78bb0ee", "comment": "Malware payload", "value": "3fa9e938c180b16dce0d7e7bf219848edd189b11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713147588, "uuid": "c2db29f1-b065-4667-92a1-77a3343b8c9a", "comment": "Malware payload", "value": "ba624878f26edffc9eb08806555dd352c0dfd3d6cc1286413d78467d5ad87a481419c2dead197ad248a3db93f93bb52e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713147588, "uuid": "f300b003-db06-4814-a338-edce1ef57bb1", "value": "T17B47333FB268663EC89A0B71997392408ABBBE60741F8C1F47F0455DCB2A5221F3B655", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713147588, "uuid": "c70f1195-f629-4cdc-836a-e98ecfe38bf1", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713147588, "uuid": "5a1429f0-6853-4a6d-9611-cea4a9306f34", "value": "786432:HpSnUwW7V7WCEhhdCRpkG8mhAdTioHPUlNek:Hpk6hU8pkGY9i1lNe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713147588, "uuid": "33ff1464-f948-445d-864b-b587840f7f20", "value": 25974896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713147588, "uuid": "52408488-5b44-42e1-8e53-237d28c42a63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713147588, "uuid": "70f437d9-96d9-46f6-9bb7-fa982c4444bd", "value": "SecuriteInfo.com.FileRepPup.10514.9400", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1bb6d3b-fb4d-11ee-a120-42010a9c002e", "comment": "Malware payload (DCRat)", "timestamp": 1713202214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713202214, "uuid": "54e6392f-3a62-4644-9f55-8abed7a01961", "comment": "Malware payload (DCRat)", "value": "3bc67fceb93f6924bcda3896a6b8365a", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713202214, "uuid": "b4fd9128-a5a3-4d29-84f8-f03aa3158007", "comment": "Malware payload (DCRat)", "value": "c1dcf7f5ba1bfb2c010b6241e11fbd045135faf65bab7c785d4e8c910e9d3fa6", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713202214, "uuid": "3354f2fd-0f2e-4771-b6ba-ef31b6d0c257", "comment": "Malware payload (DCRat)", "value": "56d0e8e963ee2bf556551fff0f9196439c2351b5", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713202214, "uuid": "ff96d7f1-231f-4fa2-af8e-aad385d3fe7c", "comment": "Malware payload (DCRat)", "value": "b5d5e3601b1f73099c4089e3f78869a01995ebde1620a81abcd9d84e3be044189e98e1e648b798f24ac0384ace99b833", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713202214, "uuid": "4ff775aa-9021-4bc5-b458-0367d057b076", "value": "T101C4B7342FEA0129F1B7AF7C85E13596DB6EB6A377479A4D04A142C60B13B42DDC063B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713202214, "uuid": "92d8b75d-ea3f-4f7e-a61d-ae7c796d26e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713202214, "uuid": "45d960a2-41be-4060-852a-7709ff18d3f2", "value": "12288:uWtxw20+rZdGDSnn3/Km1wXWaeLXQKvGGl:3tVTGGnPp47YeGl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713202214, "uuid": "ffed19cb-9c23-4865-829a-1654feea0e24", "value": 551936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713202214, "uuid": "8d7462e1-c7ba-4f3a-8037-4607e4301d84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713202214, "uuid": "300b1f39-c3ec-48c4-8a67-1e1966512a2b", "value": "3bc67fceb93f6924bcda3896a6b8365a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57e529e0-fb29-11ee-a120-42010a9c002e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1713186548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713186548, "uuid": "b5a52924-d7e6-47d0-a68d-f97bb91bc473", "comment": "Malware payload (RedLineStealer)", "value": "4f9183606b4514ab3ba63b19a06663d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713186548, "uuid": "aa13dfa5-3a47-4277-89d3-3c9124498202", "comment": "Malware payload (RedLineStealer)", "value": "c215367f8d70d8eb1d4efb715e6054ab170494ced34549bdd9f3471c43f499de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713186548, "uuid": "a8484ce7-5748-422c-999c-7067375c8729", "comment": "Malware payload (RedLineStealer)", "value": "36b841645374b2b4ce99c6af61d77ac1714876eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713186548, "uuid": "f03b65d9-962d-4beb-a361-600e37ae1095", "comment": "Malware payload (RedLineStealer)", "value": "3f3cfa921191483a6988e24d46c5f4119fa1b93e9c8e0bac9b14f4873e48d3f0158128e741a52193787e19015d032bc5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713186548, "uuid": "79401dab-e5bd-43f2-8f2c-be71d0c13489", "value": "T11F64238102BA4F28EDE073FAC27070AA11CE974C5E194E67E94721696F937D1E3D49B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713186548, "uuid": "17a7dd7c-09fc-40ad-9c6c-fdbc6157c836", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713186548, "uuid": "688499d0-9988-4b77-a11c-f378345150c1", "value": "6144:06/goVmKMiCa4GsrduEykH6+bkL6dAti0KLrkoHl8BVmFXYolndcQMR0v8P:0QVd4DXUOAt0k68+FXYopdccvW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713186548, "uuid": "3ea366bb-500f-4320-9110-0d17dbc8849a", "value": 320000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713186548, "uuid": "86ca3698-1749-49e3-af60-3e5ae7879dd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713186548, "uuid": "90fe0b16-9845-44a9-b82e-dd5bbd004f83", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b2930da-fabb-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713139416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139416, "uuid": "02b04916-3abf-4f16-8e34-1075c8d8d18a", "comment": "Malware payload (Mirai)", "value": "9442f809000ac9b396f315598780f3de", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139416, "uuid": "7e275e86-4c9b-4963-8bd8-ae06a9d0fefe", "comment": "Malware payload (Mirai)", "value": "c55ae0edbfc59dd1c40af135829d3f7acb27d69acd2f94d3d1f88a47186e23b9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139416, "uuid": "966f5e96-4c35-4b1c-aa30-2dd14dbdc7f8", "comment": "Malware payload (Mirai)", "value": "523fc3191d624074b4613c4db5d5be516d18cfce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139416, "uuid": "df7698f8-f265-4be8-a639-b8fe418bb41c", "comment": "Malware payload (Mirai)", "value": "54e4d881552ef84cff136adc3ebd7c51af705a1009915b2d10dab55daf27b86bf92d579ebc0e66ce9354473fc8c6e41a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713139416, "uuid": "9d7983a2-87b2-47fa-b8f8-79e563b2700f", "value": "T12CA34B22673A1F23C0E5A57640F7833AB3F65B891964810FBE216E8DEF196E031473B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713139416, "uuid": "3a34c702-56e1-4103-a2ce-9dcb57874694", "value": "1536:D59nwtcr8Qxz2zTT61g+x7hgnLhOIbYfiDnwbZn1rrjBKdx:F9nDdcgx7u9O5iDnwbZn1rrjy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713139416, "uuid": "ba71f02e-6d67-4140-af24-6f1082a5f745", "value": 103193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713139416, "uuid": "d5611d1f-8772-4a95-a096-5aa796dc35b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713139416, "uuid": "ecaa01d4-2a2e-4cbb-886d-ae43585a972b", "value": "9442f809000ac9b396f315598780f3de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dd923b2-fb0c-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713173995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713173995, "uuid": "1d7d1a2c-a8ca-4d00-9b24-b8dc6bb8a6c4", "comment": "Malware payload (Mirai)", "value": "25bd4b1f3bf045b70d7433bb7368a6b1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713173995, "uuid": "49f46860-e492-4477-a084-879a1e513b5f", "comment": "Malware payload (Mirai)", "value": "c57ded9aa0940d62cab1ee152a534faf9b187f8eb805365a7338998dcd708e0d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713173995, "uuid": "3458574a-0e75-41c2-b719-efa35fde008e", "comment": "Malware payload (Mirai)", "value": "30b18d6c92a6a4e690cac9ce93d50383fc6efbcc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713173995, "uuid": "859cba75-198a-40bd-93fa-217680656ef5", "comment": "Malware payload (Mirai)", "value": "15696cb94de2e4b0b72ada50c5a69a6a4aad9e6792538d9382ca24bd25435b8152dbe2f1f0bed801eff1109d2f540f6b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713173995, "uuid": "271f3b40-968d-4729-8807-eb90b12b16e5", "value": "T191A30632A241D4B2C1430AF202A7DB770D32FEF727695956D3683EB0DE3208565A6F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713173995, "uuid": "34f1bdf9-d932-42e7-9cdc-d20bb8cf6feb", "value": "3072:12qG2kUOfTLSCBKQsKS/UJL68Q8qmFnsGL/w0m:12OktbOCBxacJL68qmFnsGL/w0m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713173995, "uuid": "664794ab-e962-4380-9d71-b90762d05e65", "value": 102622, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713173995, "uuid": "c9206c35-a7ee-4d14-81f3-5e4aae0c98b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713173995, "uuid": "5d61bf0f-5aa8-42f3-9310-6c93c5c84a5b", "value": "25bd4b1f3bf045b70d7433bb7368a6b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92cd7cf9-fb28-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713186217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713186217, "uuid": "f14106da-c670-41a2-83af-5b2a689232ad", "comment": "Malware payload (AgentTesla)", "value": "d6c2bcea3bf4206f59e4d2eb682944ab", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713186217, "uuid": "f7675abb-1e7c-41f4-8a7f-073647a36f7b", "comment": "Malware payload (AgentTesla)", "value": "c7a296061f998ed6e86d15eb594248f1cf01f37a909c7b2553dbea7fbc805e2b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713186217, "uuid": "1309b7af-2576-48ea-abf5-30dfd1800349", "comment": "Malware payload (AgentTesla)", "value": "6245284f08e3e0ad6d3fc206b130b1d648020aca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713186217, "uuid": "47c66f16-d8d5-4453-9467-0664fa8c53d9", "comment": "Malware payload (AgentTesla)", "value": "b1225366bc8514f1baddc83b450eb15c0fa795b9e4fec165611306e2ba0b5b068b3fa8006786bf75fe1c1c620625c8b6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713186217, "uuid": "6c33e088-7d79-43a4-8837-1e39bc68d847", "value": "T12A457CA8321472BFC8AAC87DE5245C74DE11BC67070BD1578093395A7E1D9E3BE209BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713186217, "uuid": "ae2eea38-1eb8-4178-8f98-e64469e624cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713186217, "uuid": "735a4ada-b5c8-4b3a-99b8-4b2e6100a7d9", "value": "12288:UedflNB+CMP7apz1pNiMtLVe+y/0Uhlo6gDIMK9wNPEefguPild4ybB7H/M0Fk++:hdtNQCMapnBNVed/0UhluDIHmZXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713186217, "uuid": "734e07a2-9d88-4849-89cd-5943680a8a87", "value": 1178624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713186217, "uuid": "adf63a70-e0c9-4111-96f3-99ad5be63fbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713186217, "uuid": "3c5bfa7c-bb67-4ec3-86c7-825f31002b6f", "value": "e-dekont_html.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3931065-fae6-11ee-a120-42010a9c002e", "comment": "Malware payload (PureLogStealer)", "timestamp": 1713158006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158006, "uuid": "a70cfdbf-bbb2-4307-a079-0ffb82610308", "comment": "Malware payload (PureLogStealer)", "value": "b68ced78e1348de3af3fb2052aa4f1a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakebat", "colour": "#66E9D0", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158006, "uuid": "609a5aec-f251-41e4-88d9-532d1311464a", "comment": "Malware payload (PureLogStealer)", "value": "c829be0e78641329583de11672027a67cb3fc2ba31059e258a87001953b8f4ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakebat", "colour": "#66E9D0", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158006, "uuid": "3b01f68d-3ac4-4935-b842-115f4da32da4", "comment": "Malware payload (PureLogStealer)", "value": "c974c8857a1aecba0347280c3f6eff561a2f3fb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakebat", "colour": "#66E9D0", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158006, "uuid": "ece8192d-08d8-4332-9b58-1d9f089d48c6", "comment": "Malware payload (PureLogStealer)", "value": "fc5ccc283404e37d7640f1843e7a865da58d3e26370de649894a84fcd2041bc7f1824c319301742fed5c9ab710552546", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakebat", "colour": "#66E9D0", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158006, "uuid": "8fb209a3-c8b9-43b3-ae0d-7283787a6c65", "value": "T130F4E03EA3E14FD0C6885DF1C1A749184761B34A7673F79EBA5882A62F073B589873C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158006, "uuid": "eaa417c7-1665-4532-899c-852bb5d92141", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158006, "uuid": "381f76f8-d180-4713-81fc-cf8e92cda933", "value": "12288:rypQrulqgXsBry3Bd/7f9b7ekLKOXlpGtaKksX5VjofTYj2LMVUxa7dSItGx:xrGbcByj7fBektXlpGLJJ+C2wu0xtGx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713158006, "uuid": "ba3bbbd8-7339-420c-aab3-f4ed89952dfc", "value": 793088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713158006, "uuid": "eb827537-4bf4-43d3-93a3-c96468d42fb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158006, "uuid": "70919250-e4e3-4874-aab4-771b45cd26d8", "value": "3.dat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95d58de7-fb51-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713203831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713203831, "uuid": "afd60b76-a73c-49da-93b8-25f363fbf9f6", "comment": "Malware payload", "value": "97fba0a5a4b4f8c3a11f4d9c293c62d9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713203831, "uuid": "6f3987c5-42b4-4e1c-a269-0f20d133eff7", "comment": "Malware payload", "value": "c8c621cfb7b5980136541af20d43c08cc71574bfa10b8e50991c06b9ab84c3b7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713203831, "uuid": "6112bb47-1355-4238-8d0a-21b1de2738da", "comment": "Malware payload", "value": "bf94e7aa352eef72c8c687d3379c1fd29c774e9d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713203831, "uuid": "78393351-2238-4133-b247-5e0343c18226", "comment": "Malware payload", "value": "b2d86a736ca002b89c453d8604f425d6a8f6805b03df8ec530414fb0b937b69eb876c027fee6647d400606ffa97cf204", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713203831, "uuid": "e4803340-76d8-4c3c-96df-10cbaa254ee4", "value": "T1ACF53320937670467F2A704EE0AC7DC26E411BD7472ACC385167BDEEEDF64C9A881B16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713203831, "uuid": "c563991a-11c6-4ee3-b8ec-b730b50aedae", "value": "98304:LQnfMeIB75CVTHZraR6+pohg6TV0nU0b6Dz:LQfMeIB9eLZraR6+pvyIU0b2z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713203831, "uuid": "cff32580-6b9d-430b-923c-6dc36951a1ab", "value": 3585961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713203831, "uuid": "773777e1-0b8e-4f98-bd06-c10e6c71992a", "value": "image/gif", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713203831, "uuid": "b71ada66-c272-45ed-bd85-b566950074b9", "value": "giphy.gif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "343aae9f-fb29-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713186488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713186488, "uuid": "a98e5443-6d44-4aa1-b725-bc81df0ebf16", "comment": "Malware payload", "value": "05d1c2995d41bfae991c4593ebcaeb53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713186488, "uuid": "b3115ed3-377a-492f-b027-297a078492f1", "comment": "Malware payload", "value": "c94ed463f55d967c0fb21e6e52efd3e94d0ad792e9d965f275265d6e5a285ea8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713186488, "uuid": "31789f8d-6609-4584-a54d-04b464cfe96f", "comment": "Malware payload", "value": "5bd1f44267d82e2255b7c035d05d38e44c7b3261", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713186488, "uuid": "9ddcf5a0-1cff-49cf-aa2f-701a13bd6280", "comment": "Malware payload", "value": "a45eea51a4ca1b6ea645524726e939e4bb5931332a0ae8f42699261630fc977d61e546d3402a88757c1119d80d46fc55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713186488, "uuid": "b58366b9-49c6-462a-a1f5-2ddfd0d9f16d", "value": "T18EE4122677AE8B56C3BA87F2603212409BB14C0F4A36C7AC8DC9F0C5AA63F14465DF43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713186488, "uuid": "5ed88f2e-7b9d-4728-8364-a803943bc4f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713186488, "uuid": "f7285597-9473-4cfe-b0c0-93d291f1ac27", "value": "12288:AaAv3zT370X1fouNe8Gqr1j2tGosPCo0bf9yUnkdI+6GXaPApTiy8kFQc:79Gsh0s6vlnnkdIrGK/e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713186488, "uuid": "bc65a535-bf23-4f9e-b33e-116b52614b73", "value": 666112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713186488, "uuid": "0936fc8f-38ef-4ff5-9faf-9248c29fbc6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713186488, "uuid": "cb080e69-de1a-4a1a-9ec9-bd7308f9ee7b", "value": "InikaaurHB38BXW.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87e30171-fae8-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713158711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158711, "uuid": "4339e0e8-8ab7-4915-b5d2-270e516970a4", "comment": "Malware payload (Formbook)", "value": "e013a45c1de5e9264bda9cdfa4a6b755", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158711, "uuid": "aeea8f16-91be-49a6-89b4-966489a1980f", "comment": "Malware payload (Formbook)", "value": "c9cdd6f305bb5fae03ecec4944df96e6c48546879cf1c35467c1083d71b3b603", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158711, "uuid": "34626f18-29ee-4448-afe2-32eb3bcec2f8", "comment": "Malware payload (Formbook)", "value": "9051b34c090043d3a8bfea3e69f1dddb1ecfa4d4", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158711, "uuid": "b7c58af5-0e85-44bd-8a96-99675a6b3847", "comment": "Malware payload (Formbook)", "value": "fd2562059a902cbbe2a09bcf6a9ff2a18591cfee0dcc10d84bb1b1f517f9a68c77fe8119b416b1f9d971a1baec18ff11", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158711, "uuid": "c8dc17ce-19cd-482f-b881-7f3506613b5b", "value": "T1C594AF5263ED5008B2B33F04A9FA91258B3BBEDA9C79C54D058C5A6E0BE3940CD757B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158711, "uuid": "7e99df83-f93f-46a7-b7e4-20a7c5f2c574", "value": "3072:pHGRadgYFEhNe4VTdRnTT8w4TWXZqWggedpe+og0S7wQzS18f8d6bb/g52r:QadgYFYZqd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713158711, "uuid": "c8fc0873-a77e-4ec2-8e61-03c265bd5046", "value": 408942, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713158711, "uuid": "e31d25e0-8dcc-48fc-8a88-20d2e71d03c0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158711, "uuid": "ef817561-1e16-4155-b278-af8400a9b756", "value": "HSBC Advice_pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dcd8cb0-fb66-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713212623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713212623, "uuid": "5a041fe0-5508-454c-b62c-c57c37d4e6ad", "comment": "Malware payload", "value": "0aa7a01c162f6a13d8498060acd3a7ab", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713212623, "uuid": "10d90446-e45d-4341-90e2-b715d117a43d", "comment": "Malware payload", "value": "ce707d0bb7068268662c3b67becb50bb66ad97c2fed1ceb5806ccb1c7b7bf8ee", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713212623, "uuid": "0c70f832-2924-46ab-bb7c-7514e5985ff0", "comment": "Malware payload", "value": "c9acc1f0670ad3f0d5a8bccc24be940f635eaf3d", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713212623, "uuid": "f117a66d-b47c-4f8c-8e0d-2056aa3ef83e", "comment": "Malware payload", "value": "d009a046ac92a86616b94f3876acf177a7abe10797109c0f4d272793b59c48554d733c64eafc7155294dfac09885ab90", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713212623, "uuid": "e274a58b-0f0e-4f55-9a95-414b47f9e7a0", "value": "T131522A613D92E53945500C0FC2EF6068A6A2D79E04064616E2D06F387EBFBDD4F8F9A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713212623, "uuid": "9f973be6-7781-4448-9e94-da77783e007c", "value": "96:S26m40wBE/Mro2qq3qLp5cBc9ORQGqMPRzaORBGhBE/Mr62nP8zaORTGoMz8zWv7:JA14ll1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713212623, "uuid": "49fbb573-5c3c-427e-ae8a-49324b0fef2d", "value": 13381, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713212623, "uuid": "b00b8124-6875-4658-ba15-d6cdd1bf579d", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713212623, "uuid": "4dd85615-86af-437f-be92-10c53cecbd79", "value": "hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74da55b3-fb6f-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713216661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713216661, "uuid": "0dd363e7-af06-4291-863a-f6b7a76bb741", "comment": "Malware payload", "value": "2084d28241ad256007d75d930e28361a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713216661, "uuid": "1efb6569-4479-461e-84d0-9a0b1689835c", "comment": "Malware payload", "value": "cfcb07d0c4e18c98cde36caa2ea5ee4f1617d05026b0845f87c6226d3a49c61c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713216661, "uuid": "31d61010-4e45-4968-a7d6-ca90911c31fb", "comment": "Malware payload", "value": "4d240b571ffaa1020be7da9dab71b2b1e8f0e9f9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713216661, "uuid": "b7daf4e6-562e-440a-96c8-38ee467d4a99", "comment": "Malware payload", "value": "ce1f5362014c297912473aa676d540365eb82aa6cfacfb5cf93d4765446004373bd96c03d4b907c004416408206a780e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713216661, "uuid": "7a6a047b-7271-4eaa-9bb8-d5e148a045d6", "value": "T1AE646C1823EC8911E27F4B7994B1E274D375ED56A452E30F4ED06CAB3E32741FA11AB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713216661, "uuid": "347d34df-2ef3-4466-a64a-b1bb1693c030", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713216661, "uuid": "e625ff9c-ee34-4e57-9d49-40da2b6390e5", "value": "6144:xqY6iewP8Y/bfYzJjTATAbQcZqf7DIPL:xSwPYzJeAbQcUzsP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713216661, "uuid": "b17a2f7a-64a1-4821-bb8f-de2d96fd53a1", "value": 311296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713216661, "uuid": "49532409-6207-474c-8c2a-8f980cc8e9a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713216661, "uuid": "d272bd9d-108a-44d3-a8f9-97303717bfb1", "value": "2084d28241ad256007d75d930e28361a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04d16a97-fad7-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713151190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713151190, "uuid": "984b5bf8-d640-4ddf-911b-bd545bbef1fa", "comment": "Malware payload", "value": "4d08af475012207281e72894a09dde3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713151190, "uuid": "591e85d6-d4f0-4815-b1fd-343b542e3a97", "comment": "Malware payload", "value": "d00b96985ef370d873d5028611c31f1eac1f858347bf1c6982b3bb9e05626f3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713151190, "uuid": "71cded41-e1cd-4db2-a964-8b7cc75729d7", "comment": "Malware payload", "value": "660addb2bb6e25b734892ff6b4b55f5ee412f7a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713151190, "uuid": "044b5042-4a1f-4f5f-8a9a-b04b023f7f9d", "comment": "Malware payload", "value": "ad6c01f9a32ba6ace22fbf07601830979b9bc5652a6e0b842e30e5d0474b0b325ec563aa057f0b34e3c2b1b3fc03ba5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713151190, "uuid": "508867f4-ffa8-4f06-8324-68c853ac5ac7", "value": "T15C6523A1B7E50A17D8A71AB1056B4ED493F1D6132563EFDA5C6C274A2F623408E03F3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713151190, "uuid": "3ea7cd3f-d39c-4703-a8a5-8940f3b96b93", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713151190, "uuid": "cf2a8ef2-7e24-41b4-94ed-947f1db8a1fa", "value": "24576:C/bW5bWpIFLX5ewNIFLX5ncTqTwBCY8K67FWV3G7X2/pk52pQ:C6IO5ewy5cawBCVls82/pk52p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713151190, "uuid": "fc917410-7fa4-4c05-827b-3a0bbc35a165", "value": 1466368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713151190, "uuid": "dc5bc6f8-8c9e-40c4-9611-a456f07ff08a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713151190, "uuid": "cdc28ab4-ede7-4ebf-9e97-4d54c80def16", "value": "SecuriteInfo.com.Win32.Malware-gen.14354.12413", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87eaccbc-fae2-11ee-a120-42010a9c002e", "comment": "Malware payload (IRATA)", "timestamp": 1713156134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713156134, "uuid": "bc900fe1-9b6b-4380-9819-6bcc0273b5c1", "comment": "Malware payload (IRATA)", "value": "a82c5a62353cc141a2e3d88f6e7f728b", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713156134, "uuid": "4aaea029-f3f7-4a42-b398-959e744ae431", "comment": "Malware payload (IRATA)", "value": "d09f0caa5f13ee79a0cdd979cd5b72e42c628212431ab73359e682036068b7c3", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713156134, "uuid": "b25b2c5c-ba9a-4be5-ae0e-c3f5a134177d", "comment": "Malware payload (IRATA)", "value": "fd89554f4a41a3f82424c18e0aac0124ac379c9e", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713156134, "uuid": "e1aa7947-6871-410b-b156-4707e3fda7ed", "comment": "Malware payload (IRATA)", "value": "6d161c20eb3846d41524f0d8e319d2cd05fd3302811033ba94cffd9db7def60e251de6c3c4a6b48c66f2562a6c8f0765", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713156134, "uuid": "e4571579-95bf-4d44-b4ba-b391cf70385b", "value": "T1B0162343F265E85BCCF1C3B212351A3A107B4D54C797B78AB41977BA68BBEE80B811C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713156134, "uuid": "c02f5bf9-317b-4ad9-a158-0b686d6d9129", "value": "98304:7skTerCC/psokBGiXwkk04jhSsP2Nb4Px/qG57JlIXO:7s/V/psokBGiXwQ4jhSYm+/jI+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713156134, "uuid": "0b7c4c1c-854d-43a6-b952-cbcb43201966", "value": 4243893, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713156134, "uuid": "06b944db-0a87-49c3-801a-bfee6244ac7e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713156134, "uuid": "3eccdd11-423c-41fe-bf18-4c349a48352b", "value": "Application.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a074c9c7-fac5-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1713143720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713143720, "uuid": "27beb384-b75a-4d19-bd43-decafac0a20f", "comment": "Malware payload (RemcosRAT)", "value": "55f48dd51a9f5e43d1c206ad4f972661", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713143720, "uuid": "79b23920-bff4-42a0-9bc0-a3e08d990fda", "comment": "Malware payload (RemcosRAT)", "value": "d23b1e9ce21335de1ccfebc24b556c14bf193fd025167d68e0af9e061f9b02bd", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713143720, "uuid": "39dac952-97cb-4e55-8db0-b125efb5d1fd", "comment": "Malware payload (RemcosRAT)", "value": "dcdb11a9f0d5b2ac01600737f96383550096ac4a", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713143720, "uuid": "27cb3503-ebe9-45c5-ade7-43218f95d7c1", "comment": "Malware payload (RemcosRAT)", "value": "79d6e67c3c5a0460ce158acae96dbe802464e0e09e60e096e92c533cd7a952129dff0cbd35843524e6aadcefd032ccc8", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713143720, "uuid": "e6aacd40-5d73-4bef-b729-88cf10b50cd0", "value": "T1E636D6DB2EAE15423744335FA79FFA690B2B8D255BC37EC444C60598440E74B29E0FAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713143720, "uuid": "270cb4d3-4da7-4066-8a8e-6741da63d6d8", "value": "49152:KqDXIfW2UShFhv2Nym/GmpXhvPBi3M5xfrcjKiUns19M8X0KtC8v7sMDlZg6HcNn:R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713143720, "uuid": "1f415b59-d125-48a9-b1f8-ba7f106d9a8e", "value": 4907248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713143720, "uuid": "b34347f4-650f-4fba-b41a-52108d023593", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713143720, "uuid": "c502c6f3-cb4b-4fdb-a05a-b947bc4c7701", "value": "NEW ORDER 04154SHOP N0AWE12893.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdb23521-fb35-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713191980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713191980, "uuid": "402142e2-1f17-461c-9890-281b0cdc71f2", "comment": "Malware payload (AgentTesla)", "value": "59a4f850157ca5ce9e8229510552d433", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713191980, "uuid": "ad31de8e-ca12-4e00-a054-114f8fc82125", "comment": "Malware payload (AgentTesla)", "value": "d42df773a5031e58adb497c874fcf6d5b723aaf6eadd29283a834a08d9cf712d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713191980, "uuid": "69469b41-7fc3-44f8-a457-0e6023fa84f4", "comment": "Malware payload (AgentTesla)", "value": "699d609cdc0b19fd1a83ae89ce5de8f01a853af8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713191980, "uuid": "ed1ae66d-c243-419c-8f5a-ccb0b21e9cf8", "comment": "Malware payload (AgentTesla)", "value": "e7acb5b438a6afe762a9dad1e4f6250c03f6bd38f10472d5b8aa6d7abcab0ad793e3f8f348642e0892a71b3ad0becadc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713191980, "uuid": "683c5d88-e22c-4fd0-a12f-4b2264d370b1", "value": "T145E4224B766C5B6BC42ECBB1C052496857B6B4170CA7E35A4CDDA0C26AE3F22C179F43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713191980, "uuid": "d945a7f2-8aaf-4f57-93ee-7b22fd22af59", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713191980, "uuid": "26d23dea-5012-44b4-b26f-4e47d7817f90", "value": "12288:DaAvgzT370vptqK3DNol90+VSNXKY79gcr+zgP8hTnWIzLaMV:pxFov2XK89gc+TWXM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713191980, "uuid": "941eb258-806e-42d8-9d8d-dc80d58651e1", "value": 665600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713191980, "uuid": "b42ce09d-dd08-452a-a451-bf17625aa230", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713191980, "uuid": "37ca8e99-1396-4eb1-98df-60d76321f707", "value": "COPIA DE PAGO SWIFT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26c30e0b-fb0c-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713174010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713174010, "uuid": "45a73a67-13ca-45f2-b1c3-284a161c9c9e", "comment": "Malware payload (Mirai)", "value": "cf73cd124690532682ea45dd70a246ee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713174010, "uuid": "e6ab72fe-b27b-444c-b5f1-455f9eb83a70", "comment": "Malware payload (Mirai)", "value": "d4f85aa30e5f641fc4194a3fd53508e0a1e4939e4cfef76c433a1df8fa78bb22", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713174010, "uuid": "7f0d4e89-b8c1-4941-8194-6af7a1279762", "comment": "Malware payload (Mirai)", "value": "6f3a5ef8ca84a6588f03b6b159f5d286dd0b0f04", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713174010, "uuid": "76b12766-8be0-4a4a-8e4c-e2e1508f5a25", "comment": "Malware payload (Mirai)", "value": "39150eb7cefabdcdc86015475228a7bbb5a17eacf3068c33921de79f822119eca6993b1c8c0b018b397052cd2a6132fd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713174010, "uuid": "70d342ec-875a-42cb-80ff-c2978d323793", "value": "T114F3843E7A21AB7EE268823107F69F70CF9529D327A09341E26CE7185E7124D1C9FB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713174010, "uuid": "ebc0f263-6137-4a12-abea-51462749bf76", "value": "3072:eQ8noPFwtGVaCbc0HaAsO4oUC9F98m8Hh8dA5Nu:F8p0l4oUC2m8Hh8dA5Nu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713174010, "uuid": "190764c1-1220-4137-a551-480806888143", "value": 171148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713174010, "uuid": "203ab455-2b98-46d7-8c1d-a0fb60ed3bc3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713174010, "uuid": "0fc78bb3-2506-4767-bc52-46c91f1a6a7c", "value": "cf73cd124690532682ea45dd70a246ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ffb8a13-faf1-11ee-a120-42010a9c002e", "comment": "Malware payload (Stealc)", "timestamp": 1713162483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713162483, "uuid": "181c2be9-e696-4a4d-a96e-030ce49959c5", "comment": "Malware payload (Stealc)", "value": "3170aed3eb44bd638cce6f67650d4b50", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713162483, "uuid": "f0bfa1a4-3426-44f5-b90c-3795676c2d37", "comment": "Malware payload (Stealc)", "value": "d562b3b44859f761645676e0c0e7daad1226c5b90f53b4fe5e5395bf77454ec7", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713162483, "uuid": "c4fd8db5-3f9c-475d-93f6-4182dc49456f", "comment": "Malware payload (Stealc)", "value": "22519afd371ed56fe6b4b4565534e09d0dd20453", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713162483, "uuid": "c7d0c34d-ee7c-4288-9ad4-bdd529799b2f", "comment": "Malware payload (Stealc)", "value": "3eb5c1f3f72ab21b436bb8fd899cab58020941c413017bc4b7dfcc8e6d0834235276e89451d80d4d5e194a955a191b7c", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713162483, "uuid": "8c518da2-a3ef-4e51-a9bf-8b961091b687", "value": "T1BC8423275FE86971F2F63EB4547920A0573ABBE0C0B5F33C01AD46AD9862784C1D1B97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713162483, "uuid": "98dee638-6bb3-48a8-a9e9-c576be364758", "value": "6144:F9b8+wW/Wco9GZbOHqYCGwYyX9Y1J3yVA3Upzm88TKmIImK4E7AjEwYM/vYZu6Yj:Tb8+/hbOHsG46Xx6mWIFNOYM/h8cvB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713162483, "uuid": "1689736b-3066-4930-95d0-95444c6a8855", "value": 393912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713162483, "uuid": "ebc3a6c2-54cb-4345-adf0-11da9fc79ff5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713162483, "uuid": "cd144237-128d-48c3-9e36-0db4a8d49b8f", "value": "3170aed3eb44bd638cce6f67650d4b50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65e90d8d-faf4-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713163808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713163808, "uuid": "9b333242-ffe8-472c-9909-1cdbd05955cc", "comment": "Malware payload (Mirai)", "value": "f07ea617519f0c20bb85680fe94fb9e2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713163808, "uuid": "4b411e93-78a4-4cc0-ac77-a873a7960ae1", "comment": "Malware payload (Mirai)", "value": "d5fb41d2059becc19736b102ed95b1ba28d53967c7d3ac9c59f8995402628f50", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713163808, "uuid": "2931ad39-c6f2-4e8e-905a-754a726b367e", "comment": "Malware payload (Mirai)", "value": "ba467ad0161b72e40a3c3f130aea137768b39abf", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713163808, "uuid": "dc593bc1-c18b-4309-8244-03f4f83f8d55", "comment": "Malware payload (Mirai)", "value": "48252847f7d58a2a39bb975847609f0da5fe66e430cfdf200ec7bbf6d042d0c2b45a69f1c6313bad3f5fc8ac355d8749", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713163808, "uuid": "778bcfaf-2e9e-4e23-bd5b-2f33f2e685ea", "value": "T168932989B8D18D22CAD053BAFA6E1198371583E8D2DFB113ED281FB533C994E1E72355", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713163808, "uuid": "ec03d25d-6bba-471b-b425-d5ab639ac53e", "value": "1536:X39LUsDeiUk5GJ6IpWfgGoB8iCx4n5C+qUiq6XuGjIKdvBjgWDnVmgXOzBwbB:X39Ll8qvfy5PUuzKdJj5Vmsvb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713163808, "uuid": "f9bf7047-73c8-4db8-aa86-b07db79e208d", "value": 91288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713163808, "uuid": "d94803a3-d098-4c8e-af42-e1b48ffa6d22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713163808, "uuid": "9300115c-a09b-40c4-9a5a-9ff93de0edf0", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c68e661c-fae8-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713158816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158816, "uuid": "eed2a0f8-eeb9-4939-bf25-2b0654ab25d0", "comment": "Malware payload (AgentTesla)", "value": "a35d79aca343356756c2f16d91915f8b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158816, "uuid": "d4fad708-4782-4510-b3f3-273ec482fd0f", "comment": "Malware payload (AgentTesla)", "value": "d82adbafec869ce93ab6133e0f88ae81e1f138d6f31bd90aa054fc4331001169", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158816, "uuid": "6e87b577-b5e6-4528-888c-c75df5011c2d", "comment": "Malware payload (AgentTesla)", "value": "8cfa7f72fa09124cf447b2b9d6b56a6f18133de8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158816, "uuid": "fd1063f6-df88-4b53-94ee-443653c5012e", "comment": "Malware payload (AgentTesla)", "value": "d6a1ffc5160eb82764fccc94e41c826941d29ad219b42e77386177629a6eb9cbd43d8b3f5fe2559b7a4c605c10ca3e9f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158816, "uuid": "7917f388-f9e8-4a15-9da4-a77e7ac5e677", "value": "T116F4236573FE9F63D2FF27F9183875E0077161A6E060F38A1CD6A0C91521B428EA1E5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158816, "uuid": "408c9fa6-8a37-45c1-a324-4f3957439f84", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158816, "uuid": "f9c5a440-3853-4d3a-b7b4-ab2160f8dca0", "value": "12288:N0/tNBVYXsOJUb9p980vwF5S/yeB+fG/6va/v/n5yk+ZOohj5qpcMaCGCblpFm9w:qtNkNUb9p9vvSM/yeB+Xve52ZhQpcTXc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713158816, "uuid": "083fa9cd-ceab-4d20-a6e1-6eae57c5aecc", "value": 773120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713158816, "uuid": "d86fcc6f-5115-4d92-b3e0-6ad754e84986", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158816, "uuid": "13eb054b-02e2-4c4d-8222-b517dc38cf5d", "value": "BBL ADVICE OF OUTGOING OPEN ACCOUNT V007047-000 as at 4152024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b5d448a-fb2a-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713187090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187090, "uuid": "47e20d57-7ce8-45ca-bca0-b9019caaf966", "comment": "Malware payload (AgentTesla)", "value": "8ec5215c8f9a53b777d166e2b56f2fc4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187090, "uuid": "e28c7cf1-18e2-4966-99bb-4fc3727b3c5f", "comment": "Malware payload (AgentTesla)", "value": "d965c77ee44072fa2e0dd4bf339a30f44f816de49608a4bc71fc9d59280a3749", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187090, "uuid": "86c61cbb-76dd-495d-a234-55a66aabed21", "comment": "Malware payload (AgentTesla)", "value": "e43c4a0a7aa82ce2638dc8ac6b897f0444063ad3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187090, "uuid": "df22c8b2-a02f-423c-bb61-16526329da6f", "comment": "Malware payload (AgentTesla)", "value": "c5c22bef75ea9f1f5b3a243b9db5214b6753fc83b5e37cd5e1374d76c09a2c3c48519e636b931b4bb3c7b2f61c825dd4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187090, "uuid": "3afd9b5f-671e-43f1-b926-b68155ed5924", "value": "T139E42201F6A84B93D6BA87F99035420183B6225F5CBBE3DD1CD171E96E62F414236F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187090, "uuid": "1db8b215-c2a0-4c24-af1d-8560b0b66aca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187090, "uuid": "2b34b647-1878-41b9-9bdb-7c14855b7213", "value": "12288:JaAvlzT370rS8W8B0D3c/cm8qEf5i2FWdpz0Vl1+ks4XLJHQq9Q9bH2uI:aGBJKdY5i2FS09+4bja9j2uI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713187090, "uuid": "7069919b-969f-4d5f-9ecf-e8fd2a2c6878", "value": 666624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713187090, "uuid": "12fd3f05-142e-442a-a3c8-18f8f7fdea72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187090, "uuid": "0702d424-e247-443e-abc8-355c619a949e", "value": "03-04024 AQQ-T7630-CVE8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8467043-fb0c-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713174308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713174308, "uuid": "22451770-0818-43fb-a8fd-cbe168f0cb6f", "comment": "Malware payload", "value": "37bc139d30272f8ca5516adccb5e2300", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713174308, "uuid": "970db562-acdc-46e4-a5ad-fb76aabfc0fb", "comment": "Malware payload", "value": "da4a0673bf79583fcf55539e7a4ef94e16215c7c8b32a50c30ebc8d412048489", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713174308, "uuid": "ba2e6c92-47e1-4458-b740-0e6b767ff631", "comment": "Malware payload", "value": "8ffdb15b54175e3a9dedd10db6ce90593a0aa7c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713174308, "uuid": "84b6f4cc-6757-46f0-97ba-0a7dcc2c2219", "comment": "Malware payload", "value": "345bec9b5ebf062ead637d8781290ac88b5bb0761ee4ec9e4db570895d87483b77f070117e26cc094e97f2741b9fc612", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713174308, "uuid": "a6a4583e-e913-4904-b934-12db8cf9254f", "value": "T1D36733ADB05C264DC03AC5748D339D98A2E3050E8BE8A5AA75E7F7E573D7460CA03F25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713174308, "uuid": "84d08722-3423-41ab-aed7-94e86446c1da", "value": "bc526b1ad02acaf5d1cab0404b8af6a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713174308, "uuid": "562be07f-1b0d-49b3-ae72-692f35e78312", "value": "786432:d3k0ifwwDu3glyrF3R6FLexvARIKi6ZgyBe4XMcL4:d3k07igrqFexFKrZgCFXt4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713174308, "uuid": "564eabe7-22a4-4f51-80e8-fc8c5562980a", "value": 30280192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713174308, "uuid": "dce93581-873d-424f-a344-f1b3b3ff7b80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713174308, "uuid": "df0fbbe9-bb96-4634-9932-25179d53a5a0", "value": "SP_activator_11.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50dc9376-faeb-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713159907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713159907, "uuid": "df679064-0be9-4a99-8caf-11d2bcf83411", "comment": "Malware payload (Formbook)", "value": "135b23d07b760c07b340e87030d40c7c", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713159907, "uuid": "21e52b3f-e786-4444-8ab1-eb649767965c", "comment": "Malware payload (Formbook)", "value": "dacb9aad48869f1349e62dd30eb4aca9eaff7355e67c1611616cd23c0b823934", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713159907, "uuid": "962f57f6-a254-4cd5-8590-99e4e85a7f02", "comment": "Malware payload (Formbook)", "value": "a0f877913bbcba46bb3cc5b6479fdc2593335281", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713159907, "uuid": "e316aebb-23cb-4fec-a176-2d8fb0ecbd0a", "comment": "Malware payload (Formbook)", "value": "ee815044788b3359e2a9727ddc27e285174ae005637964e509123fe7d37e071484738ead9e50a140f852e72c9dc632af", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713159907, "uuid": "9830ce44-5d20-489b-a422-2c33a030e087", "value": "T1324423C5730285A5CC1EE67B519F346991962E1E1BE83387FB8E2D31B42C19BE371287", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713159907, "uuid": "c10fef62-c744-445d-8508-f1892101b506", "value": "6144:AyynRpQtS0fhjh2NQf6irwJhIKv8nyCbZBNtjzntbZq7H:NyfCS0feNDkFckxA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713159907, "uuid": "ab88d10a-24a6-4997-90f8-2d24bcf8ff64", "value": 268800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713159907, "uuid": "27bf223d-83bb-47cb-8237-01fc6cf4bc1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713159907, "uuid": "b2941a34-4701-415e-ae64-27a8b7732bd0", "value": "17131599069a0e2ee3c772313de436652eb63fc16f458874beccd156253cf564a27491c5be430.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52ed2d25-fabc-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713139724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139724, "uuid": "9d5ab2c9-8326-4edf-b05a-cf8038f32351", "comment": "Malware payload (Mirai)", "value": "148ae9dc486808b7ae01573a69b174bd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139724, "uuid": "696930a6-69a8-49f7-8e63-a03773a28c39", "comment": "Malware payload (Mirai)", "value": "db921c62f574bf01e35e15bbf2687a7858171b5acc82cbaac5d342db94e51d8e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139724, "uuid": "c5810223-cad1-4c10-83d7-870bba8ef86a", "comment": "Malware payload (Mirai)", "value": "f53485a3129cefae94fba1142e7c600631278c97", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139724, "uuid": "ff407687-2411-4e82-84de-103eb212179a", "comment": "Malware payload (Mirai)", "value": "2a55282472ab0fbe12e862940fb32c79b910df9fcfbd6e197d608a2fe6a1580c91e8a3c7cd213fda1f6183189479e68e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713139724, "uuid": "b9b5eaf3-2959-476c-bc3c-984a8db66b27", "value": "T1D4533B22ADF11D2BC1DC96BB21F34335F6F7438A24B84A1A3DA10E987F2465135137BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713139724, "uuid": "eff5f2cc-e1d0-4ab6-a0a9-71301b07ed82", "value": "768:H5OxiwQ34pfbyXTLb+V/xVZK2JtgO+T5VVv0lpw1tYqEII:H5Oxi4pfb+LiJneT5D1tYqEb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713139724, "uuid": "15f56ba3-4bd7-4f3c-b62f-852f5bcf505d", "value": 63848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713139724, "uuid": "2254911d-676a-44d4-83b0-07b506e98eaf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713139724, "uuid": "620a85a2-e64b-4f7d-8537-3482786a6503", "value": "148ae9dc486808b7ae01573a69b174bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a931179d-fb2a-11ee-a120-42010a9c002e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1713187114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187114, "uuid": "d8a9ece0-d9fb-45b5-8b45-8f547ce79de1", "comment": "Malware payload (RedLineStealer)", "value": "48e0d73ab44df5bf5e7c9b7956bace12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187114, "uuid": "cc4fea9c-d677-45d0-9111-1b40a4f02f48", "comment": "Malware payload (RedLineStealer)", "value": "e04d132c0dffcff980bfe8c3195085c600042bec3deabaf6cc27915017a23bcc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187114, "uuid": "1ee3005a-6d62-4a99-99bd-5a0165d99d11", "comment": "Malware payload (RedLineStealer)", "value": "d627043576c5c0427b0a942b6847e0c8102987d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187114, "uuid": "dfe547fc-3952-4a3e-a137-1fd16668e6ed", "comment": "Malware payload (RedLineStealer)", "value": "a8c4544fcd66ec81c3a174491fa0546c5c4cd55056436750e19fb4d5ec26e2d63a31d5de68e46a813f4e2086d33ef472", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187114, "uuid": "3b6cc9a0-ac78-4c21-9909-e9c39db59243", "value": "T1A245BD0273D6C036FFAB92739B6AF20196BD7D250133852F13982DB9B9701B1267D663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187114, "uuid": "5613c908-e4e8-4b23-9253-6c7bb869ee89", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187114, "uuid": "7a40f944-2630-4a64-b371-d8719319c518", "value": "24576:/AHnh+eWsN3skA4RV1Hom2KXMmHa0YAmTMNccwW+Tr4T4zygN5:ih+ZkldoPK8Ya0gTMNcRZTr4T4zr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713187114, "uuid": "1c746fb9-9d5b-4bd4-ae1f-c1b3f9d7e9ad", "value": 1197568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713187114, "uuid": "1911ca54-b2a5-4f78-b533-9bb030aab8a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187114, "uuid": "c6e76ea1-6bcf-45d0-9f77-b0bd606e2890", "value": "Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a23e8e5b-fb2a-11ee-a120-42010a9c002e", "comment": "Malware payload (Mydoom)", "timestamp": 1713187102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187102, "uuid": "4dd25274-2183-40bc-a23b-17ca740e8723", "comment": "Malware payload (Mydoom)", "value": "c89cb72586afe2f652ccea009225cec6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187102, "uuid": "1c32bd2b-875b-432c-a72c-6dac087a1537", "comment": "Malware payload (Mydoom)", "value": "e302f733d4a31342a0c908055a6e59b3fd8f1ed3ce98750d00251e4f0efe6c02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187102, "uuid": "5d73935e-b886-43dd-b666-c741a3e0ebc8", "comment": "Malware payload (Mydoom)", "value": "89617d49fe5366b120d6fe9fa098bca7d3b5e1ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187102, "uuid": "9fde0d3a-b162-487c-aa24-ce780cd68a80", "comment": "Malware payload (Mydoom)", "value": "2da605ad36c52649f84f377998d6d42fbd050428bf36c7b29ea84d4b44219f9dd572a1820743c8072fd0ea1d3681f03f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187102, "uuid": "bfd9700e-78df-43ad-9b5c-7a69ca266a57", "value": "T1A613D0983E8FBD42D2850C382903EE7ABE52FD444E09268BB5B87B0BBCB1F56455DC45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187102, "uuid": "ee63d2d6-00ee-4364-a8b9-2b8b0cdef1a6", "value": "98cd465c2ab2841f9fd90d5e847563f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187102, "uuid": "b6483c9b-c32e-480f-8635-0e9afd805266", "value": "768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/:AEwVs+0jNDY1qi/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713187102, "uuid": "99de8ed8-22dd-44d9-8fec-d630bae58e20", "value": 42966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713187102, "uuid": "3b04a481-710c-4467-956a-0950d764737e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187102, "uuid": "97ec5801-0ef1-4bf6-bbd0-977482f965df", "value": "document.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c1882d8-faeb-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713159845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713159845, "uuid": "51b249bf-bffc-4668-b44d-03a23cf86850", "comment": "Malware payload (Formbook)", "value": "56e6e0768aee417abb6c2b0e795955c9", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713159845, "uuid": "de298b47-a0c8-4eef-a1d4-ef17555ca02e", "comment": "Malware payload (Formbook)", "value": "e5ff3c02fda74617430fb1d60d5126cf1e517311c4b68e7181dcea0b58a4005f", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713159845, "uuid": "7ed6464d-f6b6-4976-8073-eb91460f295b", "comment": "Malware payload (Formbook)", "value": "b7ffc883ac73b183c5fe26f874b65e82a13ac247", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713159845, "uuid": "17a01381-c4a2-45b7-9f4c-8532be2a26f8", "comment": "Malware payload (Formbook)", "value": "e29591bf172150f36e4df40da1dffc02b6cb7a5e756ca5469b0689ce56c6973cf99aef5288d41d2c492aace0feeb3f07", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713159845, "uuid": "3b0062ba-6b7f-4211-a500-b964947c5246", "value": "T14B44122D510EF05AC6A70335EACF356281EB733B0BE41B234AB561EAB69495C931C52F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713159845, "uuid": "c4ddee9c-8ac4-4931-806a-e5b818f8899e", "value": "6144:cQguJjLqcJX8ZMZTLmMxpJKO3TNBZaHLjEZ16BBoyNJ+/oJnxBol1G:iuJPqcJMZCxxpU+BZaH3u16BBoyP7Jxe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713159845, "uuid": "544c5cf1-1afc-429a-b2af-b5c9c3897e81", "value": 270336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713159845, "uuid": "07d0dc4a-d0cc-4486-953d-ec7377817ceb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713159845, "uuid": "f3a33e98-7688-425b-89ce-0a0c39d32440", "value": "1713159844f1475a5b902e14dda4388c0ce3aba7deba1df99aa8adf460463c1d317fea8f7b195.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccfb92a6-fae8-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713158827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158827, "uuid": "8323541b-4c9f-42a3-a9c8-f19b3aa4e9b3", "comment": "Malware payload (Formbook)", "value": "91716349957dde58e981426646e41c41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158827, "uuid": "ba841949-e6e7-4678-9825-120168f6d074", "comment": "Malware payload (Formbook)", "value": "e6d6e42a6b67e3fdad165a4a0b5659773c3212c3aac6d323c30bea339da8f686", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158827, "uuid": "50bbeda3-34b3-4d33-abda-e3f4d20f2af9", "comment": "Malware payload (Formbook)", "value": "b57982f7f63ccfb9d6ee631ceee0ea70a5a9bac0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158827, "uuid": "6d6115de-1adb-42fb-a251-80ccebd7f2f1", "comment": "Malware payload (Formbook)", "value": "310e9f9b987fafe52d531a017d14d8e0210d69b0342b6404458ddc377f2df265a54ccd00e4433ee7973276487b1a4ac4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158827, "uuid": "0d88a00a-d1d2-43bd-bffd-f59c2b7c7d05", "value": "T1B115DFAC3250B6DFC567CE768AA82C60EA207476530BE247A01715DDAE0DAD7CF241F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158827, "uuid": "843873f6-9059-4bcc-a2f6-6497baf86167", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158827, "uuid": "1d0c0864-3c01-4beb-b331-11d9a4e54a3a", "value": "24576:DNLSQJg/C/TvJScBlzw5YR2FA+SQVcLk3nXF:oQC/cTvJblarVc4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713158827, "uuid": "6c5dc29b-628d-470c-9b3f-f4bf45e0f6cb", "value": 936456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713158827, "uuid": "5f38f2a0-4c79-49f9-b84a-9e4babb21e14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158827, "uuid": "47a5398a-bd8c-4075-8527-1fd424830911", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cdca356-fb29-11ee-a120-42010a9c002e", "comment": "Malware payload (NetSupport)", "timestamp": 1713186637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713186637, "uuid": "8e3c7ff0-5277-49f1-b4e2-26d8ee9d5b8b", "comment": "Malware payload (NetSupport)", "value": "8273cb8af2ab5ccd2887ad739a7d3a13", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713186637, "uuid": "8fe411ab-f82e-4208-ac8a-440b15ad4de3", "comment": "Malware payload (NetSupport)", "value": "e786f9d01d5eeddd2dd9597fb2e175ec21dbb4e8466b935d85d2ac953be0b435", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713186637, "uuid": "db0cf43e-b383-4992-a878-6531aed97e36", "comment": "Malware payload (NetSupport)", "value": "8c96ced269ad3857642030cdc875d0253dff8bf7", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713186637, "uuid": "788abccc-a4b7-4a55-92d0-205fd750d055", "comment": "Malware payload (NetSupport)", "value": "5c1e5afad3b3da0be0fc57419595c978d86af96e74ca97cb3b2059c6873d8f5cf00ad5f25f13d46f2f12a479d1dde1f9", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713186637, "uuid": "723e83b0-2b66-411c-a8a7-6729e17cc48a", "value": "T1F866334983324371E132947C91915E2305F07B79A2BFF84969BE5CDBEC7A0A1A5C7BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713186637, "uuid": "9c3a6d13-6861-4499-b316-4ba7851dfa06", "value": "196608:Z8oDmWKqtcLCrSld3S71V/YxQtw44B2yZIgrM:67pk2Otw4hyuWM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713186637, "uuid": "9c871a24-46d5-4919-a696-9b3831a6745f", "value": 7023277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713186637, "uuid": "c8736b96-f3aa-444d-a29b-10ec50b2ee82", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713186637, "uuid": "2b5d93ee-9834-4b05-8add-b840a47b1140", "value": "BB.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "446b505c-fae8-11ee-a120-42010a9c002e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1713158598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158598, "uuid": "91c50841-e25d-444c-949d-b3539d21a3bf", "comment": "Malware payload (AsyncRAT)", "value": "0444c41da90ac8db7fc08947c23f6015", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158598, "uuid": "69131528-0cc4-4b0a-822d-109b138b4b63", "comment": "Malware payload (AsyncRAT)", "value": "eada79e8f03bca1e073eed610a59fe6ff5622f00a7d591aa83dd7cf85eb1981a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158598, "uuid": "d0bfe52a-df80-4183-929d-4d8fd766157a", "comment": "Malware payload (AsyncRAT)", "value": "f690d8909222eb75949c714f42f1d79891cf85a8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158598, "uuid": "00da169a-3cc1-47ee-9da0-9f724143cb00", "comment": "Malware payload (AsyncRAT)", "value": "8dc092d3adc4a84db12dd4ea33c2e8ddcfdd121f63c6b6f852ab07a830debf553adff3ecc052275d64b39c675a6cc43c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158598, "uuid": "2711938d-385f-445b-b063-5dc7e4986361", "value": "T155231A103BE8822BF2BE4FB8ACF25145467AB1A32603D5491CC451DB5B13FC69A426FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158598, "uuid": "82d673f3-e0d7-4145-8863-3ff02290d866", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158598, "uuid": "d5fb6f11-9716-4c9c-8c29-7c77ce833589", "value": "768:uuixFTpY6owWU+7yKmo2q8IKjPGaG6PIyzjbFgX3i8RPGnrrnfOa+BDZax:uuixFTppw2cKTkDy3bCXS8RA/n2aQdax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713158598, "uuid": "a0cc5b3d-e847-47b6-8fe6-6698f8a4f56e", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713158598, "uuid": "e87595c2-d6db-4bd5-95bc-04e4dace2330", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158598, "uuid": "07f3a114-3f87-4204-a688-c5a3ad34c009", "value": "0444c41da90ac8db7fc08947c23f6015.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "165bec0c-fb41-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713196746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713196746, "uuid": "4a64c064-4943-4831-9ddc-e456b89bd1e9", "comment": "Malware payload (Mirai)", "value": "dd693e8bde56d5cc14c5e939aacb2be7", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713196746, "uuid": "3e7114bb-a10a-469a-9e47-b63bb8dcb574", "comment": "Malware payload (Mirai)", "value": "eb46b7fb1c1ec001233cc4234f352d27b8c81f747bb1d311bcab0d8d56e5abc5", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713196746, "uuid": "a55c6070-0af3-4f3b-bf81-c5e12412b4ef", "comment": "Malware payload (Mirai)", "value": "6278c3a772286c8d423d648c32177b0c125c7fbf", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713196746, "uuid": "907c0e45-92a3-4b3b-97f5-b154c4b510be", "comment": "Malware payload (Mirai)", "value": "5bf46c5468c0859412a33513fcf56d760d3c22ccea7ece5d5d0e9ad4fd5175249488782ded051bf892fb94fcb8ed7f78", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713196746, "uuid": "21439d8d-d435-48cf-a7eb-09933ba2a39b", "value": "T1F4530813F68240BDC187C5704A9FA93ADD36B8FD1328B66A1B90FBB12D71D225E1DE44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713196746, "uuid": "aa0752e9-bdf1-4bda-8405-aabce75f223f", "value": "768:kNT9wfpxIO2LDGyLZnX+WXe1JXTz/kchCeaLv4Z2nRR5gGFOXZzsrYErO:AyTZ2eyLZnOoYTrkcEeaLVz5DOaTr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713196746, "uuid": "bf851596-17b5-456c-abf7-99d0d45a9cb6", "value": 64776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713196746, "uuid": "fe6de0a1-357e-4f2c-b420-40b648f4783e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713196746, "uuid": "1e70a72d-8a30-4905-9d4a-3e3ceab0375b", "value": "dd693e8bde56d5cc14c5e939aacb2be7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47a9d330-faf1-11ee-a120-42010a9c002e", "comment": "Malware payload (LummaStealer)", "timestamp": 1713162469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713162469, "uuid": "46a9665f-bd7c-44bb-b66a-d100c9f003e4", "comment": "Malware payload (LummaStealer)", "value": "a4ac2edda7280dfabfc0e168ad4a0f71", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713162469, "uuid": "318976bf-406f-4b00-b3e2-e457cedead62", "comment": "Malware payload (LummaStealer)", "value": "ec0949ba67afa666619ee7906753c470adaac94331f67a9d968405c57f3474d4", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713162469, "uuid": "8f122048-42d5-45bd-a591-fefa03525f7f", "comment": "Malware payload (LummaStealer)", "value": "c545cd8c7801f480ea3f311d7ab2fe8b79b8c85b", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713162469, "uuid": "06d4d7c8-bce7-401c-9d96-04e9eb40a8c1", "comment": "Malware payload (LummaStealer)", "value": "09f9ed08293c7c97c39892ddb4ccefabdde40688a41747edfc57499d268e56152c89f3468b6f788fb2fdf95f94b8ce95", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713162469, "uuid": "4410fe2e-cbc0-438a-aaa6-338c2bd64adf", "value": "T1C3963807FCA148E4C4E9D23489669226BB72BC484B2127D73A60F7793F76BD09E79350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713162469, "uuid": "6103b4d3-56a4-4a02-91d2-daef530b3bbc", "value": "c595f1660e1a3c84f4d9b0761d23cd7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713162469, "uuid": "407f333d-9124-4872-abbf-fde51ef91f05", "value": "49152:UJfUsBjuiwj8R2L0SZEGpG0bHMrpZWHyQiyz6y26vDNhsx8dJPxTtja25EHZKeqT:c9KiwgRu09ZWHyQi1yRBEHZ7xUnne8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713162469, "uuid": "91e374e0-7c97-42bb-9b49-8a096f38e8a6", "value": 9374208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713162469, "uuid": "e8218ecb-0795-49cf-b93a-817a4eeb8d76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713162469, "uuid": "9fd8b1db-b2a6-435d-a753-b2cdfc396407", "value": "a4ac2edda7280dfabfc0e168ad4a0f71", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0659c82b-fad7-11ee-a120-42010a9c002e", "comment": "Malware payload (Loki)", "timestamp": 1713151192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713151192, "uuid": "83ca7e04-0620-44a2-bed7-6948458b411a", "comment": "Malware payload (Loki)", "value": "9a6ceaa122950f56d8c208f6e734e9a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713151192, "uuid": "e267e5c5-b3c1-4002-8460-7d647630aa73", "comment": "Malware payload (Loki)", "value": "ec4da0744db3c56c8c65da45b60e8082f53b8cbce1aee13eeff1562afbb45921", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713151192, "uuid": "cd83c1a1-a473-4022-814c-2d8700424e72", "comment": "Malware payload (Loki)", "value": "188b00e1d4ed31dfc7280b9d3334bb3cf54d012e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713151192, "uuid": "786410bf-33c0-4181-b7d1-256654fdbe34", "comment": "Malware payload (Loki)", "value": "d182a2471f3bdfcd7d29fc7713f1cdfe6a717ed6e414e444fbee2900c36aaba7e401321c9aa75f6663be256e081346fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713151192, "uuid": "8b19d111-3337-40c5-b624-05dc321f22d5", "value": "T17F84C01027A9BB06F1FA27F76C6228005F71659BA596F36CAC9191C90CF0F42DD66F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713151192, "uuid": "277f1735-466f-4a46-a43c-77e54f4f815b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713151192, "uuid": "f7b54a3d-822e-4124-88fb-ef844d9eaa71", "value": "6144:qmijPECZwxTMr79U+dMewYCFJvMDxvacgN2DPAXhPDKdJsd7ubQ0K2SQeyai41ON:qmij8w/6ewXv8Lv8Xorsd7qQ0Vt78gF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713151192, "uuid": "61ea9634-e042-4a25-9bb6-a86a26a1b9be", "value": 404480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713151192, "uuid": "8ed83224-4dc2-4bab-ae22-3989660ed6b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713151192, "uuid": "339cb3a1-6e21-4b93-aba6-6f45c05383a6", "value": "SecuriteInfo.com.Win32.PWSX-gen.14830.31380", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "689fa2dd-fb63-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713211487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713211487, "uuid": "b58f987b-98a6-40db-a159-e4418e0b1016", "comment": "Malware payload", "value": "f318cc5686def0c845ddc7e3408c7b5a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713211487, "uuid": "4f81a88d-30ff-4794-80d7-614ed7976c7a", "comment": "Malware payload", "value": "ec6a94264d4873ef479fcbd30b8cd4209e1a1769dd86a7f0534ae992cfb2a5bd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713211487, "uuid": "2168f0f6-967c-4f34-8ed8-36eba355760c", "comment": "Malware payload", "value": "a41f8d52622fc303bd9709047a46628bd7fdd541", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713211487, "uuid": "291e3b0c-fef5-4137-bcab-b797a183c967", "comment": "Malware payload", "value": "73993a787336e7baacb7a8f16c62cca0454f8cafb702da75cf85c2d220fb03dbe091c804097848f3a817a726512b805d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713211487, "uuid": "3286af67-ad05-4db7-9086-420d7f0426fc", "value": "T128733B96B801DE7DF84ED77B48234905B671B3954A830F3A6397FD63AC721A80D63E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713211487, "uuid": "8c66a479-e632-46a4-919c-f520d5a28c1f", "value": "1536:xiJ9OV1EFOieI4R2baS80tywXx4A+KQD9VL0wzEnj3mNuwgT:xk96EkITbasywXxnwnLTzmKgT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713211487, "uuid": "33c4e7d3-b62e-4a74-a3ff-615214e1956b", "value": 73448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713211487, "uuid": "555f0afd-5c4e-4578-b893-b2f084058f2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713211487, "uuid": "a331c5be-aa3c-4ae1-a424-f01fb590ca73", "value": "f318cc5686def0c845ddc7e3408c7b5a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76d42a67-fb63-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713211510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713211510, "uuid": "10e4851f-a711-46eb-be60-18ffd4f209f7", "comment": "Malware payload (Mirai)", "value": "e484d3e22a2a8e2eedf860eecc871287", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713211510, "uuid": "561c6038-14f8-4932-9409-6a4c6aa20bde", "comment": "Malware payload (Mirai)", "value": "ed728b0e6419f3a5e63f8e297aeef70e39f23eeb3d3b64964e0d2c25c1aef737", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713211510, "uuid": "9711ef9f-ea9f-499b-b3c2-ddc8713561cb", "comment": "Malware payload (Mirai)", "value": "c006edd8b67fbd5f5dc2bebae924da89d18adeae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713211510, "uuid": "df80e38f-3415-46f3-bf72-dbd8ea1b81f9", "comment": "Malware payload (Mirai)", "value": "2be10e2dca5ba2de04f08c12b2db4ac67fefd13b32e013081048874eb824d558345110c30787d47e4819981ae9cea833", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713211510, "uuid": "0acce4d9-db44-4da4-8ec1-61ea2b3013a3", "value": "T1B8731A46BC818B12D5D4127EFA2E118E3323277CE3DEB3129D106F24778696B0E7B956", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713211510, "uuid": "b1c41074-c991-4507-9025-fa74b7f291dc", "value": "1536:4gn2DcdDjE7fy6TLAa+ZGtQyMgitKvSbJ+CH5/YW:bchMawKvSbJ+CH95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713211510, "uuid": "728cd12a-acc2-46c6-96b8-7a5d95028d64", "value": 79356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713211510, "uuid": "95413b74-68f6-4d10-ba33-071baae4ba03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713211510, "uuid": "f6936528-246f-40f6-add5-b8924648aca0", "value": "e484d3e22a2a8e2eedf860eecc871287", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29956a8b-fb0c-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713174015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713174015, "uuid": "5c5cdd4a-28c6-4b68-a822-7b347b3cfea4", "comment": "Malware payload (Mirai)", "value": "7990403c73e568fcb7a7b2caa012de7b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713174015, "uuid": "655253b5-9828-4bb0-9265-67453003ccb4", "comment": "Malware payload (Mirai)", "value": "f0b7f7c2a2c1b602ca3600d1134e7ebdbcb2df5d873ea13e6fe85fc52f9cdf1a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713174015, "uuid": "7ea75034-8ee5-4cd2-9ca2-a0fb4b88c4bf", "comment": "Malware payload (Mirai)", "value": "2c7bf6aad00ff2724435c4a308ebbf07301690ef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713174015, "uuid": "74c3521e-49c6-4624-a259-df7498ce37c0", "comment": "Malware payload (Mirai)", "value": "aa9b32b31ede378dd948689c790a996d34fb74299fcf62c8f18bae43fc9da5a30c6bc31b11c8d3d66b434b8d89650001", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713174015, "uuid": "c7392607-50aa-4fb2-8f66-313b990daaf8", "value": "T194E32A30D4504B17C2D213FAA79E825E3F221F9793DB33115B38BAB41FE279A1D69924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713174015, "uuid": "0e43ab28-c16e-40b0-b61e-3898e4169126", "value": "3072:Cv/WwsLgaq353qHiCOvhOOyq1DQHbe1kmhxQwoVSUNu:KPLaq351hOOyq1L1kmhxQwoVSUNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713174015, "uuid": "c3a49616-86d1-4a0c-b7e3-700a626a2b43", "value": 143019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713174015, "uuid": "d41399b6-7d8d-435c-bd1d-02ea95a27c26", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713174015, "uuid": "7fe37ce1-9f80-4632-83b4-4ff73fe8fb8d", "value": "7990403c73e568fcb7a7b2caa012de7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a540b7df-fb2a-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713187107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187107, "uuid": "c9e22ec1-9389-41ef-abf6-68b96cd61c68", "comment": "Malware payload (AgentTesla)", "value": "9c04064bfe1db89c4b547c54da82a95c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187107, "uuid": "ef710b32-4f85-40fe-a290-ba61a2536543", "comment": "Malware payload (AgentTesla)", "value": "f0e269e83b71ba4647b2359703852475faa1288d44f0e3059c84f1c9b4037f07", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187107, "uuid": "a71901aa-1c99-42fb-adc4-2d89a237f2e0", "comment": "Malware payload (AgentTesla)", "value": "787b346831d1fe9a156ec733266517196b8fbd00", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187107, "uuid": "d39bc92b-56e5-4e33-b380-e4bbd382cddb", "comment": "Malware payload (AgentTesla)", "value": "1ee5a76a43bb290878910204c6c6f009c61bccfe5bdfb6bba4e187d5430a7b5bd0e10cc441295aa2de4a3f447f2c9cc6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187107, "uuid": "2cf9ba7a-e4c7-4c01-b260-0f010ed5c387", "value": "T148E4238E22D91716C8A88FF929B3144413F4F7E96912E3194CC1A5F77E27F812245EEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187107, "uuid": "9a102cf4-631f-47d4-b742-c3efe5d4fa18", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187107, "uuid": "b4c22e94-55da-4e21-8530-541e5186872b", "value": "12288:Mkvq31eoW2IgbVovFOpLLvY5D6ugRNfoiPg4buk1W8yn0oIupxuWm3cdM7S:MeqFhxVEOtY5OuiNs4buN/VzTuWm3J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713187107, "uuid": "5ef5181c-4ea3-4a8d-a205-36ff3b5739ae", "value": 708608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713187107, "uuid": "014c387c-691d-4bc8-8887-b533e11f6b65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187107, "uuid": "da3ac56b-ac85-4433-ad73-cf77154693fe", "value": "MT103 .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38954e7c-fb44-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713198092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713198092, "uuid": "76e2ed7e-bc5d-4490-9fa8-ef0b323b531d", "comment": "Malware payload", "value": "287a1a2634590adac14dc6a6309c66d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713198092, "uuid": "f2867c79-3146-423c-8316-57245efeea80", "comment": "Malware payload", "value": "f2ba06696a0290098dede81c6d7f99cc0306d6f14a55bf8443f8d72df29b9177", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713198092, "uuid": "61073054-71b7-4619-9bbf-d782f86bb0a3", "comment": "Malware payload", "value": "2f6560e011210053c005fc65bb8d63825bd3e82d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713198092, "uuid": "f6a328e3-43ac-465f-9f48-206e17a764c1", "comment": "Malware payload", "value": "836ebaf5814b0413cfef34e1327ada42c384113b5677368461e76e64a24e29b2d2219b55aa15ba194b884944ba20b94a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713198092, "uuid": "eae0f945-fa09-4fdf-a541-7c0ee6f62b00", "value": "T1FB267C57B8D70C95DCBAC3B585798215AA32BC080B3633DB2691BA782F337F14976B44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713198092, "uuid": "42d23d27-8c1c-4aea-9872-fe59723f6d88", "value": "c2d457ad8ac36fc9f18d45bffcd450c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713198092, "uuid": "4877cfc9-3b85-4f04-8640-1ed37d682251", "value": "49152:obkvsXXWFU2F27jk5USYlzTacGmWcI3Fa89fac1JgW6yve:D9UZjtltI+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713198092, "uuid": "2bdf3cbc-5d06-4b10-b45f-f830e9c512fb", "value": 4801024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713198092, "uuid": "f081a393-dee0-4297-8dd0-cb3618a67857", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713198092, "uuid": "7677f8d5-cff7-45a6-833a-1b5e5c0acf93", "value": "SecuriteInfo.com.Variant.Midie.144704.8660.31773", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fafe9e2-fb51-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713203794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713203794, "uuid": "5d5a1506-ea7b-4f49-a6e5-1e25f837d6a7", "comment": "Malware payload", "value": "702995dcfb2992fdaa59bcd9b49f84eb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713203794, "uuid": "d4dbf8e5-7cf8-4227-8609-2fbc4228cc78", "comment": "Malware payload", "value": "f4007e1fa10c4f256867191f91736bb5a428381c5096504b861ad94504c3a93a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713203794, "uuid": "290cc3b0-13db-45bc-90e6-6e37bbf31013", "comment": "Malware payload", "value": "4f5755bc81976317145840ee93630cab1a09b9fb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713203794, "uuid": "93c7d90a-0c5c-460b-938d-28eb7beb1344", "comment": "Malware payload", "value": "6a05456903c7632b44b9aabd0ce9a117d491b111eb2b6499b049daed2ca567782c0d7a7aa9e4fd26ed771596a0affc98", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713203794, "uuid": "c2ebbb0b-7e37-4d3f-a711-86b5498263b1", "value": "T17B4633ECD45F05A0A5BAE1FA50CE14523C153E89542463274FA88CAE19C37F826FEDED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713203794, "uuid": "75f250a0-d2db-4f65-b3a7-5627b8fe2974", "value": "98304:sRP8e3AxWaHZsuU8tSS92zMbpKV7/qU7i5WEru4fi7lJR:sR0ewxWa5smtYMbpg5vsuHBJR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713203794, "uuid": "501f59a0-e381-4d61-9b2d-fae4cc5a4858", "value": 5835840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713203794, "uuid": "1afe55dd-5ae1-4450-aa6e-663ad5b01c62", "value": "image/gif", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713203794, "uuid": "1743d185-ea80-49c3-8c5a-b1f62136b615", "value": "bla bla bla.gif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aea53a0c-fb2a-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1713187123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187123, "uuid": "8a58d08c-141f-4127-bd82-36c791d569f9", "comment": "Malware payload (RemcosRAT)", "value": "6d53853d0d56802e6ad845407f61eee7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187123, "uuid": "03cfe325-9639-4fbb-b89c-90dda0de0410", "comment": "Malware payload (RemcosRAT)", "value": "f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187123, "uuid": "34bde4f3-35fc-4761-9d21-a253ba30e466", "comment": "Malware payload (RemcosRAT)", "value": "3cfb6e47d65afb417444d23908e28163ab83a341", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713187123, "uuid": "2197e7b7-1eea-43ea-b52c-44049ac56467", "comment": "Malware payload (RemcosRAT)", "value": "45c60aea5e6c73b31aad6e7c543260f166163c61d0fd9275fd0889e556303d26a6525043f2a1384631df02bf4d759013", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187123, "uuid": "8e1ea5e4-e14b-4f89-affd-28e528403894", "value": "T1612512236ADD7EC9C43887B0BB3393C1D32DFC150862D51EA9D524CAA57E2137922BD6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187123, "uuid": "f6358a38-019a-4a20-963e-2bfa78f7326c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187123, "uuid": "1a1d591b-3ef1-411a-aec8-a186c0a026e9", "value": "24576:Zo5Cx4T0Nq036gAfCwpOypJ4k4ZS3yWw:C5Cx4QN/OCypJ4ZZSCWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713187123, "uuid": "5291441e-76bc-4782-ac42-ef5b45a79ba0", "value": 990208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713187123, "uuid": "629379dd-ba38-4761-9952-b715f42696e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713187123, "uuid": "d6d2102e-66f1-4248-8662-88e7c5695ecd", "value": "RFQ SY101 Quotation 2024.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19bbc51b-fb41-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713196751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713196751, "uuid": "7a52012b-10a9-4c1e-801a-e309ddc847e1", "comment": "Malware payload", "value": "c622f3a39c3aab235d9faa8aa3a34c92", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713196751, "uuid": "ad8ac1b0-4252-4758-97de-28e51b95617b", "comment": "Malware payload", "value": "f64a0b4bbdbe56f5d44e9a3442fed38c775cd755ac29c7263d3fe7a0a8937ae9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713196751, "uuid": "de42b5d3-379a-44c1-804f-49979dce854c", "comment": "Malware payload", "value": "b5c0bcb16a9ba9421e713299bd780612d94181a3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713196751, "uuid": "0d112260-0465-4c10-ba19-5df2bc6fb7cb", "comment": "Malware payload", "value": "31e78a0841fc6f8ab030123477a56b0a9ca28a3df1d90f1fd01bcf89c7dcbe25c43550722cc24056edf3e82d482012d2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713196751, "uuid": "d1a95fcf-b756-4e85-a1c5-fb209050a41a", "value": "T1DC933B53632C0A43C49F6EB02EF727F183AABDA113A66240510EBFD45772BB41552F6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713196751, "uuid": "0880dbf1-2501-4e1f-8fd0-b805591935c8", "value": "1536:JE+We+1gbhDBICyqIGM1ShNm+gWJhfgAmSgTxhQgcn:JVj1nrIGMsHgWJhfgAm3Txugcn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713196751, "uuid": "968bc5c0-fb26-470a-8a15-5978beeaca2f", "value": 96774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713196751, "uuid": "bf6dcbc4-d3cd-45e6-8b8a-c1ad71d39661", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713196751, "uuid": "5ce4700e-7db2-4f0c-9585-f4be4e731f29", "value": "c622f3a39c3aab235d9faa8aa3a34c92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4edd67cc-fabc-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713139717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139717, "uuid": "ccbc54aa-d84b-45b1-b56c-e35586f0d62f", "comment": "Malware payload (Mirai)", "value": "7fecd112a7e0eacbe012dbb68679ed7a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139717, "uuid": "8e45d87f-4d8b-4d8e-8b3a-235b6ca11c0d", "comment": "Malware payload (Mirai)", "value": "f97ed093ca2c238eced78cbdb61b7b97f5358f6f69e49e08e0852007e1e87fea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139717, "uuid": "92fa3557-f3cf-4b27-9c58-ec622b84056d", "comment": "Malware payload (Mirai)", "value": "22d8ee5fd7734d36472a0fd3fe21577335d77e9d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139717, "uuid": "be9b87f2-6cb9-4055-a161-bdab54d5c8e4", "comment": "Malware payload (Mirai)", "value": "ba51000fbe26a998e4b987e80c133712c78ab0025eb3816d93f74387373557ce3d0855c4dcffb6e0184c29ec8d8cae91", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713139717, "uuid": "e475b1e1-15b3-4672-bc93-94ee8d3f4ff2", "value": "T1AA432AD7F800DEBAF809E73B44131506B230E7E506921B326353B52BBEB61A45867F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713139717, "uuid": "b134940d-08b6-403c-bf9e-fff45f696925", "value": "1536:AV3a5nWlaPvg8ANYzB/CpDRvPxzjrwZAuiq+:WaZPvkYMDtPRoB+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713139717, "uuid": "66f94426-b89f-4161-9111-3d042c0c6ad4", "value": 60328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713139717, "uuid": "fcb96a78-6fa5-422f-9b13-00688daa805d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713139717, "uuid": "1038af97-b6e0-4a42-8219-e086c7ca9d71", "value": "7fecd112a7e0eacbe012dbb68679ed7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46099bba-fb2a-11ee-a120-42010a9c002e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1713186947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713186947, "uuid": "5f8b1724-42db-49dc-a2e9-4ee3546dd03d", "comment": "Malware payload (Rhadamanthys)", "value": "0a23a90bf1273c4a6094fbcd6fbaff1d", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713186947, "uuid": "dbc8e536-19d2-4644-9f0f-d2d2c906b283", "comment": "Malware payload (Rhadamanthys)", "value": "fa0fee451b2dd9c532189705177457d0982e1f27f11e3e2b0b31b9ece654ff4c", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713186947, "uuid": "75618756-240c-4140-a94c-8dda3cc9e16f", "comment": "Malware payload (Rhadamanthys)", "value": "e11b7366af2a68763ef350b0b5cc380e66e3645d", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713186947, "uuid": "b9cb052c-ff14-4178-8535-1c2c4b42487c", "comment": "Malware payload (Rhadamanthys)", "value": "82206c12e2b1221cddc69b40b11bfc84c37a9b856ca9edf8dc0684594a69da37d6d6d9a9345111c0897a63aabc752b70", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713186947, "uuid": "da2793bc-66e4-481a-9b1d-a5fe64348297", "value": "T14BA401F9F0E17E6D2DE58B87A4001F021DE882C361394DB5FA3E36D948650788F9E2D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713186947, "uuid": "0896cbcd-ef66-436d-88cc-216ca7f5524f", "value": "12288:CCQgw6wrf68klS1+t/WPwqwp1pQbQFtw1nT3DCOLZLtomL:CC/w6we8qY3wTpQmtEnT3DVjl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713186947, "uuid": "3f89441e-be9e-4305-9d01-272af9d0b184", "value": 483110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713186947, "uuid": "befd5e1b-3b61-4c1a-ab4f-b0e951d9c34e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713186947, "uuid": "008f04f4-e3f9-46f1-a73a-d52242d575a0", "value": "roland.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed589c1c-fb28-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1713186369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713186369, "uuid": "c8e79355-8208-4c19-8e4a-3bbdfefc5912", "comment": "Malware payload (RemcosRAT)", "value": "d822c95bd53f00fca100fd5a8e262c84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713186369, "uuid": "5a361252-17f6-4904-a3b3-9227031e6afa", "comment": "Malware payload (RemcosRAT)", "value": "fadcd7b36622cde793fdb8b3c509c13efb05a57e5227ea5c0dac37ef49a5cb02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713186369, "uuid": "cbe35f87-b4b9-471d-9373-966efbff9e3f", "comment": "Malware payload (RemcosRAT)", "value": "5198d2fdc041d5b71fa0ca9e12308b0d835a2e6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713186369, "uuid": "71e6d1fd-1667-4f05-9a74-608df61fa1b7", "comment": "Malware payload (RemcosRAT)", "value": "122158fef2c3b3cd515b3fa945b29a1003ff7737474d7116bbb7892d9725c146b89304a71a3850ba49ea5d9f43c2f68f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713186369, "uuid": "424513f9-d59d-44d0-9707-2e02542f5e3c", "value": "T1BCD40210B61DDDBFC91A0AFB4C72754003B25E1ED064E64D6CD6BE6B32F23A21852E97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713186369, "uuid": "f2494dd0-c4d6-46a2-b0c7-d06efe485fec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713186369, "uuid": "f732f199-62f2-4fe5-bdf0-628b5188d0ae", "value": "12288:+CHNBT5iQt+QD+pkBFJsoFlTlNeg8jQHhpKISzAHEAmD:lNlpBr3d8j8H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713186369, "uuid": "8015cf00-141f-4150-a265-0daf5573173f", "value": 632320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713186369, "uuid": "df22b860-cf5b-4a10-b4af-043aa488a48a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713186369, "uuid": "4855fd6f-946f-4c51-b8fa-fe5df396c1f4", "value": "e-Payment Challan.Net.CMS4006975825.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c12f8da3-fb28-11ee-a120-42010a9c002e", "comment": "Malware payload (PureLogStealer)", "timestamp": 1713186295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713186295, "uuid": "19d71fa8-2fee-4c56-b3c7-d746b6a367bb", "comment": "Malware payload (PureLogStealer)", "value": "19b8560aa75f3e7f881886bfaa1b8fde", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713186295, "uuid": "f5d04e45-5493-4742-b2b6-8d6bebb33e62", "comment": "Malware payload (PureLogStealer)", "value": "fb3ade95b80b44b8b6518c6b034b5a87543ed3720f9025e257bd9d9250b0270a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713186295, "uuid": "86e70034-bcbe-485a-9f86-43a360dd0f3c", "comment": "Malware payload (PureLogStealer)", "value": "2b65aa6d39617923463e7aad29fe14774ad339b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713186295, "uuid": "971620a0-2520-4c54-b857-95de627e2b91", "comment": "Malware payload (PureLogStealer)", "value": "38295435395a0731615321bdb1abcb410f1c83f0f68bb98bf46faaeddea1788ce9dbeb75d6f249bc2869abbf93085e9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713186295, "uuid": "3d37ca4b-a329-4619-87ff-83893213be1c", "value": "T108340AA0FBD236B3D1BE1635A051410182FBA90B5BA7BB5A374EE1322CF33D86CD9515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713186295, "uuid": "e833075d-abb2-46e5-bae0-870ce3ab7b2f", "value": "3072:gEUOVhKW4u6SUfzbspKNSOccF6l3iMAelbWTz6NuDpLYXDMxVDW7GmCMY7pdkj:V914u6SUMySOUIGbW7SK/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713186295, "uuid": "7df0861d-95b5-4ee8-bbbe-c7e30292ce34", "value": 241152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713186295, "uuid": "d58ac2f5-5302-47f9-a6f9-914a5a8b5d27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713186295, "uuid": "70aad47b-a162-44f2-8a11-f518fa442328", "value": "Request For Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c69d8475-fae7-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713158387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158387, "uuid": "0a7646d0-9f7a-4daf-a728-cae92984d896", "comment": "Malware payload", "value": "0d5308b31a51e1592fd23024478a7ad1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158387, "uuid": "9c98f9d9-832c-49bf-bd46-c3883b50f727", "comment": "Malware payload", "value": "fc648b251d84ae20494158f38c18fe163e712effcdafd60d3b76eb4b5e85bf28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158387, "uuid": "e05e25e6-efed-40fb-8276-326267a89a6e", "comment": "Malware payload", "value": "04c38ebdd70e3fa80a0ca484b61512c7f27a329b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713158387, "uuid": "803188d0-7e7a-4ef5-a477-c8040dab2487", "comment": "Malware payload", "value": "604f6aac820a8785ece0b5cb60591508acaff94cd7b3c8cd5b2b5771a89c01bc5251e65942ac9bd269e5c3d04fe8e411", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158387, "uuid": "21144380-2ec7-4744-a7a8-00ff22ee49e8", "value": "T1032612C19CDC88EDD35F8C340BD4CF9E44CC8A66B73ADB041895A5DDA693B8837C51AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158387, "uuid": "8b14793a-79d0-4523-bd78-007b2cb51cdd", "value": "13e2dfe787d993815b86f2993920ba7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158387, "uuid": "f506f22e-957f-450e-b7e7-2781d9c95765", "value": "98304:Ac//////xy2vP9LSa4juUilaY7tn6rQhlo23r7WWdZVJC2zP2fcOc2onUJs:BNOvCjaYZ6rQLo23rRZfCI6hc2onUJs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713158387, "uuid": "abdf5d54-989c-4670-a29f-a87b647a1e64", "value": 4734464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713158387, "uuid": "458fcaa4-c26d-4353-85d0-3beb5c8a66dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713158387, "uuid": "cab20225-4076-45c6-91c6-0095ce49e9ca", "value": "0d5308b31a51e1592fd23024478a7ad1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d53f1dfe-fabb-11ee-a120-42010a9c002e", "comment": "Malware payload (IRATA)", "timestamp": 1713139513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139513, "uuid": "0fcd93ec-1d0c-42cb-afcc-cdcd5f210a88", "comment": "Malware payload (IRATA)", "value": "d22a900fdf91b5700244aebadb75ee14", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139513, "uuid": "cb480d7b-c1f1-43a8-ac5f-f89062b55a6e", "comment": "Malware payload (IRATA)", "value": "fd81e7840edbe88dc1dc4cbc93256e349be28fa34b8c00c92ab1b49a85abcf67", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139513, "uuid": "77bdc7bd-4839-4403-a28a-28161ca7034e", "comment": "Malware payload (IRATA)", "value": "21d4050f525adeae78b8b40fc4c54c83dc6d0570", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139513, "uuid": "d554296a-2181-4e3a-bd12-e39b6020d8e6", "comment": "Malware payload (IRATA)", "value": "1860aa0a042fb5316fc138e662560fc7cb65a61a152f651f1860b78aefe61f07dc5862757fd05fb61f318d2631d85b4e", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713139513, "uuid": "009c7ba2-08ac-4f00-87ae-e3b5ba7a9704", "value": "T137C51287F752A86BC9F6D3322171063651774D28CB03EB8B6C08B7BD68B7AD847856C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713139513, "uuid": "d1d36c88-ee88-4755-8a10-9efc2459db77", "value": "49152:1560DWpmbb/wrdL6v69ND8Y7mz3p+gJsnglzU2gUZ+0AQ:WpaDILxDH6jp+gsnGz20hd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713139513, "uuid": "39e319b3-c092-4710-a9e5-659696415aa9", "value": 2697594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713139513, "uuid": "cfe277d6-0ffc-4cd2-8283-6db7d6776db5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713139513, "uuid": "81d47fd7-0c4f-42bc-ad21-42a502f1c1c8", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45a6fb17-fb29-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713186517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713186517, "uuid": "7ecce7e7-016b-46a2-b596-c82843493425", "comment": "Malware payload (Formbook)", "value": "a1ceee96597bb8e5cd3fd74c8923cd36", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713186517, "uuid": "754d308a-7f9d-4da3-9e3e-9e5f3b0bc17c", "comment": "Malware payload (Formbook)", "value": "fdb4f6f9ea52687412174418c535e66c650a7208d94f547c0521208285df19cb", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713186517, "uuid": "25b39996-6f6d-411a-aea5-96ebf5fd9162", "comment": "Malware payload (Formbook)", "value": "719161c5553f65a035e1bb236ea33a740d4ca883", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713186517, "uuid": "066e0373-d8d4-46f3-9cff-5dd3bfe83945", "comment": "Malware payload (Formbook)", "value": "e3b33647d1ba703e20397135893f597759619eddaf55fd26faf8fed2d84b8227a83ab76443e4437f9e8e9869eb7a1283", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713186517, "uuid": "f94a4244-7512-46f0-b0b9-274848690fbf", "value": "T17BE2F13FAA138E05A39B2D092875BF07AD791F15250DC301E88913B9D23CC57AA60FCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713186517, "uuid": "3638f62d-445a-45e2-a401-87e7e9ae8b30", "value": "768:IidOC0/CXVtZUcQlnPiopSAxWxZ3rieJsefAhWCt:Iil0YVscaPlpSkqZ7PJsDWCt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713186517, "uuid": "85632e32-433c-497b-bebb-cdce3f3ab06a", "value": 33054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713186517, "uuid": "32407c20-f057-4bfc-97e5-fa39c7e81c18", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713186517, "uuid": "cc8b88b6-51d0-4ca4-9c4c-ab19627382e2", "value": "HSBC Advice_pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c14ffe2-fabc-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713139740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139740, "uuid": "5cb3efd7-526d-4252-b689-034ae1107275", "comment": "Malware payload (Mirai)", "value": "582045c56f0e7f07daaa32e5608976f4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139740, "uuid": "c18e4ea3-2e71-45ea-8044-3ec1d355f1ae", "comment": "Malware payload (Mirai)", "value": "fdd556b2bb8148f8fbbee387c2c6be089fc8f0203620cee0cd5f698fc564b68b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139740, "uuid": "3e40202d-fc84-4bf9-8265-e9c64ffbdb43", "comment": "Malware payload (Mirai)", "value": "4f54dae1313c2118b99f29620611c2e5d6fcc6dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713139740, "uuid": "c93d789b-5c1f-4792-9e24-6d6c76052f78", "comment": "Malware payload (Mirai)", "value": "2bfc453b3e5521ccd52680eb3db8a0ff0a28f079583922661f768aa97c9604d7930bdc550324cdc39259ebc0bdc789b1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713139740, "uuid": "500843ec-c2d7-466b-ba8b-f91ff1cb9453", "value": "T195C34A46EB414E13C4D5177ABAAF01493323E764D3EB730699186FB43F86BAE0E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713139740, "uuid": "8e8fdf7b-f016-47d1-885a-453cdb406325", "value": "3072:xR7CokaeFBECXDBb7xcr4o2wbZnVzqcNxVnyK:xRVkaeHECXDBbOr2wRVzqcNxVyK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713139740, "uuid": "33b367ea-9508-49df-8e1f-a3258020c208", "value": 129782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713139740, "uuid": "e323c40b-c41a-4395-8f7a-40a568e77b2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713139740, "uuid": "1b37b330-dc23-4250-9bf9-59e11df8a4d6", "value": "582045c56f0e7f07daaa32e5608976f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdcf68b1-fb03-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713170398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713170398, "uuid": "a9cdcc76-84d1-49f9-8cf7-dff9f190ad6b", "comment": "Malware payload (AgentTesla)", "value": "a84f252391c9e6bf08501a773400260e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713170398, "uuid": "79a4269f-7681-43d3-a9dc-9f8eada048d1", "comment": "Malware payload (AgentTesla)", "value": "fe713895248de4b043b3427642117fb02d309dcacd002d7f183e07112976b515", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713170398, "uuid": "5ac32050-f48c-4d03-b68e-0b10cb88ab48", "comment": "Malware payload (AgentTesla)", "value": "a2748cc0d875a943be5a781b61316a7ffb7b2b2e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713170398, "uuid": "9b5dfd4d-d94f-4ffb-acf8-98da3cf7ec4a", "comment": "Malware payload (AgentTesla)", "value": "6abbf27ac398c81cce3b540da68d1aec4dfa818889865b939cf4a9ac9028f7a4f405785291c3eeac7c915e095beee544", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713170398, "uuid": "52d46728-928b-40df-ade8-e9276d0448a6", "value": "T18BF4126031ACCF37E63E5FF8687844A18BB5752A7124F75D9E9640C91969BC00EE0F8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713170398, "uuid": "c94adc94-0401-48b3-9d85-acb2c58e7080", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713170398, "uuid": "2a649e6f-b37c-4efc-8c3d-39d99d0f455e", "value": "12288:SLLNBnFNBbOKAKbVQdNllfNEl3osgk1/VPHVeeeQR1XFUKDX:gLN/NYpdrlf6lBgk1tP4sGi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713170398, "uuid": "67b27c01-080a-42f1-91c3-128f72674bee", "value": 774144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713170398, "uuid": "005a7d95-4a88-4efb-93ee-84a4cc604cc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713170398, "uuid": "4417afcd-f6d9-4ac3-aee4-7cb92f6d6f1e", "value": "Pesanan Pembelian Segera untuk Masalah Pam - PKNSIPSCVKON.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12a8d86d-fb29-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713186432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713186432, "uuid": "288ff58d-3e4e-4ccb-8d18-4e047b6b8c13", "comment": "Malware payload (AgentTesla)", "value": "9a84501c87a8c1daaea8d11eaad9482f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713186432, "uuid": "c4c187de-3253-46d5-aab9-7182ef56e1ef", "comment": "Malware payload (AgentTesla)", "value": "fe8740d99ceab2db3f8d780de23b7d42daa2918cfbdd7c4be197119132bdccb5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713186432, "uuid": "fdc20cfc-de0c-4367-9a0a-d399b8a84987", "comment": "Malware payload (AgentTesla)", "value": "43de15f3f5b215e05f147c3c10a4bf704f0c77e6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713186432, "uuid": "eb5fb486-8d45-4c99-b776-13c465d4c5c6", "comment": "Malware payload (AgentTesla)", "value": "311a51b938dee489a9cff59054eb59272480f2d30b97c2b3d339a478f60bda4f27d108447690d1308c54558e99ec5e80", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713186432, "uuid": "08bdb18a-a91f-4e30-91a3-de9c1d54ea27", "value": "T180F4F0983640B6DFC867CE77CAA41C24A661A467030BEB43559726DCD90EADBCF142F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713186432, "uuid": "9d2d40b0-1e6b-4bb7-897f-81915f0be197", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713186432, "uuid": "53f7f780-007d-4933-9682-b2c20ac1c84a", "value": "12288:WeFDuvzT3708Lifz9OORcdxEHMVk75Voh/xGrkWw9g1vWzpq4LEL4KTGGx8FtHrS:WeF6AY09OxRK4h/x2Fwu1v+hL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713186432, "uuid": "6edfaa79-256e-4826-aa05-051f6a1ae080", "value": 752640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713186432, "uuid": "8a013ef1-102c-4fd2-b908-47ae5b05d150", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713186432, "uuid": "fa1bd3cd-9a10-4008-8aab-3afd17056a23", "value": "e-dekont_html.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6f3868b-faf1-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713162709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713162709, "uuid": "1a6b1b61-2469-47fa-925d-d776c93c42b2", "comment": "Malware payload (Formbook)", "value": "2ee2623172a671c136cfefcf11a36df6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713162709, "uuid": "277f082f-b039-4c24-aff6-c14bd6299522", "comment": "Malware payload (Formbook)", "value": "feabf25fdb9459088e746a927ecdfa1e831785b0153aa602d78aa8c6b0e28449", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713162709, "uuid": "c291f0e5-f448-40db-806b-f7f02de523f4", "comment": "Malware payload (Formbook)", "value": "4a6ab93e46b266a048ea368f82639211d478fb33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713162709, "uuid": "275d4ea5-a4b8-464e-83e5-cc725a25adfc", "comment": "Malware payload (Formbook)", "value": "a211416bc87bbb4cef571a227c98834b52953a782cb0dd28839cf3ac82b9486150333b0f83db2753368abd988cced9ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713162709, "uuid": "d95436c1-b866-43fb-8441-36bfe05e06be", "value": "T1F245C0027381C062FFAB92734F5AF6514BBC6A660123E62F13981D79BD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713162709, "uuid": "44096499-a897-43ed-9785-fc41e8e0f046", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713162709, "uuid": "230e545a-b926-46c8-be9d-e5268fe872ea", "value": "24576:4qDEvCTbMWu7rQYlBQcBiT6rprG8aMRvoIxp4nb0:4TvC/MTQYxsWR7aMRwPb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713162709, "uuid": "ed21605e-8b87-4d61-966d-07e474ca677d", "value": 1256448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713162709, "uuid": "524b8816-5ee7-4856-ba2e-75c2000ac043", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713162709, "uuid": "98bec1ec-0ad5-4d83-a197-999b936ad120", "value": "SC_TR11670000_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }