{ "Event": { "published": true, "date": "2024-02-16", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2024-02-16", "timestamp": 1708128181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "bca4c77f-96ab-44d7-b485-cb0ac1351e4f", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e28e739-ccf0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1708104297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708104297, "uuid": "f5a21df9-210c-4208-8169-6d6861f464f5", "comment": "Malware payload (RiseProStealer)", "value": "4147f7751441f1c4b6e463c0a6199fad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708104297, "uuid": "d861a2a2-7c3e-4166-972f-468acdbf1204", "comment": "Malware payload (RiseProStealer)", "value": "00311062d65c4c2ae902864835d1f179d7c648eb88475af7c2a928f7e54238f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708104297, "uuid": "645a821b-9f8b-4d9f-a797-4e2c603b2fbb", "comment": "Malware payload (RiseProStealer)", "value": "e35b6f3d990d6623ce762cf3da84a481f842ff76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708104297, "uuid": "4b2f64a9-79a0-4cc1-ac92-08464fa74eaf", "comment": "Malware payload (RiseProStealer)", "value": "a56592816a1c86bce8166e32a8dec5bd1a0ba8616edb55672e29d34a8fc4ca273c21b96283802e0ace735f929fcabb3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708104297, "uuid": "3c55d842-fb4d-4c97-acce-be26edab56fe", "value": "T1661512CE7C8085A3E29876B408C2F7B9411EEC55799A50C93CD9BF97F633E29182356C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708104297, "uuid": "f32def27-463d-430b-825f-009e072547fc", "value": "2388fee6ad8ce4f4a35dbaf64e2da01a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708104297, "uuid": "ca7b9251-2bf7-4a82-b592-2dcbcadf6985", "value": "24576:feQLNRA3VNb0604qiqof6JQh9gseCzW+t8U9DoDn1:jnA33b06UitEQh9ikmUSB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708104297, "uuid": "d1333780-4754-46c3-82d3-64c3e0752088", "value": 922064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708104297, "uuid": "9c90749a-9f0d-43a6-8b9f-1bde576597b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708104297, "uuid": "e3a62606-8ed3-423e-a47c-7cefb47b302b", "value": "SecuriteInfo.com.Win32.TrojanX-gen.16186.27665", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5892137-ccf5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1708106617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708106617, "uuid": "2802d6db-aa6c-4776-a32a-4c0c59fdf3e8", "comment": "Malware payload (RiseProStealer)", "value": "242bfbb9fc3a3381a05c8eac350a8385", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708106617, "uuid": "a408b748-6040-40f3-9dc8-f935ef5db608", "comment": "Malware payload (RiseProStealer)", "value": "00d626937c00e5bb06c353f5724b53b80897de9df5789926c3403abc7ef723fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708106617, "uuid": "3fde5118-b368-4b28-afda-8708a11b28b6", "comment": "Malware payload (RiseProStealer)", "value": "ba86b0562855e909b9cfbecec67d1cdd72630943", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708106617, "uuid": "99d0f04e-f32f-4d49-bc69-50dbb533dd5a", "comment": "Malware payload (RiseProStealer)", "value": "de4da11d73fbf822bf7c5197f59b1b4262a2aee2077ef1e5c7e2e358d2a645409b68e356202f1ce01b23e24e888770d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708106617, "uuid": "804fb1f7-107d-48c4-b3e2-87407bfa8a23", "value": "T1795633CA1DC235E8D864A8389AC2BE1C76F91F389C93D73D1564AFE3BCB62245075643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708106617, "uuid": "369939a1-4888-444e-ab66-765ea910850b", "value": "4329a5a28af84abf208d95062e79baad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708106617, "uuid": "9be92b03-4bec-46bf-a90c-df2b63722bd5", "value": "98304:aKrXkmkBcS4+yJArey1uxZmfZbcahTorNDDay3SZdUWDJWCdb8uTxKfb6jHp:aKrXZAuy1ymflhTa+WWD8Cl8udKfb6jH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708106617, "uuid": "20734e00-67e9-4961-8490-c9212b956d4e", "value": 6033920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708106617, "uuid": "8f63a962-edd9-4376-a656-ee69043beaa7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708106617, "uuid": "222bd79d-1cc9-403b-8779-39a422c07c0b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54466e06-cc9f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (STRRAT)", "timestamp": 1708069518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708069518, "uuid": "1b4cc918-45d4-4f48-84e3-31ea7a3e194c", "comment": "Malware payload (STRRAT)", "value": "f6cc7b3e58245a47fbb011a855d9e1a1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708069518, "uuid": "189dbc2a-5f54-425d-947e-64eb33c93541", "comment": "Malware payload (STRRAT)", "value": "03ade8775dcfd3e7d8ba1597d7013ace8b85e0db35f111d144863da9cd1ec598", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708069518, "uuid": "bd2bf57a-7a0e-4ace-beae-bc4c0411535a", "comment": "Malware payload (STRRAT)", "value": "71e0cf024fe81784d426de260f2edd0933472382", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708069518, "uuid": "b3d39f5c-a754-40d4-8adf-ac48398d0d9c", "comment": "Malware payload (STRRAT)", "value": "ad40abea8265894ce259c47e1a854322c16064044d5787e1dd33a43cf17d9e8e4a7d56e8c7a56732ba0cd0360a144784", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708069518, "uuid": "5f126027-614d-4a36-8ba8-fee70591274c", "value": "T1DAF428C57B6439479BBBE624C315F123AD38D42B1D8729EA3DC07A099EB7C801D6E970", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708069518, "uuid": "846d6b81-d39c-4af3-8384-44d5b941786e", "value": "768:XQBKDbZi/mvCtahuXaM43+fwmGC9Emr21lYTHehprf/HwfJt7BtOhZAfUdkHf4fF:XQM/RKMO600puex9Mo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708069518, "uuid": "25083caa-a8a7-4ad9-98f8-02122007c5b1", "value": 789191, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708069518, "uuid": "38bf9daf-bffe-4fc6-b888-a81a8dc1244c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708069518, "uuid": "75f0789e-f5b8-4bfa-9a53-7653f31e5cc6", "value": "PO-65547.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffd465b8-cc8f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1708062933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708062933, "uuid": "099b9264-eb48-44c4-ab71-83f5205ebc89", "comment": "Malware payload (AsyncRAT)", "value": "60b1ae96ce2b60887771acf3ee020673", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708062933, "uuid": "98540899-e003-43ce-91b5-78b12aa5386d", "comment": "Malware payload (AsyncRAT)", "value": "0546d33b8b9ca46ed6e91ad57d8359751800f1b62adfd5a03b4317ba6562a20c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708062933, "uuid": "836b7b7c-e394-4caa-b006-7b5bb3c82c00", "comment": "Malware payload (AsyncRAT)", "value": "0206c423aee55b35991d8f033a87e0a6cde185cb", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708062933, "uuid": "3498243d-be6a-40b8-b96a-cfaa711aafd8", "comment": "Malware payload (AsyncRAT)", "value": "6775cb116fcfdca73d5a03431d10f67b7005d1c8c435e9ec5cddc0bcee3a82417f431cd5401f46adb1f14eb0981bc535", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708062933, "uuid": "eb99dc38-819a-45b9-a13f-eebecc3f1ea0", "value": "T11404BEF67B891FEAC2D808B5847E510A4318DCAF10139F03A47A7AAB9E32FE7D517445", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708062933, "uuid": "5b0a1891-0fad-45c6-ba04-8f71c5d6512a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708062933, "uuid": "bea5e375-1c4c-485a-aad2-63195b946686", "value": "3072:IJi2ve9lhDoNX8POhXG35vDBttsNzI6XHMw:I9CjDo1AOhsvpYzJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708062933, "uuid": "cb506ca2-b17b-4835-9e05-d2d0741b8544", "value": 176640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708062933, "uuid": "addf6e78-cab7-4168-b652-a6ee0f824345", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708062933, "uuid": "5a71685a-349c-491d-8509-d52529476ab6", "value": "QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f52b720-cca7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1708072972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708072972, "uuid": "b9e8da81-59db-4a85-b99e-a390d8dedd73", "comment": "Malware payload (Gafgyt)", "value": "a3ce069d9f1b4cca23cb4a4bb81fb6fb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708072972, "uuid": "a5cdbbe9-c99b-493f-8308-3dd562766cf7", "comment": "Malware payload (Gafgyt)", "value": "055bbdfb224af3d5c1e7e14cbc9d85f1e18416b8f6029cc4c71d39c8fa8dac72", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708072972, "uuid": "1dd9aeeb-f6fe-430e-ac55-02b0a3a7eb3e", "comment": "Malware payload (Gafgyt)", "value": "15b77fa6ab5bd3c57908e68676182d6a42b34b9a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708072972, "uuid": "f0b5f83a-4a51-49fb-b17b-ee0088b7b66b", "comment": "Malware payload (Gafgyt)", "value": "9d9e7c7460f9a43f9eb7cc5b35105f479fcdc20a20868bfa4b9d1ba1acd9e4dae0808d5400ecfa69d0ffc738734b86b0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708072972, "uuid": "9d01eecb-9346-4f14-ba0b-80a27b17e8ff", "value": "T1ADE34B06B31C0A47D1632EF43A3F6BD093EF9AC121E4F640256FAA8A91B1D375546ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708072972, "uuid": "ec400e24-41ee-42dd-a93b-a14d3eb0762e", "value": "1536:rHd2Xu4Jf1u7bnG22bJDZ42yxp6vTRv0Q2UVhX4MyrOBvA0WWkmKSXkqoRZ4n0Or:r4XtNo3B2yx87lnXWrB0Bn0Y/Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708072972, "uuid": "8a4a42f8-c038-497b-9f59-f1cf24167079", "value": 146396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708072972, "uuid": "5cdbe7ca-7ac3-4682-aa05-ef2918222955", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708072972, "uuid": "f05032ed-c18b-4a62-afc5-5416976df2fa", "value": "a3ce069d9f1b4cca23cb4a4bb81fb6fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d50d079a-cc8c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Tsunami)", "timestamp": 1708061573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708061573, "uuid": "0d1eb336-aede-41c9-be7d-2700063753d7", "comment": "Malware payload (Tsunami)", "value": "efe02555dcc64e9dd88bf026127b6158", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708061573, "uuid": "3dac7885-68de-450a-bd2b-189b86369a7b", "comment": "Malware payload (Tsunami)", "value": "06a5c38e860b79332d060760d9d5fd0944abdacda79c3ac75eb1079870f437ba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708061573, "uuid": "6c68220a-b7c3-4e11-83cd-ecddc8234710", "comment": "Malware payload (Tsunami)", "value": "8668597602011c01eb0d387e9d87b4a1216bd85a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708061573, "uuid": "db1b2a2f-bd6f-45db-9252-748b11f1cf2b", "comment": "Malware payload (Tsunami)", "value": "c6c497790ed639fa1e792675236105b64cc78d09e32d4286563dbc9205fad38b6d85e94dc990c9d3968ffcca29bb17c2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708061573, "uuid": "e90acb3a-10be-4490-8c45-ba9bc014d978", "value": "T158C31805FA605633C2D22FBBF79A828D73252B99679733059528BFF03B827996D37140", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708061573, "uuid": "706eeda7-bbb0-44a1-88a3-b4b2bb246987", "value": "3072:QZubDtf4H13vbTvALtYr9gHu9hN+QU0jbsVDQKvtX8Fiz+ltTG+tHGZdhQzuZZ6O:ZrVHvtzQtT7tmZdEuZZreR8m1QkQFrrn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708061573, "uuid": "d0c21c7e-9100-4b6a-bf7c-7f5de291b7fd", "value": 122055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708061573, "uuid": "6063a58e-2cb1-441b-9d9c-d12da7695dc4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708061573, "uuid": "dae12350-42a8-47c8-9b18-3f1c0c8fefad", "value": "efe02555dcc64e9dd88bf026127b6158", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41df9b27-ccf5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1708106423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708106423, "uuid": "d4d22a6e-0763-4442-b6ce-d6ce8eee1769", "comment": "Malware payload (DCRat)", "value": "abe6aab2d9381828cde7a28cf2634901", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708106423, "uuid": "1de26b4c-d921-4d45-90f9-c6becb3573f2", "comment": "Malware payload (DCRat)", "value": "070416269ee0d1db916c9aef01884951191d7de2786069c7f1e4acb34bcd0bc3", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708106423, "uuid": "e0fbfeba-8010-4d13-8f8b-9ac61d79b3f2", "comment": "Malware payload (DCRat)", "value": "ed0108b57a7c6294ca250cbba22a2bc4f7f2c942", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708106423, "uuid": "2c8ad545-00cd-4b1e-8830-0a951a164568", "comment": "Malware payload (DCRat)", "value": "dd4b963ba6afdb3d8ae499ab2944ff2dc70b910978d4ba04f837dd8fcb0c51f689558a7703f1dcdaee1638eb663cd6de", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708106423, "uuid": "510e0f66-334f-403b-9016-76a89c1df57a", "value": "T18415C72429EB003AF177AFB599D1389E9A6EF6F377079E9E304043C64712780DD9163A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708106423, "uuid": "4952a58d-f7d7-4010-b4d6-4673746eb0a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708106423, "uuid": "dab20568-c45d-4214-9368-5a9578f72d0a", "value": "12288:X651STe2uWf2vEt6IZMA6aQpW3Ari4VVyZC0+1cp9bpsx3/iIVRBG7dgZqGLMZ8l:XiDdW+U5MA6t3iE0nTtnYp6D+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708106423, "uuid": "d4280be4-50f7-45e2-b2e8-3971c6a5f0f0", "value": 906240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708106423, "uuid": "35fb610f-8332-4736-8aba-4ece352a2d42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708106423, "uuid": "2cf8b11d-c6b7-4ce0-9a5d-b1f52092a990", "value": "abe6aab2d9381828cde7a28cf2634901.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1ab8783-cc9d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708068842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068842, "uuid": "412586e2-b229-45a8-94f5-ed5dde101489", "comment": "Malware payload", "value": "f3a28c396de728a54dff5e92b94f4a8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068842, "uuid": "bae93da0-4254-4bd6-bc76-4bd397928529", "comment": "Malware payload", "value": "0780a5e281356bcebf340a18efe9824d88f849791c4aeba3e7a03d07870305af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068842, "uuid": "802451ab-a7c6-4091-ad06-81441a71022b", "comment": "Malware payload", "value": "15c7e91e0faf73ad36b320ba9e08c3113ae23a23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068842, "uuid": "04bfb567-8ad2-4759-975d-273b2b31976a", "comment": "Malware payload", "value": "bcc89d871a159d74fef73262decec035cbec6c93b52bbd714e24b4fbc180b50953cc6774a76aa19366e2cf3ec46e31a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068842, "uuid": "98245f70-6b43-4f8d-b459-7961809931f4", "value": "T1F6C43D9C151C031AC37ACAF384C4052FE2256477DD7107EE52D75F29A932A83BEA1E6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068842, "uuid": "10cdf82c-cbfb-40e2-8c4d-69239c741cfd", "value": "6144:38BjZ8Bj5I9Z+E008Pip7GS9AZAJBdqN0SmkYGjUJ/w8QSgZj91Jm9Zj2VZj2RfR:38xZ8x5s0I9Zj2VZj2J/S1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708068842, "uuid": "fb29ea24-b52b-459f-b170-2e36486ab5d9", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708068842, "uuid": "469f7f10-ec46-455a-b44b-80c1b292dfd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068842, "uuid": "415c8417-22a1-4822-95cf-c3158bfdddbd", "value": "SecuriteInfo.com.Worm.Win32.Carrier.28317.18249", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c85d92a-cd02-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708112105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708112105, "uuid": "62999648-0767-4513-92e7-40774a3a23f5", "comment": "Malware payload", "value": "6d00e5218837d91e1aba57a03c3e7a16", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708112105, "uuid": "8348f2f1-a4ae-4fbb-a1b9-8a9ff0a54f2f", "comment": "Malware payload", "value": "09990d84f1d9b34158110c59adba6354a9c2f1d96c977e6bab91c24fe127cb03", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708112105, "uuid": "da7a39a4-96cb-4e84-a4ba-549de84b8e34", "comment": "Malware payload", "value": "7a30477ebd389878ded974bf70c3d2d70ccff219", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708112105, "uuid": "28609427-8dee-429e-913e-483807bee73b", "comment": "Malware payload", "value": "098977291f2a6213320ee62776a91835de2847f81dc3a3b519039d4a8edcb0a5cad946870550cff0549d02a1951eae6a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708112105, "uuid": "e618e75e-8a69-48ce-9706-aea474bcc41c", "value": "T1BAB23B06B7D8833BCD5F0FB6D8A2181427B9C686EA53E71D56CDBCB12B733D042122A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708112105, "uuid": "233583b6-d4f2-4510-8738-c42da3cb4fa0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708112105, "uuid": "2078be98-f117-45d0-955e-e03650e04ac0", "value": "384:0eUVXAW892rhPTsS+QPjIsjWJ6SwWskwsdATxzMA9lSjAuklPTVxp7J:0PAW892VsS//Sh5suaPTx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708112105, "uuid": "8cda168d-8828-4a7a-a7cd-aa40e815e854", "value": 25600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708112105, "uuid": "85b4e52a-2ba3-4c3c-b557-305f29944e41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708112105, "uuid": "f785854c-7847-4a57-b2cd-da2095f963da", "value": "Grace Engineering and Technical Services.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de8aa173-ccd1-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708091224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708091224, "uuid": "bccce68b-0bc6-4afe-a912-52a324616f95", "comment": "Malware payload", "value": "a18ba120d79d6729d21feb135a71c622", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708091224, "uuid": "5721838c-85df-4e74-bf43-d83b57ab4a77", "comment": "Malware payload", "value": "0b419cf91a924b1c7ba8da5592a92471ebde2fc744098c06bec02a4f44641557", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708091224, "uuid": "ab53fbc6-1c31-467e-9784-84feb796ca21", "comment": "Malware payload", "value": "9bc7b4687c2912d6b7fe8e3c4bfdb9ca6debea28", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708091224, "uuid": "bb34f9d9-2434-4633-bd69-a09f6f4b09f5", "comment": "Malware payload", "value": "f3785b71e2ed09507277ef0dd520b1fcecb1d0f7000d366d3c24bb69f1ea39ebf70fd6b6236644525c308f1cb1706040", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708091224, "uuid": "f20ee2cb-8b22-4a13-8cdb-c8844938f1f8", "value": "T10267F1E29B84C85E54FB5937DEA2D73AF4461C427697380EC9223A6788F2F74F170258", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708091224, "uuid": "2595beeb-91e0-4501-b9d5-8e2d6f5bd2ae", "value": "786432:hJ+/hP1kS4ZwSDg6FRgsM3sXFCvsGHibiGas6+jT2ae:eMS4LFrM3sXFHxbw+v2T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708091224, "uuid": "640acc59-107c-4eb1-b48b-ae48c47ce213", "value": 32441724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708091224, "uuid": "bed41967-a10c-4d33-8239-8dc5df45a6a8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708091224, "uuid": "b5b7b9e1-6d38-44f1-94e1-157bfd71f3bb", "value": "0b419cf91a924b1c7ba8da5592a92471ebde2fc744098c06bec02a4f44641557", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "530a71ef-cca2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708070804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708070804, "uuid": "33db9c49-cee7-4fdd-b4f8-803a8f7d2417", "comment": "Malware payload (Mirai)", "value": "fb26cda47acdeaa18eaa8b91cfe0f7e6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708070804, "uuid": "c90dba73-2bb4-4757-b902-0322369c4ad8", "comment": "Malware payload (Mirai)", "value": "0bc32fa3e8535b9502ff2f0689f8fb121dcfe2bd71a940b9309b26c8f13d70b3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708070804, "uuid": "bc21711e-7f99-4012-9313-48c075bb83eb", "comment": "Malware payload (Mirai)", "value": "18184b92d4ede02bdfb0d30370ac94a2550a59f5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708070804, "uuid": "d3913e54-5c68-44b2-9aea-e92ec5121f5e", "comment": "Malware payload (Mirai)", "value": "c71e3e06fbc8d51b4e8d3694fe1241d7b7b1e794188a7ba8768d1281946a989a4a7f7a055513e972accd996147da1fc2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708070804, "uuid": "080743f1-a749-4a8f-9185-2409f72574b7", "value": "T129E31945F8519B27C6C212BBFB5E428D3B2A57E8D3EE72039D215F20378A95B0E37542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708070804, "uuid": "dd32d6be-1807-4b3e-a042-1cb45deec2d7", "value": "3072:TZh7RVCzzM/ldqFPIX42lbf7PV56jvuYYf:TZdR/a5442xf7PejvuY4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708070804, "uuid": "6d5e18a3-16aa-4e74-96c1-bf477e615f9b", "value": 146272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708070804, "uuid": "0f7ce975-79e4-43a4-b482-b814031f4904", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708070804, "uuid": "ccf58194-81a2-410b-b52d-d528f667ff3d", "value": "huhu.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a32baece-cce7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708100574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708100574, "uuid": "e79611a6-c378-4af5-8285-d54d9527627e", "comment": "Malware payload", "value": "39ca3a062f939b4101466a7e892acf8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708100574, "uuid": "6758c6f2-bf54-45ff-8b84-7c74bb213157", "comment": "Malware payload", "value": "0c9632a70fff39fe6839b20f7a1f9da33c0fbc2ead326463b79a47aa0651f750", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708100574, "uuid": "ff414a5b-d678-4e64-8d02-ab24b2953419", "comment": "Malware payload", "value": "178aa80f4e688e1b845730e0570756dbf9f67809", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708100574, "uuid": "608eac9c-48fb-480e-9cdf-e3bb9a794f33", "comment": "Malware payload", "value": "0b19ae518fba3ad1166199066c581101249ed037bb5f00bdbdee3de810985fe32c879c28db4813ec9127505ae843d251", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708100574, "uuid": "85fc9104-ec4d-4482-bf96-9c60e41d9ad2", "value": "T1F735231156E0833AF0D82BF8A3F979A72374FCE05739979EA29160C95D61380D97532F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708100574, "uuid": "045a60e3-8861-4605-b203-4b153701f830", "value": "0ebb3c09b06b1666d307952e824c8697", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708100574, "uuid": "ad75fd03-bcdf-4bac-bec3-88330d888963", "value": "24576:6ZqrAiMxSQB6EeEemEjVR9gYnKvjN9yOTOv9OGpAV28h9xQmlAi:Kqr4SQB69KEjBpnKaOiVz2w8h97lh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708100574, "uuid": "a8a0ded6-2106-4d7c-bde2-e0683d15c6fe", "value": 1150464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708100574, "uuid": "81be6573-3418-4477-9215-2478801022a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708100574, "uuid": "702bcd45-58f4-493e-a42a-da7ccfb8fece", "value": "SecuriteInfo.com.Trojan.MulDrop20.5838.21987.16447", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6c19fe6-ccc7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708086890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086890, "uuid": "4efea00e-f11a-4b4e-9ca8-ab64436de9b0", "comment": "Malware payload (Mirai)", "value": "02897b4d18ec53e0be070114763885d0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086890, "uuid": "4193f566-5d0c-40e3-9550-2a6e96687d73", "comment": "Malware payload (Mirai)", "value": "0ce199895dd3059d9a3c3b66f48b163913928cb4f5dec71913f26898012a1313", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086890, "uuid": "e401ab16-e15d-4861-ac52-c85bb50695cf", "comment": "Malware payload (Mirai)", "value": "90540a242a9f74dfa072918f6eb99e28a6c4ad2b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086890, "uuid": "f38df742-c774-4c1a-9df7-31ac61ccd6ec", "comment": "Malware payload (Mirai)", "value": "2974edaab3683f3528dbfa8809cbc1612475c929e3162e963494620c0e80d394386c25092925e8c46caca1a2b4d79590", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086890, "uuid": "6945a054-627c-4c3c-be76-afa5f18763f8", "value": "T111D30845F8415F23C6D612BBFB5E428D3B2A17E8D2EE72039D256F20378B95B0D36942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086890, "uuid": "ddaefc55-5848-4b32-a32a-c632484e6c4c", "value": "1536:9PTk45W6gJXa0BNkANzPFuAewIP4VUNGqT+YE7EgDdGT8IF5lBIdwywAFG1xOqEP:NTkesNkmzFui04MPaYE7EzIIcU+mj4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708086890, "uuid": "a92f654d-5d42-4264-9ff8-d47dcd860569", "value": 133888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708086890, "uuid": "a6ce4d91-e07c-4080-89b3-5ef251f6a186", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086890, "uuid": "a4d7a65d-baea-4eb6-8f47-eea6c00802c1", "value": "02897b4d18ec53e0be070114763885d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7819e794-ccfa-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1708108662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108662, "uuid": "1c2a65aa-9fb1-4123-bfad-0ce5b2b6158c", "comment": "Malware payload (Stealc)", "value": "b111b74a7f2979a517bfe4fb6c88fe80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108662, "uuid": "9a19b8ce-a9d4-4935-813d-35817be03a5d", "comment": "Malware payload (Stealc)", "value": "0ce20355c39691f815eca3acf7e9e6addd4e8e2159297e4afbceef64111a0837", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108662, "uuid": "4e4a648a-96ed-4597-b2e2-99ba036477a5", "comment": "Malware payload (Stealc)", "value": "a1e05cb369ed0a24a9aff8066514ede7cd17dba6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108662, "uuid": "f5a65406-4626-4359-a9c2-c026d686fc9c", "comment": "Malware payload (Stealc)", "value": "e2f1250128eb6999a78314a6df783562f0338a52769aaf37276a80ed9c71da6bfd1c0390264e1f499536b4e10f9ea852", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108662, "uuid": "5e8c7b32-dd68-45fc-9c35-db4ca08ceacc", "value": "T1BE44CFD0A6E4D031D24325398921DBB24EBB78353962E98F6FDA177A5F287D0D22430F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108662, "uuid": "8edcb4e8-0f77-4f67-9125-008502626a4d", "value": "701b7eda6b324e6e9073377243e2004c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108662, "uuid": "c73cc101-01d9-473a-a6b2-e573c76fcea0", "value": "3072:Ib0S8j2zIWWnnMe8TEzBlgkVJ3xlrI6QDJ170Z2z7DlT:IbXC28ZMePakV7/QDzp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708108662, "uuid": "a3a20f94-c8f2-49ca-83f8-d6b7cd0abb62", "value": 259072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708108662, "uuid": "b83070b1-b153-4a73-b4ab-8fa7624846c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108662, "uuid": "162c7c28-2e8e-4b17-818a-c1df1a17b656", "value": "cfDqE00R1M2FHvud1UskY7La.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc83f92e-ccef-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708104079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708104079, "uuid": "97a32a9b-541a-4b3d-8a4d-316877b79789", "comment": "Malware payload", "value": "adce4873aa5a54f4c3eaf02b9a9b2ca2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708104079, "uuid": "a1d89478-00b2-4e22-824c-e37f6bdd4f02", "comment": "Malware payload", "value": "0d185ea3b0a49c2fa65bfd2757c9d0705657f0639fd36f196ac394fcd38c361d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708104079, "uuid": "eb885b09-67ec-46cf-a1db-8da27196e996", "comment": "Malware payload", "value": "30df07e83063822bfff5038cb2fdb250cd18e5cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708104079, "uuid": "a45171a4-fa41-41d6-9281-69c159735690", "comment": "Malware payload", "value": "36a80047cf659b35c43d3c289cb8d4b5b5d0fe1121f44839a0436862414219d9a9c7d0761cc9da879fd863e76c3f9a0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708104079, "uuid": "c26d96bb-949a-45b0-b10f-f1923b372721", "value": "T1D5D47C5FF5D507BAD4B6907CE513AE46F2357896072046DB03D086A62F2F7E0AE7A320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708104079, "uuid": "1e58d02a-2ee5-4e10-bcbc-0f9496d31297", "value": "ff1950b83ebbc71a2475e6c8c8cb0707", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708104079, "uuid": "5f722fc1-720e-4f7b-b3c4-cdc03d1a58be", "value": "12288:uTjTe9Yd3lrqQLo3iDBnXyH5+P0orR6AZURudpBL:uTvB3lPcKnXE5m0pupL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708104079, "uuid": "0183c7a7-d97a-40f1-af4d-628c5151ce37", "value": 609792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708104079, "uuid": "06187a8a-1748-4da0-9f89-de3f30fc8bbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708104079, "uuid": "8ac68e92-6d25-482c-ab5f-b1fab01af0a4", "value": "down.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e24a5e2-ccdb-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1708095331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708095331, "uuid": "fa61410d-2fe1-45e6-ba66-a2e14ee9e49f", "comment": "Malware payload (AsyncRAT)", "value": "a40ae1798523efc710d6c3f2fb4bf180", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708095331, "uuid": "de793eac-3e8c-45be-920f-980efcfe6641", "comment": "Malware payload (AsyncRAT)", "value": "0eb46efbb0344f6599caaafbde6899f71aa5c8bb0a0586f58541d8de60f663dc", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708095331, "uuid": "f7b096aa-8ea4-4b75-aded-3609903f9da6", "comment": "Malware payload (AsyncRAT)", "value": "4bc040e149f27566508c8fa2d283ac221ca726ed", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708095331, "uuid": "93fb599e-bcf7-4b73-916c-cd1cc5932b43", "comment": "Malware payload (AsyncRAT)", "value": "318d8ea13307074a1a7dcdb900acc4eb51774b57e365ef9550c14885e2cc4ce4ff9c25ae23e346cb5e5c148b80a4c9be", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708095331, "uuid": "462a7345-42a1-40b6-85f2-1ece5caa6b52", "value": "T11A232C103BE8822BF2BE4F78A9F26145857AF1633603D54D1CC452DB5713FC68A52AEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708095331, "uuid": "5c4de7dc-9779-4076-9912-2ff9ce799c50", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708095331, "uuid": "ae432440-5a6b-4d23-96ec-c520903cc5fa", "value": "768:luiZNTgoHzBWUZd9rmo2qrgKjPGaG6PIyzjbFgX3iJ7rfdnuvvPuMivTjgiBDZrx:luiZNTgsr25KTkDy3bCXSJf1uvvjiIcP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708095331, "uuid": "72137435-79db-444b-9d4f-d91a5d321d8e", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708095331, "uuid": "eb5b23dc-1910-472a-bb02-30708f92b950", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708095331, "uuid": "de25871e-02fa-4f54-911d-f1120eee95ef", "value": "a40ae1798523efc710d6c3f2fb4bf180.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b26719cf-ccd1-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708091150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708091150, "uuid": "8e174539-2140-4ecb-ad70-4d33967f4a74", "comment": "Malware payload", "value": "59dbf698726193dae0c000cfe6d4031e", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708091150, "uuid": "f1e2655c-61fb-4b70-9340-05ac1140f849", "comment": "Malware payload", "value": "10fb829a1c7192fab09f6ad210f4d0bd85f19ee97962896f1344231a5f6b2dcd", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708091150, "uuid": "b0c8166b-4f81-4b10-905a-6fa1e99d2708", "comment": "Malware payload", "value": "48034318030331527445c3e6af161bf6a4c8c6a5", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708091150, "uuid": "72836c34-ee00-4e91-abec-8fee315bbeac", "comment": "Malware payload", "value": "806f2402d3487278b4bdabcd72091f86fe6ac855255d74c09a21c4afcae92c65799fcae35331096644279f601c4e7dcc", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708091150, "uuid": "a2ff590c-e297-4139-81a9-bc9fc87f11e9", "value": "T1617701E29B84C85E94FB5937DE92D73AF4461C427697380EC9223A6788F2F74F170258", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708091150, "uuid": "f30329d5-84c2-4ac1-8bf8-b60f127f1215", "value": "786432:etJ+/hP1kS4ZwSDg6FRgsM3sXFCvsGHibiGas6+jT2c:eCMS4LFrM3sXFHxbw+v2c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708091150, "uuid": "f5184475-1e32-4053-b165-12aa2ad3f74f", "value": 32826741, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708091150, "uuid": "b02231a5-efed-45c4-9729-b4f64f459aa5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708091150, "uuid": "931f8d7f-ab0d-49ab-843b-aac75ea648e2", "value": "10fb829a1c7192fab09f6ad210f4d0bd85f19ee97962896f1344231a5f6b2dcd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e98e7864-cc8c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Tsunami)", "timestamp": 1708061608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708061608, "uuid": "aa3f752f-6078-45b8-8777-5d0b3bece2da", "comment": "Malware payload (Tsunami)", "value": "0b9fbbe256da99ceb74e842cd7b52e30", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708061608, "uuid": "a8dab8fc-2856-4078-8fa7-6ca8a3d09c25", "comment": "Malware payload (Tsunami)", "value": "11213be34dc773301961d0328cddf010ae2c430b4d63692ef86515d106ec206e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708061608, "uuid": "e037830c-366d-4261-8099-0da56ea21463", "comment": "Malware payload (Tsunami)", "value": "d4ce846d0eb084d464beb0784dee636cee4d3c68", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708061608, "uuid": "3533b6a6-6292-413b-bd91-357216ceb921", "comment": "Malware payload (Tsunami)", "value": "d1a929edc26bead028c216f9b3424446c3f86b08204117f9309cc98e61781d26b6029da30148bd56e53a84e6cf33644d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708061608, "uuid": "6328374f-5d49-4460-bae8-e4121e66ff91", "value": "T1A2A32AA3FD00EE62F40A9A3A09D707247A30F7770F832975736B39659A752D43826F46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708061608, "uuid": "73dcfac1-59af-4807-8b6b-16226f73fceb", "value": "3072:WKcj9qJ/ClQMPZZpu9OERoCyaMS2WrpMhk/mLUVBCv3QX5W:WN9Z2MPZZpu9OEtyafrpX/mLUVBCv3Qc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708061608, "uuid": "62ffc8ab-d490-48eb-b247-a5bb9d3f4b94", "value": 103297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708061608, "uuid": "0c2f3ffd-895f-45e6-bd12-f1696cea73e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708061608, "uuid": "fa276960-a5a1-4fe2-a2c2-b536cf91e444", "value": "0b9fbbe256da99ceb74e842cd7b52e30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55f1ee35-cd23-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1708126214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708126214, "uuid": "8e8404d2-0d71-40f9-bb63-5e4b528bb61f", "comment": "Malware payload (DCRat)", "value": "b2b94010d5c6822d11c6fc034f0fe2f1", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708126214, "uuid": "a6d03cd2-f1de-4d45-a318-62c25fa0b265", "comment": "Malware payload (DCRat)", "value": "1124b7248acf62c1662354f13a1c07366c93b78abd910cf0bbca9b2a654128b3", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708126214, "uuid": "7176ebb7-b054-4b39-9b3f-2f34e2af2ff3", "comment": "Malware payload (DCRat)", "value": "305c5a8553eaf76ea1598170c8394f63fb90dcdb", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708126214, "uuid": "6ba8af29-70af-43b5-a565-a8a0dbfe882a", "comment": "Malware payload (DCRat)", "value": "a89296afbc6cb134a506ee1f329b8a36d81120c4d36c82db1f2f78582bdffad6b25979b88013e402f856c99fe4c78140", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708126214, "uuid": "e051b60f-ab74-4499-9375-e1073eaba756", "value": "T1B9B5CF0A69974EB3C1E47F3584D7242DC6B2F6227A13DF0B3A5F1095AD07122AB179B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708126214, "uuid": "5b750ac9-b4a5-4a57-bb10-75f55452154e", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708126214, "uuid": "a88e9bb9-d18f-410d-ac37-d29f745d80c3", "value": "49152:IBJBk2Fqgu4dagOSIrmnwNoNk3nlV0HAuGF:y/kYql8tJns3nPMw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708126214, "uuid": "853736bc-83fd-41fe-92fb-03c2a89f844d", "value": 2382661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708126214, "uuid": "e14e7fbe-faab-423f-909c-c1dbe9d8d0cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708126214, "uuid": "dc0cd854-45c1-4417-90cb-7f9c9a5a056c", "value": "B2B94010D5C6822D11C6FC034F0FE2F1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c018ee6a-ccc5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1708086019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086019, "uuid": "cebd726d-ea26-41fa-a4fe-35eef06e5dfb", "comment": "Malware payload (AgentTesla)", "value": "32689e74b5423969e698077670db0967", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086019, "uuid": "0bc34007-c4d6-4252-9732-6c98fd79bf13", "comment": "Malware payload (AgentTesla)", "value": "130236a150ef9a7e59c172fb50d8ce855cf90f0ce8166fb694308b385c3fb239", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086019, "uuid": "97ac52e5-d9d2-4508-a257-d2bc58b45612", "comment": "Malware payload (AgentTesla)", "value": "74184a8c9a2f464e7fea70388768ed2af36e17b1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086019, "uuid": "c6f327f8-3147-4ee6-9d84-ad5993e0bc1b", "comment": "Malware payload (AgentTesla)", "value": "1b8ab5621879d6276bad3b3feb2a9fd90b7ae03d8b15a0002742f87271ef68a8ed25c50c2b94aaed3f2e3669889f8d7e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086019, "uuid": "47524cc8-16b0-4774-9dc4-72f2d349e441", "value": "T1808302C6BBEA049B9B1307BF682D564EB9C3C817F4072F25260E7A1A7D9A3C7891D144", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086019, "uuid": "c856b35c-8ef3-4d9a-a2b2-84e8adb39676", "value": "1536:0hn2gmM04kGdgmr4uGBfXggltImuqvjvKcvQm1:6n3hrSlXgit7uqvjRIm1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708086019, "uuid": "92706bb3-6a56-4ce7-b5ff-ea9f796d3198", "value": 81804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708086019, "uuid": "c9062568-7989-4b29-89d8-73dcb20166d1", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086019, "uuid": "e09488e3-24aa-43ad-bd31-10053066263b", "value": "4323432-3434-04T142248.263.pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d3424cc-cca7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Kaiji)", "timestamp": 1708072942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708072942, "uuid": "5088000b-7d81-4716-b305-78f1c103abb1", "comment": "Malware payload (Kaiji)", "value": "bc52521a7472b02d323cbfd0bd32e988", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708072942, "uuid": "58040cd2-2bd8-4de2-bd95-14d450619488", "comment": "Malware payload (Kaiji)", "value": "13ebd767b180f1e737d0f51992566409ac3a3c3ff6f64d719515a73d08fd4563", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708072942, "uuid": "8c405597-551d-456d-8070-c2bea097c4cc", "comment": "Malware payload (Kaiji)", "value": "a21014685d86bfeeea8a41fc536eddea6a9a6dc3", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708072942, "uuid": "d0a0e033-a123-4cae-8e24-be7cca9e85cf", "comment": "Malware payload (Kaiji)", "value": "b9e8e6648981983622710e0cbf11961efe3cefd3e28acf4870f85b6b4b50e78ad5852e41b7d3106a8478bdebf6a9b071", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708072942, "uuid": "eadff9fe-d3ba-4d8a-ba69-81c1949648a7", "value": "T1CB463903F85195E8D1AAD130CA6282A2BB717C895B3023E33F55F7B82F72BD45A79354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708072942, "uuid": "21024784-92b9-4aae-9164-891c988c36fa", "value": "49152:36YAazFaGdD95S9rb/T0vO90d7HjmAFd4A64nsfJSNi2nYr3miNAbBlrqlTMcN7p:ldvpJYrjAQENL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708072942, "uuid": "84d3a54e-ab47-498e-a10f-9e56f748e8f0", "value": 5398528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708072942, "uuid": "1103a0c2-02b3-4d41-8457-1f12f8eb7882", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708072942, "uuid": "74186b11-38dd-4c07-90ab-0e0c2a95d65e", "value": "bc52521a7472b02d323cbfd0bd32e988", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8c50199-cc9d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708068854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068854, "uuid": "eed6fa56-cc09-4d45-9797-eb4a7bfd32be", "comment": "Malware payload", "value": "eb74240543a7f3bad1a49c3ec9f17253", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068854, "uuid": "283a06a8-e492-4700-b93d-433052c316b4", "comment": "Malware payload", "value": "14c3252d2e705d49b9f9d1551dd0daab874850002108cf69a3487fe89dea5965", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068854, "uuid": "e056b37a-ead3-42f1-8104-7b06e1dcbbc7", "comment": "Malware payload", "value": "5415dab2da4cf57036eba9fe578185c0ac4500e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068854, "uuid": "8c4166cc-d26d-4bc0-b43c-da97770a95ca", "comment": "Malware payload", "value": "e54d8be355a61f7ff70fbdaf3f918963990e0722eb2fdc27905b9e8312e8c86f70461cb87ebac366a89b92f7cfdd3b71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068854, "uuid": "d6c0f07a-6ddd-4fdf-a2d7-15a87f86c371", "value": "T1F1058E02F6D240F7D22D153004BA27B9AB798E430B15CFC79764EE6A5DA31B19E37239", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068854, "uuid": "859574ba-d263-44c2-9dcb-c1706cdf2761", "value": "6144:ztM3Sz4jSBnJ47Qb1n5f0rUl5pTghIJ/TY2Icp0zZS2+aIdpbBVtPR911Bq6rPoY:ztMiz424Ct5f0rw+ayFQaIdD/PR91SAX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708068854, "uuid": "94922b41-e25a-4f9a-b131-4ddbb55b60a8", "value": 812032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708068854, "uuid": "789ac54b-0e28-4f4a-ae27-b2b8ee742d38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068854, "uuid": "feb7014c-d1cc-4b21-b57b-6888385840fe", "value": "SecuriteInfo.com.Win32.Application.PSE.1OV7PVV.25889.16961", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1545c78b-cca8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Glupteba)", "timestamp": 1708073277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708073277, "uuid": "ae80931b-008a-4abe-b4db-51327ee4662a", "comment": "Malware payload (Glupteba)", "value": "1d78752d3e1c99a008e0fe39cc6af493", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708073277, "uuid": "adc8edb5-c187-4930-b21b-399c49ca6d37", "comment": "Malware payload (Glupteba)", "value": "1803f7596ff7888850cef5139e767e036cc4b05036b162561b85c882bc353b22", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708073277, "uuid": "a5187861-2f14-4e38-a5c4-dccc0ba41abc", "comment": "Malware payload (Glupteba)", "value": "610f34ddca72d1730b1b92e25be8919108031d3e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708073277, "uuid": "014e95ed-4e34-4d3b-aff0-63e2434b87ee", "comment": "Malware payload (Glupteba)", "value": "a8137f5a6e6d500915590f99d5dc38c877efa3f461d2467fd108b7cdfb4a5673d4a4619f181a77eb26b8a6f6d3e32358", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708073277, "uuid": "0155d8ee-b534-499e-9e2f-ea0ce73e8559", "value": "T1111633316368D122D01DDA394217DEB0CD7EB8A1306BAA7FD5F19D792F32A61934432E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708073277, "uuid": "ad82f712-2fb1-41b8-9434-96f2d647977c", "value": "06795e7a4243010ba1cddcdd6acb03bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708073277, "uuid": "548702df-e67b-464d-b333-3abfe261e9f2", "value": "98304:7YwFB0Sify/dhCZNMt3bJR8SZOgPvoiD962m:88B0O/dACNR88O0oiJM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708073277, "uuid": "833c377d-dc0f-44d7-b947-afe529f1bebe", "value": 4403576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708073277, "uuid": "5d07f9af-c1f1-4faa-8c39-5424b085b219", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708073277, "uuid": "b98fcb1b-da31-493d-8d8e-4e0781170d7c", "value": "1d78752d3e1c99a008e0fe39cc6af493", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c62e1016-cce7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708100632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708100632, "uuid": "19bbfb72-2318-4c4b-b4e3-1fa0270c50a5", "comment": "Malware payload", "value": "7b33a1c3deb68cfc25352c8a115dc36d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708100632, "uuid": "d1b9a2b8-c923-48f7-8165-d15a28cbf97a", "comment": "Malware payload", "value": "18a72a5f52e9da32098cb60b38a3b07e311428bb379f1f6d438031337f855d95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708100632, "uuid": "ee226db7-fece-411f-86f4-37eb8af6af26", "comment": "Malware payload", "value": "84423e34be5662534893f9726435e93ecc9f04ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708100632, "uuid": "f9bdad1f-d484-4c7a-8536-2f18dc3b44e1", "comment": "Malware payload", "value": "240a530bb4170e2b743fc9b112b208cf761c1b9f4a0924ba98ff3582e8089f8b1bed3f9bac9d3f0778d5b01d86a75512", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708100632, "uuid": "52dc6240-a97e-4e45-a6fb-364103734cf4", "value": "T1CE245B167090D833F70529BB046E8B534BFDF533E6766AB70319C7381B2818E4B56EA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708100632, "uuid": "b3c5d549-2a39-4028-a291-44d9096b797d", "value": "e1ed1b87d365b2ea75670bba09649dc7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708100632, "uuid": "8a27c854-4b8f-4723-93f1-49fe8d2506b8", "value": "6144:B5EOb38QS2/Z1bqhbA30cZqRcV6U3bIN03UNp:B5EOICLT3QkXUNp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708100632, "uuid": "351b93c9-ffde-4396-b224-2451bd3cc1fe", "value": 227288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708100632, "uuid": "2554a4ea-655d-4d63-8188-85f325850208", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708100632, "uuid": "44377342-77f8-4252-8954-f691d482d6dd", "value": "service.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b603f144-cc9d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708068823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068823, "uuid": "9dd4bc9c-b4d0-47a3-aa55-4ae17dee252f", "comment": "Malware payload", "value": "be5d7e752fb3013cbdf9389ec923e543", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068823, "uuid": "0f7adc0e-3b36-4201-a3b7-854433256c92", "comment": "Malware payload", "value": "18c4a61da492996f13f3ce613755d9e44e19c327806a7fcc46e1d4464fc4aef8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068823, "uuid": "98afd3b0-75bc-4124-b0bb-d319566e708d", "comment": "Malware payload", "value": "1da222f1ded6c8474a7d6b2fd9492b799dddfe8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068823, "uuid": "016207e7-f733-4552-9c66-e48034cb1f34", "comment": "Malware payload", "value": "ec1da6babffc31b0662999fe618769cfba043929405a2d5cd3c1f78c30f868ba7ee9fb9bce5bb8ac19a992407ec4f854", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068823, "uuid": "73a34d65-4834-4ebd-ab08-b4198d763d4c", "value": "T16404B62EFFF9C63AC0BC457388B38AA8AA63F9135C5286471694671D1CFD3446F220B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068823, "uuid": "37949881-c611-49e8-9202-0c5d25284aad", "value": "c28b77a2bc6d035202e1d96d050db252", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068823, "uuid": "51507dc8-2683-4c0a-a291-4e5fcda8cd21", "value": "1536:h409FktapZHCF09uVv0+VS7MxuNmmCw1EcBAoFLN9dYG55REVmS+G9OeERw7YwZl:h40IapZH9uVv0nDNmmC6io/7EN2w8Ql", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708068823, "uuid": "35b83499-2312-40cb-a95d-5c5a172dddf2", "value": 186935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708068823, "uuid": "4697fc0e-2d0a-49cc-a89d-fdcbf37d321b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068823, "uuid": "c8c38f9b-760b-4215-9b57-5162d13f7b1a", "value": "SecuriteInfo.com.Trojan.Win32.Sasfis.15005.13171", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6813b69f-ccf2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1708105199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708105199, "uuid": "6c5b1a7b-fc0d-4ca8-b47c-cf6ecfbb7824", "comment": "Malware payload (CoinMiner)", "value": "3321a47b3598da49cb08511e82c78564", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708105199, "uuid": "b078966b-84eb-4afc-bcc1-e6e3ae16e01a", "comment": "Malware payload (CoinMiner)", "value": "1a109ca6aee6428139ceae15eef29fab8d1959d4c71fca54076c590097b53eb5", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708105199, "uuid": "815fced5-1004-4784-b472-7f046adae1da", "comment": "Malware payload (CoinMiner)", "value": "1885a9b903ccc05fa5277fef40c0ff770ab41f09", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708105199, "uuid": "de6a8cf9-287c-4735-8da2-90f4068168ee", "comment": "Malware payload (CoinMiner)", "value": "0d9d0df73b2d77c06bd787326bcbf4a3bf7d3f5870d486cfdc338da320a44436d6ddc0822fb1c2a4f6315fa59dc2e442", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708105199, "uuid": "8f2c2ff2-8b45-40b1-b6eb-e362332cca6a", "value": "T1BD969D55B6A100E4D8BBC53C8A0BA617F7B2B81543B0ABDF17B442A61F173E15E3EB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708105199, "uuid": "4fa6143d-b4d4-49c1-b7d0-784a86e93651", "value": "761a03f9b880fa5c29060a36ea73e9fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708105199, "uuid": "dbf047b2-8c09-4589-9d05-278b05d07d1b", "value": "98304:fytTZp3dw1WZMREb5FLnFqC3M5fMpd/O6Qnqfsqwc/iNhz3Vv/p:fyViC3oMpdG6QqfrwcanrV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708105199, "uuid": "2607735a-7068-4d12-a8e2-e05c79cbe388", "value": 8650752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708105199, "uuid": "a6cadbe9-9fb1-41de-a42f-21c381f2576a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708105199, "uuid": "480f48a0-3445-45bf-b088-cb3a5299208d", "value": "1400000002.conhost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "639f37d6-ccc6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1708086294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086294, "uuid": "2731ec81-de72-403a-ae4c-b079ca59edb4", "comment": "Malware payload (Formbook)", "value": "2c211872e28f8cdee5cd3cf7303202c2", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086294, "uuid": "f41c6c36-d811-4dab-a972-13c5cf75f2e0", "comment": "Malware payload (Formbook)", "value": "1b1f97279cf2908be5f7f576dac2e2eb7a657eafac602e4bdc1367d94b69e7cc", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086294, "uuid": "876be01c-2c06-43bf-b749-c730a899bc0f", "comment": "Malware payload (Formbook)", "value": "024cd38efc853f28648235dbef054b4f0df59fa3", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086294, "uuid": "fc917c32-51f9-4e52-b4db-2a8631658993", "comment": "Malware payload (Formbook)", "value": "fda665d32826ce98f5ce46a13f975ede0ab3a9aaba176cd5b081770e6997362931c8a7e2f22089b9aa04c5004ca2ee7c", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086294, "uuid": "dc41b45c-cc71-4e96-aa09-21cd55506109", "value": "T1C1F4231B382A9B75CABCC7F19CF7501517789E1A8609E7662C89F1DB1AE370183B610F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086294, "uuid": "34234288-f0ee-4fac-b695-23798ca2f0b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086294, "uuid": "cd3eceed-5177-41c8-a38b-12725964ce09", "value": "12288:xoQ4W3UwxZj7+eJ26ssY50hiVgpxGET/vxFYFCDUr0Q2a3FuNHPEc8/KGl:+AUYv+FKIgfvxOCQr0Q2eFuFPx8/KGl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708086294, "uuid": "439a1bc4-8829-4394-a13a-ea4d799bebbb", "value": 726528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708086294, "uuid": "1e29994e-602f-407d-ab11-e375e3bc93ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086294, "uuid": "35a1669d-91ec-47dc-803b-5aa11c667402", "value": "DHL_AWB#6209811980.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b30bc88-cc8f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708062604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708062604, "uuid": "ed3237bf-6373-4280-aa1e-5a9e365f1550", "comment": "Malware payload (Mirai)", "value": "f5df2c195bd77c9682f5a9e1a746eea6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708062604, "uuid": "ae8dc963-7fdd-4bab-9d8f-f9431dd7e89c", "comment": "Malware payload (Mirai)", "value": "1b677dc7c5eaaca29f84c5f6d8e3d65f7be5c705c7efbe2e9ceafeadb1730d52", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708062604, "uuid": "6643bbdf-bf15-4114-b37d-83783911e0da", "comment": "Malware payload (Mirai)", "value": "54f199b9068d77fc1eb54ac16d1956316aebe422", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708062604, "uuid": "2c4e927b-5c6e-4ad7-bd8d-c744858adfcd", "comment": "Malware payload (Mirai)", "value": "58f91038995ad1e820eeef6b23f74d7efd422d4c47a7975bdcec8f2a4951f1d90415f53cbce5587da9dca56afb0cfee4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708062604, "uuid": "e3ec2c00-dc1d-4773-be85-b929469b5a8e", "value": "T135E35E56FA404B13C4D51779B6AF42453322A7A4E3DB730699285FB43F87B9F0E23A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708062604, "uuid": "f4cee298-f432-44f9-ad5b-b0d8e0c19f36", "value": "3072:atP5jHwaVnoo/6wLU03ZfFrgc7Yd/ak4iXD/oM/9s+HBmNwaCST3:UhjHwaVogHLUsZfFrgccdPlXDAM/9rHU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708062604, "uuid": "ffb16c0a-bee6-4542-bba5-0fb5225b8f5a", "value": 144845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708062604, "uuid": "f89235e2-886b-42d1-9a52-3e7001a2d2ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708062604, "uuid": "5e5e0928-0b37-4919-9c84-7bb9fde4009c", "value": "RpcSecurity.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff84a732-ccc5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1708086126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086126, "uuid": "23bb2066-60fe-435a-8ba7-710e9cb2a8af", "comment": "Malware payload (GuLoader)", "value": "42eb3ffc480c771bb24917612e26d96e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086126, "uuid": "b294f441-f236-4a13-b607-6cc706daad0b", "comment": "Malware payload (GuLoader)", "value": "1d6d6ae038198c8de4498cba958615fef3f5598f866aa94516287d204b341b95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086126, "uuid": "5166441f-4d1d-4793-afdc-fefb9bd8d867", "comment": "Malware payload (GuLoader)", "value": "87053bd4b7cf1647130e508baa73b3cab9abc3a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086126, "uuid": "3b923d74-e318-4331-b4b7-3249ec41cb0a", "comment": "Malware payload (GuLoader)", "value": "cdee199c59b8390645e99682205e8d3d7a0e4f3f600bfe10e4d831c6d078bd0c19107a2660822ac1e0778e2b1a4ac63d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086126, "uuid": "1c8711af-d1f6-46b9-a20c-5567d2d5c9fa", "value": "T1A5F412112BA4CC07EB96523441B1F3795F30EFA8291BCB135AFA3DAF7766B996C24101", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086126, "uuid": "d6243820-b748-41ee-8046-9acb38dc523e", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086126, "uuid": "28075262-e4f5-42b1-84c0-a5d298675272", "value": "12288:FcgyoAFj5VqLjbfYJmWiIRutXv+DGIFxifyvYMaQyLi6R/LohEdIxL33vfGE:FSXEf6iIRut2JiqvYML3eU33HGE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708086126, "uuid": "c2314e1c-c1ca-481c-b95a-1c72149a608d", "value": 729600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708086126, "uuid": "a41f4755-7b22-43b0-a9ec-80ea2f98808a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086126, "uuid": "7fbb6439-561a-4b30-93b8-c24b0c758690", "value": "Ziraat Bankasi Swift Mesaji.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c888caf4-ccfd-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1708110085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708110085, "uuid": "4bc3f8a2-e3dc-4680-b99d-661d4211ee3b", "comment": "Malware payload (AsyncRAT)", "value": "ef49632625eba89042cf069a2da26fb0", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708110085, "uuid": "abdf9ea6-6e69-4fc4-bf40-e97d8bb3a055", "comment": "Malware payload (AsyncRAT)", "value": "1dd1eb8191ca6cc009dbad0da4420945953452baf46e4ce11b3d815c955d518c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708110085, "uuid": "2bc3d482-cffd-4547-9c40-d96c12fd72e5", "comment": "Malware payload (AsyncRAT)", "value": "5ce88a6a9a5de7421d6d30c41e000e3a6c139bed", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708110085, "uuid": "d1c5f72b-66e9-43be-8b2d-94096d6e9523", "comment": "Malware payload (AsyncRAT)", "value": "fdb4568aa8797968503b4db9e769b10c7ca7541668b6be75eee709443568c949521a052dac78976b050bc8b5bfde3a0b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708110085, "uuid": "db759dc7-2114-4d3e-9eeb-5f66f4069cd1", "value": "T13A6318053BE98129F3BE8F7469F6668546F9F5AF2D02C55D1C8800CE0632BC29941BBF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708110085, "uuid": "6cbed978-0093-444c-a4e2-3b667a69ce14", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708110085, "uuid": "3a33f1e9-fc10-4b51-b43e-541dcdb148db", "value": "1536:Q2wukvF1ak9gcKu5UYF2fK+B5bQj+UkcwUsJ38XrmTGnx:Q2dkvF1ak9Ku5UYF2t5bQBo8XEwx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708110085, "uuid": "be30f95a-c0b4-4e6b-9ea2-90304647c25c", "value": 67584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708110085, "uuid": "f57dd761-d933-435f-b9e7-e44fffe98bec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708110085, "uuid": "e6b3ff43-8d67-4b62-b3c5-5a3855c1aee6", "value": "f60000.jsc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0a3d5a2-cc63-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1708043876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708043876, "uuid": "ea1c0785-5839-432f-994f-7a2ad3217572", "comment": "Malware payload (Amadey)", "value": "97256cf11c9109c24fde65395fef1306", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708043876, "uuid": "e410abd9-a8eb-41f6-98d5-c82c0fa3441d", "comment": "Malware payload (Amadey)", "value": "21c23083404349dbc8e7094338acaa07ea5a7e3a442bb81a528e06c175b8d934", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708043876, "uuid": "0249dba5-563a-48a7-9b9b-c4b0296ee883", "comment": "Malware payload (Amadey)", "value": "e60278d8383912f03f25e3f92bf558e2a33f229d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708043876, "uuid": "1b7d7ba3-cce0-4120-8575-fda13a6dfae4", "comment": "Malware payload (Amadey)", "value": "58ad2e8757e332dad0a70b6398a4c3acd40af20e142d16027064de7384433fbae52e84528d4144617914fab226367f0d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708043876, "uuid": "0b24f96a-5c8e-481b-ad7d-ce56db3b031f", "value": "T1F195E13BE163627DC92B34B1F80B16FCBF58FC335A2D18753689264B48E14B8A5B9435", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708043876, "uuid": "26191d76-461e-4450-9d6a-9c654de5fd00", "value": "30ca3ef40f58b346fdf8b0c3248813a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708043876, "uuid": "e6346df3-613d-4467-9951-ecfdc87712ee", "value": "24576:rGpVQOAoqyDshVag6Vu4luUR/oF1av5H/BNMVMmFTMqITdpE4bTJ5/kOG01N74:rBoqyDBVZAoCyQzITdpBvJ5U01K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708043876, "uuid": "3e3136cc-dc3e-4aef-b94c-af4375d3ff8a", "value": 1930056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708043876, "uuid": "2cc916c6-1582-420a-85c9-614b48016b50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708043876, "uuid": "5676efc5-ce8c-4eaf-9cfb-1e26b87d1f55", "value": "97256cf11c9109c24fde65395fef1306", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a83785c-cca6-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708072642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708072642, "uuid": "07133d48-f76b-4990-bb9f-95d0b64e6678", "comment": "Malware payload", "value": "4e38f9b7252fb373629fc6c0d1faef87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708072642, "uuid": "236d7325-ba4e-4a49-bc63-e536b650ab92", "comment": "Malware payload", "value": "21c33aff99fa8b58b6741b594d1cb778fd5b39110354c15319298c8b20d06330", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708072642, "uuid": "ea8f327c-50a1-4eca-a0f4-8d7048b307c9", "comment": "Malware payload", "value": "629057da970aa13eb710f909c7a7cce302ca2907", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708072642, "uuid": "08426fbd-43bc-4bfc-81c1-62bebc375c2c", "comment": "Malware payload", "value": "a34b90e607ed6049c19ccaa702e61a3f2f190eb1b0e08440e65737bb0be2e260d55b63bb56ba2326231f55b6eaee6eac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708072642, "uuid": "36e730b9-ac7f-4c38-9197-680a51573c3a", "value": "T1B4F3F12337282E20DAEA97B1A8F1C551577BF0AADD3B8F8F1145121A7F42F914E17B12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708072642, "uuid": "ee67e468-96fb-4a45-a948-8cd93d735116", "value": "3072:x8gFgA1n5g+PGzbNlbn0+NChClr3vEjqXFboH3vuNRyyVvRGp13AHqTgyjq2r:xzFHLAjLvmuj7VasqlP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708072642, "uuid": "ceeed924-b8c4-4d52-b324-43ad4dd4b204", "value": 168960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708072642, "uuid": "6f88493a-506c-425e-974d-61799da35a05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708072642, "uuid": "25605d43-6993-49a1-b328-5d3794f0ea60", "value": "SecuriteInfo.com.Win64.TrojanX-gen.11414.2761", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55acf490-ccc6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1708086270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086270, "uuid": "a179f91c-7552-498c-bbe9-004f53deca11", "comment": "Malware payload (AgentTesla)", "value": "277ef3feebea0ed6ce7d03c0737d2aaf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086270, "uuid": "7c85c012-7a9c-46cd-b279-6a149b4e3110", "comment": "Malware payload (AgentTesla)", "value": "22b2daef8e8806a91e0c408f7d00ff1fa1e8bf902af3e0975a621d076cd60f28", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086270, "uuid": "4979fde7-e454-4553-936b-0c2ea405bc3c", "comment": "Malware payload (AgentTesla)", "value": "e9062099ab73362e6a26645cb3db9a0d6175eb18", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086270, "uuid": "78c5db2f-ab26-475a-87e5-822c03975730", "comment": "Malware payload (AgentTesla)", "value": "44801a7e1da1672936d6edf6e08c4a52775776c4ec0e25e6eb7d7374282a04f5811233c2c6f340736aa8a65ee39d719d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086270, "uuid": "44af25d4-cd7f-45f8-8f19-b5e02efdb7ed", "value": "T13CE42316527CA731D86857F5C063392C13711E2F5773EFE53E8992EA2A63B04835A307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086270, "uuid": "6dc7bfd9-5c60-4bc1-b675-bccda050ce0b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086270, "uuid": "2a833f62-fece-4ac3-ba6e-b271ffe8ccf0", "value": "12288:adQ4W38+OQTWnco2p7z7CF15Mjzu6zumeHfDlh8SrJbOIVtgSxjmUB9eQc3bLLOq:KA7yncou7zC5wu6zumsfxJrVg4hB/c32", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708086270, "uuid": "2b804524-b1b2-47cb-b149-e83e02c525eb", "value": 692736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708086270, "uuid": "4c963f82-4f98-44d4-a482-063d382f314f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086270, "uuid": "ca89b9f0-391d-483a-8eef-37de0f2662e9", "value": "Scan Copy_xlsx.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65e8001f-cd01-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AZORult)", "timestamp": 1708111638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708111638, "uuid": "260b7f4f-7ea6-4cfe-8a60-a0c207917dc9", "comment": "Malware payload (AZORult)", "value": "ec88a4c1dcfb3861f6c9c364deeabd94", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708111638, "uuid": "fe39a345-87b7-479f-b923-fe77b325653a", "comment": "Malware payload (AZORult)", "value": "23722503bdcc20ab9e6482bb2d3e92e50b13443799f361975bb36a91f0eeb895", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708111638, "uuid": "1d838fde-e641-401d-987c-5450dd907332", "comment": "Malware payload (AZORult)", "value": "ed0d81e041345ddc9ff9fea8bad197ee1a66fe82", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708111638, "uuid": "c737537c-6a33-49ae-aa12-36d4e7b7cf52", "comment": "Malware payload (AZORult)", "value": "5fe7bbd1a0fd22e15db51bae6faf92d369d54f29408252d4da84080d745dda3dade32aa1f3df9241265e311ddda78e77", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708111638, "uuid": "9ecc7170-df8b-4e9d-b756-f308f93430e5", "value": "T1C1F4133C5B4CD723C7F8267EE0D801D10BB5A76BA252E7C8588479A15ED3B6026932DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708111638, "uuid": "da754f1d-4aa5-4db8-a8d1-14eb0021abf6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708111638, "uuid": "467dbb8a-ca9e-481e-a5ad-028396b0c9e1", "value": "12288:rtHCL6YFXDk8fwYXzlRLf3AM+lsEttF2s9NgztG2Qk/sxJhT:xHq6Y5hRLsGEvF2sOtGkIh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708111638, "uuid": "c406865d-8a5c-42f4-b1f7-ae3bad125c92", "value": 734208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708111638, "uuid": "24147123-7eeb-43b0-bf95-18873ab76b54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708111638, "uuid": "40e6f2a8-bbed-4b05-ae50-15646fe02da0", "value": "Iz{$_owt)[.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95fc3627-cca6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SystemBC)", "timestamp": 1708072634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708072634, "uuid": "e499739b-7472-4ca2-aeb9-e180ed63fee1", "comment": "Malware payload (SystemBC)", "value": "ee6d312ae99e8a03ef00a28b09bf2471", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708072634, "uuid": "cbd68bc9-f95d-4be3-aa46-4bf572ddf5f3", "comment": "Malware payload (SystemBC)", "value": "283c4f9174d19944189f5d6961f3319420c752bfaa6f65c19dd85ad2ca1cd77f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708072634, "uuid": "83a36050-e94b-4fe6-b8be-69bbbaddbe26", "comment": "Malware payload (SystemBC)", "value": "52cb11288e48a2335866f77059733feeab6d4c86", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708072634, "uuid": "be953651-9eb3-471b-83a4-f7ccd529fd66", "comment": "Malware payload (SystemBC)", "value": "828df44f8c8673270f86df27ae6362a0ce3d3b586faf6f75ecd1d4792b984c2cb1f91c1cab976b42f57d010e9bc89e49", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708072634, "uuid": "4eb79ef9-1818-4cf5-8f24-b02e358070b9", "value": "T166521A577C108892C653C57E728E5725D67BB7B3A370C026DFB08C607B71BA39B59009", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708072634, "uuid": "255aef3a-52f8-49fa-a05a-a96c712d2e39", "value": "d66000edfed0a9938162b2b453ffa516", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708072634, "uuid": "e3ee724c-e960-4c30-802f-59bed64938a4", "value": "192:FxfzqMmTL+f6eeAY82mNZRZ1eLP/x1f1NvFCDkoiTFDWpHiJqutRo3YFa2:FxGMmv+f6eX22RZ0LXTNN0koODGiJnRR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708072634, "uuid": "e970bc08-3de5-45e6-97d7-456bf7a9abe2", "value": 14144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708072634, "uuid": "c40d46fd-7118-40a4-8c9d-f39485008351", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708072634, "uuid": "b6433ac0-e2a5-434e-8b1e-09bec49ff2b3", "value": "ee6d312ae99e8a03ef00a28b09bf2471", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd50c8c0-cc88-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1708059923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708059923, "uuid": "8824e25a-e675-45ad-8002-815fdac7ceb5", "comment": "Malware payload (DCRat)", "value": "030625e0dbb698131c8a37898748dee4", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708059923, "uuid": "3d9a88b4-e01d-43fb-ad56-51acf52cd969", "comment": "Malware payload (DCRat)", "value": "284f083103d1c160d9e4721ecce515646ce451a1b7ddf9dd89817904e21a4a2d", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708059923, "uuid": "d02f54b1-6884-4d8a-a736-10561fffbefe", "comment": "Malware payload (DCRat)", "value": "6cf3ca2cdc2266204ef55991e8b94fc04105d9c6", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708059923, "uuid": "29b273cd-7fdb-44a7-81ee-97fae9a07201", "comment": "Malware payload (DCRat)", "value": "425f07d414e510362bf790933ba6c16971fc8ea3a9d7deb108c7cde695e71b4aaf3274cb03451b0540be375fd334484d", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708059923, "uuid": "b02f6dd6-4592-474c-8612-b9eb8c4ae647", "value": "T1E88633B07B265457D1301F3821D8E7FCE6539CAEB66EB2AC8DAC1CF7742356521A806C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708059923, "uuid": "60d5bde4-ffde-495c-89e0-96b31e3cf1cf", "value": "d5d9d937853db8b666bd4b525813d7bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708059923, "uuid": "aadad2a1-8f08-4bde-9a57-e5c18b0e90f9", "value": "196608:oTUXMo6Sm+lYLkgT3pQ9N/uWwtRLemyTKUglVf4mCu:oVolliggT3pQXWW6RLmTKpbN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708059923, "uuid": "4a2782a7-9e76-4595-a99c-935ca73c19aa", "value": 8495616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708059923, "uuid": "915df2ad-3811-4d49-a66e-f46a0ccf150a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708059923, "uuid": "ababe79a-0cbf-4d84-945b-5bbeb1e0aee4", "value": "030625e0dbb698131c8a37898748dee4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba51e6d9-ccc5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1708086010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086010, "uuid": "bfeb4ace-073c-4ee7-84af-f7d0045c13b0", "comment": "Malware payload (AgentTesla)", "value": "6bb62f3bbde9bbeb24a7234e24758651", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086010, "uuid": "554236d3-00d8-4615-b711-51070cfa670b", "comment": "Malware payload (AgentTesla)", "value": "28a68194f8ebd811ed384c4d11aae353b433135de4bbaf9c6535d4b87b33c5c9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086010, "uuid": "7116d804-c3e4-48ef-a31b-3d6ab2c5e995", "comment": "Malware payload (AgentTesla)", "value": "762ea7a7b64d4129cb755870eb57b34c651e96f6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086010, "uuid": "9cb9a6a8-d2d6-4e10-a598-4ced33f3d562", "comment": "Malware payload (AgentTesla)", "value": "35413b66aa06aa666cf155f422e42349a9f67cd646957ada1a8b8f6641c6aba69d594d5e2598f02847b5108a8dfc640c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086010, "uuid": "f0dece40-74c6-42e5-84b3-5b86bdc10c3d", "value": "T1E4F4238E8EAAD248E7F41E75DB71A57C0A0EB31D1F673F6338BE1A186601448470DAF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086010, "uuid": "b68a8520-2003-46e8-b598-0edd788c31e0", "value": "12288:lpnWh31+qJQ28sum4F7XUxAFEP43mbT3ARhHq2fJB05hvja+izyDQW7HlTR7:vc+qC28xXFlF66vqygjaLzycOHJB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708086010, "uuid": "30c45896-37f3-4ffe-95e0-26aa9e181d0f", "value": 744930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708086010, "uuid": "bd04ebc7-188c-4ee4-aa6c-2b30f13590cb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086010, "uuid": "495a44ec-2652-4310-85ef-66b35110b30b", "value": "Reservation Book-list.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41b1285f-ccc6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1708086237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086237, "uuid": "01d218e1-cc81-41d1-9b3c-f8880a576703", "comment": "Malware payload (Formbook)", "value": "ac8ab67bb666db685f5ab64a4f4d7e38", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086237, "uuid": "bab7ca87-c74e-411c-8fc1-588dbb2cd7c4", "comment": "Malware payload (Formbook)", "value": "2a0597aec4b365dd5793a428f24d44996565c875ce34adf6a59ccd98c8c27562", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086237, "uuid": "7d578033-3953-4384-9f4d-81a0992b0d39", "comment": "Malware payload (Formbook)", "value": "a2f2560a7de36b5b6abf4d2ea3b91a09dab77a2b", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086237, "uuid": "c96e845f-10db-4aa3-8cf3-b8b6b935a8a6", "comment": "Malware payload (Formbook)", "value": "6a5a48864f63431d575f02e54d5ac1b03161ea6e85ed6d7167b2928018ae9551e2e06ae045e45e0d5ca203ebc39a7736", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086237, "uuid": "bcf7274b-2a7c-4e78-a3a0-a777b2b9bf5c", "value": "T19AF4234A76BC2BB4C17D8B7B9CF279241739B9064C75E58D2E48A0C71EF372A070264B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086237, "uuid": "a6b5ed02-3deb-43bd-ba42-d55079fd3c12", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086237, "uuid": "12a16af2-5763-4d86-9a11-99f67a44f4c5", "value": "12288:5KQ4W3DhV/CfF/F2c77J0B9JDe3xV02P3Sr8hHcjbWID/vd6CZoIiG9zX6bsM:8AtV6f9Ac77K3JKo0BOrD/ECZoAzKbsM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708086237, "uuid": "73ff41db-20c7-4f9d-90a4-bd7c0300193e", "value": 728064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708086237, "uuid": "9056dd54-97b7-4383-98cc-8b6e8cc05c5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086237, "uuid": "53bade48-5fff-4911-ad63-944dd86b9fb4", "value": "DHL Shipping DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eee747b6-ccc9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1708087816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708087816, "uuid": "050afbe8-7059-4d6d-8fd1-a8fd62c6c04d", "comment": "Malware payload (AsyncRAT)", "value": "170ed51ddb22cd75bf0fa4fa2a1bb6c4", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708087816, "uuid": "93072641-6321-4ef2-b1eb-a52d0dfc6848", "comment": "Malware payload (AsyncRAT)", "value": "2de5faa16c405e6a3bc14b9d31a82cc389290066b36ed8f0d99d7cd53b1b1d1d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708087816, "uuid": "86ce4cd2-78c4-4291-b56c-61f0066ecf24", "comment": "Malware payload (AsyncRAT)", "value": "2e74fd6be27a77a883208db0d09524f15dfa7d00", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708087816, "uuid": "d3aee75f-ccc8-4a2f-9ba5-136f4db7c148", "comment": "Malware payload (AsyncRAT)", "value": "121a902018e6383e1757c534c0f9d039da9b080b8ec9192bec3d0ebd0bb75c2832bef673f05151f75e35795f79f55846", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708087816, "uuid": "44c18879-f83e-43e0-aa88-063875f4faaa", "value": "T131E4BF823149DCDBE40728F258AFD46012B87D9F9161C64D3B83BB2B95E7352249B78F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708087816, "uuid": "669907d2-1b46-4065-b58b-a0d017694c05", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708087816, "uuid": "eba20cf2-e656-4c78-b552-aed0edc44e8b", "value": "12288:ijWQ4W3K9jGCN0TPsnAH7UA51BlkOUCIV/VKMSiyyjK:7AK96jXQA51BCObIVNKMd8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708087816, "uuid": "e3a42efc-9830-42ee-9ef3-92caaad0f6d4", "value": 695296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708087816, "uuid": "3d72fa1d-df90-40e3-9bdc-b86eff857a25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708087816, "uuid": "54d627a2-cd6b-4b04-8305-abcd060376b6", "value": "rNewOrder.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5277f307-ccde-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708096573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708096573, "uuid": "c9f58a6d-176f-4b6f-9317-c35f657a4adf", "comment": "Malware payload", "value": "92dc74d595bee0b58e932215c3b09a9c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708096573, "uuid": "9007dded-4387-4812-a033-4ae9dc75acfc", "comment": "Malware payload", "value": "2e5cce985d72f0e62d64a08c7aef7fd32c8ad12655985a22d7c720b54d06d884", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708096573, "uuid": "48d50591-5b46-45f9-aa25-dad929084a9a", "comment": "Malware payload", "value": "0a4b2e7d51aea8e8dccf27ae84519b6306972170", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708096573, "uuid": "39528d03-1b0e-4e82-bf3c-763901a114df", "comment": "Malware payload", "value": "f20564596503d2aba7a36ff0ec12bab48b7188559d0665521972bb37cd8a0a7421e36e2728075f471074951f3996cc75", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708096573, "uuid": "d3476e6b-3dd6-43a5-b5d4-e9086075d1db", "value": "T1CBF6D984B7C5B0E36311AB63DB5371B2EB97BC8F1545A42FD447381896AD27AC8C34B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708096573, "uuid": "18adf5d9-b5ab-4575-ba4e-086746cdc5d6", "value": "24576:Mju80czfTzeruPHCoRDgq2IIy9k/m9PThSl6n19snTAvZFc+0o4XOrOLxyV5Gg3r:M4qEk7pYkC3jUvVNWhaPe6GjHrnA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708096573, "uuid": "fc88187d-041b-4139-bdce-f288df0ed926", "value": 15682563, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708096573, "uuid": "a4da6762-d45b-4136-ba8b-86a01c2b145e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708096573, "uuid": "5f870d72-3823-4dcc-a714-ea9643abb229", "value": "legend_produce0217ap.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "503529ff-cca2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708070799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708070799, "uuid": "e39782d1-6b9c-435e-a7b3-51d25b4505c5", "comment": "Malware payload (Mirai)", "value": "1b98d0c712a5ab5f166e192bfc2a0213", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708070799, "uuid": "eb0aaf97-e9bb-43d4-8c7c-254469dc534f", "comment": "Malware payload (Mirai)", "value": "3100e86d661a795f774b010eb34d232406e78dc94500c8be1508a434696bcb88", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708070799, "uuid": "bce1a1e4-8f98-48e9-b8da-ec78889a5a23", "comment": "Malware payload (Mirai)", "value": "3f077b65de43252670058199916e935ee89b4310", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708070799, "uuid": "98b421eb-33f6-4c39-9b23-7bbe45125913", "comment": "Malware payload (Mirai)", "value": "586c9604fa5b968b63a4741f24a76ebf0e99c5eb3d52ad420581df2cae11fa0133a1c16397ff43b839e5a56fe0868048", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708070799, "uuid": "0de6be27-aba3-4be8-8675-aae855e8f3cd", "value": "T1DBD31945F8905B23C6C212BBFB5E428D372A17A9D3EE72039D216F25378A85B0E37546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708070799, "uuid": "559923ce-ca0f-4183-8a95-03f7a750ca0f", "value": "3072:NplIge0UwEnn3Pj011qPoc38/24iOiHcRPaxmbK0TRDCYDeA:NppEnwqv4igRPaYm0tDC+e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708070799, "uuid": "03e71570-e7cd-44e1-b9df-4b3b93abf743", "value": 142176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708070799, "uuid": "a509abf9-ed54-4754-84de-0756e086a0c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708070799, "uuid": "c02cdb9c-dccd-4cf6-90e7-605ecc5fbd69", "value": "huhu.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d6c29d8-ccc6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1708086283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086283, "uuid": "f30465ea-3600-4556-a23b-93d11c7a61d7", "comment": "Malware payload (Formbook)", "value": "6c48969a6649ad4204b63171be98a93b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086283, "uuid": "202fba31-a07e-484a-8418-bb80c17aa0c4", "comment": "Malware payload (Formbook)", "value": "31524f39434c3244675e67dfe4e81a70229e86d5ac09bf4a425102e1b2300615", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086283, "uuid": "2aca5968-bcb2-44a5-b202-d683f4dcadd6", "comment": "Malware payload (Formbook)", "value": "1636e18e9b1307ddd733a114e732b755f7b324cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086283, "uuid": "18477da6-a6f7-4908-9c62-8dc55acac720", "comment": "Malware payload (Formbook)", "value": "e53374dfcac313e47871fbc860d3a24c2efae1b328dfcf16051a8efc26bb095f61bf83b5f329c88529a02a79952d7d3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086283, "uuid": "4d9ce780-ae92-45d1-9bca-293674c9d4d2", "value": "T18035BF5FE68380BDC9E22E70DD7AB3D9962965E60222C1972BCD1921DDD00F13B3572B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086283, "uuid": "8c2505ab-5dc1-4a98-97e5-4bf9282dac30", "value": "d3bf8a7746a8d1ee8f6e5960c3f69378", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086283, "uuid": "b0cdfd9d-9fbf-45de-ad51-670bd819d394", "value": "24576:pRmJkcoQricOIQxiZY1iaMav1UD6ozfEHgeM0:mJZoQrbTFZY1iaM41UuogDM0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708086283, "uuid": "95c8ed3e-a1f6-4de8-b726-5822b29f704a", "value": 1061161, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708086283, "uuid": "5c0ed04b-d505-4605-9b4a-d4a2f4a42970", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086283, "uuid": "a987a7e2-a86a-47c2-9f2a-9cabb3158b8e", "value": "zbe - dekont 2024 - 02-16F114Ft.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a42a6b10-cce7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708100575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708100575, "uuid": "d57b991d-cfdb-4799-a78f-0edeb9788857", "comment": "Malware payload", "value": "ea784962101f935766520624005e2e56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708100575, "uuid": "eef26090-ade5-47a2-bfbb-96b63f60f916", "comment": "Malware payload", "value": "3510e5bb936dc2555fca73cb080d004c263d2a350b639f96159aec15967d3823", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708100575, "uuid": "c40d330b-af5b-4b16-9431-0d06ec140e65", "comment": "Malware payload", "value": "ebf1458b7b0b7eee92f176fc5fa861b2b606fef5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708100575, "uuid": "bcce0f88-fbb0-4a86-86d3-65febf45ec31", "comment": "Malware payload", "value": "16c2d1523bc8dbe241faa3014388fa0129064d2090a2bf1d32927eaaa9d07e6d37dde394a1dcf27fb0b5a9f4035bfd35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708100575, "uuid": "531e7ce7-c577-4edd-8df3-618c8d1f44e2", "value": "T150452311ABC549BBE0F833B066E9139316BCFCA4672953BF928404DC68719D1A27937F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708100575, "uuid": "3c780878-1a59-4053-8686-7f9421a66a81", "value": "0ebb3c09b06b1666d307952e824c8697", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708100575, "uuid": "d630f87a-408b-49fc-a435-81204da7d236", "value": "24576:j4TDqT3cm7OKp/qL76Lg37BYIg8r++MzDxQAREQg4U+FPg9:Sq7cB71YV+Mz9QAREQMuPq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708100575, "uuid": "2d4b9d86-14c9-4e83-b05a-9471550465d9", "value": 1199616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708100575, "uuid": "47110698-c759-45f8-be63-f4e6a1989a7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708100575, "uuid": "193f6a85-ba4f-4308-af67-45d15d8916e0", "value": "SecuriteInfo.com.Trojan.MulDrop20.27296.25834.31212", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c19424a-cc8f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708062605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708062605, "uuid": "2b9223fa-80b6-4c05-bcf2-b325b67e5f26", "comment": "Malware payload (Mirai)", "value": "430adf5cd658dfb72b97441bea9e6e5d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708062605, "uuid": "9e4bed1e-6e4a-4c8e-be6a-c8a8b339e2e2", "comment": "Malware payload (Mirai)", "value": "35aa6112ccd04315e378361de116080a7ea0ec7656053c8325b2001a6ae60713", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708062605, "uuid": "9dc43013-6aa7-492f-8d0c-4341c12aa6b7", "comment": "Malware payload (Mirai)", "value": "e81c94cdd1372fe78c95bd7cd7c5a3aebc0576c5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708062605, "uuid": "7774c1c4-f055-4a2f-aee2-f4d016c810c2", "comment": "Malware payload (Mirai)", "value": "1421a5d3222ce68f5df78df0975bbe4c34675c62e73df536f191db4ae610f2f1fb850981379114c8ce92d914756b4c02", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708062605, "uuid": "e1ff19f3-a062-4154-a5c1-d28e637b6502", "value": "T16C434CC5E243E9F5DC13007020B6EB33BE36E1F91119DA97D3E8EB636D92512E44AA4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708062605, "uuid": "372e3c39-75cf-4357-9874-61537df41213", "value": "1536:DgLG/crzf+oXU84BhJCHj54U5UtwUSNLZKB:Ui/crzf+oX5X5yNS1A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708062605, "uuid": "c85b3bc1-b850-4e3d-aa2c-e2b50f618b37", "value": 59444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708062605, "uuid": "48d00d49-717a-4180-8fee-0296f82afdba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708062605, "uuid": "78dbf6d0-9c79-4c0c-9354-2fb3b2a09781", "value": "RpcSecurity.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "703141b8-cce8-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708100918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708100918, "uuid": "15d72e1f-fd3e-4b3b-a75d-b212ff908873", "comment": "Malware payload", "value": "3cc9e8cfe985ba20254c314537a5a851", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "luminati", "colour": "#C55A22", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708100918, "uuid": "86dfd6ac-511c-4642-b46d-576a002fcff4", "comment": "Malware payload", "value": "36c7e45595426c0b91888874fb60aececac84a29289a111b623e5dd22540c34f", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "luminati", "colour": "#C55A22", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708100918, "uuid": "b132f428-ac14-4a03-bba6-0ef5cfd5fb06", "comment": "Malware payload", "value": "8223ca19d4b6559808ec35b0c4074aa140ca2009", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "luminati", "colour": "#C55A22", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708100918, "uuid": "e88b2a1b-3289-4e9c-9259-ce713be9cfb4", "comment": "Malware payload", "value": "2951343db3eb47c0ec9cacfbbed38f1053a658b88f1afd400f709926802c8069c507e93ffe5ab0c34c16128150cc634a", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "luminati", "colour": "#C55A22", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708100918, "uuid": "b6132d2c-7277-4e44-ab5a-07c86d2bce6f", "value": "T1BD963380F30DA427D577D93A83B64B6A4A09CC195E87E79715A6F26C49FFAC08D84FC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708100918, "uuid": "7bc23741-0c5e-4a86-8b51-c4f254cafb75", "value": "196608:+HgAaqAzl+BdR91QAgqGZsWlh3YMEuljuaQ5c+KAQkaYrrF0YMeW:+HNQl+h91xWlh36uljuaQ5F8YFjMeW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708100918, "uuid": "2517ba80-e11b-4148-aaf6-e9eb2f3168ed", "value": 8967786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708100918, "uuid": "994d3448-d383-462e-8ca8-f407f8197a65", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708100918, "uuid": "f12d4bbf-c3ba-4eb5-a2fe-329e6e9f6ca3", "value": "luminati.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f065e686-cc6d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708048305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708048305, "uuid": "084eeb24-5f28-4113-855d-d7295dfdf746", "comment": "Malware payload", "value": "5f985a160c214dab159c606f46de5f3a", "object_relation": "md5", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708048305, "uuid": "e80d4b43-143c-4681-b1b4-919842bbfd3b", "comment": "Malware payload", "value": "370e6c9898da5ad3146fb94726de6dba7c50ae6c69ce9f9bc9a6c91a880f6896", "object_relation": "sha256", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708048305, "uuid": "3bc346a8-4628-4843-9314-b2a97147d694", "comment": "Malware payload", "value": "2f9dfab7118f2bbe943ef0b726f0983dd07c6da1", "object_relation": "sha1", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708048305, "uuid": "2d4026d9-0b25-48f4-b415-fb8f1c198470", "comment": "Malware payload", "value": "8ad2049a09dfd6856e0f77d0e72e46c9e1c6f80bb935705429ffa8e8317888d85d6a4506536289118be65cc50a7165e3", "object_relation": "sha3-384", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708048305, "uuid": "db0c31ec-f9d2-4f47-ac6d-f20230b1fb61", "value": "T193900214B84CF55D1B9A02F045B5C1108990C0845110B9641E58D4595150AF50A16456", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708048305, "uuid": "cf9bd02e-dc7f-48b6-87d1-41e1de48d7bc", "value": "3:jiAEm8Vp7PHsvWe3wO6:jiANCVPMz3Z6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708048305, "uuid": "9413bdba-12be-46b7-9d79-e6cf58de7d4e", "value": 57, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708048305, "uuid": "8ed15f25-7ff6-4c90-a13c-506ac57fba8b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708048305, "uuid": "3e5b7713-ca09-4814-8c39-bb4e96a0461a", "value": "Report_PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6f899f2-ccc7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708086863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086863, "uuid": "0733f5b8-69cb-474f-9505-f54faf2a8ca6", "comment": "Malware payload (Mirai)", "value": "0368b81c227b3b15ff79fbf1e2738583", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086863, "uuid": "ddf6c717-0c7f-4759-a2c5-75f0857420f4", "comment": "Malware payload (Mirai)", "value": "39a11ad2565422d1ab33b3369b27a6f82913b408850bff4ac15ef6b3ccde8112", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086863, "uuid": "8aa80d9e-8c86-46e0-96ef-dcae3836946f", "comment": "Malware payload (Mirai)", "value": "a1746439424cfc1a34b74b9e956f740d15427487", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086863, "uuid": "da729cde-7809-47e9-b9c6-31b21ad5a521", "comment": "Malware payload (Mirai)", "value": "89d128f8fe8f7cd61e4417b8c789b8e0a091d443dbcec69b26af62ad29a8a704e40043c6f9c34d80647348dcdf042560", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086863, "uuid": "bf79dd34-b6f8-4562-9214-add5f1de5f9b", "value": "T1D804881E6E228F7DF66D873047B78E259B5823DA27E1D640E1ACC1105F6039E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086863, "uuid": "9d4faf46-a27e-42ed-a739-85e091b57450", "value": "1536:T16zePrQiQY3uY05Y9vt6Sw6cFL+z14R7oOe/3LM76qfTOSV2dLi6jyfjJdN:TnPvQp46SKFahy7ox3LIS4OLnyfjJdN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708086863, "uuid": "a76deba7-f8c7-402f-9a84-3a59aa6f8790", "value": 173824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708086863, "uuid": "36a18580-35c9-41a1-a4d6-98b515173fa0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086863, "uuid": "b37b2697-2948-4bf0-a5ae-ab24afb513ba", "value": "0368b81c227b3b15ff79fbf1e2738583", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7e72b29-cd1f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1708124714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708124714, "uuid": "370e5d3b-a2ff-423f-95db-fa48438250c9", "comment": "Malware payload (RedLineStealer)", "value": "b26a391997da0b33965483486c1773ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708124714, "uuid": "5ef7dc34-a383-4588-a6d6-1927b953db7d", "comment": "Malware payload (RedLineStealer)", "value": "3c1325c611ea5ba3fc198cb7f7b5626ae68071ea7a178b0939738dd37cc8bf51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708124714, "uuid": "c74d88c9-8966-4f73-a7fc-376a0b082e3c", "comment": "Malware payload (RedLineStealer)", "value": "91eb86a0a2f37473821b090b38c8c1a91e73f289", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708124714, "uuid": "7107deb0-b391-4cd7-b1b8-1182ec35abc5", "comment": "Malware payload (RedLineStealer)", "value": "08210e860286b161ba2419598e63dba3b42055fa4d04e115212b7d2c183659903c190bafd238b116f1faca1272bd27b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708124714, "uuid": "91d0177e-971f-45dc-b130-e216393c9799", "value": "T10994CF11B141C433FAD36A72A8D4C4745DB9F4304F6902D737C4A53DAB6ABF3A6382A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708124714, "uuid": "6c4eb8d4-38f0-4228-821c-b0cea1227b0b", "value": "f5b092552ec597635b0eec0dd811df92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708124714, "uuid": "70faa6d6-5e7e-4e6a-bb9a-829e1df0b92b", "value": "3072:adMcIDm0sCq3jmDIbnlOyv+GDEa22wjAhsAQuej924tNLx:5cIDm133jmenhDEMhcxN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708124714, "uuid": "d2ec3f8a-2be7-4074-b275-49b89efc092d", "value": 446412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708124714, "uuid": "25b808b9-0234-4162-980f-78d9d22e4c5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708124714, "uuid": "e4ef335f-84b8-4beb-915d-e120f4787412", "value": "b26a391997da0b33965483486c1773ab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce05c366-cc93-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1708064568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708064568, "uuid": "95e495dd-0cfa-4500-b978-8e9bef1f795b", "comment": "Malware payload (RiseProStealer)", "value": "871fa11809aa642b00efde164b84cf4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708064568, "uuid": "1d4b62d5-93d3-4a49-9d04-d55372a26235", "comment": "Malware payload (RiseProStealer)", "value": "3ccabf9a9b688fd14180e71025b7afa277b41eec7d84d285c726622450259a1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708064568, "uuid": "248d4e3d-c7d4-4e19-bc5b-a51a9c0fde9b", "comment": "Malware payload (RiseProStealer)", "value": "d3ed53880a03a738b4640c18f6792de0f47e23f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708064568, "uuid": "ce35faea-8890-4320-bdfc-f16bd933c094", "comment": "Malware payload (RiseProStealer)", "value": "9053d232504e64f4d86e450f27f397566dc70b607d117cba5796e0ec29c21db17b8dfce58c4986512204d925015a86f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708064568, "uuid": "9c8278ae-2bf9-48f0-8d06-f91e74c9965f", "value": "T1791512CEBC80445BD688773548D3FBBD121FEC85AD9060DD6CE8BFA3B632A191923519", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708064568, "uuid": "c8969668-4292-46e5-b726-54fdb16c798f", "value": "7e0228b96dbf47857e2d508028d66fcc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708064568, "uuid": "b9a0122b-d007-4960-bfd2-131564ef6837", "value": "24576:xkhm2or+Y6XCk3LVvOhCxdgFKU+LzaO4MUSFc/YG2z:xkm7+Y1kxOYrg8U+Lp4Mj7G2z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708064568, "uuid": "822876d2-c0aa-4455-87cd-8abea7612b92", "value": 921648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708064568, "uuid": "4043ab65-aa7d-4127-89cd-22568a1ae2eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708064568, "uuid": "fbaf5e98-aeea-4e0b-81a9-86087ba161b3", "value": "SecuriteInfo.com.Trojan.Win32.Obsidium.12139.6153", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1b5cfcb-ccf3-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708105806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708105806, "uuid": "bf107cd9-5ede-4b4e-b2c8-9d6320e77ff6", "comment": "Malware payload", "value": "5efb1e2f15353cfc6a7145d5373ac301", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708105806, "uuid": "cf935398-3b89-4ec9-aa0c-e76c6612caae", "comment": "Malware payload", "value": "3f1e62bfa3ca085f4385071e74112ce386c1dd8a7a4fb42f32ca204b7cf602d7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708105806, "uuid": "b14ab72c-8425-49a1-a800-a9a57dab61b9", "comment": "Malware payload", "value": "017dcf8550a78ba5023d01243db972fe32cd1971", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708105806, "uuid": "05fdb1ce-df4e-4a20-9bd9-f0798e3111af", "comment": "Malware payload", "value": "63d860a6cdd17161562189f2e71997b81667279c0b46e19d9fdba067beec506c0d8b3159da5fabe8d5386ff206576935", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708105806, "uuid": "f435bf21-2dee-4816-8403-2e615fa43016", "value": "T1A3135AC4E943CDF8ED5612B121B3F3368B72F03E22ADD957C799D662E882601E54728D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708105806, "uuid": "857b5961-30af-45fc-9b1a-1d5f8336506b", "value": "768:A5aP1wwa3NCOZlMbvaUxMklXXIm+icV/IQwP5OA6KchyFes5:A5aPOwadCOZlMjtlHL+i+Y5OtfhyFr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708105806, "uuid": "3482a101-aa64-46ad-9ac0-1527a5aaf059", "value": 43120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708105806, "uuid": "80df9712-442d-40fa-9b45-686d5ee1e27b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708105806, "uuid": "d0e3e46f-4efe-484f-b726-7cdddf3de018", "value": "shindex86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9928e28e-cca6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1708072640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708072640, "uuid": "7b6fe5b4-2914-4b00-8947-6ed2b5550b3e", "comment": "Malware payload (Formbook)", "value": "27dc3158162af3f6f65d2c161c08ac66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708072640, "uuid": "2182572c-0e54-4fb8-906a-b5d7d6153fd8", "comment": "Malware payload (Formbook)", "value": "3f71cd633e4008724884843131ed3d03c8d6613882f81a8afc615ad30f841dfe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708072640, "uuid": "2f257441-c474-422e-9986-79dbef07275e", "comment": "Malware payload (Formbook)", "value": "4d9f5b81931329b9333bf5be57c0fa7877c9972b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708072640, "uuid": "eac60786-e1bb-41b7-9489-d7127b945a50", "comment": "Malware payload (Formbook)", "value": "ad7ce0768098d587ae7aa3b73e80b6364be1578be501c4ec1648900194a21a3f73f2a3fc77ee02f78fbf3026a24c0b7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708072640, "uuid": "54055761-c2d3-4274-86f6-31df53e819a8", "value": "T1AFD412593EF88B3AC439C3F61025707097B271479820F3D86EE9B4D161B3B651BA7A47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708072640, "uuid": "213e2e16-62b7-41a6-be17-8664859890ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708072640, "uuid": "3eb040b3-c9af-43c6-83c2-e171208c87f9", "value": "12288:R1Q4W3CK5FrxhGJP2Vd9IPpIk+9z4VYQ9rGM9Bs:pA95pzGIVdOIdz4VY0p9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708072640, "uuid": "96c090de-9514-4455-a0e0-1a827075cfd0", "value": 627200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708072640, "uuid": "efb281b0-2a18-43fe-a753-bb6c7fd289d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708072640, "uuid": "2167260e-b185-4496-ab7d-740b9ef0d48f", "value": "SecuriteInfo.com.Win32.RATX-gen.5296.23288", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f5bda4c-ccc6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1708086206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086206, "uuid": "c317f33c-89e5-4ff6-ab27-78dcb8ada184", "comment": "Malware payload (AgentTesla)", "value": "26a4cead74be04227d9113e6fb14ff41", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086206, "uuid": "034b4a0a-6e0e-44ab-affd-46cc7e6b759d", "comment": "Malware payload (AgentTesla)", "value": "3fb1f1682df65edf093d919941ef34973a66660688dea04f948857758b58925d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086206, "uuid": "09e2af81-0dfe-4980-8c00-3aade814ebf5", "comment": "Malware payload (AgentTesla)", "value": "f386e39c3f23403a1a86bbf2710e072fda0ae054", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086206, "uuid": "746bf4ad-1ac1-42cd-950d-0a64612966db", "comment": "Malware payload (AgentTesla)", "value": "9ce728083ec5ed244f8b8f02e01430d1e2cd63cbd78bc8875b1b9a2b3fa3715b8d41b74abc3a6f096d9c0b651243bf32", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086206, "uuid": "04fae9a9-c5f5-43d8-817c-edbf06b87f86", "value": "T166A4F7C114CFC40DC35E3233A5A1C52A68D4CE32645B632EB71AAF8EF53B74A574E698", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086206, "uuid": "0aec76dd-0f8a-4775-a356-39541a06453e", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086206, "uuid": "6aba2d60-64a0-432e-abba-3971bbd488e7", "value": "12288:eYXpFXx3/Ze574zRJcYgzYtDUgk0TTW7n:eY5xe57waxzYtwfn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708086206, "uuid": "ae41a9a6-742a-410d-a4f9-cb5a4a750675", "value": 479033, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708086206, "uuid": "47557568-76c4-4f38-a775-cb11505c4076", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086206, "uuid": "9ab323db-b153-4f90-8d44-572686d74712", "value": "hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6b87eb6-cc9d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708068824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068824, "uuid": "a8fc9718-db27-441a-a5d4-fe9d9b802ca2", "comment": "Malware payload", "value": "8c7eed2cd10e17904d46021271095aae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068824, "uuid": "e389e0c8-09d8-464e-bb27-7742fe1d47ea", "comment": "Malware payload", "value": "3fbe5ac1c9150a599027a0a1ed60c9364ee95a716c221d1e07a2c6128e21415c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068824, "uuid": "72d31339-da6b-4869-8524-70c23e346d46", "comment": "Malware payload", "value": "acaa2f673363b2e21cad8a08ee4932978540bffc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068824, "uuid": "8fbe48a7-fa0a-4343-aa2a-cd644ec2cc34", "comment": "Malware payload", "value": "51a47455d2745515ee3473373fbb9649fdf1afedf5c8988b56a3dc981fa544da1c5a7362544c9ec9ad8faf03995373e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068824, "uuid": "24f041f8-635f-495a-a702-8235bbf86871", "value": "T15F4419C66498B22FE1DF4C37AFA148F90269DE645230B28A52843DFD46F0DC91BF4B59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068824, "uuid": "0150a051-00c5-4d1b-beb4-50579247dd34", "value": "3072:pT/FgCJ9re9fWK8C+iOKveh/oh1tpQka/JhIxHwxHxHPvjHGxd:pI8C+iOKGh0pQkahxvry", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708068824, "uuid": "939bf84e-afc4-4155-b35e-e74c2a84584f", "value": 270336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708068824, "uuid": "65090cc4-5f1f-4580-89b8-7276f17f2ea5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068824, "uuid": "1b21eaba-96da-4c28-854f-65376ee2e872", "value": "SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.23904.11189", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "230e6a6c-ccb9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1708080602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708080602, "uuid": "51273d18-80b3-4abf-85c9-c0bf8616ef82", "comment": "Malware payload (RiseProStealer)", "value": "a38dfcf23492d3e72f37949f360e9c2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708080602, "uuid": "cf979211-8a82-4574-9ba5-fbae89c811de", "comment": "Malware payload (RiseProStealer)", "value": "3fd6911a2df871f06a8c7a0fb7e86ca5d785b989203aae724c8c19457ba43098", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708080602, "uuid": "09f822f8-b056-48db-8e0e-00bbe3caf2a9", "comment": "Malware payload (RiseProStealer)", "value": "03f4c1bde39a35b7b722d54e12d7ce92bfb55a68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708080602, "uuid": "97f8bf02-3cb9-427e-8fe5-69c6e8a69c7b", "comment": "Malware payload (RiseProStealer)", "value": "e4016df0c2e216e430d197ebb9968672d2f121f60d7d5ba6f8e527888cf4efc4c1179a00fc760ccd4ef5f32556e6fccc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708080602, "uuid": "88c9bc58-7363-4354-92c2-2d45977620b6", "value": "T1971512CDBC8044A7E784377854C2FBB9422EEC45A94650CE2DDCBF5BBA37D19062296C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708080602, "uuid": "4e6397db-6d8e-4569-9be5-6a2459c9c0bb", "value": "8f8e3e19c3b0c3209b0b23173538a915", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708080602, "uuid": "cfcda234-4740-487d-9bad-a9f57421be1d", "value": "24576:qNLraWKjbhFzJ6HoOHCt5RN9M3xdEtFG2xbf:KrqJJcHuTHc4GU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708080602, "uuid": "4aeff8ce-9479-493d-a904-d64387465b42", "value": 922064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708080602, "uuid": "9d200e8f-c1dc-40b0-9c43-445e91a252d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708080602, "uuid": "d5a71959-e8b8-444b-ad0e-bd4dbee47a67", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "306d876d-ccc6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1708086208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086208, "uuid": "d17338e6-771d-4e49-8139-600d7d7170bc", "comment": "Malware payload (AgentTesla)", "value": "d42d897abe738cdd6a42ec39ad3b6ea7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086208, "uuid": "25cbd735-ced3-4560-a164-e92cdbb8cfe2", "comment": "Malware payload (AgentTesla)", "value": "40c8d5dc8a52c5b405755cc6e6404c7e6c7d16ca78cfff3f8159c8851e80cc36", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086208, "uuid": "b0ce7afc-687c-4567-96da-30eebe91056c", "comment": "Malware payload (AgentTesla)", "value": "d95703d439903cf0d3fa99ea2528b5babbdf4842", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086208, "uuid": "bd71c4d6-1bb8-4c45-bc3a-b1b86cdefa80", "comment": "Malware payload (AgentTesla)", "value": "6e44eb6f83a3babd961301f3d7724f94863e86377d51af4f4b7814ea79d90b723fe629b0c1d190d1a738a7b164edbfed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086208, "uuid": "0bf8d5fe-23ed-486b-b1a9-49c102d1242a", "value": "T17CF4536A2CDF899EC32DF93155A48020F5ECC5B237034629768A6FCD9B37685678E31C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086208, "uuid": "efdbe74d-4a23-4e38-9b2e-e604c21f4e85", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086208, "uuid": "6167dce7-9bb3-414a-9714-851e7a3491fd", "value": "12288:mycrCS0v1MYHcFWbGBGlYK+XQXsj/GrT6Pp8MUqpW2MGtHJuHChZMRv+dtguGeM8:ACS0v+YHOtLnTtSnm0D8DGBNco0JwFA8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708086208, "uuid": "b36bf9e2-81e4-4b45-961b-e81b5f5befdf", "value": 733696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708086208, "uuid": "61952ac4-a8f9-48cb-87ee-522ca6b29072", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086208, "uuid": "9c4f2341-f24d-4238-914d-d45087cda2a8", "value": "Shipping_Document-001222890.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43f38050-ccc6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PureLogStealer)", "timestamp": 1708086241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086241, "uuid": "7233561a-2ce5-438b-ab0a-9acadb8d36a3", "comment": "Malware payload (PureLogStealer)", "value": "cc1d94bb23d3c4023af3f3a24aabef9b", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086241, "uuid": "20407fee-262a-444c-ac24-6173eaf1ee17", "comment": "Malware payload (PureLogStealer)", "value": "40da62228f91967f460b5722e0b8ad3935534b163b62ed62f9314ea6331fe89c", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086241, "uuid": "9d164a88-7073-4916-af1b-acf92dbf955b", "comment": "Malware payload (PureLogStealer)", "value": "8457af9d57b604e2ea6ea83f4229d2fca698509a", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086241, "uuid": "45678018-da1e-4977-a71b-a1e16ac6716b", "comment": "Malware payload (PureLogStealer)", "value": "c0f03c9fa305dbf7b678ae8a4305dbf6dddda860dfa61595bc5035bd448f72b6ce84e3bd5a5ea40a515eb703e2313f92", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086241, "uuid": "627eef2c-7d48-408e-997c-90d21dbdce2e", "value": "T1E3E4225072B87F76E9FE87F1566A119043B3A20B7493FB5A5CC472CA6A93B014742B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086241, "uuid": "2eb325bf-b1a6-4118-82a4-8a4e2a3c7287", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086241, "uuid": "9bb3cbf2-e5fd-44c8-8dff-976b3be2dd8a", "value": "12288:hdQ4W3VxVA2txcu1TyoWTLAuT14i8pNMuHfQOVEWZ6Nh5V:hvA7VzrTjWTLAoopNT/QEEv35", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708086241, "uuid": "881e5be7-4b84-41bd-ba10-d4b9e64ce87a", "value": 693760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708086241, "uuid": "ecc7dc4a-00bb-4d09-981b-85c81123c8ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086241, "uuid": "488acc21-1912-4163-8361-88dbc341dcbd", "value": "DHL SHIPMENT AWB# 4633817031.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ac18e8a-ccf5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708106573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708106573, "uuid": "e4d8b494-51d6-41f9-963a-8c99bd455dd5", "comment": "Malware payload", "value": "945c48b426452f9da691c46f2fdc6a07", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708106573, "uuid": "77f665d7-8335-4e8b-b38d-2ec88386f850", "comment": "Malware payload", "value": "40e61a6c5f46702a808cb94a2f27c6460b5a86c9878d831213c3acd31eee1984", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708106573, "uuid": "26fda5ed-1b03-4648-99ba-8179c3dab2c1", "comment": "Malware payload", "value": "f84340391a3aaf5a361415c309a4177203856bb9", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708106573, "uuid": "d88cfa8e-7f79-43d1-b2ae-321623e83634", "comment": "Malware payload", "value": "1c319edc91b7bcbe9516320059f82ec7577f3d6656588504abaf3c69f95b46d2420abc454279579a404840d45085ba32", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708106573, "uuid": "4d9ba56a-348d-47ff-99d5-c90aad2b4f8f", "value": "T13F45B1114BA80059F3B617354AB12735A7B1F81633A38B4F370C131D5FAAAD28D7679B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708106573, "uuid": "35a22884-cab2-490d-aac5-8c9abfbb98e3", "value": "96:590UlnHeWQU/9JXcCU8uIeYM5+IkwAf8f:T0UlH3HXQwkgxwAU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708106573, "uuid": "8e7dbd01-fe4f-4035-b9ba-c572428e203f", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708106573, "uuid": "b7ccff41-447b-499f-84c6-4f5ed489b723", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708106573, "uuid": "589dc761-8510-45d2-a2a2-85258458cad4", "value": "Damaged_item.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b79bf519-cc9d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708068825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068825, "uuid": "438effcd-dad7-490e-a9f3-e4e323618b3c", "comment": "Malware payload", "value": "2fec4ffaa91f021c8a0cac244786f60d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068825, "uuid": "3b9fa312-5a32-42ff-b18f-9ca8ec3172d6", "comment": "Malware payload", "value": "416c6495e86eaa6951bd188a2a7c68623d98e68b6f8ecb90bb760d05d383f7b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068825, "uuid": "d6a9228c-b429-477c-9ee8-cea12db9ac66", "comment": "Malware payload", "value": "f627925cc1f5c57d280d54973589fb28b7d4c4f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068825, "uuid": "2a67708b-428d-4646-9deb-82294388e12e", "comment": "Malware payload", "value": "ae46d375eb6b8706a6407acfb9aef7d225214f6d7e4fbade6f7b6096f490545e27a743978be82ff380dcc32df82b34da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068825, "uuid": "648cfa61-088c-4b75-a6f3-226b6da1677d", "value": "T17116234CBFD18F13D4FA1778A82A4BB187149D13B076EE1F593439CAFFB6A416582620", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068825, "uuid": "f1fe1bb8-ee86-4c6b-9a97-139942aee488", "value": "acf92f74d3858142348cc20bffe74562", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068825, "uuid": "6839fb02-27eb-449f-9271-e83055f61bc0", "value": "98304:gtJ7PwslnhjpEFd3dg9DFXC7XRq8KLY03wyO:qJ7PPtpC0RC7hyLY03wv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708068825, "uuid": "2c82ed43-11d2-41fc-b6fe-ddf954053e4a", "value": 4163399, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708068825, "uuid": "5e2680f0-e358-439a-963b-372105a0467e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068825, "uuid": "a51ec8bb-183a-491b-929e-f3d344bfac4e", "value": "SecuriteInfo.com.Riskware.00584baa1.17763.24590", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfdf1acb-cc9d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708068866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068866, "uuid": "27e6b6ba-350e-40d5-9eb7-443bd5cff06c", "comment": "Malware payload", "value": "9044b0f8942c162d2bf9a82d49c07986", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068866, "uuid": "3b1c2ef1-aae6-40e8-bf62-043ed8b0483d", "comment": "Malware payload", "value": "4213c44bad7c45426f733a195fe744c618459bf5c2e8d21f7e64f62096ba96f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068866, "uuid": "e779c955-78b4-4f03-8073-7966b7ce35b2", "comment": "Malware payload", "value": "2580f9bc8da86886c632d9d5aa2fc355ddea507a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068866, "uuid": "ece0d84c-3f9e-465d-80fa-a2f0aa71e0ec", "comment": "Malware payload", "value": "51428950e26a9e58ad2872ed66bc3189892df09cf87cc3d9310fc710fd8b6819b81ae8e9504793c53171f81decbe3b33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068866, "uuid": "f1e11644-ff12-44cb-9785-69874a8b4be4", "value": "T1BEF48C55F5F290F0CB0160B006AF7F32DA67A9364B629BD3F269EBDC6832C544A37125", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068866, "uuid": "591b878a-cd1d-420f-8e98-0ebeded4726d", "value": "6144:VovYgyICT5+TNBGQ7D8bDkNWINJTsCNhVUkAwJoxrkqF4eWJSt7sn57GOmnPP4ae:VorhsxkAwWVkqFzWJ1uYa1VbCe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708068866, "uuid": "4733130a-8f8c-452f-9848-bd0bce96828f", "value": 770048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708068866, "uuid": "ba325f43-430f-4182-ac86-137d6ec48c2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068866, "uuid": "5ab831b3-9431-4945-9761-5252db606493", "value": "SecuriteInfo.com.Win32.Trojan.PSE.15IBL0F.25998.12878", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd31f090-ccfd-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708110093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708110093, "uuid": "cb0e1af5-455b-4db9-832a-08a6764e77c7", "comment": "Malware payload", "value": "1f80a36a258b4a461cd69d76478bb9b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708110093, "uuid": "b456fcbe-5b3e-450f-82d5-8a93341ae94f", "comment": "Malware payload", "value": "421ba8ed6cc368d7f2caefad695968affcc3de3b0c6c066bb08ad08b8f9d57eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708110093, "uuid": "5bdc3719-5574-49eb-8a15-595ccb74e247", "comment": "Malware payload", "value": "6627a6e2b2a543fc02f9bf1829dbddf20b49b6ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708110093, "uuid": "5c39b8b2-7df9-489c-99d8-b3ee4d5e876f", "comment": "Malware payload", "value": "fc80f61b2a46c1b477c95553326ce07a8233fb97833ee63678023ae421e24a4f57cc051f7bcf3ba20ad4549b3258e0a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708110093, "uuid": "810b1054-9d88-4222-9976-83dc4b44e813", "value": "T139D423A87BD8C942E47260BF05BACFF54B72C9A9EE0406B947CF3463D4F29414568BB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708110093, "uuid": "21fb48b6-0e34-4ebe-be3c-ca47aa5c04a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708110093, "uuid": "a2c7c5da-f03d-4514-8347-7ac4a4555ff6", "value": "12288:PvNoSwequ7QXrW0G4cczBLLWJMd6JfJr7LCVuO4jGtYa3nyu:PvSSweJ7QhnnVL0m6j2t9nl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708110093, "uuid": "f03a01cf-4340-4ebc-b291-5e04a0172a79", "value": 610304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708110093, "uuid": "178a351a-450d-4f39-97c0-a25d7a2ea6ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708110093, "uuid": "73cfb31c-4b16-4d88-b680-17e251a87745", "value": "400000.MSBuild.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c600f98c-cc9d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708068849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068849, "uuid": "c298c4cf-1ef6-4338-a89f-be0b158b6455", "comment": "Malware payload", "value": "cef92b6cde242e163d6444b9448d1416", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068849, "uuid": "bb194ec0-5804-4d5b-a2e7-1c52863e07cf", "comment": "Malware payload", "value": "42361479e7bd86ddacfcc7134c5308043de9ea32267fa3796833fcb258d5a08b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068849, "uuid": "eb538242-76f2-4ce2-aa76-d4dea87aa30a", "comment": "Malware payload", "value": "824c93e01fe4ac810671e39fecb1bff5eaad396c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068849, "uuid": "073b4e2b-e5b1-4f3d-88ef-3f1b0b9e67db", "comment": "Malware payload", "value": "964a08e574a1a5b90882b4cf6237f7af9c02fc271d98cd3d67ab6c2562f5994b31ca17f609769cac1a268e120b6eaa3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068849, "uuid": "af2d5754-2f75-41b9-b321-41ce3c12b5ba", "value": "T18527E093A97D40E2C122B6F7C8DFD25C74F56A302B3B764527AC1D08CA67DC2B7A4192", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068849, "uuid": "e405ea1f-bfd6-4962-886d-0b45eb872f81", "value": "73c52744bf83e07772d06aed7624d5c3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068849, "uuid": "92784a21-374d-4e4b-b07b-092e73d4d5b6", "value": "49152:pNdCIGmCe+ptWnh+A4OeqOIlwjzL1ZjZCqHf32CnnRa5lbYRmKJvrnY:puIQ32nIGsFZjfv2CnKYRtjnY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708068849, "uuid": "4d437c86-be69-4849-a2ef-5e37cfd698f1", "value": 21834438, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708068849, "uuid": "4fdc80df-9501-42a6-924b-f948c2139358", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068849, "uuid": "ece1dcef-6a37-4596-975a-2ab784d821da", "value": "SecuriteInfo.com.Trojan.MulDrop5.14602.7377.3462", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1f2f9df-ccfa-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708108732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108732, "uuid": "a52cede1-2f11-4dc1-b0e7-7233091ea851", "comment": "Malware payload", "value": "c53e89d7daa03d189bc8d78b2c85656c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108732, "uuid": "94d9a90b-46ea-4fe8-a7d0-d0254ba2ff99", "comment": "Malware payload", "value": "445b0e40042373c6d75e78ae1be25ccff07107a26820d0b84a50d20ec3f254fb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108732, "uuid": "7362cb85-f792-4bbd-b5b8-f9c97d82d062", "comment": "Malware payload", "value": "2064cfd74ba48a9465a3cfc21de40a04c4698ad4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108732, "uuid": "42737128-0159-4082-81f3-dda545b409f4", "comment": "Malware payload", "value": "f4fdc1c7c9acb0b3c3e4582e6b8737030771592ebce71e94edbd60dd482335222d699106ca275e46f63f2ced759d02d9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108732, "uuid": "410a0ba6-6054-40b9-971d-dd403552e617", "value": "T1A592C7A379F45233406340C561A1BA0FBEC2A01BDA42E890F0DDA7C23FDAD56A4976B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108732, "uuid": "489cdc18-08d0-4609-9330-cc51485386c5", "value": "384:UFzeztXYN9EoJlkRAPksfRx9PboLIiv05PkPk5POHPogPaqaCxitkyrbj7:UFzeztXd2MdNv05PkPk5POHPogPaqaCa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708108732, "uuid": "9136036a-fb01-418e-bb91-b1cb8a97821a", "value": 19431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708108732, "uuid": "c62a40a6-26c7-4560-8272-25608b75a450", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108732, "uuid": "f09464d6-d666-42e6-b698-9ba7d7354fad", "value": "SvU9v6Os57WCjFfr35eSNPuC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19fb8504-cced-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708102921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708102921, "uuid": "3eefc2df-96db-4e63-86b9-d276992ee732", "comment": "Malware payload", "value": "3a434422af5021b2087c85c315bad9ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708102921, "uuid": "4625988c-c70f-4048-a4d8-db71a94dce23", "comment": "Malware payload", "value": "45395e701819b1ca0bb6042764e166f72a5ae7e362dd5ad07174f519ee5155ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708102921, "uuid": "b479eb44-c5b5-45f7-9c9a-acd6d40df6dc", "comment": "Malware payload", "value": "9a142957057ef7567e471652af8d45acfdfed2a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708102921, "uuid": "a7803a7a-e86a-49b2-ab31-d0042240b373", "comment": "Malware payload", "value": "506da5e875a47d3164f19bc0d37b4092a8407767b6e5a980b8ef9fee1d97b7c35ae62a0878b70bea81adf1db0dae1094", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708102921, "uuid": "99abff49-e4af-4e52-880a-8f2080b3ff81", "value": "T1A49533156EE6023EF4CD1EB3548DDC408BB2CF259EED9562844DBC692E373B0196AC36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708102921, "uuid": "a8c48ce2-61d9-4000-a66f-5e47af2ed89d", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708102921, "uuid": "64aa3db9-814e-4ce9-af36-f860081c45fb", "value": "49152:gJgXQXcdcniqzA+rk7wt1hrGUrzolsIEZmJ2YTtiZpSbm2kDkFn:6cuPzA+Q0xrC1oYccm2Oun", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708102921, "uuid": "af35b02b-220c-4a5a-b7fb-1ca6ca6d62ec", "value": 1914368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708102921, "uuid": "a2f89848-3d26-4978-9b5c-3d75e37a4bf9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708102921, "uuid": "e3412ef0-46fa-49d6-b82b-70e29e67eae8", "value": "explorgu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50c1be51-ccf9-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708108166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108166, "uuid": "0cb390fa-2efe-4a96-9b84-aba519541a7c", "comment": "Malware payload", "value": "1195df4fda6108c50b35dad0f91ae12d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108166, "uuid": "f2bca57a-07af-49c8-a775-06cf6e7f3462", "comment": "Malware payload", "value": "4649ba132780762985203c1426c9a257fe09a2a7db7994458646b617d1e43c69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108166, "uuid": "680ec6c9-2982-4cc1-9084-87540fe8a0d5", "comment": "Malware payload", "value": "7397b1ab2df52c2ca745cf0655e027bdef8a203e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108166, "uuid": "24c0ea35-cce3-4c6b-bc4b-addcffd7f22b", "comment": "Malware payload", "value": "9a30d9f0d0a75f7ec5ab75114442e7c9445e4b980effc4733639a7f1778d3439ecf76728afb590611dba740d9152ab36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108166, "uuid": "59f2d00e-da5a-4b67-b863-b75144d9dad7", "value": "T1812733281971D777C79CFAB59AFD96EF12828A0F425411EBBB43305FC50AA8712CA743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108166, "uuid": "0c461f37-847a-45c5-b9ff-b9e2c5430c47", "value": "3444120b275e5e629e02d070781d38e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108166, "uuid": "baf92c9e-01c1-4b0d-80a2-205ac0ff6d10", "value": "393216:Rw9/9a/5NnyqGjL4AqH/3hkFHzcX0TljYVZ2HW9Tugjc8Sjgwj:Rp5Z9A4lfhkF+cE322l7zSgwj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708108166, "uuid": "1356ded5-c507-42ac-a830-3f6e516d8c22", "value": 22126096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708108166, "uuid": "33cc02d9-c632-4fbe-938c-9d14cb9ae77c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108166, "uuid": "1567244f-ffdf-4500-9b4a-6a5e175df9db", "value": "SecuriteInfo.com.Win64.MalwareX-gen.1700.8009", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d8e3a20-ccf9-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708108161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108161, "uuid": "e81b03a8-c60f-432c-b08e-f8a7ad9af0b8", "comment": "Malware payload", "value": "30c4d035df73d088c686fab5a627ccaf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108161, "uuid": "6081c79b-4984-4ef1-8ea6-a4607bb1fd65", "comment": "Malware payload", "value": "480d05a62f1102d9d224ab5cc56d3db1305d4b3065660a255a949421d6f4748e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108161, "uuid": "975cf202-59a7-47f4-9642-f635fa3f3d94", "comment": "Malware payload", "value": "ca98219c40adb3059b023c919f6e003436d5ea75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108161, "uuid": "23dde14e-61c8-471d-aeac-17e11a1ba604", "comment": "Malware payload", "value": "4ef4b01ba2b537e3d9716f011b3d06045eddc6509aef90fa8e4868d3cc9f6eb5ca56a380a91557e6d9ebce63fe78a7f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108161, "uuid": "4b1f6300-2e68-4efd-8ee2-9443d40cf3d5", "value": "T101A49E2167A8D545DD9C0378E48912F087F1BE01F83BE69F70453EAA7F736A0CD02A5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108161, "uuid": "24d31a6d-7947-402b-ae36-1cfd0a29e278", "value": "6144:dIEbIelcCYiGlG3SWbB8Jb0XhCPpW0xzR7LjgOoapDh/g+nCqhTimgr9:dIEbIwXtGEb2VmCPdzR7LMQhbg9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708108161, "uuid": "4bc287f8-6c7d-4711-94be-7b02379b6d0f", "value": 486822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708108161, "uuid": "0b98fb99-dfa0-4789-b68f-fbe9808080a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108161, "uuid": "5f3140a2-0ddc-47f7-8ea2-c2ac94e7ad95", "value": "SecuriteInfo.com.Win64.TrojanX-gen.30335.3899", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce5e927c-ccc7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708086902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086902, "uuid": "c23caf6b-959a-4633-b3f5-0e19b3daeef4", "comment": "Malware payload (Mirai)", "value": "8766e5da287869739d2ba62dfe10725c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086902, "uuid": "ea1e54fd-2df4-4f73-adc7-da2e6a26eabf", "comment": "Malware payload (Mirai)", "value": "4905d2432718f01c9e9df002f708d5a1e058538ca992b21994eb7f77ca6420d5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086902, "uuid": "fdb789b6-ca9f-4796-bf8e-3d7019deb0df", "comment": "Malware payload (Mirai)", "value": "300a7863aad50669e3ff04af30c8556c589300d3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086902, "uuid": "390c22ef-8ba1-4ab5-8bc0-e7746a1ded6d", "comment": "Malware payload (Mirai)", "value": "6bca9d833093c055475f89696e982e68c2b11d06319d00b26c00f79a555831db67185b6a0e874db06c677b2aba148bb9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086902, "uuid": "0bd36d3e-db63-4353-80eb-90aafb6b261a", "value": "T1FAE30A56F8819B12D5C111BAFE1D124E37231B78E2DE7312AD246F747B8A87B0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086902, "uuid": "8d8f5594-c904-4d53-8c00-8cc2675726b4", "value": "3072:0CKdUnodrjAXtY+fw0aHo5yj4fCO3OZRjD:0CU0aAXm+fFaczH3OZR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708086902, "uuid": "c279fa8d-f42e-4ea8-805f-841bca748a2d", "value": 143260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708086902, "uuid": "1efb4679-7250-4036-a954-720154598155", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086902, "uuid": "48efd026-5017-4981-bf61-de60ecca123b", "value": "8766e5da287869739d2ba62dfe10725c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15d3cf8e-ccc6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1708086163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086163, "uuid": "bac75078-6187-4e95-8308-a88515e66055", "comment": "Malware payload (Formbook)", "value": "0fb5f38f74b792805f53f263ca72e8db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086163, "uuid": "207264fe-d8e8-4515-a8b4-114336eb0b6e", "comment": "Malware payload (Formbook)", "value": "49664746d15579ef991459c2202480d99b2cfadf953bc46e56c305512bb9fb93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086163, "uuid": "31ac1775-f327-4f56-ba18-4781cd08810f", "comment": "Malware payload (Formbook)", "value": "8eb1ca7c0e7ff100dbc8922cf2b13469e42a4283", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086163, "uuid": "4e08d60a-2dbd-4315-ac2e-ed25f53e6b39", "comment": "Malware payload (Formbook)", "value": "ab067f938a3ca449ac565570fd4762c9bb6a67b0825bdbaf9d052af1de538c729d0d35211c3f3e528d01d9040edce97b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086163, "uuid": "d58b6a4b-c0c0-4360-b6ff-f1d3fbd14e0d", "value": "T1D445AE5164CFC02DC3AF3232ADB5F22959E8D9321217936B33C92F5EA9376421B1E725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086163, "uuid": "836b11d3-de3f-4504-a6df-68e9a85c8078", "value": "d3bf8a7746a8d1ee8f6e5960c3f69378", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086163, "uuid": "25fecd9f-24c5-4d54-a975-4a57ed15c224", "value": "24576:SRmJkcoQricOIQxiZY1iatbkkDJ2yyIpKY7:HJZoQrbTFZY1iatbxN7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708086163, "uuid": "b7dfd033-1544-4b95-8241-0a04b03c5a59", "value": 1172247, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708086163, "uuid": "791e90fa-d14b-4439-8e30-956ffaef2df7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086163, "uuid": "088bc762-1c32-48b9-9d46-079dfbd0d655", "value": "Dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "374bf867-ccec-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708102540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708102540, "uuid": "1727c474-498b-4e9c-9c25-9bd8458444e6", "comment": "Malware payload", "value": "3f8a709d985a594352b29909e8aac4b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708102540, "uuid": "df6fddbf-7599-4007-9509-d8ceaeac1ddc", "comment": "Malware payload", "value": "4970ca4b524953ce938e1571a6c044a49a29e6962de1543eb933c511d0a059d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708102540, "uuid": "68246236-e16a-4a1a-83e9-641238c41007", "comment": "Malware payload", "value": "f71044e0710333c82bd4e5075d29e28520bdf5b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708102540, "uuid": "21559eb1-80fd-4c13-8bd1-850ddd9c06c7", "comment": "Malware payload", "value": "699e7c4343a7473029d4f4fb02364b9eb73bf65dc2db679ab30fccdeab4f8bc1793b441f843ddde3b2829461086dd029", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708102540, "uuid": "354354bb-ec9c-4419-b353-56a9aac41cd5", "value": "T1C6036D55DBAD0247DA1D497A58B120C03B32FF8357C3BBE90CE9D8E56A836993530EB4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708102540, "uuid": "f615dd48-467e-4462-90c4-ba43c5ef61ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708102540, "uuid": "b113decd-f94c-49c7-bf24-9b5e7c386bb1", "value": "768:UjZSJdMAa+TtZYKgRGlvOqFPUqbTNf+VbsHiMCPqcZlA:UjZSgAactZYFRGhHteOD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708102540, "uuid": "d4539008-b622-43ef-adc7-a76e63ad3179", "value": 39936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708102540, "uuid": "4462501f-a31d-4dc5-808f-ffa32d4373a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708102540, "uuid": "9ea09627-559b-4f0a-8511-04c31a436d93", "value": "QUOTE_C3350191107102300.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01740df7-cc6e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708048333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708048333, "uuid": "556a11af-e50d-4b70-96ba-51bde70bb417", "comment": "Malware payload", "value": "0a33923fa52ad7683bb1c07924ecbf79", "object_relation": "md5", "Tag": [ { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708048333, "uuid": "2d330f63-320e-4235-9785-17b93fd9c021", "comment": "Malware payload", "value": "4bdff89b4a48bc4f1910711cdba901a7ab94d7a5b13f07dbe8f0fa827d30dc58", "object_relation": "sha256", "Tag": [ { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708048333, "uuid": "198015d4-5a69-478c-a197-a71f194dc500", "comment": "Malware payload", "value": "c50888b0752449d027aa8d8bbdd9a117eac657ad", "object_relation": "sha1", "Tag": [ { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708048333, "uuid": "46e1d42d-1fb1-4112-b164-acdadb71344c", "comment": "Malware payload", "value": "dcc5ac6735f8c8ce2194f28e44d0e3bc17e07dd7673df10dab42686284e8e0f04e6e0e7a13225dbc208d2970dba5440f", "object_relation": "sha3-384", "Tag": [ { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708048333, "uuid": "849881fb-293c-4fe6-b642-1c19b9f17d45", "value": "T106629E3DC220F835E5B5013EB08C13F1F85E0A88E3996056C209F9DCCBAA9975B267CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708048333, "uuid": "bb6f92f0-bb29-471b-8464-6382680121e9", "value": "192:/ifqtbtgk5IgBvB90hYQQQFHF3HMr1loO6iKP543BIjxieqiWz1tLADVfLyqmx2e:/igtDD9sYJMXKkKqfpC1NADMq/e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708048333, "uuid": "72d2ffa0-5a58-4212-934d-e0f146fdc967", "value": 15882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708048333, "uuid": "de6bca77-0e1e-4b80-b7bb-f886a699d0ab", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708048333, "uuid": "56209e8e-2b22-48a3-af7d-cc222eaf3d63", "value": "414586502.1.docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d962e75d-ccc7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708086921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086921, "uuid": "c122c223-22c1-4704-8e2a-2142f13651b8", "comment": "Malware payload (Mirai)", "value": "a10587aace983feff5133f4163eb0419", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086921, "uuid": "e0c212d0-b2a8-4f69-b2c0-606cd7197b86", "comment": "Malware payload (Mirai)", "value": "4c579f52c1bb6ad32baad861486adbd60e60c0e30429ccdcf87f8eef23c3bcdc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086921, "uuid": "6f72c24d-2b69-4ba3-9f44-9b0f2bf3a3bb", "comment": "Malware payload (Mirai)", "value": "b5e2bc7f6d7ea453df4b5e601ed36bd71593523b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086921, "uuid": "c666492b-514f-40c2-b91d-bbba24914026", "comment": "Malware payload (Mirai)", "value": "88deb16138e0e7e9e8f968525781d940c4643e16c9845c551a2baa0f89730835451aad11784e92748a51b073a152d9f2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086921, "uuid": "2918b8e6-23de-441c-8953-5d92f9e36c16", "value": "T14A04C81AAB550FBBDCBFCD3706E90B0139CCA44722A47B363674D528F54A94B49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086921, "uuid": "2711bb50-a184-4278-aeb9-fe7e562b4037", "value": "3072:IJPmns7VUKWxVxE42sWrnCNpSLoUYxuJVN5L:Ios7VU7xVL2sCCNYLfKQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708086921, "uuid": "ab9f1d59-6963-4296-af85-1f15f482d4f3", "value": 186092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708086921, "uuid": "2fa9f547-1043-4d93-b6ca-df54cc4fcc5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086921, "uuid": "0a15f6da-700f-4f14-97ab-505c5916e2db", "value": "a10587aace983feff5133f4163eb0419", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ec94d3c-ccf0-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708104298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708104298, "uuid": "8544d8d5-2a87-4939-abed-636f932bfb80", "comment": "Malware payload", "value": "d83d2ccc4680be1e1edf3257d6ff9423", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708104298, "uuid": "3a7e6a50-1d9a-494b-ad61-111f19606d7b", "comment": "Malware payload", "value": "4d01e5ba25e891e03ac1b5d15153b3cab76a0daf722ce71b4ad114aa9b9f95e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708104298, "uuid": "31524d15-9100-4d56-8861-78344cc6a985", "comment": "Malware payload", "value": "9425d1cc2eb316494c203f45a8591395a720b4d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708104298, "uuid": "7cc7eff0-fd6b-474d-a40c-1c707cc576c0", "comment": "Malware payload", "value": "1b3a52e296d5880b87a5e1a1825bf31e04e922c1585679e3b28b87b84657b36b0c293d1936f43db339fa705838539a4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708104298, "uuid": "6dd55ff4-425b-4f0f-b46f-0c50c830fb30", "value": "T1A884AE1B73E800B9D9BFA27896625506F776B8060B31D3CF1394846E1FA77C18EB9B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708104298, "uuid": "bca4db91-f3b7-415c-a06b-5240ea0dd9ae", "value": "6a91eb82bfd19d2706c7d43c46f7064e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708104298, "uuid": "cea854ae-ddce-4af2-a8e9-d598c5d6afc6", "value": "6144:Nu/4FqqImCXLRiAIrmP78INx705NldswYEdswYLdswYmJBENdYe5z3d15kL:NGMAumP78IN6nYLGNmOR6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708104298, "uuid": "2d98ae11-d21a-42bf-a300-62cd74958c28", "value": 373929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708104298, "uuid": "7c5a1a6a-aaa9-4fda-b139-7132c90c85b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708104298, "uuid": "eb3e7fc9-c849-4aa3-b95b-e2031bdcebfc", "value": "SecuriteInfo.com.Variant.Lazy.478346.22398.13028", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa3bc647-cc6d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708048321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708048321, "uuid": "cabb43a3-6f66-4878-a690-21b0f59aa9df", "comment": "Malware payload", "value": "2efb8a145ffce86d3a488e0302e66948", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708048321, "uuid": "2172f59b-36f3-4a23-b819-f48c525e66db", "comment": "Malware payload", "value": "4d6f377e69280639e96f772e0b724b7bf63c23d11cdb68d6f0405dd0acce7f67", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708048321, "uuid": "4a52e0ee-d689-4702-bcba-13be49278c8d", "comment": "Malware payload", "value": "8d5da2431f7461cde8a213d36aadec197e91011c", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708048321, "uuid": "5df74922-0fca-4684-b39b-fe2183b355da", "comment": "Malware payload", "value": "d27bb299ad9b332d28e14e827d32bdb8b4f2f87a6a423d28099d6c42797e02954606a4cf84394f2d97da13a79f74cae1", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708048321, "uuid": "4517802f-9590-4f7b-ab1f-577002d6a49a", "value": "T15CB012042D54E491901E13C2143DD04D5AC08454310DD4D2804DCC8905002800D34886", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708048321, "uuid": "1a608a12-c9b3-4875-8078-e893a7af963d", "value": "3:gHisi/iMILICBaZb:NUr+b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708048321, "uuid": "56369a19-9439-4f6f-9417-edb640e28a1b", "value": 91, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708048321, "uuid": "81671c50-f088-4f8b-bc29-0dd398d52bae", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708048321, "uuid": "b7c5d05e-6e4f-4907-87a0-929d6bdb8cfe", "value": "reports_2.15.2024.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2870d669-ccc5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1708085765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708085765, "uuid": "7a2b21a9-ea6f-464a-8b0a-8502a88af982", "comment": "Malware payload (AgentTesla)", "value": "0a926440a9cf830cb3c83dcb35f23c81", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708085765, "uuid": "03a94737-7ca7-4819-bc3c-f383994e065e", "comment": "Malware payload (AgentTesla)", "value": "4eddafd2e922488aa0c11b6e4679f472c6332ca399979ec689fa6d35da808a6a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708085765, "uuid": "c37dda3b-cd8f-4f24-be20-fec168f6843f", "comment": "Malware payload (AgentTesla)", "value": "f37b4962b300502b84a73548007f7f239136f9a6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708085765, "uuid": "1264f951-49ea-4a27-af83-a25793f249aa", "comment": "Malware payload (AgentTesla)", "value": "256cb2b5628a1cc6ebc1851df9b93f06691cfd01271fcca550501bd455282aeed5efd9592094a02426e6a3f97ea88055", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708085765, "uuid": "cca22377-98c6-4e9c-a792-1935e057b4dc", "value": "T1A6C4F146BAD18A4AD85247350DF78BAA5315FC019F938B0B324CF31D3DB03A55E27AB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708085765, "uuid": "4bf57eba-cd32-40b4-910a-59aa3b4bc224", "value": "12288:hkkd8VQzBZrq3bVD1MI/7MSD4EbUkG0GAGUkmJcWp:UWBA3bVN5DhGAGUkmJcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708085765, "uuid": "7f0d5d96-0c6d-4ba2-895c-92051032f85a", "value": 551936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708085765, "uuid": "79872866-fcc4-48df-87d3-0b81da1270e1", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708085765, "uuid": "a063c508-128c-4256-b0b8-a6f14aba98c5", "value": "PO#5653497.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e35b4a9f-ccfa-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708108842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108842, "uuid": "1a5271c9-9653-4206-951e-c16504fd437d", "comment": "Malware payload", "value": "146c0d4532748fbe90a0e3b7c8c8d32a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108842, "uuid": "a7817c94-3578-43b6-ac15-2756258a43f3", "comment": "Malware payload", "value": "511686b3a6d03f0fc07963a436b63c17ea2d75ce11c3deb992c414aa3653c25c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108842, "uuid": "3913d4b2-6982-459f-bb6c-a1462fd6f8a9", "comment": "Malware payload", "value": "00c10ed7fe352ea05b9e6ce4169fa386bff6a34e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108842, "uuid": "11a0e8f1-5b4e-4ddc-90a9-b8b98fd8e93a", "comment": "Malware payload", "value": "4df83bf1c9e9028b2be72283846968c047511f44054ec1d6681877eb1f7ceeb551604e7c1cf8f5e67240c4a080cb39c0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108842, "uuid": "73a33782-dcda-4df4-b2b1-91d5050cf708", "value": "T11F34F73BCA15CC3206D6A39FFE5F6A53B5FE828536B44861E9F9C12C0385E85E217C85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108842, "uuid": "3cadc0fc-8757-4b5d-8a3c-377abbcfb67c", "value": "3072:qBlLFywXPmFFbNLal4lCjSo2LwlNYIR1Eyh0mR7keVY3nIY6/uR:IYLLa4Cmoqwlt1pNSnIY6uR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708108842, "uuid": "e0c223c4-f72a-4b30-adfd-86035daa6acc", "value": 248839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708108842, "uuid": "bd4b18c0-e744-4c65-b9db-cb10a8ebe6dc", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108842, "uuid": "5773a847-9cf9-4f0e-ada5-490b217625ab", "value": "yOBENW8bda45jXDVXaZlzm7G.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1fccead-ccc8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708087311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708087311, "uuid": "addda48f-2dc9-48ee-8e71-6131b5268dd9", "comment": "Malware payload (Mirai)", "value": "668364ed33c09d7c252568344c4b413e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708087311, "uuid": "2bb5d20f-891a-46b8-bd5c-ca9b64cc9abf", "comment": "Malware payload (Mirai)", "value": "51dd0aac50ac26998594dcec830da6a4f3b017c7a04b1b4c1dcfc3d15f9d6c73", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708087311, "uuid": "c65727d7-f63d-4dc7-965a-1d9b55ea6c70", "comment": "Malware payload (Mirai)", "value": "4996307c7e1b70d3ae4124f7265b1a15561a6bde", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708087311, "uuid": "f40b66d1-c3f0-4a50-ab8e-92e34f3e3d13", "comment": "Malware payload (Mirai)", "value": "aeb36ad1ad16002c9eb42d34b1654d37939346fe88d4f4dd57731c41cee6545f3e373dbc630a7a067b1d78b69c1baebe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708087311, "uuid": "c25786bd-f568-4eea-ab62-55c4cb6dd5b3", "value": "T189D30945FC415B27C6D612BBFB5E428D3B2A17E8D2EE72039D216F24378685B0D37A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708087311, "uuid": "f48e143e-5463-4862-a1c3-a975578e3528", "value": "1536:o6sYiS5hDkW3wUjrk9tAT2Qt6aGFfA8ML44VsNk+TnzB3k1BwAWOtR7l9sGwywL6:o60WW/PhFfl485rzB3kdtthKlbVtg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708087311, "uuid": "3061e80c-d336-48fc-825c-9d869889f088", "value": 142080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708087311, "uuid": "35b74497-7d1e-47d8-a895-93e33b995512", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708087311, "uuid": "307b2365-9793-44a5-ab7c-783fe9d92c8c", "value": "668364ed33c09d7c252568344c4b413e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf5abedd-ccc7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708086877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086877, "uuid": "8213531f-1b11-4559-987e-75918b9a6a8a", "comment": "Malware payload (Mirai)", "value": "38126b4591dfbf0ee0260c3f5002701f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086877, "uuid": "c920308d-879b-4621-aa60-9dc6f2791d10", "comment": "Malware payload (Mirai)", "value": "52401b80f85fa3eea27daf36122e373a01c9166c0e50b2de6139a3241ae72ea5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086877, "uuid": "4de0d6c5-fc63-4ad7-a41c-7609b558eb06", "comment": "Malware payload (Mirai)", "value": "95157b0603acd20273c2b60d60d92da582306880", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086877, "uuid": "5f3ce981-2ba1-4db1-b8e5-059bc4a143eb", "comment": "Malware payload (Mirai)", "value": "156feecb68e970f67d51a6bc38dce13988b6b4ba8b6917f4cba9082ccdef3aceb5a81d3d6fff9f2eafcbbd38b6c87022", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086877, "uuid": "db3dbf70-cb72-4ba0-88cf-64dd132f9689", "value": "T12504981E6E228F7DF668873447B74E25976833D627E1E641E1ACC1102E6039E641FFAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086877, "uuid": "e511118b-e2c0-424c-a061-51413638e89d", "value": "1536:ByxAwfIOuY8bfDHtdF1Nl9VLPz3hqbKWWvp80WdHB83gQgimjIukv7teJZQy0gju:huu1ftkB83p1yIuy7AZQytWrKzv/AVXH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708086877, "uuid": "4a737c39-9f06-475a-b7a5-5ce87e2ce75f", "value": 186092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708086877, "uuid": "44bf1d64-a1ce-4fae-a537-5305d1e86470", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086877, "uuid": "adcf78e7-f28d-4606-bd82-93de5958363f", "value": "38126b4591dfbf0ee0260c3f5002701f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caa0eac7-cc9d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708068857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068857, "uuid": "d45a12c9-9210-420c-9558-4fba01a2547f", "comment": "Malware payload", "value": "a4ce0698e30ba673dfec65eebdb018e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068857, "uuid": "d292a17b-b792-4a40-8079-8fb96e430514", "comment": "Malware payload", "value": "52c228872e4d6ea3bbfe51c5b0afd1a865ec0ad942baa7a1f562da77940fdf18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068857, "uuid": "87b8b66f-a855-4b96-9000-bff0a0ea9628", "comment": "Malware payload", "value": "1413d70ff59322ba38ceaa80722e4f31a5decd16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068857, "uuid": "b1597fac-7346-4bf8-919b-df6df6694012", "comment": "Malware payload", "value": "fdbe237c9f1bd0de1c29ee4a68b278bc5d3eb5fb63153357b12e893594cbece4690be4871ee7daae053db7b4acfa41e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068857, "uuid": "407d4089-8d36-41f0-b5d4-5681e09f8ae5", "value": "T16E063303A3C34439F425AE794C9989456C9B78BB18E910097FFDDD8C6D39AD2893B372", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068857, "uuid": "9c8c36ba-a2e5-47fe-a9fe-6ad2fc9374ab", "value": "48aa5c8931746a9655524f67b25a47ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068857, "uuid": "d44bfb90-a706-492d-8d83-5fdecad5445a", "value": "98304:eQbzj8wwDUsvEeDulaQ4D6Pn0uC+2ZFCqxBL:bzzUBvjqtY6Mf+CQqxh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708068857, "uuid": "c3f6a8d5-f4dd-49cf-af19-412f8102eafe", "value": 3980324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708068857, "uuid": "09da6fdb-8e84-4206-b0f9-7a5e5b5c0131", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068857, "uuid": "55e67dae-2f27-4b72-a011-2434f05893ba", "value": "SecuriteInfo.com.Win32.Malware-gen.20201.27767", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b190ca1d-cc9d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708068815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068815, "uuid": "2a11741b-057e-462f-8ab2-55f7c13c7579", "comment": "Malware payload", "value": "d24ca80f54fc58fbbb97e12b01dbbd8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068815, "uuid": "b08dccd6-79ac-4e5a-8355-1be6e3df6125", "comment": "Malware payload", "value": "560d1eec8cd039eb52d09d6e37fa68fa89420ebf4f2331c3b2512a7e1133c680", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068815, "uuid": "63339b11-89e5-4b1f-a354-2505d387d0ae", "comment": "Malware payload", "value": "dd10b17a73efa697e3ba27a7c90457d6dc44d8b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068815, "uuid": "82bcbb69-4632-461f-a8d6-0e64912ef84e", "comment": "Malware payload", "value": "3a3f4e6f4fd311fcae2bff9d4a679e8a946501cef299ddf18f885698e717094fb95cf1b8fe0803a6d767003970990aa1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068815, "uuid": "1243b5d0-b5a6-443f-b48c-f50e172aedf8", "value": "T1C7258D12B9B38091C33565320DE7333AAA76D6890F15EBCB725DCF2D9B32650DC362A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068815, "uuid": "83190733-eee9-4675-96d5-eda19c2620f7", "value": "12288:sddIpLUEveZAUy3KYY0PkKXddHY6QxCDHOuefkIjbhRA2c:sdo5U2Kv0P1gCDuuefvhrc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708068815, "uuid": "0cc6681a-a89e-4207-88c4-c314d1c48f16", "value": 1044480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708068815, "uuid": "88db9174-7f45-4d57-a1b3-6454ea44f796", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068815, "uuid": "aada757d-ba60-4a9b-9943-bbc9ee19396c", "value": "SecuriteInfo.com.Win32.Trojan.PSE.15IBL0F.14575.9858", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57565cda-ccf2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1708105171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708105171, "uuid": "c3c7c20b-5cd7-4028-9bb5-a11b2b1958ab", "comment": "Malware payload (CoinMiner)", "value": "d67e4f13be920cfa287820bfb5120352", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708105171, "uuid": "1be92fe3-3e2d-463b-a5d4-fc78ba0406d1", "comment": "Malware payload (CoinMiner)", "value": "570a0620925b20b16863882a31f7602e92fb5f193305bc20e0990c59607734a3", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708105171, "uuid": "0d1e3731-786e-405a-bd46-207a1b280b01", "comment": "Malware payload (CoinMiner)", "value": "43605da31ac706f106ab5ebedbddeac7a9581d48", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708105171, "uuid": "1ffbd712-ae05-42a3-b704-faa90cca3581", "comment": "Malware payload (CoinMiner)", "value": "24eec3abb8a115f0147b53454885a20122fab8ec15e0abd4681cfb7fc2f32d7325713539e2b823dd31ddd5292b66b096", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708105171, "uuid": "4664ddbb-96e1-43da-9567-cf9d680c55d2", "value": "T160969D55B6A100E8D8BBC53C8A0BA617F7B2B85543B0ABCF17B442A61F173D15E3EB11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708105171, "uuid": "01b4f6a8-eb60-4c91-b4b3-978f3341e62a", "value": "98304:qytTZp3dw1WZMREb5FLnFqC3M5fMpd/O6Qnqfsqwc/iNhz5VRzp:qyViC3oMpdG6QqfrwcanFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708105171, "uuid": "ed8e7af6-2fd8-4a61-88d3-80b2389a3852", "value": 8683520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708105171, "uuid": "5ea12d29-143b-4867-b813-fbb18c4242e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708105171, "uuid": "d971fe8b-ea23-4c9e-925e-1c15aad1fe35", "value": "140000000.explorer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "838cf7df-ccbf-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708083341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708083341, "uuid": "6110a9bb-5555-4ac8-9ef3-2f2acbbbcf18", "comment": "Malware payload", "value": "f58195836da0faaea41f70fda27444cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708083341, "uuid": "4f8fcabc-f32a-4962-96b5-d5c0d759cd80", "comment": "Malware payload", "value": "578ec40eb54828a3ebe1d6c51ef39c50a83dd0f0013435b7d9ca4a7fbd11451c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708083341, "uuid": "0557fba8-473d-40b4-89f6-46555bce0b53", "comment": "Malware payload", "value": "0689aa29d20bab97bb08e48f75bb5c242a142866", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708083341, "uuid": "152a3d2e-d806-4b23-bc8a-1492cd2a6825", "comment": "Malware payload", "value": "528e1e36b779867dc4d65550caf2b2c34b4c57856734867ecb2cfb67ce39f71d8137d4d36654bb955b4495638ba8ea30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708083341, "uuid": "29102ede-f3d1-4d5d-95c6-1edc7aea4cb0", "value": "T1A7E24C4B739A01D8E2A6E2BCC6E34615D7727C424711A7CF43F1A24A0F366E0A97FD51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708083341, "uuid": "332729fe-b995-4ae0-b2fc-d849a050575b", "value": "5c1a60293f85998dd3f715d26b32501f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708083341, "uuid": "0eef967f-5326-45a8-bdb5-26d800ba57b8", "value": "768:m6UM8DJH5QXPJgHfYJu35mUw0w5U3X/8t:fToJZmJgH+kXwO/E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708083341, "uuid": "956f189a-e50f-44f5-9297-152d676c4193", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708083341, "uuid": "472cfd98-dc52-4ac0-a2bf-09b42e4cf7bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708083341, "uuid": "21dcb2f2-eea3-4b4b-a5fd-9b3916bdffeb", "value": "SecuriteInfo.com.Win64.MalwareX-gen.7201.3314", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6dadf1d-cc9d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708068851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068851, "uuid": "6a56ca93-0d0e-4ca3-bb8a-1b76a82437e2", "comment": "Malware payload", "value": "ac651804682b75039b5a8c839f7df92f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068851, "uuid": "d79a0ca1-e5d4-49ad-bc41-0f54998dc5ef", "comment": "Malware payload", "value": "5801ccc20f8957a3ee91e8ebee46e26c813068f0c3fee75d80c6b7f6db1339ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068851, "uuid": "0106a244-70b4-41ec-aedb-37824d823a18", "comment": "Malware payload", "value": "3c30d97a8138cb3f996a6d930f0e093c76c6b214", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068851, "uuid": "da938847-aa24-4ea7-aa83-10fca7e47946", "comment": "Malware payload", "value": "022d6f8de9a8185f9d9935de44dccfa523caa82b3dad3afb0320252f39b9d7e5aca24866d349214a1e96c4a36f2a190f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068851, "uuid": "21e33c46-233f-4cbe-b038-e69b4bbaeaff", "value": "T14383A523BE1C742BFC8545321D59D1A96A21AC3978806D03678A7C8DF8397C376DA73B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068851, "uuid": "c1608927-c3da-4db7-bbd8-246832cf59d9", "value": "21ba38e59d13e69620c1686680e136d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068851, "uuid": "1a64f597-96ed-4f96-b334-2972b0a7dfdb", "value": "1536:tJgblyRshbVGmW8xfJhQI1UtsyNxHAMAkwOECIA+dfaH99E/an:tJgMRshbcOJeI1UtsyvHA/CIpayI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708068851, "uuid": "c49bcc86-da1b-41c3-81c1-10a587db8dc0", "value": 87152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708068851, "uuid": "4ca7a52b-3e6d-4825-9906-33b70fb41b06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068851, "uuid": "beb1c4d4-978c-43cc-9ca1-7880ff3a2248", "value": "SecuriteInfo.com.Unwanted-Program.00538a001.3102.17325", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d3f9e5d-ccfb-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1708108912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108912, "uuid": "65d381b4-f9c1-4b62-95f0-bec2680521a1", "comment": "Malware payload (Adware.Neoreklami)", "value": "2b9a96f1bf48f37ef36a4442edd4cec0", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108912, "uuid": "0920b139-6179-4d62-8e43-a135037f3730", "comment": "Malware payload (Adware.Neoreklami)", "value": "5839bbec86b17ba5abcf2967fb2a2a2efb47bad5b86151189ea89e77f936985a", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108912, "uuid": "c7fab91e-7c58-48d2-a582-2eea46f8bafb", "comment": "Malware payload (Adware.Neoreklami)", "value": "6fa1d311c8e9f21d9a3af5295c339ca2cb05d9e2", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108912, "uuid": "30ef375c-921d-466d-ae8e-38be6ad0595d", "comment": "Malware payload (Adware.Neoreklami)", "value": "5d0c02f11ee8ca79a757a639e989eaeb11cc69fbfc2ec82485438b362d1723f9614328124e73dcaab886e3bdfbe29d83", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108912, "uuid": "3454523b-b7c8-4800-a1f0-d7b726be73a6", "value": "T1BD7633197AE865BAEA4740740D382BA3E0E1E2DC0722847FC7EEC59E5DBD249D03572D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108912, "uuid": "17f06ce7-8b0d-4301-a0fa-69712db87e99", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108912, "uuid": "f6479a5f-0ac8-433e-8e9e-3b5ce29cd995", "value": "196608:91OzPuyAJHOj+yIeZtkjIdeJ9T90Qo28YpW0NNprW:3OzPuyqTeZikeL2xkThW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708108912, "uuid": "dc043d5b-7f45-442f-b68d-882663d295a5", "value": 7611008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708108912, "uuid": "c101e4e2-5cad-4dc2-accb-bd7cf4c993f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108912, "uuid": "e4a1ed59-f94a-4425-b3a3-21a9ebafc36e", "value": "1V65xThDwhJRksczqoKxH5zi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2cf61d4-ccf3-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708105808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708105808, "uuid": "1127b67e-1ba1-4a1f-a52a-c68ea22a371a", "comment": "Malware payload", "value": "77e4c040a94b5591d2f22828b99e1f0d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708105808, "uuid": "4f5cfb1c-c538-46c4-adde-e4c3b42d357e", "comment": "Malware payload", "value": "59ccc9a42324fd9b6b5a23c579667e21dc8cb57db1c878070eda80e338b2196b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708105808, "uuid": "88cb0cea-f629-4eef-b845-d500e9b64949", "comment": "Malware payload", "value": "52124e4c14a003887157b7239bf7fb3cd709f0f8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708105808, "uuid": "731d6383-df0f-4e5a-8284-72a534711a49", "comment": "Malware payload", "value": "f5525a56a94c3ee2226d2b9a2d2fed90a3c54eedc750fcb0531f660a3c99f227839f7d8c0dd58a9374f7f76f691961d8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708105808, "uuid": "ce4869ca-a78e-4255-ac19-a68fd81371ac", "value": "T186332881B9819A13C5D023BBF66E42CD372563B8E2DF32179E226F51378A91F0D6B611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708105808, "uuid": "76032b12-6c7e-43a6-b0ef-dfada3455ff2", "value": "768:FCfMHOs6LsI7PrNkmUy2SDezeiD/Z4Q9Lfo34YrkQ0J0wwRJ:WMusCUyqzYYLeARIR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708105808, "uuid": "dee00cc1-e93b-404a-b6ed-cf7124e00208", "value": 50780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708105808, "uuid": "69a19ad4-f2de-40a0-b372-498a14e380b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708105808, "uuid": "4748bb30-6ccf-413b-9463-c10bdb9e576a", "value": "shindearm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91f8fd00-ccf9-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708108276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108276, "uuid": "8f83e54c-882d-4ab5-bf50-37ab1e04a37b", "comment": "Malware payload", "value": "dcce5bc3e27295a1cbe13a411244fe93", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108276, "uuid": "c889cf26-c826-49a0-ad55-a786e408c12b", "comment": "Malware payload", "value": "5b1b7bd1fadfc3d2abcd8ea8f863fe96233e1dac8b994311c6a331179243b5cd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108276, "uuid": "90c55585-209e-4625-b798-abadde193474", "comment": "Malware payload", "value": "827c9efd52de962e485825e9bda8fe4f39271351", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108276, "uuid": "8ce791d3-3b69-4898-843e-abccd6973677", "comment": "Malware payload", "value": "c1bf970b3059336fa8f775d167316954c661c3226c915e1037a54b395431fa1aa50f1512d9e4a2744103c15d8755b6e8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108276, "uuid": "358c9773-1f46-448a-8a8e-91ea5072841e", "value": "T11B83081A33F79A21C2E845B880F3055503B5E2861273DF0E2A49D6761E437D7BBBDA8D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108276, "uuid": "d2526346-740c-4164-88f8-fe5cab89bec4", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108276, "uuid": "06c76cf2-7d4a-45af-9c72-459d6b0e4d4b", "value": "1536:dGhaCGjTF5TAiYrSiixlwplH/umiuEVGQ:fdmiMMlwnH/XiTV1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708108276, "uuid": "825488f9-5b71-4d0d-8ac4-4d3c8f667229", "value": 86016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708108276, "uuid": "aa4fd186-2a5d-4316-820c-55a2f02b3cc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108276, "uuid": "84fa2076-925a-4a07-af66-f582dcc01c98", "value": "blah.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b6a06b8-cca7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708072966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708072966, "uuid": "d69d5412-5732-4a62-b15a-85d7214c0335", "comment": "Malware payload (Mirai)", "value": "d61792cd258426ce01a59b34ad935863", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708072966, "uuid": "ef75474a-afac-432b-ba1b-de0f26052a6d", "comment": "Malware payload (Mirai)", "value": "5b47244abfaa217e4abc1e87b1d159bafd119add5479b413a831b6ae14a24ca4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708072966, "uuid": "80ca168d-2348-470c-9ba1-cea3d4a91c12", "comment": "Malware payload (Mirai)", "value": "6e2aa48835f34e769861bb6bed1ac246073ed354", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708072966, "uuid": "1c3a108a-fcad-4f9b-88bc-8866f296675e", "comment": "Malware payload (Mirai)", "value": "63df5e4867e7018754fddb51ec9be1a4df9064fc734e75f5750b6a4e1822822bd8b7e288e6869a3b694bcdb203de3620", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708072966, "uuid": "53d6f546-183e-4d86-8890-5b6340385127", "value": "T176C36A72E8256F68D695D170B0B08F791B93998181576FBA29B7C3B08083CDEF6057F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708072966, "uuid": "f9d46e0b-5a2a-4724-8728-d664ef70338b", "value": "1536:7abDDLIJyTA5pTJv/Tzd5UCyAM1LCaKzPFDS45QqP4jdWJA4nofO1UO9I:7EcJ5j558AM1L8zx5QqOdWy4noyUYI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708072966, "uuid": "4ba0b887-f2ab-4df5-88c0-e5bfcc9a774f", "value": 129920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708072966, "uuid": "a23de281-664a-42f3-aad2-e6eda03c8ca6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708072966, "uuid": "94fdfa43-3326-4457-9365-512ca5f9093e", "value": "d61792cd258426ce01a59b34ad935863", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0b24b81-ccf3-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708105804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708105804, "uuid": "c2b88e76-1861-458f-b78e-78cb26ae5bb8", "comment": "Malware payload", "value": "8a4b325bb209e736c6f5481a60700a6a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708105804, "uuid": "557efb97-6927-4078-8073-77e232211e93", "comment": "Malware payload", "value": "5c2fcc6722a74c374d8d77e7a2d05afb78d85c6ce6cc10f8f14233a7aabef29b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708105804, "uuid": "1b7a3ff2-ba47-4dc4-8089-b6613d2e6f17", "comment": "Malware payload", "value": "8763dfc5d8a8b665b75d4449c355becf28d796c5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708105804, "uuid": "ac0354b7-f5ff-4df5-b153-0a8fc3df16cc", "comment": "Malware payload", "value": "527d7dff42648f7dac5f3c8a0c807fc7c8b6591166be77ef701fe16775e541c5bf5a616de3294bc19cc91bf46f822099", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708105804, "uuid": "c5270dd8-a5f7-4d81-ae50-41be3bd89e78", "value": "T1D9C33B46EB818E03C0D61779B6AF42453323AB6593DB73069528BFF43F8679E0E27506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708105804, "uuid": "780c6bb3-df09-412e-9b5d-efc4cafd7f3c", "value": "3072:xdF5s3tNOEPZU1y/61VRSjGlL+M/9YpsKX:xdF5sdNOEPZUQ/wGGlqM/9Ypsw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708105804, "uuid": "56af4ea6-f95f-4e1f-b723-c83f39733d63", "value": 127323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708105804, "uuid": "4347dc9a-08ae-44c7-ab06-6bb82e9d5665", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708105804, "uuid": "f8a89f2c-b95e-44f6-aabf-acb9e0c58178", "value": "shindearm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3927ed8e-ccf5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708106409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708106409, "uuid": "b3eef200-64d7-4924-9e07-583b898601ed", "comment": "Malware payload", "value": "d13d793e0726847b3960d5621f09d300", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708106409, "uuid": "e88c8a97-9e33-4561-bf8d-75f5bc1f7dc0", "comment": "Malware payload", "value": "5daa9b6e18218e20b738b79b6af14a6dcbeba9fff210344ae51ad66db4f7eb5a", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708106409, "uuid": "e86191d0-e428-4e66-8258-6c07de5fd314", "comment": "Malware payload", "value": "69307ffe902b4e79adbf2622dc83d65f2b477df0", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708106409, "uuid": "bc89ac5a-7a42-498e-a0be-88a7bc86c604", "comment": "Malware payload", "value": "f0c587e259e37d7eb30359a904925f059972bc6cb45d074af2f485192cceede5157543b67580da224044318bb79ddd29", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708106409, "uuid": "509a2932-d639-4c07-a002-73eed22b1333", "value": "T1A5218332011FD71F8E841010FA4EEF45ED3C51549610A788FADE9CA8C1B89BC757E69B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708106409, "uuid": "1dbebe66-615b-46e1-a6fb-faa07819397d", "value": "24:LLMn9uLrCAx6lsm4qmcjLw1dCbKHxUZh46z/KC2OKc2xbl6lmelQKDZF:Lgn8hgsp1daKHaZh46z/3R6gmQQm7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708106409, "uuid": "a39e75e6-f5fa-4fad-8308-fe0d5ef901db", "value": 1405, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708106409, "uuid": "4471d954-6869-49f0-aec0-5fd9d6bd76f2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708106409, "uuid": "8b3acae4-eead-48d6-9055-be49cbdca8f8", "value": "file2.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b05e8d42-cce6-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708100166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708100166, "uuid": "b6869136-2987-415b-9d97-ec9bee36beba", "comment": "Malware payload", "value": "9f797f1d099263ff19b2aecd09707080", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708100166, "uuid": "9e59afa0-698e-4995-afcb-cd9290e64e20", "comment": "Malware payload", "value": "5e058c313a97c5bd3122e8554f9217e18e1c879d72d9f0f5df985f7ff3827d5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708100166, "uuid": "31f2c5ff-ce25-4f90-85ba-89f73ea757f8", "comment": "Malware payload", "value": "da96cf4bc56816aab63ad8cd8613f03a4b2a8555", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708100166, "uuid": "5cbfbde0-2cdb-4b3e-a0fa-56989bf0cb6c", "comment": "Malware payload", "value": "e1d1663391b1a130a38c4fc46b94ea2745e9f955a926575d8fcc086dbaa751910997abc56eeda663d49cfe5676017bc4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708100166, "uuid": "d96b85e0-592a-4808-a72a-9e6b4f1af55a", "value": "T1ACD46BC6E3727800E7291CB08EA39418DADDA97045583D27767CD5DEA6E5BCFB48302B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708100166, "uuid": "015b6b56-92cf-454a-a316-b8f1fa245a63", "value": "f494e9bb2753c3b395b9806eb5f3c320", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708100166, "uuid": "3a31cceb-d6f4-4b55-ac6d-c9416fb1f276", "value": "12288:T8voyMkzQD5w92uPFSfleaq9ffGuYFs89u0Yf1cHQVw3eia99a9i:TRkzQRuEfleaSWuYf9u0YfIQVw3OyY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708100166, "uuid": "af1e4587-210c-4fea-adad-4193a17ed7b9", "value": 620932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708100166, "uuid": "7cf63618-b3df-4808-be9b-140ab2b84bfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708100166, "uuid": "35cb2d5a-c7d2-45fd-a54c-324b47acad87", "value": "TrainerPW.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0382d4ee-cc8d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Tsunami)", "timestamp": 1708061651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708061651, "uuid": "9d1f9818-81bd-48f7-a682-a82c2bb8a16e", "comment": "Malware payload (Tsunami)", "value": "bc57a96223d656fc9b280156f658a64d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708061651, "uuid": "cfd3a502-7531-408b-bce2-d956005ecf05", "comment": "Malware payload (Tsunami)", "value": "5e1b1a7e4ae5ac6e7509b7bb713913ba5e5fa4b2245a8a2a887f6b4652e0b5ed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708061651, "uuid": "95a8f1bd-7eac-4cab-a661-566b87ef2e37", "comment": "Malware payload (Tsunami)", "value": "64c09c10e917569d91c5b24d8a8391019c8a3f9a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708061651, "uuid": "60bd4a70-bd0a-4d00-81de-738674bc003b", "comment": "Malware payload (Tsunami)", "value": "98f26dc5b9470e85a9fdcb2da56a215916587002e9679bb9d862650047fbd7d713b4cae08f8a234ef8aa5dc21d3f2e7f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708061651, "uuid": "a5973c83-3dd7-4570-a894-19d64cff33a7", "value": "T112A32C57B70D0B6BC59B1EF029B723F08B65F56212A221C1E51EFEC017B2A742427FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708061651, "uuid": "4c11c15a-7fc0-445a-90a0-0debd3c5e979", "value": "3072:X/mF64kqDo+aydhQz/fdXbPMTkUUVBCkdQXpW:X/tR6o+RdE/f9DMTkUUVBCkdQXpW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708061651, "uuid": "70149d36-e723-4a69-a200-1593f2c0fdb9", "value": 99152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708061651, "uuid": "67157b32-6392-42ea-bc29-020d7d4118f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708061651, "uuid": "b8ff22f5-561d-4384-8b34-6b6d0cbd7ec0", "value": "bc57a96223d656fc9b280156f658a64d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b23c8caa-cc9d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708068816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068816, "uuid": "c05aaab7-af60-419d-9525-424f186c2987", "comment": "Malware payload", "value": "3ed048f9565bebb7bc66e22cf9e205ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068816, "uuid": "60aa0a4a-6367-4fa5-94a5-a8e08be1d25c", "comment": "Malware payload", "value": "5ecd89004e2f0fd3e17d6a79b17847c6536a5b0f7766f83f0b41eb67b7df41ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068816, "uuid": "a67bacae-f5cf-44ef-95bf-2eb7604656ee", "comment": "Malware payload", "value": "308a6bdaf82cf12bd50e048522e34a71ca53bccf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068816, "uuid": "bc133b40-c2ae-4b44-8a84-278bf9b93e5c", "comment": "Malware payload", "value": "9f582189335fa183887c440fcc2e6d1166a01438b493510543e1a74b667e3f26a4838b4cae3fd36a450858627b9a8fee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068816, "uuid": "cd985805-7b16-4b73-ab21-4e59c88b1735", "value": "T189549E12BB944876CA4200724DBF6B7BFABAED954F115BC36348F96C8D315E0D237249", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068816, "uuid": "74ddd6f7-83a1-4a7b-ba55-b6721d045d20", "value": "c58493f657ed3c3c273038c1a190f477", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068816, "uuid": "7a520f19-a481-417a-9316-f8781ec07dd0", "value": "3072:uENJ4ogVVjObagOVGWMBSChH0GgtWNuwyvRJn25RRSZl7fAVANBqmIDjt6fIJzB8:dJ7gVKaJVGWMSChH0vc5G7quqr5BeIz6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708068816, "uuid": "b105e9b1-cb28-4f1a-b8b7-2b5c79835b52", "value": 304240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708068816, "uuid": "cb39846d-1ff4-4349-903f-dcdd57f8eece", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068816, "uuid": "dcdc2170-6000-4d87-839b-a15431cde908", "value": "SecuriteInfo.com.BackDoor.CmjSpy.321.6724.3212", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10f1f6aa-ccfc-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708109348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708109348, "uuid": "ceabfd6d-9c36-4cf0-a8d4-9fdaf5b72e3a", "comment": "Malware payload", "value": "72ae4dad97d845c0b05f96d815e2fda4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708109348, "uuid": "fdcd58eb-a13b-41b3-bba0-4022ebee1eca", "comment": "Malware payload", "value": "5eef7a796512d97875116506862733e389c1d7cef5d3717246ba331a61b9a84b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708109348, "uuid": "546b6718-76be-4330-abee-e6c46bdd7750", "comment": "Malware payload", "value": "d1ecaf4009317d8ef381916aeca1b0ec5e645e25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708109348, "uuid": "688105dd-fd26-4f71-8bf9-beb86bd80b08", "comment": "Malware payload", "value": "88b433ff86482b9ea2fccff5889fda3b251dc1741e9b4ac33f8cb821bc3919139392e9f68693aeb950b8464d15b3303c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708109348, "uuid": "82d7f682-6744-438b-a03f-4416fee0a058", "value": "T172D56BA1B607FA9BC48A16B48417CD95352C4FB48333989BBC5C7C7EFE72CC22592919", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708109348, "uuid": "1bb80e1c-3d38-4f1c-9e64-8697005e50e4", "value": "486ca3f472de32dd22473d52f4331bd8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708109348, "uuid": "621e944f-a482-4d7d-83c3-a5b17a2f3da7", "value": "24576:NzhD9nzoSc6LZY6ut4pBV/JeperDoqLvfMYSQ6CY4Ls9n06uSG9c9ru3uf678VW6:VhJnzMaZBv/NS2wwvXtgBH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708109348, "uuid": "8fdc627d-a8d3-43f1-b65c-d73b2d25d5f8", "value": 2760513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708109348, "uuid": "7c834806-170f-4946-90c3-827139d62ea1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708109348, "uuid": "8f7909b4-57b4-47fb-8a97-48731dcea2a5", "value": "E_MountLite_66.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8f8abce-ccc5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1708086007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086007, "uuid": "bb1e28e4-8500-4e25-9764-b0de4a130af6", "comment": "Malware payload (AgentTesla)", "value": "376dabffe4a104f24e0dbe8963a5bd36", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086007, "uuid": "55d4cd4d-702c-405a-83ea-8792437194cc", "comment": "Malware payload (AgentTesla)", "value": "627a615a3ea5a89672fea8779431f86f6a11bf03df9d0c66e4e5f033680454d1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086007, "uuid": "8ae0a06b-69b8-41b4-a62e-68abb46cb486", "comment": "Malware payload (AgentTesla)", "value": "a7c7d18ebcad4e77e5353089f59e19e2b6f546d7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086007, "uuid": "c5aac287-af42-4817-9600-fdd2598ab4d8", "comment": "Malware payload (AgentTesla)", "value": "652205f6f7b2470ef312eb21b8397e2cad980050823692c65a5c633af30fcd50cd1d9051b188b0e5228ea0d2fe00b0e5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086007, "uuid": "99f62fd0-711b-4863-b282-5f8005f23b7a", "value": "T196F4230EFC7E71D596F8E263699822191915BC6486074A8D5580EB370F23F83FB36B71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086007, "uuid": "1a6c9e6c-8676-4aac-8e75-46ab783e7d9c", "value": "12288:WkJz6Xni2lUJqFTa4d/Ni2+mdNh8PVHcSkXt3p1IEJOJanuahtYexyUyrSwTDjaw:96XnNlFESN0IbxXtZCEJtnuavYeyzWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708086007, "uuid": "1b4b8cab-f13b-47fa-a9de-ef6771fb3823", "value": 763791, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708086007, "uuid": "aea9020e-9c9b-4ee1-93ed-4b3b699bc4d8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086007, "uuid": "60803737-d0fc-43be-bbe7-201cd3fcc604", "value": "36KV XLPE Cable, 300mm\u00b2.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "849307d2-ccce-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1708089785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708089785, "uuid": "904804cd-5e77-4ae7-a690-8e65736619f1", "comment": "Malware payload (AgentTesla)", "value": "87d5a37e59ab075d061953cd838c18c3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708089785, "uuid": "554245d2-b3f5-4ae6-a26d-2da7fe8a08be", "comment": "Malware payload (AgentTesla)", "value": "6303997ee7991fdfe0c2e0807c3d961fbae0cc5542a68ca7d39851bdf9a5cc55", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708089785, "uuid": "0e2a46e9-a0ae-431f-9282-a746fcfeb19f", "comment": "Malware payload (AgentTesla)", "value": "a88a0e319f049b6e1b7b308ed0726bbfca7dd605", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708089785, "uuid": "95b6e3b6-8654-4495-9251-8810722767e3", "comment": "Malware payload (AgentTesla)", "value": "7b8ef09e52bf8d23f19baee66b90d24989f8adc6b9ed471b10867f0ff9d25a956bde2a29d249327c7615e75f94dbef20", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708089785, "uuid": "df4bfa43-a8ff-4279-b7fc-4d2a339ec4b2", "value": "T1A9E4222221B47BA2CE3C47F95525105183BE96BAE0D1E3485DCAF0D93BE77018BD6A27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708089785, "uuid": "78181871-418a-43a4-bb25-5484a55c862d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708089785, "uuid": "56870e18-c47c-4fbc-a111-34423c0dc6dc", "value": "12288:gjQ4W3A81mOF2w+Yes8rg8imzO5wIG2Of7nXMDwYon7SNUKwLQsVZL+y:gVAgN5g8iVwInceo7SNUKwLQGCy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708089785, "uuid": "13591c3c-67f8-478b-81f0-2ae53062b940", "value": 690688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708089785, "uuid": "b7847d24-d6f7-4b96-aeba-6af008837a16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708089785, "uuid": "45da7283-66f7-48a3-adda-76dc298649b2", "value": "87d5a37e59ab075d061953cd838c18c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee865297-cc8c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Tsunami)", "timestamp": 1708061616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708061616, "uuid": "81913330-7449-42d1-8c31-afbefc9a8bd8", "comment": "Malware payload (Tsunami)", "value": "4db1cbc58c0ea81d98c69ea0cab1aa67", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708061616, "uuid": "14b3a384-d8a4-49e9-869d-fd3406f02658", "comment": "Malware payload (Tsunami)", "value": "643eeca9603e46925da2151d0e901a72ef1eb1b04aa3f6848ed583d9e1d1a141", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708061616, "uuid": "8ab380ce-ebcc-4fd7-898d-86b7a0ee2575", "comment": "Malware payload (Tsunami)", "value": "d955937b9f8664c567cb4238cc8607210a488854", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708061616, "uuid": "d510f47d-3ef3-427a-8757-bdb0ddbd9410", "comment": "Malware payload (Tsunami)", "value": "4bd41ea19bbcf4462726c39406103adde40ed4fd7315e132ffc46d7980c64573bd269d005e3be3d243f6c636ebb22873", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708061616, "uuid": "d7959c32-7f8b-4058-a8bf-1295b3c6277a", "value": "T106F33B05FB508B37C1D2277AFA5B838933228BA4A7973342D92C6BF42FC27995D32554", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708061616, "uuid": "00c359c0-d040-495e-bb45-634849a04974", "value": "3072:fE0gigFLuc9G0/UeNXahSLsydvIBPBveayUKG44ufm20YlsGr3ZN+h0ldhQzuGrh:A8y+6m7YWGrJ8hIdEuGrri8cDqtB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708061616, "uuid": "be9f59d4-79f4-4276-ae48-c6dd116bb154", "value": 162832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708061616, "uuid": "4f3d8ca7-8933-444a-91cd-ece39e5be50e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708061616, "uuid": "76c03be5-112e-49ae-8ac2-92f854041911", "value": "4db1cbc58c0ea81d98c69ea0cab1aa67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eb4826b-cca2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708070797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708070797, "uuid": "5541d1f2-3402-40d2-a6ef-397718af109e", "comment": "Malware payload (Mirai)", "value": "847ca4173e5e93f537d3655ecddc6285", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708070797, "uuid": "eca7b536-b409-48a4-90de-c33c34d42308", "comment": "Malware payload (Mirai)", "value": "649fa02f58cb21ba0c0e1ba4f7a12b112ea58655a6accc9d37a56cc56f188d34", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708070797, "uuid": "6fa2b91f-026a-4caa-9adc-4bb514540039", "comment": "Malware payload (Mirai)", "value": "c3104618fb5681cdf22c63ff80f839a1d29e8510", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708070797, "uuid": "c0994aa1-35b6-4b1a-ad2e-10a078f68374", "comment": "Malware payload (Mirai)", "value": "bb74463ed9d1970f38f7ca90c3ce7ca8da075bcc575df0719b5d468e277fa3b610b6ad9f33935bcf89d00fea02ddcd5b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708070797, "uuid": "da196544-8e08-469e-a10a-b05b9b6dd76f", "value": "T1BFE31A56F8819B11C5C111BAFE1E128E37131BBCE2DE72029D246F747B8A97B0E3B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708070797, "uuid": "ab4de0db-1ff3-4c89-9d47-dec622290186", "value": "3072:+NousY12Uss4o6XWUYlYiaofZlHtSCXbY9NYx:Wow2X26XzYl3a4WmbY9NC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708070797, "uuid": "d39fc2a4-cc4f-44a4-a75f-939d3bcc6354", "value": 155004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708070797, "uuid": "2fb1fb3a-6979-41c2-9b1b-1939b87ecaf0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708070797, "uuid": "369ec5b0-6da5-4de7-913e-648e95e25507", "value": "huhu.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df03faa3-cc8c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Tsunami)", "timestamp": 1708061590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708061590, "uuid": "c1b53b79-d8ce-4052-a7e8-b9a2b2be4502", "comment": "Malware payload (Tsunami)", "value": "77c37d9602781aa49c63a9fe64246350", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708061590, "uuid": "2eeae446-089b-4a00-8c4f-ba2ec0d8b0e1", "comment": "Malware payload (Tsunami)", "value": "652fa22ab66830da2cef315848d74a49fe41809c36b691b202cc1e8643ecccda", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708061590, "uuid": "063e3159-e202-4375-bf12-729566b35d34", "comment": "Malware payload (Tsunami)", "value": "7d8fde7fcc77c7e043c838c9a3f79665228d850c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708061590, "uuid": "064a23da-375e-4e2b-8629-e29d9fe4d7b0", "comment": "Malware payload (Tsunami)", "value": "70087183dc1a6e2c7703aa7e21639c3ef828a90b7346ef6a2cacd68a83430deaa627ed336df0348a958778dcbf3c4dcf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708061590, "uuid": "6a8106e8-4b97-455f-b3bd-ba44e1d0466a", "value": "T1FB935B0758624FB3D04A6EB52DB75560075BFA620F4F0B8BA26CA9F40747CCEB50E7A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708061590, "uuid": "9166ddf5-35ad-4920-8a61-082347b3850b", "value": "1536:leu7zuKSd0d8ctOp6JnjCudhQzujnE6C2UVBnH/XQXwW:leE1SRctfjndhQzujE6dUVBnfXQXwW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708061590, "uuid": "be1fc436-7f20-43a0-bb63-719f0172139b", "value": 90824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708061590, "uuid": "4609c312-64b5-4aa9-96ca-a96a6d462333", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708061590, "uuid": "44803bb8-420e-4f90-9bea-568844aaf7f9", "value": "77c37d9602781aa49c63a9fe64246350", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0b6c2d6-cc8c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Tsunami)", "timestamp": 1708061566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708061566, "uuid": "aa2803cd-4749-43e7-8ae0-47416191ee1b", "comment": "Malware payload (Tsunami)", "value": "0b9a409d5b560277a755d18b0446addb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708061566, "uuid": "4cb4ee20-1513-49dd-96c5-512b3fd324d4", "comment": "Malware payload (Tsunami)", "value": "656639f032e8e10efc8c581cf03bd2a75c89cdb71cf25e857f2bca1d8b983c42", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708061566, "uuid": "c0c4c74b-f247-4787-acf2-e629aff57a31", "comment": "Malware payload (Tsunami)", "value": "43798d74458be86829ff66cec10073578c724149", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708061566, "uuid": "30e11cdc-aab0-4539-b781-f9f7ceeb285f", "comment": "Malware payload (Tsunami)", "value": "8d5327542045bc053720bd0a80bfcb7302519a1dbf94473e601897cf7be914315db42211979656dc1b15e85c23173b1b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708061566, "uuid": "f5cbf582-1909-496e-8c63-aaa1453b1c3e", "value": "T169833A836650CAF3C5531AF502976B984B36F93B0E7BEF81F31C6CB04E61588792A794", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708061566, "uuid": "f0d1feef-9e11-47e9-9a1c-d61aaa0fa029", "value": "1536:6WpMwtyWhH9ejtkVV0Ly50383jh5F30dhQzy1Hpko9VgbvCPVFL3ApQITA:6WGwtySlVVD5k8TF0dhQzy1HpCbKPVFn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708061566, "uuid": "e71f35ee-b71a-43f3-a10f-33f749b6c8e6", "value": 82797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708061566, "uuid": "67ae4cfc-9c50-4713-b9dd-84abaea850ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708061566, "uuid": "10f5456b-a240-4ed1-9456-66109f26f951", "value": "0b9a409d5b560277a755d18b0446addb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4605f75e-cccf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1708090110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708090110, "uuid": "fd2c52ec-8047-4b4e-9aba-8aa3f35e3719", "comment": "Malware payload (AgentTesla)", "value": "9dc5e58f6d0bfff562c1dd75e936810d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708090110, "uuid": "eebf38f5-174e-453f-8915-90070d3d2d08", "comment": "Malware payload (AgentTesla)", "value": "66c5379be5b060d3c326f5689a014ba5c010f16ab13b06de21dc937bce8ae86a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708090110, "uuid": "f5061315-217f-43e9-b1b6-12bd4118e6f0", "comment": "Malware payload (AgentTesla)", "value": "1860137e78dab67f3025f604ab9f6bd3ccc7035d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708090110, "uuid": "b1a026b9-5b08-4f5d-808d-85c01fdb6459", "comment": "Malware payload (AgentTesla)", "value": "81f7bfd535333ab85ee00366c2522a0f3a599e2094737d5913af3053b47d87f56d41e9d0838d9b485a0587f18591fc6f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708090110, "uuid": "0ed1880f-4ed1-4ec7-8657-7bf03dab6b91", "value": "T177E4232431B97336CABD87F5727820E107BA9526B150F3D14CD5B5DF2A8AF008692FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708090110, "uuid": "90a080ea-7a7d-41da-97e2-8763230d9aa7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708090110, "uuid": "1675d98d-b7fe-405a-924b-fda841391d30", "value": "12288:UwQ4W35uO8v+rR666+lyficCPNlgF7G5fFNp512BFQRFdhza:UIA5ulmrR66ifpCllgpi/p517m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708090110, "uuid": "d2048b08-00c8-4741-8c86-9de92a114f8d", "value": 693248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708090110, "uuid": "00b0e4f2-86c2-405e-9bb0-275a1360ec9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708090110, "uuid": "3952b757-75ec-49e8-b549-9c112dcda10c", "value": "z13J5oYc80SrOlGatP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82e7f647-ccd6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1708093218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708093218, "uuid": "5725ea71-5888-4215-86cd-26a6a3e58fe2", "comment": "Malware payload (AgentTesla)", "value": "8077b3e5a20f5d489fa82982140733ab", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708093218, "uuid": "79c32aa7-4bb0-4a72-82a2-b44c811775d0", "comment": "Malware payload (AgentTesla)", "value": "67362222dc4dae93f62f984771afb1b9d319ea23335bd4bb4e941f5e1248edc2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708093218, "uuid": "f705c7ce-5455-4630-a834-f6d5f911f2b0", "comment": "Malware payload (AgentTesla)", "value": "52a097dfa8e24b4ab52c9cae829df1b38ecc4e84", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708093218, "uuid": "3097d90f-1eab-4240-b9f6-fc1109c55cff", "comment": "Malware payload (AgentTesla)", "value": "0d5f709363124e4d5654c0cc5f9a30f0418e11f6a4c7642cdb53c8c2a1494536e5cdcadcb7780d4022cf9b86042e8c62", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708093218, "uuid": "9a442eb6-085c-4199-b86d-c26393024b08", "value": "T16015C022F5C69036C1B327B19E7EF766963D6D360326D29723C83E315EB05816B29723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708093218, "uuid": "92236b51-757a-4807-a1d8-b977fc703733", "value": "d3bf8a7746a8d1ee8f6e5960c3f69378", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708093218, "uuid": "96c38c90-987d-4917-bd2e-2785ff74c17b", "value": "24576:pRmJkcoQricOIQxiZY1iaM/U48ni1dq6ReVbi4:mJZoQrbTFZY1iaM/vuWdq6O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708093218, "uuid": "2856b3b4-f181-46fe-be97-823afbe586ff", "value": 942455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708093218, "uuid": "49e78c0b-03d1-499a-9b77-4d47f53b8065", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708093218, "uuid": "c0989442-9227-4abf-a690-34afdd416c74", "value": "EWW.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2a375fe-ccf8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Glupteba)", "timestamp": 1708107928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708107928, "uuid": "65595aad-f215-4c6b-aa5c-16bd82804f19", "comment": "Malware payload (Glupteba)", "value": "665144a3735750d01b271fd052798b50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708107928, "uuid": "7447cba9-6d45-41f6-8992-8bd89fd50d8a", "comment": "Malware payload (Glupteba)", "value": "67a20859e5bbdc1d14e676411102e429e3bef682b98c0482fbd8f531c1ff417c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708107928, "uuid": "d299948e-66b6-495f-8d1e-996c0a3b3cf6", "comment": "Malware payload (Glupteba)", "value": "5abb144159e75af230c17fb90f71111902410c5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708107928, "uuid": "460b22f6-0e25-4300-ae8f-7663c649be69", "comment": "Malware payload (Glupteba)", "value": "e6887c1338dbf196a480d8afe222e933bd7c4a29939732de97ea0791850c9aae6fc529cfdd39e7e9e782b895d47d0d4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708107928, "uuid": "338100a6-71b6-4f6a-851d-baeaa6a94be7", "value": "T1461633712295C275E163273E8D60DEF20D7E3822E272E58F3BF54579AF386A18530729", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708107928, "uuid": "16b254aa-af1c-4380-b1b1-ef1b86b59b4c", "value": "a23f80ebb5180166b721931b00404ab4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708107928, "uuid": "ad476035-1354-400c-bcaa-559ff5052aa1", "value": "98304:pVhcdKJHEnZTRTBaBVuUMc61j3OcapEaNTl1+lpR0+O15R7Vs:p4UJknvTs761TOcalb+ziHj7m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708107928, "uuid": "52e00d8a-a1be-41b4-93ca-46feb6ca36cc", "value": 4364688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708107928, "uuid": "faf99b1d-9ff2-4023-b960-f3c2926f7e0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708107928, "uuid": "a48c9a89-c570-4fed-abd6-61a49ab6f608", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "955115ce-ccfa-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Glupteba)", "timestamp": 1708108711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108711, "uuid": "3d1f10a6-91a1-42dd-81a3-76d1e80ddd7b", "comment": "Malware payload (Glupteba)", "value": "5666c1f486343ac45bd6e56a68895b30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108711, "uuid": "3f4f8ff1-2faf-471c-96c1-c0bf387cde73", "comment": "Malware payload (Glupteba)", "value": "68d3f9a99b088216e7825a88db2d5ff0ccc669050abd9574ad101b8a2c536581", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108711, "uuid": "d439588b-8b1d-4224-aaa4-c317d036b48e", "comment": "Malware payload (Glupteba)", "value": "1575dee5754afdb0be4d0fd5c089e9516c7cd08c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108711, "uuid": "0013633a-448a-4d4e-ac60-7f8e88d8e6ad", "comment": "Malware payload (Glupteba)", "value": "14eedc74454e638d2695cec01c7e3b4af724e4505264a27f94fa472bed209667a208f2e71996bf63724c2a60d951bd8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108711, "uuid": "eac5c299-dfbb-49db-8298-a83ccaa42b79", "value": "T1B316332035F5CC31DA676234CA2C4772CFBD3C7265B01A9B97D2B1AA2F65F51A134368", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108711, "uuid": "1c7605d1-a2dd-4c33-843a-40d20a45ef51", "value": "701b7eda6b324e6e9073377243e2004c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108711, "uuid": "d5d4d143-3d68-4b4e-ab26-210853cd0955", "value": "98304:2BHjSuPxAevvEm99QhtbMBLIsONshHSPvvR7r:2BVJ39q3MBLKQyXVr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708108711, "uuid": "6500b2ca-aca2-45b1-84eb-9ff86056d7a3", "value": 4326800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708108711, "uuid": "ce851060-0ba9-4c0b-887b-e928974b360e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108711, "uuid": "e4b1509e-1c35-449c-9756-b11fc75fe09f", "value": "SCdNhWMdxpZb4IQ24gqk9ire.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d34f827-cc8f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708062607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708062607, "uuid": "eb1a058a-25e4-4d0e-a076-8bd71fe3db53", "comment": "Malware payload (Mirai)", "value": "92d4b9598a68b86b459bd4067d236034", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708062607, "uuid": "ca929700-6df8-43ed-9639-213f0e99b188", "comment": "Malware payload (Mirai)", "value": "69b2a4f059638f4be5d76ec31ef24d6c1adb631cf7839c8e2cd87e3de48c6fca", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708062607, "uuid": "e4f2096d-ad2a-4a6e-8c60-c839023d4cf3", "comment": "Malware payload (Mirai)", "value": "acd4c6586d9ac5a0b72f5ab4d478eade86e1b7f9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708062607, "uuid": "c5d6e2b0-944c-4838-a2eb-ac912f9090e0", "comment": "Malware payload (Mirai)", "value": "b08170453bc700da6dc92609cdb37a926df60d1e66b9aabf58784fd9ef048780c760888429619a5cad8393ba53967319", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708062607, "uuid": "34ed3888-8409-4ce8-9748-a4754773abc6", "value": "T178634A62B8815A27C5D423BBF66E468D3B2563E8E2DF32079D312F5137C682F0D27A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708062607, "uuid": "7c6bd9ee-870f-478b-b080-fa09467f17ff", "value": "1536:HJh0i6BIG8vgiNTFu9xhfxoIHELX7qBI8rDJa10:HJh0UUVfauE7GBprD4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708062607, "uuid": "c4c757c9-cafc-4f00-8333-a6a79141d8b9", "value": 69028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708062607, "uuid": "8a3a5ba6-5ee8-40ae-b3e9-f7af266a7fa5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708062607, "uuid": "4f42619f-27e1-4c68-a80b-187a8771ca60", "value": "RpcSecurity.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7d30e3e-cc9d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708068852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068852, "uuid": "7e7b98c9-0f83-4367-ad84-c33c3f7a131e", "comment": "Malware payload", "value": "994cb6684100b5b90a27ca9c2648fe82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068852, "uuid": "f922a5c5-17b5-491a-888f-636914030be3", "comment": "Malware payload", "value": "6a7cc3802fb6875835604d2ef6058b5fb6fde44f6dccf97f747c555b78e9b281", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068852, "uuid": "15b388ee-a5c1-45b3-9652-8b016bb02ff9", "comment": "Malware payload", "value": "b66bb0f94a924a439a6483d5fb919b28761d17ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068852, "uuid": "8976dfd3-d4bf-4004-b542-05bf572340a6", "comment": "Malware payload", "value": "af8a22324049c846438512060824be79c4bbf6139ab291ef21dda0dd478f03de4122a755f55238989f81481ad549fe31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068852, "uuid": "b8a72add-0e31-4b6e-9a0d-72c5b3e60f7e", "value": "T11B159E02F5F280F6C22519311D6E773AAA7ADA571B24CF87A390EE1D6DF21C19837139", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068852, "uuid": "538c5c89-941e-4602-9bb6-2c5c2c44393b", "value": "850fd08e5f766f5e6c4d7211614d752f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068852, "uuid": "982b9a65-627a-4469-8791-6e7aef2efcf9", "value": "12288:kWJtvl8pfXTju7m1nav9uHsivAIutHEExiyN3aad2+Wr65+4:kWJYpfDjymgv9RHE1ytHd2+Wrl4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708068852, "uuid": "92489575-dac2-48a9-b13e-b10d71f08354", "value": 892928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708068852, "uuid": "a933ebd0-a8b4-4570-937d-1c1d9b56ec92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068852, "uuid": "e9fdb8fc-345c-46c9-9b85-902b8fb0b0ad", "value": "SecuriteInfo.com.Win32.Evo-gen.12368.19042", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bfadea3-ccf8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1708107622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708107622, "uuid": "3656cd2e-f5fc-48bc-b3d9-4e5897565202", "comment": "Malware payload (RedLineStealer)", "value": "0dc6b0988880054c5750c88a37d6776a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708107622, "uuid": "9e6a39a0-8396-4beb-b594-eb132551946d", "comment": "Malware payload (RedLineStealer)", "value": "6b3442f3867aad390ecbe493e952df11f40ae02727d068b4fcc2485513706257", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708107622, "uuid": "18f815a0-c277-4d5f-ad6a-44bd37079b05", "comment": "Malware payload (RedLineStealer)", "value": "c65496f6d349457ee9d9b2b238a068e23a55c273", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708107622, "uuid": "aecd360e-ebe6-4810-9606-2256152de3c1", "comment": "Malware payload (RedLineStealer)", "value": "2891f59ae5a89c009ae1ea57bfb53686bced1c6085474e7cb2cbe038433f891d67c93f3fb59466d4712ae306bc603262", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708107622, "uuid": "1289a3ea-2d0b-4c35-a577-fa6e193b8748", "value": "T169A4F12126F5D031D143E2B18925CBB60FBF7C76F561E8DF2BC295BA6F24690862930D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708107622, "uuid": "5478b646-b4e1-4eeb-b200-257f31b12054", "value": "701b7eda6b324e6e9073377243e2004c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708107622, "uuid": "d070ff42-9098-488b-8dd6-9dcb3206cb3d", "value": "12288:Yd6yhKSv2bbOLUzyVpVveafKoMCaAuE0uizUM3swJ:CKSuD2VrvCofGEMcwJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708107622, "uuid": "b3b015fd-b26c-43f3-86a4-87631635245e", "value": 480768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708107622, "uuid": "7e981805-d6e8-4f45-ac92-ed5c4d5ce6a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708107622, "uuid": "f939a788-7219-43a0-a75b-4e069b0136e0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eccfe61-cc8c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708061294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708061294, "uuid": "ad428b20-7074-4651-8589-db3f6aca7cec", "comment": "Malware payload (Mirai)", "value": "57a9755bf5689ae9c4fff9d9b2efc491", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708061294, "uuid": "29cdc235-88e8-41f5-8fa2-829796098b76", "comment": "Malware payload (Mirai)", "value": "6c64ae730fb3921eb6d36673d09e48e76b4822fbb6e32cbb310520db376acf5a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708061294, "uuid": "b9c76c20-4962-417a-b878-cbf7a8d831d2", "comment": "Malware payload (Mirai)", "value": "b7c9c1d24d50281dc5f15415fa4afa0b6f47172a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708061294, "uuid": "ba58aaaf-d3b5-4638-8a58-bdab84c09829", "comment": "Malware payload (Mirai)", "value": "280c8ee563ac790a1ba003712ffee647a6c1aed7168bae03d35f219f211cebae54e06561e3b07188326560cf98e53222", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708061294, "uuid": "fc44ccba-a1b0-475e-bf33-d847e7090d1c", "value": "T10D937DC5F243D0F5EC8705B15137AF379B33E0B91029EA43C3696972ECA1911EA16BAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708061294, "uuid": "2e1fc970-a695-4465-a293-c57b155da0bd", "value": "1536:sUYl80AvyebhzEzASUs39IaJi7M3MX1+NgKVL4GRUS3tkDN67:sUYq0ovNHSn39IPI21HKVEeBM07", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708061294, "uuid": "02ad17c5-ffba-48ec-a91a-21615a98d3a7", "value": 89672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708061294, "uuid": "39a0ce9f-9f59-4cd9-8f4e-f40e8232f71d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708061294, "uuid": "93829380-487b-4520-85ec-6cb9077b3493", "value": "57a9755bf5689ae9c4fff9d9b2efc491", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df1c7cd9-cc6d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Pikabot)", "timestamp": 1708048276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708048276, "uuid": "d963d55c-7090-43d3-84d5-71d94d31bf1b", "comment": "Malware payload (Pikabot)", "value": "06bf67a1a4b9688d5ea65698b9f46db4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708048276, "uuid": "f08bdf03-90d9-421c-8b4d-d6938c793e42", "comment": "Malware payload (Pikabot)", "value": "6c91b714aefef2438be04161d812403279c2da887902f9e979e83ace50dbb37a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708048276, "uuid": "bb287a5f-8d95-4fbe-9fe5-b6a70312f347", "comment": "Malware payload (Pikabot)", "value": "42f0a6739acc2251a7c38239258fa9b7a2fc13f0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708048276, "uuid": "96d2256a-0579-4ab3-9274-9fe638d7488d", "comment": "Malware payload (Pikabot)", "value": "cc96cba18f7c956350659d57d7b64698f7e1d397bfb36131ad38ec7446e8aa3f309c6256fad745968f376182b357533a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708048276, "uuid": "0e7c1f3b-8394-4561-91c7-f9062a771304", "value": "T12206AEA17DC804A5E07B03314F99FA78F16E7DB01EFE31971292F629A936D410B1C66B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708048276, "uuid": "82e68fdf-4b79-47c7-a039-25018ed0f67f", "value": "607d0c9fedb370b1ce70573304bcd084", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708048276, "uuid": "13499f7d-b104-4b3c-b5fb-a7c3985c3808", "value": "98304:xwrMZ1Fm2dvuvPSyzxUY9TdxbfPMHFLOAkGkzdnEVomFHKnPY:xDZz+dxbfPMHFLOyomFHKnPY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708048276, "uuid": "b7b8a4f1-f0f0-4f5b-bec1-5ac76bfe783c", "value": 3771464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708048276, "uuid": "5d9358cf-0efe-4ee8-9fd1-a9ee1163630a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708048276, "uuid": "2d5fc7a8-cc56-40da-9157-aa74c5ea10d1", "value": "SdQ", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9e68fec-cc6d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708048294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708048294, "uuid": "35c89b81-abf1-42f1-9f7c-5c6e9e759bdf", "comment": "Malware payload", "value": "1bb607118047afc5c385b82385dd931f", "object_relation": "md5", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708048294, "uuid": "f79dd0fa-ba59-4c19-a864-15883d7fbda7", "comment": "Malware payload", "value": "6d0b4b5b2e80af440defa248dcbdd8b0d8abe38bd8b4cc10d5e60913195cd73f", "object_relation": "sha256", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708048294, "uuid": "eccbf8c6-ac95-4cf6-822e-42a9e9a799a7", "comment": "Malware payload", "value": "88bd192cc4b7acb21b9c4c2056d3e05d838f9f60", "object_relation": "sha1", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708048294, "uuid": "97d31b87-a5f5-468a-8de7-32f55176852d", "comment": "Malware payload", "value": "d7429d6f96f21a7295a2eb775a415fca4201ac5688a2196d5ce9873a80a72c7f735dbc77ef0d28263dc3d69a51a95eab", "object_relation": "sha3-384", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708048294, "uuid": "61391740-876c-426d-b446-69a55bd6cab2", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708048294, "uuid": "a9bf9df9-95cd-4ad5-bd1d-fa3eefb4c59d", "value": "3:HX:3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708048294, "uuid": "ec838d54-b832-47c4-97c4-72c46fc8cde9", "value": 18, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708048294, "uuid": "839b59ce-0a92-4e35-a835-8cd8534b67a5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708048294, "uuid": "3690e8ee-3027-4498-84c6-841aee87b14f", "value": "1.cpl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38f6eecb-ccc6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1708086222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086222, "uuid": "43e499e2-2a15-49f0-8de6-dfc405bb16b7", "comment": "Malware payload (AgentTesla)", "value": "0a88ee819bfdcffac9429d1476667b23", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086222, "uuid": "6dfd0678-111c-4e3f-bda3-ba04bbb296ae", "comment": "Malware payload (AgentTesla)", "value": "6ecf0da45be85e0af57e9c74de09ececa8240f1c9ab48066c0f34ce18c4a7fab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086222, "uuid": "169a8139-1ddb-498f-85a9-a5237407deec", "comment": "Malware payload (AgentTesla)", "value": "d9eb02f212dbb4c8f93d56533a806551546a535a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086222, "uuid": "90607977-3cea-4be6-a13c-1a236f244028", "comment": "Malware payload (AgentTesla)", "value": "720cfad1d5b7c8714efe27d1e9cfe6aa7d9fe9edc37c054a302a7e00a933020c1a85adc68fa2f21f95201314eaef6366", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086222, "uuid": "f98391b8-1535-460b-92ee-ed54e941fb2c", "value": "T180E412043625DB25C468A3F4E66480F613FA3D19F072D2AB5FC57ECB7AB1B528642B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086222, "uuid": "1bc2bb92-d9db-4648-b485-6d37263bafce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086222, "uuid": "262e8459-150e-43ae-ac81-2d68eb96d5c2", "value": "12288:0WEhssgdksE8quzpYhhxn1dOupNJlXQB39XnRv9LXl1HmbncOf/:xEhVgdkzVuzpudV29XnRFl1unr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708086222, "uuid": "a3669ab2-824a-4cbe-aef1-f6423b1cd127", "value": 658944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708086222, "uuid": "362f5691-d697-4f89-a2ff-4127b9c23d55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086222, "uuid": "e6908d36-21dc-43c2-af9f-287c228ddd53", "value": "2023000000025 scan_Fiyat Teklif - 10523 2023935164- BUET 0%01%..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99e53e40-cca6-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708072641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708072641, "uuid": "fb4b75ca-52b1-4f27-abcb-0bc76fef9bff", "comment": "Malware payload", "value": "085fb103d697f5b865af82b36d860200", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708072641, "uuid": "abe84da6-e036-4cd2-a193-7db210e9d732", "comment": "Malware payload", "value": "6ee34c533e633d0e6a5dc58618a7328cb57fb990963e822c7d93f3d46405afc0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708072641, "uuid": "c51b6f31-f8be-4bdc-832a-a7f491718244", "comment": "Malware payload", "value": "e3a7797f0405fcc9184f86c194cdd6b55680a2ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708072641, "uuid": "f6075e86-31ec-4896-84f5-8bc4f4d50d18", "comment": "Malware payload", "value": "fbaaf0f06a5b29ecd26db2786a9f38ae33333926859df298b89328a8cb9230e08d9090917cfed1149ba22272483d3b8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708072641, "uuid": "2f233456-7877-4dfe-a4a0-30c1207677ca", "value": "T1820429A7B2A440B6EC76C23485531F2BF77AF81507219BAF035406E99F277D09D3AB50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708072641, "uuid": "9bd40ab9-eea7-4ff1-bb94-d8245a6a6a71", "value": "8b6f3d7913fac7fea55dfdfab8fc8155", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708072641, "uuid": "1b48c274-becf-4369-9691-97c94f9c0536", "value": "3072:4pHn7U8MHI37HO6QHieCpjcaWnv8lJGqPD5YVqsCfxKTpKckPxiTzV2229y:GH7fQHieCKaWnEbGqq0229", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708072641, "uuid": "65d58746-934e-40f8-a858-2be456647cf3", "value": 186368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708072641, "uuid": "4e0392f1-3188-482d-a556-a339e8998f98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708072641, "uuid": "88709ca8-8b16-4ae7-9fd7-a6fd9141a38c", "value": "SecuriteInfo.com.Win64.MalwareX-gen.8598.7884", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb575f05-cd1d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708123807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708123807, "uuid": "353eb639-b206-476c-aea2-443a87e76a3a", "comment": "Malware payload", "value": "6782c1d8cf37862f151c4ec1401f8d70", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708123807, "uuid": "0a524946-7197-4d44-9263-7791c951fd93", "comment": "Malware payload", "value": "705d2288a5866619d00cb33bb4ebc63f8cd99e347255064f92d366809a5ba0be", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708123807, "uuid": "3a3c4769-9d36-425f-8194-8796bcf8e911", "comment": "Malware payload", "value": "66e2f51c670265108de96707db02560f326872b7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708123807, "uuid": "f4efdc88-ca94-4a6a-bc67-e7206a73d97b", "comment": "Malware payload", "value": "2b11ebec1f384120a58090f5c725530595adb89c2a3d4043ac97f64c52ad6097f1888337295a6aedd551c377bedc7e44", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708123807, "uuid": "bcba3af1-2efc-46e9-85a9-95a7bae6f1cc", "value": "T1F2430986BC91DA17C6E452BAFA5E41CC372523E8D1EF7203DD216F157B8A82B0D7B640", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708123807, "uuid": "284ab248-df99-4f92-8e84-9404caf92b28", "value": "768:RWUV68KxqqxORaXrnP47Rhke/4DRr36ow4r22Fk6NP6QNCXHkz542DiKYbqOR:hVZKJP4N/KRr3n2NKgXE9NWbqOR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708123807, "uuid": "4494fb44-0fed-478a-b4be-a74f85208d7e", "value": 60556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708123807, "uuid": "f397f4b9-a48c-47ea-b44a-5488a63b8870", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708123807, "uuid": "1e5cd0ca-d0fe-4af4-b62c-c855cfb7e1a1", "value": "jklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e70b60c6-cccb-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1708088662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708088662, "uuid": "fb11e7eb-76eb-40ac-802a-6ff49100e52d", "comment": "Malware payload (Formbook)", "value": "dd6d1268408f89097056189a33244873", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708088662, "uuid": "5062340e-8a1f-4183-b884-4397a39ae661", "comment": "Malware payload (Formbook)", "value": "7145bd1637fdc8111b86d7586c07526d2c9db8f4e2f30d99ea9740feecfd3d2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708088662, "uuid": "b5031eaa-dafa-4022-99b6-7b8a7bdae8be", "comment": "Malware payload (Formbook)", "value": "3509aa5e0ed96fc4f9932eb594c0dd439865fcec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708088662, "uuid": "1e74699a-c60d-4c7c-8f66-11add75264fc", "comment": "Malware payload (Formbook)", "value": "6025b61592efd53d1c63757cd040a4ffe4e35f6fb10e73e7f7f42a48eec2003009cdd0c50d128052c596c6784018e762", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708088662, "uuid": "9c4d5554-fb7f-4234-9f00-fc82fb845b98", "value": "T14AE4DF4E97204393F0046BB5DA7D3E1943601C7C75C1EBE4F9A6766BAEE1BA6183301B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708088662, "uuid": "7af01eb3-0cf4-46ba-8e9f-b1f7e4486c5e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708088662, "uuid": "eabba9b7-510f-4d9e-9c2e-241fdc687b12", "value": "12288:PxQ4W3YSFbKIFbj8KEmyDvZUeIVko+KJUAO2+hKoztqBXi9U+s:jA9Lbv1ybZUeIVcKJUjKoztc6Ns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708088662, "uuid": "b4f74a30-be0f-4463-8308-fc4bd2a820bd", "value": 720384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708088662, "uuid": "241d112f-2978-4ad4-a1bc-db632cbcc2c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708088662, "uuid": "3ad34929-885d-470f-9eaa-1f7cb267a8c4", "value": "BBG76865646 PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bffa6e7-ccec-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1708102521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708102521, "uuid": "ec68b3c3-a2ae-49c6-a966-94d7e5451425", "comment": "Malware payload (SnakeKeylogger)", "value": "b9d77c2410b5808b0e703395bb2907b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708102521, "uuid": "b46fe0fe-dfe6-4f00-b9dd-5eada9366011", "comment": "Malware payload (SnakeKeylogger)", "value": "7161d933e8ce30fc8824cb3532294905ca0582760a306254ad03318619519c04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708102521, "uuid": "90e47d29-50c7-4796-90cf-1890066ed1c6", "comment": "Malware payload (SnakeKeylogger)", "value": "32e61029b0c3c25c56d5862068a3410a30a7670f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708102521, "uuid": "85273803-2a2b-4c93-9eec-4273d84cb068", "comment": "Malware payload (SnakeKeylogger)", "value": "e5f58168118142c8b7e7e33c1f68e349bd96afb7670f1a57fb078885c52a7743e6573044c4719439df6c04bf00c27d64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708102521, "uuid": "68136315-ddae-404f-9119-cf51c1e3a420", "value": "T14974F142F2FE2F26D5B587F7010629501BFA276FA6C1E60A5EC750DF1631F044EA1A63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708102521, "uuid": "9a25ee63-84b2-437e-97aa-04b390755b85", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708102521, "uuid": "cc5d759c-dd03-433b-a6ca-f9d9f01e6078", "value": "6144:mTyLMh4wMzywrWIq/2K7SBBMIARmCmwOE7bjVPJcfsduGAnx:LLMSewr9hBSRmp6BPJU7GAx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708102521, "uuid": "34f69ce1-2fb1-4416-a594-9c5b7266c127", "value": 341504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708102521, "uuid": "d3dc35d9-f01f-44aa-b1d3-913adddc8dbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708102521, "uuid": "88ffedd4-9f07-4117-856a-b36f29e49605", "value": "Vessel particulars.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2699fcd1-cd20-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1708124846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708124846, "uuid": "615776df-095c-491c-b32a-3dccf5b51a38", "comment": "Malware payload (njrat)", "value": "f5c4ff3797506dc87d58a1e7f4e0d61c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708124846, "uuid": "dab83c31-89c2-4a23-90eb-e468d4176d30", "comment": "Malware payload (njrat)", "value": "73cb2cafa83f8eafefd85bd6bbed5d803f6457c1d622cb9617a8cdffc69ed14d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708124846, "uuid": "574eb0a4-974b-4228-ac74-81fcb4ead646", "comment": "Malware payload (njrat)", "value": "93730466a36aabdf872043c7af7bec8ac9f1c849", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708124846, "uuid": "4bfca0ca-0338-40ca-b3d8-1e8a45e017a4", "comment": "Malware payload (njrat)", "value": "28b49fb03eb7e990a79a09ad222e1a7fc47116e8866a41f495df5c84009359da3d4ffcf48d803eb30392cbb1d8c14689", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708124846, "uuid": "f8a76912-a0b0-414a-b03b-c838cc8b26e2", "value": "T128E2F84677A54229C6BC5BFC8CB313110772E3438432EBAF5CDC98CA5B67AD00245EEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708124846, "uuid": "a6459bb8-fe45-406d-9e4e-b531ca97b60b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708124846, "uuid": "be6b51dc-d385-4cd4-832a-a1ed7679a563", "value": "384:Z0bUe5XB4e0XfOViiaXLilpknD+WTCtTUFQqz9AObbA:iT9Bu2zaXWlRmbA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708124846, "uuid": "057f45f9-71e8-44bf-8cec-31d8c759e940", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708124846, "uuid": "ef0bf226-feeb-4391-8676-6f2378eb3c8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708124846, "uuid": "0ee3ae44-48a3-4717-9f43-09067834a68b", "value": "bTAB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06a01fdc-cca7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1708072823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708072823, "uuid": "d53e525f-77b5-4ef6-ab94-205ae02e5fd9", "comment": "Malware payload (QuasarRAT)", "value": "c48ef58312b33e1738e90eba710f32eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708072823, "uuid": "1bc6e1bf-1903-4227-b4b2-881b362d4be3", "comment": "Malware payload (QuasarRAT)", "value": "7432cc083f910a462f63cb050b2858d5ee004c57db74b0e1d2769f45d893fa06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708072823, "uuid": "60e5d0de-da96-43dc-8c11-40120914bdf7", "comment": "Malware payload (QuasarRAT)", "value": "dfb5c3212557cc6b09dc60f70bd815a72a0c7925", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708072823, "uuid": "9acafe6a-b0d1-4a50-8570-0d695ba9a96e", "comment": "Malware payload (QuasarRAT)", "value": "7e5bfc508a140c87bc46115df315b1a066d33e6e31fa937f028c37e0f5c5723b9cf00bd36cb4d464754b51882eda4d69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708072823, "uuid": "18a2475c-25df-40a6-b3ff-11ada03e630c", "value": "T17486335073B65CEAD6F7523581D1C84BEE72B49917A2CA8F037C02D11F1B3929E7E6A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708072823, "uuid": "aa5f9609-1ad8-4ffc-861a-5ae4608d083c", "value": "1af6c885af093afc55142c2f1761dbe8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708072823, "uuid": "11da4334-c1a0-49bd-a55a-afe462f19a9b", "value": "196608:bI788YWqBA1HeT39IigQ7vKub75bcjWgbkzfZSkjw3lF1t:O8jq1+TtIiL7vB5IjWqkzdY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708072823, "uuid": "891225d1-1d14-43c9-a364-20fbfedb50f7", "value": 8469447, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708072823, "uuid": "3e36203a-f1cc-46b3-8add-1d752f59c38c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708072823, "uuid": "5e9d3c9f-786b-42ea-98e7-a5f3ce76a2b3", "value": "c48ef58312b33e1738e90eba710f32eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88307088-ccce-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1708089791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708089791, "uuid": "c5ec5b89-5a08-4133-92c0-612832dd38a0", "comment": "Malware payload (AgentTesla)", "value": "7f70eec56d05cf2eb2f88b765bb3f01c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708089791, "uuid": "92def2a1-3dd2-4b36-bd99-921ce978fe4d", "comment": "Malware payload (AgentTesla)", "value": "755d262d3f1e444bdc34a6a4c536738bdba7e0b321bc6a7771ad059e1ce5d8ff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708089791, "uuid": "166510d6-011b-46cd-a860-ce9c11e6b9e1", "comment": "Malware payload (AgentTesla)", "value": "fab14aeb9a012be522e990881a09047b18262334", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708089791, "uuid": "90423362-1ec8-4dec-9f68-543b652d0b6c", "comment": "Malware payload (AgentTesla)", "value": "7a2db1a3b213dc47ac3a14f34d914106b54361773792d57976aba0c71d324a6b995f211631cbdcd73f01a98df43647c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708089791, "uuid": "849ad100-0fa3-4869-80ef-0b38839e864d", "value": "T19625B022B5D68036C1A227B59E79F3AD973D6E360327D1D723D839315EB04432B29B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708089791, "uuid": "1bd4b8f3-30bd-446e-b753-357f8ba6e5ee", "value": "d3bf8a7746a8d1ee8f6e5960c3f69378", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708089791, "uuid": "810f8ac8-7ae5-4ad1-97e5-dba7f57d782d", "value": "24576:pRmJkcoQricOIQxiZY1ia9PmOytxJ6Kz2yvp2:mJZoQrbTFZY1ia9OL76I2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708089791, "uuid": "72adcca8-12fd-40d9-acd9-2c368d79afc0", "value": 967417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708089791, "uuid": "4c6f2b06-b003-4ea2-bcec-eb394e210790", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708089791, "uuid": "5cdc7944-dd4e-457f-85cc-903489e2eba4", "value": "7f70eec56d05cf2eb2f88b765bb3f01c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf2eb82b-cc9d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1708068838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068838, "uuid": "ea3b4c5d-03eb-4d45-922c-78935982eb1d", "comment": "Malware payload (Gh0stRAT)", "value": "966d928fd846eb2a177f3a551773ba7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068838, "uuid": "50c44bb0-ef2d-4f92-ad31-3c959827eb73", "comment": "Malware payload (Gh0stRAT)", "value": "75dc2c936b009479f47c314374c77af97d8699884c3a5f91c768aa86870cba45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068838, "uuid": "75237e3c-af46-4bdb-b4a9-ba5bdf4da074", "comment": "Malware payload (Gh0stRAT)", "value": "6ab5444c3cd1787ab47eb50a90e8654b03b06e39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068838, "uuid": "900c6beb-4d9b-4025-bc42-2ec30396c145", "comment": "Malware payload (Gh0stRAT)", "value": "333c486523252108cbc89f7bd43f1b85fcc4fb9889ea595f693ab92193986d37014a8c7a251e5ee69d2c56822432dc89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068838, "uuid": "591d1540-4df9-4a4d-86cf-dc0849dd3a4c", "value": "T196C7DF0220357B57F99215B374A61FC67ED85E213F2EA8F643858EA0B599BB5E03403F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068838, "uuid": "78fc7e86-63b9-4ef9-929e-490357813948", "value": "8c2467b431f094dc01451bb80bc51a45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068838, "uuid": "24f3ce98-8e3d-4b46-af92-83facb571b77", "value": "6144:j0SgsF4yiVx/GQ8T/7EiT3PPi8sNBPet/XYV4yUAQYfZzNeB7vr+l//wQmhJ2i68:jgsSyHXS8sT8e4y8Y8K5w1Jv09g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708068838, "uuid": "f6c654e1-3c49-49ba-aae9-06f55a77ce57", "value": 52791952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708068838, "uuid": "09b6cb0f-8cd9-493d-a690-1300d90e8236", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068838, "uuid": "b7b3eaf0-eda0-4c37-a35f-d223ffeec112", "value": "SecuriteInfo.com.BackDoor.Zegost.297.21873.23452", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5f407d3-ccf5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708106618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708106618, "uuid": "e37a0570-bd21-4090-8a36-43e97d268b88", "comment": "Malware payload", "value": "1db1dcbedd96d24445b5cde20aab3e96", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708106618, "uuid": "b72b688e-f9d1-4154-b82f-8036bbdf5953", "comment": "Malware payload", "value": "76fbfcb8754ba7e23c855a71db83aae75c106d84e106330b772cf3a28a440993", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708106618, "uuid": "d1b71152-d90d-44eb-ac3c-c886ce95131c", "comment": "Malware payload", "value": "3271f06dd328c72918b6a94fa39077d206e76fa5", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708106618, "uuid": "29f64c30-4687-447e-9e49-3a53677d0ddb", "comment": "Malware payload", "value": "303f44e424a61095618413738258f8eadd4193719d9268d71b815767c98eb8907ff21ee3641ceec40ed43b394c0b4145", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708106618, "uuid": "5bb8b3b2-c4c1-4c51-b7ad-0f74b056becb", "value": "T1EF51F753A74C1303D932E87C2BC99615342212AFA1D14E79AB2A51198F46639AD2E24E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708106618, "uuid": "a31eee40-4e2e-4701-9863-e7b51c2b9009", "value": "24:9pZUI8l1M8O/0VuesMJh7/iz8jaXWW8S6nXigg/HMjZGv95Vv/+VAdXpKXmAaa7x:9peI//sn/CizgPMuh/+VypK9R7ZOYsE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708106618, "uuid": "426ef6c2-ca65-46aa-ae1a-2b4afc85d613", "value": 2988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708106618, "uuid": "ce77c519-c060-47ed-8f71-d3078c7e8f33", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708106618, "uuid": "4c090dcd-574c-4173-a59f-83ea90349a6a", "value": "damaged_item.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "831d0735-cccd-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708089353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708089353, "uuid": "636f76f3-6a6b-474c-8b01-c090f819edc0", "comment": "Malware payload", "value": "a30b5525296e02375eb287ab790e37a6", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708089353, "uuid": "6200511c-ef05-47f9-a7d6-f65edf5192a3", "comment": "Malware payload", "value": "780c8d2593bc7d79e1ed751173c10b942561ad339d7f22faa8a9ec7fa4a121fb", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708089353, "uuid": "459b6f9d-fea1-488c-abb3-0332f1914156", "comment": "Malware payload", "value": "c49c2577290f329a4806dddd0eadab36578b824c", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708089353, "uuid": "669f8bc5-7373-4b36-b892-3fdcf1600c82", "comment": "Malware payload", "value": "32bd5be9c3e3daec261e6adec2af9b984a9277ac80ccf7ec3092e71ed5971ff8420e3003aa8847eded177f9953f08e12", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708089353, "uuid": "41109822-d375-4ca1-8773-5a4c975124d4", "value": "T19065334877E562F90F86BA987EA623047775380CB42AC5F5337347EBD396885DA7E800", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708089353, "uuid": "fdba9d38-e4cb-4d8b-8d52-9103c2e66e0f", "value": "24576:j2l9uhmq8prB+LW1Q7HuZ6ilxezY8Ighm1qJI/J13o69IJHZIAGaFxxIfvaYsdZJ:Pd8ic6OZvlxezYvghDy/pCgWxxIfLoZJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708089353, "uuid": "0bb82c39-7ea3-4e84-a606-eb6f1b1b46f8", "value": 1508357, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708089353, "uuid": "6a70a027-5d20-4db4-a926-4fadbc95f600", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708089353, "uuid": "9be84b30-340a-495d-9d5b-531a2587d157", "value": "SOA 8400139526XXFEB024.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4b55e18-cc9d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708068820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068820, "uuid": "8c32f669-d152-43eb-9917-3654ff9436c9", "comment": "Malware payload", "value": "095cb2ef9c61816f0f00562532b04e54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068820, "uuid": "22e413ee-10f0-4d75-bd12-07293de72987", "comment": "Malware payload", "value": "79ca78f685ac8f3b6ca6d8edbbfd0227a171ebd7b461d1ab993b240c45b759a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068820, "uuid": "9d21f288-dd02-42a6-b68b-fd05b37b2590", "comment": "Malware payload", "value": "e111d19f0e798ac0fcf06ef6047bc1139a44c045", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068820, "uuid": "85b86682-7297-4c10-8ba0-98333f8a9a04", "comment": "Malware payload", "value": "a1b6d4e2f9c9ea0502516e6b85c9c78bae5becfef27fa813f2d63c829109f26b313d9196206d04c4ad74b93b351cf104", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068820, "uuid": "da028e90-98b3-4361-b23e-4a0458728b05", "value": "T11FA42373B6568CAACC4507B44867360DBDB0B79C0C2BAB3D99147A2E797FB009D2C752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068820, "uuid": "d28548bf-efcd-4aa6-8028-25972ddea512", "value": "96b7cbed03b40abd591879b047572968", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068820, "uuid": "1e68b362-76e0-480e-b2ec-c225fba46782", "value": "6144:y3ZjaO4wqsrSTxB4lilPycdeYe8QBcHOwbC/ynhyn4sV0OAHnzqCawX6IWmsHL:2DlLrS0lOcFcE/yYVApaJmsHL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708068820, "uuid": "17232f52-8626-44e6-97cc-2a3115b56bfa", "value": 475136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708068820, "uuid": "3cc070a9-b05a-4e35-b72b-faa7336b709f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068820, "uuid": "983a85d6-9ea0-4a29-a3f4-bf91edcb14dd", "value": "SecuriteInfo.com.Win32.Evo-gen.10682.26428", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d5c1204-ccf5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708106470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708106470, "uuid": "a54529b3-cc52-4059-b6ef-9392edb6f351", "comment": "Malware payload", "value": "1ee38923768a6c95fd58dbbd94f91ceb", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708106470, "uuid": "cd7d5c3f-764b-44f7-b78a-dfebfed72dd3", "comment": "Malware payload", "value": "7b34e6746d3340b778eeeee6a248b30e177d18ab71b121740552782c0d5be5aa", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708106470, "uuid": "d053b34a-c52f-40ed-979b-23e7d532d16a", "comment": "Malware payload", "value": "362eaefc8fc2d5368fe2e3e35d61dfdd6b193e56", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708106470, "uuid": "365196e8-ff1b-4ee0-9e28-27993227c416", "comment": "Malware payload", "value": "835a37fc6b573709d39cc28dca7c000052c2c9686f929c8bacbc55b9e307e997d4e2761aa28b4c2822876462085a8e36", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708106470, "uuid": "ffb33381-aa8e-463c-ad68-087619c44292", "value": "T137125184909674A136DCAB53C240B50128DA32FADA18D209DAF4C67CFBF7D5664BCCE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708106470, "uuid": "9b0444c1-b9d5-4349-9e22-a8b4d9d0fc29", "value": "192:f1VrNVQbtpOlQ2kg4KPHd+mc5HGONPCH5H3vQOgHvH+f01Rs8qVpPgRqvVN6bCnp:f1VrNVQbtpOlQ2kg4Kfd+mcdGeSd3vQO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708106470, "uuid": "b49acef3-dc71-449e-9c0f-9f06ce3f97bd", "value": 9031, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708106470, "uuid": "b0a50a0a-9b63-45af-a8e7-43e0d4bb055d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708106470, "uuid": "52b6d135-b0b3-4dbc-8746-ee5a580e1958", "value": "file.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c73678f3-ccf0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1708104500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708104500, "uuid": "4399af59-da4c-4d18-a99a-0eaa03ae9912", "comment": "Malware payload (RiseProStealer)", "value": "164be98750a7af56c9711ee1d334cb41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708104500, "uuid": "dcaad5b4-412a-463c-969a-401aaeb39d0d", "comment": "Malware payload (RiseProStealer)", "value": "7b84600ae27b06b1b6ecc66fd873c3a2875625d7dad97c2896a8a646815a8d0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708104500, "uuid": "447eb096-bbe9-49a4-9800-e5ee9bb4173a", "comment": "Malware payload (RiseProStealer)", "value": "a4be7d66fed790a57201bb591787ad625683cc6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708104500, "uuid": "a5e52b13-4358-453c-92ca-1bf6c4f877a5", "comment": "Malware payload (RiseProStealer)", "value": "692baa2f1729733d7c389eb59d6a2aabf5ecc2ffa1867818ecac1b2c2343c5ede1e03e930daca1029e3cd7123129ee1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708104500, "uuid": "30e58e6a-8b75-4738-91e0-de0d3ad9ef4a", "value": "T1CC563316AE851588D0C891386A67FCBC74BE2D2E734D4C5C51B8F6C364F3D286AF2563", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708104500, "uuid": "9de57f9c-96ba-47f7-9985-dc5f0a796a8f", "value": "4329a5a28af84abf208d95062e79baad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708104500, "uuid": "63101005-0da3-4ea5-8fd7-401472216df9", "value": "98304:lOoyHsBQL/WXCdwKxDn+84ES+cIEIc+o6FbXcywejPQtiBtdHl8oR04lOXN9GDkU:l0oQrWkbn15c6V3bQgRR0yy9Nw+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708104500, "uuid": "ae25bb5c-b676-42ff-8459-a4eb1a52fa45", "value": 6051840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708104500, "uuid": "71f91b63-5ba5-40e6-bcf6-fa6b9f0fa134", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708104500, "uuid": "a1c49e97-c388-4bf5-9a90-3407461bdaa3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d450ef7f-ccc9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1708087771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708087771, "uuid": "fc7a2273-1248-4ca5-b7a0-559e0755fc82", "comment": "Malware payload (AgentTesla)", "value": "0e2b9571feda3cfd58a639c882f35752", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708087771, "uuid": "37c542b7-67ac-4404-a410-d68663b792f2", "comment": "Malware payload (AgentTesla)", "value": "7dee9fefa212bc40871203536b5eaa48d661e84de62e30ba8837666a843df0d6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708087771, "uuid": "b49da3e1-4fe6-42a3-9b69-91f942e89e3c", "comment": "Malware payload (AgentTesla)", "value": "133ce80c32719523f0245ab0f568db9cb92df7d4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708087771, "uuid": "c215f6c0-e4ce-4c52-8ec1-92e203db2212", "comment": "Malware payload (AgentTesla)", "value": "eb6c375301a3313d9de419378eb1c2a2c349339245aa89009cdab7eeb2761e31abc4c15c5e5cf3cbcd2b8ea81418edff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708087771, "uuid": "218650f8-2007-4b5b-9e0d-f23863d00b88", "value": "T17DE42357366A5B72C758ABF1087325241BBB4C6B5903F7D51F89F0CA268BB1483027AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708087771, "uuid": "8f46b8a2-0897-4fd8-b2a9-c0db6c4b931c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708087771, "uuid": "a6b4d8b9-41fb-48f9-a927-7e54040ff7f4", "value": "12288:b0Q4W3sN5OZYsWVRUl05bJJgf0bwp9yY1jvVad0Thlk4H5iEFj:AACGYsLlElJiOYtaAH15", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708087771, "uuid": "af2f84c2-1cf1-4ecb-8d76-f303f4844ebe", "value": 690176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708087771, "uuid": "9dbe070c-8bf0-4b09-8d28-ba1434f55978", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708087771, "uuid": "081df677-86aa-46ad-8540-d77cf711e430", "value": "z1PO24-00001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6bb7e6f-ccfa-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708108767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108767, "uuid": "064da8f6-86ab-4fbb-96d4-081ac0075b2e", "comment": "Malware payload", "value": "722ec3a6be4343d8090310ef3b85b585", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108767, "uuid": "f21582f1-6f92-40bf-8190-f46b45530f0d", "comment": "Malware payload", "value": "7e145dc42525399eff4e09a649b880c9de3e16854eef5e5de8e70d82b295bcff", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108767, "uuid": "85e9c690-da4d-4f19-9469-699e77d19e47", "comment": "Malware payload", "value": "19c174bdeafa131c80c1c17715ec8110212e1030", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108767, "uuid": "aea131ab-7722-49b3-b23a-9bf268631e53", "comment": "Malware payload", "value": "42225f278a72d44b3e3abfc577c7192ca73a027496042421d1a7b0894c13f76ab807da3bc9d52baf133471e675903625", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108767, "uuid": "f4b6a187-64de-4497-b929-5f62e542757f", "value": "T12A34F73BCA15CC3206D6A39FFE5F6A53B5FE828536B44861E9F9C12C0385E85E217C85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108767, "uuid": "a87deda0-824f-43e9-802b-268a0af67fe3", "value": "3072:qalwEFywXPmFFbNLal4lCjSo2LwlNYIR1Eyh0mR7keVY3nIY6/uY:ZYLLa4Cmoqwlt1pNSnIY6uY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708108767, "uuid": "ae7a4620-d02a-46cb-a01c-2ac6850a6283", "value": 248848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708108767, "uuid": "209a069f-385f-4fe9-8d8c-985083ea1e10", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108767, "uuid": "7f1f5159-f0b3-42dc-a61e-4ab370780403", "value": "zisGY_8tnPfKjJDRy3e3Z7SF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c99a44c9-cc9d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708068855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068855, "uuid": "95dc2b90-b664-46c9-9cf9-ce613363c702", "comment": "Malware payload", "value": "a827283f0e75d18911c8b237e91870e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068855, "uuid": "32f5178c-73e9-4650-8a6a-96c3f91a8d7a", "comment": "Malware payload", "value": "7e22731c48a40b4397a8a38d5ba86942cd1ce6ed008c21b04157d85f47782167", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068855, "uuid": "55002b53-16b0-4908-80c5-df0f1cf9ab88", "comment": "Malware payload", "value": "39bba4acf55d380ffceb3e84f758695d640e63f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068855, "uuid": "a126ed91-3bf9-4d94-97ec-f8eb536ad21e", "comment": "Malware payload", "value": "59e25edd9f71174d4f88ed46cd0c51450e68e6c40e7c1e5c318e60e14f91376fe196f01c7e58236b6fa2b430ba5d5cf5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068855, "uuid": "c3e9ac87-0563-4ad3-91b3-de460b73533a", "value": "T1B475F71DDBA917D4EFCE60B51F528E79FAA6B2477923DA828BB6D9503C01520F933D00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068855, "uuid": "7f507ed5-5546-475f-97a1-e3d7a2cbb649", "value": "12288:RZRUBNMr+ojQpb/1TDPCnOakclFciYo9sVikfeBje:RZRUBN9ocpJTwOajFci39Of", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708068855, "uuid": "f1e5e4b5-510d-48f0-82c8-02b0912aa075", "value": 1658880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708068855, "uuid": "1c7c3701-2761-41cd-9a1d-9dcb90cd1f21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068855, "uuid": "c4ca44e8-985d-4817-b008-7b4217dcbb84", "value": "SecuriteInfo.com.Win32.Trojan.PSE.1TYMTF4.27679.19454", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fe3c5fd-cd02-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1708111923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708111923, "uuid": "97f8cea4-1ccb-4aa3-ab2f-48f1feb4c865", "comment": "Malware payload (AsyncRAT)", "value": "ce8fce5acb32262c703a120d601b12a0", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708111923, "uuid": "f4017e4a-8599-473d-8c72-91fefd369e68", "comment": "Malware payload (AsyncRAT)", "value": "7f3955296943f7d92e1f030a7f673b4459e5c68940c6c036e86204ee8d1dc0d4", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708111923, "uuid": "96873b46-87c6-476b-9290-6fd97ef713dc", "comment": "Malware payload (AsyncRAT)", "value": "e6fa32af9d5831ecd7ac46da103fea51b1b30d04", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708111923, "uuid": "c284a996-0c8b-45e3-ad8f-08b90dba6cb1", "comment": "Malware payload (AsyncRAT)", "value": "54622cf1a9176a332a195d2e85eb52a7283fec7ba38b51e48547601d539aba32892cb64fe89c7b55a3bd87bf6f231203", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708111923, "uuid": "8ec4ddc6-003c-4b9a-af26-0e1edae26ecb", "value": "T195B53987BC9045F5C0AE933189729596BA31BC440F3523DB2A90FFB92E76BD0AD36744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708111923, "uuid": "cb365892-dd23-4307-80b5-9ec9cb68b05e", "value": "5929190c8765f5bc37b052ab5c6c53e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708111923, "uuid": "152ebff1-8cad-451a-a0a8-b368d47a6b36", "value": "24576:maE8OldmUHkr/ybzkM/LjueJ63uSDPwcvz+q/pGztLohRIK:rmdmWbVTj9J63XDPwcScx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708111923, "uuid": "dac2620e-08a3-434c-9651-0243c5ee5576", "value": 2271744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708111923, "uuid": "2a1e164c-72ed-4ab6-8d7e-3e05ce331ddb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708111923, "uuid": "e4186196-14d5-4e6c-991b-4007d8e82d7b", "value": "SecuriteInfo.com.Win64.Evo-gen.28580.7717", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "513fbad6-cd0a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708115469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708115469, "uuid": "4f0953f0-489d-43ab-8084-d595ea9398a4", "comment": "Malware payload", "value": "b47bcc229d0aaaf951f2103c8aafa513", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708115469, "uuid": "50f13028-644d-4675-bfbf-2d16422d0b49", "comment": "Malware payload", "value": "80a3ebff5af50b239170fbddc5f7286cbf437570d285790257749cbfeaa52709", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708115469, "uuid": "d358a981-11fe-4377-93a6-5e1cf705408c", "comment": "Malware payload", "value": "538ad172a5d59adc29430eb52ec953d8050460ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708115469, "uuid": "c9ffc947-6086-4f0e-9f20-74021f3d6aa0", "comment": "Malware payload", "value": "8ed11419544fbdd21e95d823b5af243783305f527b8b75117e38d8885b08417e5bea332ac9379a382e08884fe1a9af67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708115469, "uuid": "9645204a-480e-426b-afe1-1ced4577459b", "value": "T1C4E46C0AB0C380BEE6F219700C98B77DCA61A96C87358FD37345EBB9C561E827D27165", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708115469, "uuid": "3546efdf-82f8-45fb-afe6-c0db65b626d5", "value": "81a048a92f4dd1237e68c5435c7cdc7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708115469, "uuid": "64ca5ec3-5568-4e95-ab31-03977ed2fc48", "value": "12288:kUPZeuw8FuS3B2L1FjN5Te9GgqXpX1d1wi18POMWeT5fo2bdSmkvkw:9PAuw8FiFjN5CQbpX1zc83f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708115469, "uuid": "31138132-0eb7-43c1-a334-2d9ffdfc233d", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708115469, "uuid": "0f17d3e5-c63d-4fea-881c-a3e9b9008537", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708115469, "uuid": "bd85a7f2-e9c1-4ee1-a4c7-8df4f53f4241", "value": "SecuriteInfo.com.W32.FakeAlert.TW.gen.Eldorado.9108.9763", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b3b6bb0-ccc6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1708086226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086226, "uuid": "42efa160-d513-48c5-aeec-eb0d8b550fd0", "comment": "Malware payload (Formbook)", "value": "d378f567d320baa6aadb3a4763c2ae09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086226, "uuid": "f831d951-532e-43fd-b79a-058f7ca0457c", "comment": "Malware payload (Formbook)", "value": "8192cce9a032b0e6024194cf3a38858bc8c9e620144742a8373d961ca22927fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086226, "uuid": "7e0def6c-fb61-45c4-9d85-60a51819de70", "comment": "Malware payload (Formbook)", "value": "92ec565322d7dab53bdc413689ea798f5c6b0295", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086226, "uuid": "9506fb1f-326b-4aba-bf94-bd788a079ef9", "comment": "Malware payload (Formbook)", "value": "79e30898e4f4a373a50e53fc1bf08d3165f6d281e1cd8b84481677757c591cd589677b22821fd307fc491f3a78758ae5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086226, "uuid": "f092e7b5-37a1-4d01-ba2b-d263cfbe31d8", "value": "T1E5E4F12036F81F47D5BA9BFA56B1A1100B76752B6835E31C8CD921CE2D25FC0879ABD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086226, "uuid": "339a2b60-a886-4dc0-8c95-70e11fe6b625", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086226, "uuid": "088217fd-b504-4220-8d51-d2cc7132a2df", "value": "12288:LX3TscInpNkzZM4n7Kvhc0mufagUw9Nh9yofV9KwLc8nU:LX34VnpNklYhcIVygVE/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708086226, "uuid": "8151eaaa-0811-4b0f-8512-99122af6248e", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708086226, "uuid": "23ea4f89-64bc-4776-bcbb-8ecdd226edb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086226, "uuid": "4a9512fc-83f6-4f48-b35e-344eaa877021", "value": "Sipari\u015f PO026242024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7fe9d97-cd23-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SchoolBoy)", "timestamp": 1708126459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708126459, "uuid": "ea4d8867-3242-4abf-ba0a-c49b9abb9e46", "comment": "Malware payload (SchoolBoy)", "value": "827bc2ab9d88cf4fe3cd8615f7bf6dc5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SchoolBoy", "colour": "#609074", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708126459, "uuid": "2bee51f2-5c77-4b8c-8c8a-278ee7c46cc1", "comment": "Malware payload (SchoolBoy)", "value": "81e6ccb90b8493860fd2fba13237700e1a180668bfdbc1f1fd65f199caa07b84", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SchoolBoy", "colour": "#609074", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708126459, "uuid": "ff50c34d-f383-490e-8b11-dece8a44edfd", "comment": "Malware payload (SchoolBoy)", "value": "12b430e88a6a39094760847bdff2b421bb3b8a90", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SchoolBoy", "colour": "#609074", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708126459, "uuid": "1204a47f-2600-4fa7-80bb-e56ba82bac32", "comment": "Malware payload (SchoolBoy)", "value": "41eb86e2053ad59f0f323af24928cbd73eebdc4214530032cdda108968a87d18db79018e9053962cf636816dcc388886", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SchoolBoy", "colour": "#609074", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708126459, "uuid": "a6a5599f-7690-4b15-a604-d3878e193f1f", "value": "T1C306F133F245F53EC4AA05354677A694993FF7A2B85A8C5A57E0088CCF291406F3A78F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708126459, "uuid": "c59e4d65-89fc-4fd2-ac5b-0b9bf36adccc", "value": "186d238a2d9795ef040981c853cd3335", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708126459, "uuid": "5df051d1-c91c-48cf-8d9a-f4a2aa075307", "value": "98304:Kl7UGD5GK1yNEdVMzN4moGbiwTswBnSY:Kl3D5GnEd+zN4moGWGRSY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708126459, "uuid": "98395ebd-c9dc-4abe-a05d-ce1331fac8fd", "value": 4008960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708126459, "uuid": "c3f443f0-29a5-4bab-8208-be4f9ece6423", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708126459, "uuid": "0853e51e-eec6-45ee-beb9-98805eaa9e46", "value": "81e6ccb90b8493860fd2fba13237700e1a180668bfdbc1f1fd65f199caa07b84.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a7c064a-cc85-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1708058415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708058415, "uuid": "ceb41166-90ac-4db9-92c6-b9893260aa46", "comment": "Malware payload (DCRat)", "value": "3162918d4416f975209170513989207e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708058415, "uuid": "50ef25ac-6fb3-4928-bfa4-1702ae2bbe09", "comment": "Malware payload (DCRat)", "value": "84c7debe3cb4532bff5d9b73600923aef456dc3dfbbb5dafb68fac8e982cff74", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708058415, "uuid": "fdb6d265-451e-4b59-93b6-5d35e563075e", "comment": "Malware payload (DCRat)", "value": "5f914a97870fe27cdcb4d385be53b9ab8dd7c4a2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708058415, "uuid": "1dc4f35b-25ea-429e-8739-821887e3f077", "comment": "Malware payload (DCRat)", "value": "080b8c399378316154262bc054c22089b3c3f008ea7176eff63148a5046c93a0bcb7d6a8854167d13fe4b64073e04689", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708058415, "uuid": "28814700-0266-4f51-bc69-525720f66128", "value": "T1AA85234179C298B3E1A31D362535A760B83DBD206FA9CDDF77C02A5ED9216C0DB317A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708058415, "uuid": "f917cb4d-6b15-45c5-a1e2-5ae92f05a001", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708058415, "uuid": "384a489b-8b0d-4861-ba58-34f4f760a8aa", "value": "49152:IBJpjmIoRr7wUqmA/qi9oVjlQtBvpVgVV:yDOr0DmJi9oVmtJc/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708058415, "uuid": "3b7f02b0-396e-4975-b9cf-2ef687fe46a3", "value": 1795979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708058415, "uuid": "5470e9a5-786d-47fa-9161-4d58b95d719e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708058415, "uuid": "ee28a0b0-905b-471e-8e5c-70968b0d104f", "value": "3162918d4416f975209170513989207e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c02d93a7-cca7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1708073135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708073135, "uuid": "007ca0d3-0829-4953-82fe-8f18c81a7236", "comment": "Malware payload (AsyncRAT)", "value": "9c4fb4fe69e24136320b3daf99004547", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708073135, "uuid": "daa57091-8f2c-4a09-812d-c8e085863f76", "comment": "Malware payload (AsyncRAT)", "value": "8661b1bcc5df80e2694f3ed8b1fa7f592174c642b71dc481227078ecf6d86171", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708073135, "uuid": "2fd8370e-7d08-41b8-8c81-d7103a2073bd", "comment": "Malware payload (AsyncRAT)", "value": "c733adf72c40397a9f1b97c3914ebbcb3e6ac222", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708073135, "uuid": "e7eec29a-943e-4c8a-9bd3-e83de4aed822", "comment": "Malware payload (AsyncRAT)", "value": "d3befee2030722abe48100be8c1a0cf2767d4ccaf86ad9fbabe3b9a87f61ab359a726d7ac418c1bd3fde094608b01238", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708073135, "uuid": "25e9e529-f643-4fe3-a403-78ef8b9977a7", "value": "T1A734F838F7D85832C55B0AF09CE054B85775BE67EA03F26B4CDDB69A2931391CE12872", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708073135, "uuid": "c326f20c-2d46-4f59-a621-43a4970a4cf2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708073135, "uuid": "3af73193-9d96-4af4-ad16-16fc04303ff9", "value": "6144:4XqEYT6BwbIN/B5bhhXcC3oHtD06enUuVnejOn0:f62bIf3hXX3oNY6eUuBeCn0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708073135, "uuid": "40592874-5cce-40ae-937c-69f38c1b6665", "value": 233864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708073135, "uuid": "36f5265b-0edd-427f-a40d-8cabfa3437da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708073135, "uuid": "16dbcdf6-3642-4c66-9fdd-9e1c9c035c41", "value": "9c4fb4fe69e24136320b3daf99004547.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cef50e84-cc9d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708068864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068864, "uuid": "3137d65e-56fa-4343-82d9-cddd8b39ede2", "comment": "Malware payload", "value": "20bd8cc2fd82f578c80939e49d74a78b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068864, "uuid": "bf2198e2-5ebe-49f7-9790-2adf3c6b08c8", "comment": "Malware payload", "value": "87ca80ddb9beda9d641ec17fc97065faf17497e80e4a69c9e4f6f438a1bb2f7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068864, "uuid": "e64562fa-8cc9-403e-ba2d-96db19918cc0", "comment": "Malware payload", "value": "e6e22bce73e2982a62b2754819401063cee9ba08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068864, "uuid": "3153f83e-cebf-49c7-b795-1dae24a15bc7", "comment": "Malware payload", "value": "95d3e01c4c4c6795f296e8bc992d6b9eb63a010709b3d2d6bc200204cd73d61efdbb981cb43264cd258107d1958998b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068864, "uuid": "5a93ccd5-3a95-43a5-b96f-341963fbd8e7", "value": "T1BEF4E612EA60B11FE552C4F0AAB5D27A39157D362148AC07B382BF4665717E3BCB132F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068864, "uuid": "03a96e24-5da0-4951-be6e-22a2577411e3", "value": "dd9e274814026d52710fd0df0340e0f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068864, "uuid": "65c8b7fd-feab-46b6-a0f5-ede9675f5a4c", "value": "12288:DYNJ+q41qe8rlCLiCCYyad2jDHV+61wfI+ZpDRL9WB:DYNJ+/1elCGCCsd6HV+61wfI+J9WB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708068864, "uuid": "613b8c45-a07a-4d3f-a311-ef76376533e9", "value": 738416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708068864, "uuid": "928d0c5b-f55b-4467-a616-98716fc93e7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068864, "uuid": "c4274575-46b5-4749-b9ea-b34da547311c", "value": "SecuriteInfo.com.Trojan.Hide.Heur.6750.28242", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f67cccb6-cc6e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708048744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708048744, "uuid": "34210637-2bf9-4f44-9d50-abe90c914ef0", "comment": "Malware payload (Mirai)", "value": "399916f8e3160c28782cb46b6d292fa9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708048744, "uuid": "3af48358-4a8a-45a1-979c-138c69d25a54", "comment": "Malware payload (Mirai)", "value": "882c0dfbc7d04f1b82aee7a169c173dda4e337bafee13d04274fc3ef9a5aa22d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708048744, "uuid": "b0139b36-6c23-4c55-955c-09ebc9cfed30", "comment": "Malware payload (Mirai)", "value": "b91da271bc2523102fc3a12346bdb03dd99cbb41", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708048744, "uuid": "4545a23e-4068-4951-af2e-aecea3c70894", "comment": "Malware payload (Mirai)", "value": "a18f61678c1e60adb68e4d68db18d7780967509a503b58064e5dfaba760d9465f67d4e119e39dcb35fa9b7e6154ab3e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708048744, "uuid": "435f846e-4025-4d13-87d8-7e0910c4824d", "value": "T1DD53B71E2E218FEDF76C873547B78E21975C339626E1C6C4D15CEA001E6438E685FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708048744, "uuid": "e54136cb-53b9-4302-a529-7d3ec7695005", "value": "768:sJiW+up9YSJtSnS8FU3UrlD6pjs9sfCUsIJpQvGbCBEFuGChdmdUtVuV3PBd+8Qw:sJi6pfWS8rD8zfCU7p4QuXmNDCwd/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708048744, "uuid": "a51b128c-3b63-445f-9375-818eb523b6e7", "value": 61324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708048744, "uuid": "8479b7d7-e0b5-4f97-887f-31c489534fb8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708048744, "uuid": "ad7e9d73-4536-4fe5-b070-3940068271db", "value": "la.bot (1).mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b96a232a-cd1d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708123804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708123804, "uuid": "c788642c-34eb-4b54-bad2-f3c8adafccac", "comment": "Malware payload (Mirai)", "value": "1da61acf7ca1e5d776764ebd737bedca", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708123804, "uuid": "243349d9-be57-4c90-aca7-ba56e8cd77e7", "comment": "Malware payload (Mirai)", "value": "887b19d1bf6c4569655799c3def884cc33fe5dc5cd8d5551b9a5780226e2607a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708123804, "uuid": "c553a447-e12e-42fd-9a76-ec52064d0482", "comment": "Malware payload (Mirai)", "value": "5c2742c7b45ed3a85596eae590ea2344a4b2a98c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708123804, "uuid": "18fc3c99-cb81-4a17-b1f9-0018da319400", "comment": "Malware payload (Mirai)", "value": "573453cc6b27e6e68c0ff11b93eed1655d8b58a5447d24c2a115c724e8817a2bb764314eebaa972c0819c903910c7f7b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708123804, "uuid": "4faac60b-b069-40f9-9508-2de09edeff9a", "value": "T146D33A46EB418E53C4D517BABADF828933239764D3DB330699189FB43F46AAF0E27501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708123804, "uuid": "497ef3e1-7f27-4f0f-bfa7-7ef1d4d0fa2a", "value": "3072:mGsskU+TtCC6qvdqXTp39JhCaUMrdO8N6nYVFM/92Qe4:vssJ+TtCXqIXd39JhCatrQnYzM/984", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708123804, "uuid": "23075a83-dfd4-475d-8403-1208d422de5a", "value": 134846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708123804, "uuid": "5ead4de7-b4c4-493c-8a2d-11704163f5f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708123804, "uuid": "98f5ffb9-5b2e-4c7f-8343-b3c6f951c79f", "value": "jklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f47df7dd-cc9f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Glupteba)", "timestamp": 1708069786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708069786, "uuid": "388fd8da-df2e-4b38-85c6-9fe2c8deeebc", "comment": "Malware payload (Glupteba)", "value": "7c7ffb7d2daaef30734cffcc6fddd712", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708069786, "uuid": "f1f58a8c-e1d5-4ee5-b3e7-324a394b8f10", "comment": "Malware payload (Glupteba)", "value": "887ee8b0f7c4f46b4bc8f19019625b5bf14f4d404d869ffdb9832c27abc57d38", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708069786, "uuid": "b18ce8cb-69e7-49f6-9f87-3d6d540d0fc4", "comment": "Malware payload (Glupteba)", "value": "aee7c5cce60fedb4d91d1781b0568c1921fb6688", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708069786, "uuid": "043d1024-1030-4a34-afed-271cf4bb079a", "comment": "Malware payload (Glupteba)", "value": "141d406035cac0f11688c13561741bba993e7118ec8b007147b9fe9399c873013a0bd56932bd72bfe013f70e95e383a4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708069786, "uuid": "60d33c73-16b0-46f1-bd6a-e0f924ac64f4", "value": "T12C16331063604476E00FEB31879CC7F50976F865A686B61EE7B3FEBE8B26550C1D036A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708069786, "uuid": "d06ee5d9-b990-48c3-bed7-13f419c60a81", "value": "06795e7a4243010ba1cddcdd6acb03bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708069786, "uuid": "096b810e-45a4-45c8-b838-a49aaf262048", "value": "98304:trnmGEtyQs6G/n3vrODGhz7cUeYJrXlDfk:tKGEIQs64zsGhfOY1XJfk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708069786, "uuid": "5e9ed622-d2c3-4f71-b6f6-c0587dcf4577", "value": 4402584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708069786, "uuid": "2ec316f8-a1f5-40f6-864e-6ca53ecdf5e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708069786, "uuid": "9a5e4aaf-d0de-4a92-8dc8-bba62ce1c946", "value": "7c7ffb7d2daaef30734cffcc6fddd712", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30f96764-ccc5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1708085779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708085779, "uuid": "b78b11a6-eb17-4a67-ac8c-bc26bf994c4a", "comment": "Malware payload (AgentTesla)", "value": "7d8e01f6a0ecc2cb6fec614028d019e0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708085779, "uuid": "99b593bc-f75d-47f5-9f0a-22aaea2c50c0", "comment": "Malware payload (AgentTesla)", "value": "8918ac8706f6f82a2d1a567f00f92820d48cbecf6a2dc8c79282db4e6a8a762a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708085779, "uuid": "8b75bf19-9a86-4d67-ab92-b7dae7b6d23a", "comment": "Malware payload (AgentTesla)", "value": "953f16e6ba806cad9f59cdebff711efba066a1bd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708085779, "uuid": "845241b9-97dc-4f9f-b785-69c9f767f051", "comment": "Malware payload (AgentTesla)", "value": "59f657473b040004e342cbc6f06c8801914644138dbb2d89b5471228013acb3fe909d38f3b43bdf512449d3e98b84533", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708085779, "uuid": "fdccee49-bc9b-4f8e-96da-8aecd0041042", "value": "T165C40151BA81CB46F496437049F39A9B6328FD815B624B4B320CF71E3EB07E95E17A31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708085779, "uuid": "dc5a6a44-b562-48b7-b204-e665ca2efc93", "value": "12288:bTkmSEXMcbNedomzEDV73bVtrMI23vkwjMTOx2WxZI/:xSSMMednEDB3bVAkwSK8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708085779, "uuid": "57e34b7e-3cb7-4bae-87b7-e51c6cfef648", "value": 570368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708085779, "uuid": "6f947666-fba1-487f-8695-41112e162589", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708085779, "uuid": "b03bc760-240d-4e4d-9a79-c56a04359d00", "value": "Facturas 0000051113, 005112,, 005113, 005114 00033511353.xla.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1717b7dd-ccfb-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1708108929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108929, "uuid": "3d300575-f0ce-403c-9af2-9f25aa5a0d28", "comment": "Malware payload (RiseProStealer)", "value": "c76136ff4825e4de67d501006d7523e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108929, "uuid": "52575f27-e596-4b8b-858d-4500236aaaaf", "comment": "Malware payload (RiseProStealer)", "value": "8a93ad2f29cb4cd72038ad801ca05734fe892875700c24208d78097c14467116", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108929, "uuid": "06984f49-c690-433e-aea6-d7d1246ebbca", "comment": "Malware payload (RiseProStealer)", "value": "7d102d2740f91297071f214dcfa75105a7929bed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108929, "uuid": "a71d3947-526f-4f26-9a6d-678638debf0a", "comment": "Malware payload (RiseProStealer)", "value": "1a17443eda9afabb06a34b5e48813a7cca05686a83d8740d400fc4138721b375ab7b4060529532768420b0390d75520c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108929, "uuid": "7f0d0066-45d4-46ea-846d-952c16802ace", "value": "T1AC1512CEBC4105A7D354377418D2F7B8126FEC91A69650CD7CEC7BA7BA32A29082385D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108929, "uuid": "74c49c1a-1766-4ee0-93ed-3abc9fceb576", "value": "2388fee6ad8ce4f4a35dbaf64e2da01a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108929, "uuid": "d25a6993-8649-4bf4-9d6b-912338d087e5", "value": "24576:ETlG/sHzdtJqXBb9X1K2oIJ/xo3rhTcXkHFD+tLMlJi:Ul/5fuVt1gQJcV1HFKelJi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708108929, "uuid": "78e5b21e-46ad-4dae-99e7-da3489b62ab3", "value": 921904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708108929, "uuid": "2477d221-d893-4838-8f57-13e6fb1e6bea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108929, "uuid": "059f178f-b59a-4184-bed1-3bb9059a3e9c", "value": "rOkYJ1mWX1nQBFjlrktxZEDU.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "195517cc-cca8-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708073284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708073284, "uuid": "9de3eb97-7b73-4d1e-941a-fab828b935a0", "comment": "Malware payload", "value": "b9ce097f4acd13c50f8c348e33496ca3", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708073284, "uuid": "4e5b3302-e17b-44d1-bc63-5c55f9949179", "comment": "Malware payload", "value": "8b2b77b55e4e0ea2daba8276e3bd40eba3e54552051cdfc46c2dc451d09c8ce1", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708073284, "uuid": "10051706-57f0-4742-bf6f-46ebb64016b9", "comment": "Malware payload", "value": "934b9cbbe2f50a05b76794056647e05a2289a899", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708073284, "uuid": "b8818c6d-788a-4bf7-9945-83d05475b4df", "comment": "Malware payload", "value": "bad520d0c5c18eb4e96de9f835d380beed06f410c1c41b74b726b0906de9dfe35de117abc62d5e5ec17d5fcdcb60e12c", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708073284, "uuid": "f2b37c38-ef86-4f34-a9fb-6c84f6f0ff85", "value": "T135663355B3F10DE9D823407CC486D855EA73347A17B8D2CB43B551A72FA3A82A83EF16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708073284, "uuid": "b942aac8-1017-4f50-9415-4dfc75509578", "value": "1af6c885af093afc55142c2f1761dbe8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708073284, "uuid": "8c554acd-fb76-4628-a7b6-758f2914e376", "value": "98304:NhGzNBS27wy4Pf1N2zIh3ET9qMxVMOPUh3PdWPEUrJY6AOxbHWvKJ1ngOcsS4m:N6x4FMIZETPjPePdrQJ/BHnPc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708073284, "uuid": "a298a0e8-b1cc-4ffb-864f-ca9e12d4ee9b", "value": 6573069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708073284, "uuid": "73dd9f00-b271-4207-885f-d70ca269606b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708073284, "uuid": "f0daaaa3-25ec-403d-a439-08a1948df416", "value": "b9ce097f4acd13c50f8c348e33496ca3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd2ad21d-cce5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708099866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708099866, "uuid": "ebd47bbb-cf54-4d74-abfa-58ef3f50ce42", "comment": "Malware payload", "value": "2691151d4cdd87f16d8f11e6e14429eb", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708099866, "uuid": "164b7902-8e00-40cb-925f-f36a6ac18b1a", "comment": "Malware payload", "value": "8be8adf7295833d4299e104ec6e249491c81f4365d2606d57f5c869702d30669", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708099866, "uuid": "88652d51-401a-4ec1-893e-7a70a4ea5719", "comment": "Malware payload", "value": "08852fc1487fcf72aa0d62887507dcc4477f206b", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708099866, "uuid": "574a4c4e-2348-45b1-b55d-35894dc7706b", "comment": "Malware payload", "value": "b36b3a00e18478b37060d6edac29bed428ff0c080412b72960754f5337772e7b761306aaf970db4f99dd8049a9980f55", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708099866, "uuid": "f2ac351a-c12a-49df-be4c-998c21b3ff20", "value": "T1B66101242AED1725E3B38E3298F196569E77FC27EA318A1D4091038E4516E00ED25F7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708099866, "uuid": "8faa8fd3-8572-496d-b843-f6c8a73265a9", "value": "48:8zfpDf4BvI0F1Fsx5q0drSsTdkIPXuH7p:8zCBix5q0d3OGu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708099866, "uuid": "07bf990e-e15c-4268-8175-9da4e7f61b90", "value": 3457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708099866, "uuid": "b69bbcfb-bffe-4ace-973e-e5e3980654e5", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708099866, "uuid": "12ba0cae-21bb-4ca2-b138-a6ca5e147a41", "value": "chase_statement_feb_09_2024.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c730133-cca6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708072618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708072618, "uuid": "777aa8b9-b537-4b9e-a2eb-aee472383de2", "comment": "Malware payload (Mirai)", "value": "cc1f585969084e48f01dc3d189a187c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708072618, "uuid": "a413fe85-29ac-458c-a897-9197ecadcda7", "comment": "Malware payload (Mirai)", "value": "8c0dc63e45600b75c1542c9eecdbec0ce6575d81c06b36ac6e286ad834833262", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708072618, "uuid": "c6e79448-c43f-4ec2-b02b-dbd267314a8f", "comment": "Malware payload (Mirai)", "value": "a91765d421900f70eca42e75e5fb6695a66004ee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708072618, "uuid": "07991938-4b98-4d22-ae1c-55eba431de91", "comment": "Malware payload (Mirai)", "value": "ec3e72fb15078b495ba70852192cd3f0d299fb9d9b0151846e904fbda4dfb73a2b08737a7a47b5a05521a3cc50de222c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708072618, "uuid": "a26a96b5-f665-48e7-9f2d-9d33ade752ad", "value": "T1B7F339D7F800DEBEF40AE33A48530905B130B7D211926B376297797BEC3A1D91967E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708072618, "uuid": "a8cb3bb4-c495-4fad-a2c6-16f7b0c6d159", "value": "3072:AdA1P4dVoI9h31irlP7rqzia1s2j3ySTl+ABWVrjbiCLE1XWX+yu27JU:KAgx9h31irlPsm2jiSQABELE1mOyu2JU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708072618, "uuid": "ff0b1845-7606-4d52-842b-7d30901995f5", "value": 162208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708072618, "uuid": "93dd2131-512e-4245-9396-dda2676b834d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708072618, "uuid": "5636b1cd-d08d-493e-b007-a7efaf3a4d30", "value": "cc1f585969084e48f01dc3d189a187c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b92f3456-cc9d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708068828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068828, "uuid": "0b7ab6b8-01d5-4315-be40-30e687fe3625", "comment": "Malware payload", "value": "8f25098f349aa756457445ba3829a3df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068828, "uuid": "acf7e112-bd7c-48af-a25a-a411c3126b72", "comment": "Malware payload", "value": "8cd90751fab567479eb1a98e5775a0659be840a3374f0c25590c200c03cb1f1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068828, "uuid": "6f20a53b-0274-47d8-8b60-0e08abdc0c3a", "comment": "Malware payload", "value": "61e2ffdda4c7dbc05e1a56778c1a4cbf2bc084d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068828, "uuid": "9bf1f97c-c5ca-4b14-8250-acf100f6b79a", "comment": "Malware payload", "value": "def5018b0073834ee4654f38d1c4dd90abc0c5960564f084c86b11e0619d4dd8a676ad3ba2d09e8c10093f4ae9558abf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068828, "uuid": "27985e5e-0738-4ec9-8379-d034fd419dde", "value": "T11A939E62B6940C85D4DCB53644A78B643B35FC124B5CA7D32BC07AAF1E326C1EE72396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068828, "uuid": "722b9769-a474-4d7f-ba42-a45b3a6c451a", "value": "d9d489ca0c655624a9024a3b704311a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068828, "uuid": "cfa1889b-8f90-47e3-8067-da4a23700709", "value": "1536:Hi5gttR11mP2nFYKKr+sn54xpFX4v2IhE7tMoy/lDtW:1TaP2FYKhqCXFovT6hMoyto", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708068828, "uuid": "074d6df6-57ad-42be-955b-1a5d60df3616", "value": 89600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708068828, "uuid": "b9cf7769-7867-4fcc-9d30-2ee59f1bd966", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068828, "uuid": "734ddc82-2afc-4d15-bb52-468703a869f0", "value": "SecuriteInfo.com.Trojan.Mayachok.557.1418.10835", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bfc8716-ccf2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1708105232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708105232, "uuid": "b3225e15-7b24-42b7-b062-2a9e938f47d4", "comment": "Malware payload (CoinMiner)", "value": "d8628060619f5fa8bcadb8f32806b36b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708105232, "uuid": "72f9a699-db9f-47ac-9b48-3acf43c2c913", "comment": "Malware payload (CoinMiner)", "value": "8dfbb07cbeab1ab2d2b0a7acc3f8c7074d3bc3d3fc60546e5e294dc49d13386e", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708105232, "uuid": "316791dd-eaaf-4d61-b181-48212745d45e", "comment": "Malware payload (CoinMiner)", "value": "b2052b47ff877ebcda00761cc06640093d4f76db", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708105232, "uuid": "6456b636-2074-43e4-9723-560e24b30e1c", "comment": "Malware payload (CoinMiner)", "value": "d60da612b0ea21d83418cd1df2a92ccf120c28469efcfdff425b5dcceed32c19ae8d99b9aca4264753cce6c76ab69b82", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708105232, "uuid": "a909eaa1-a867-4237-89c8-cce7c12271d0", "value": "T13F869E16B2A520E4D8BBC13C86CBB917F7F174195B60AADB17B086B91F237D1463EB10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708105232, "uuid": "16339f6b-8658-4ba6-b298-b2c7a6b4171e", "value": "5681267d092041a8eacd53c9efb12b97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708105232, "uuid": "89f26fdb-bcfc-4069-8126-3798c12b831b", "value": "98304:KJuCqT8q5Jt3eM2UIDLeIY3I7LMHrPZF6OhgIDxDjP5yzfeuHiFk+qmn:Mulp5JtBF6Oh3Dxxyzfp2tqy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708105232, "uuid": "118f5dcc-846c-4db4-860b-7e14999fd4ad", "value": 8318976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708105232, "uuid": "f05c1867-cc6c-4929-9669-ebf583d74483", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708105232, "uuid": "8da4d298-51bc-4071-9699-cbae354c28cd", "value": "7ff67f190000.notepad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bede322a-ccc8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708087306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708087306, "uuid": "34227136-154a-451e-91ab-c483ec2bfa7f", "comment": "Malware payload (Mirai)", "value": "ff2e3f139b96dfd2bbe4edf220e892d9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708087306, "uuid": "738d6e97-14e2-4820-ae48-23209dc6b7ce", "comment": "Malware payload (Mirai)", "value": "91a28ef0106909bec34ef34dec4e8c1075ba795ccadefcde9bff58c87b194dfa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708087306, "uuid": "c08c10f6-92b2-4b1a-892f-2c2e5d0761b7", "comment": "Malware payload (Mirai)", "value": "7f7ee5dbda1474a7228fe3b245c85cb439383916", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708087306, "uuid": "8c29058e-d0ab-4627-b10f-5953b2b63358", "comment": "Malware payload (Mirai)", "value": "6bc5d1e5c3bd1dfb2e6d81fa8cf8d8e35bad257e5e7a60c98d93de1b4437eaa1b2f94e636baf30f7c01e516c2486802e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708087306, "uuid": "476db0ed-0a52-4d72-a499-25b783de9713", "value": "T1DEE30B46F9818B12D5C111BAFE1E128E37131B7CE2DE72139D246F647B8A97B0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708087306, "uuid": "0fd80b56-2981-4ae3-9e44-6ea4402d18af", "value": "3072:X+IyUGwap+XbH/1wLaUJ038PodCedqYRXZ:OIyVd+XD/1iaBf3dqYRJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708087306, "uuid": "e7c24fb2-6fc0-4b70-a2c4-f4d92cfccaca", "value": 150460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708087306, "uuid": "9a7546d1-364d-446a-acd5-38bdf906d611", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708087306, "uuid": "62db6143-f8d8-4db9-a304-e307b542149a", "value": "ff2e3f139b96dfd2bbe4edf220e892d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1a46257-ccc9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1708087686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708087686, "uuid": "6e28f894-1a6a-4e7b-b605-634aa79826c8", "comment": "Malware payload (AgentTesla)", "value": "4a84a32ae970e8fbe1a4439cbe4752d6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708087686, "uuid": "dba4009c-8345-4338-9d0e-7f6712f92fb1", "comment": "Malware payload (AgentTesla)", "value": "93ee7308d3073782266ccbfca04d483aa35c95becff7a80326d65f615b777676", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708087686, "uuid": "cc860cd5-3af7-4161-8f03-bb56309ba301", "comment": "Malware payload (AgentTesla)", "value": "e81aa0f853208535c51c749c85b81ccb6be90244", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708087686, "uuid": "f5ff35e3-4010-491d-b785-ce9d290af521", "comment": "Malware payload (AgentTesla)", "value": "13f14904a3ca6a8789e0b042a5c6ca09bc9fc341b9375287a720f07ea1703d099f51f82a341bdb13b2b7bf5d5118e61d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708087686, "uuid": "ac1a9a25-7c10-458a-ae2a-cb01fd78e743", "value": "T1F0340F037E84EB15E5A97D3782EF2C2413B2B4C71633860FAF49AF9624516825C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708087686, "uuid": "3a495986-529c-41e2-a23a-14473c88cdaa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708087686, "uuid": "489591a9-a204-4305-ba00-aaa6e032ec73", "value": "3072:YWaKZ2yui2P2eVjyRI5hNixUnYWb0WLr5IDEPLHhl:F32yui2P2Qjy07ixUYu0WLaEr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708087686, "uuid": "ca210033-cdf3-4ce1-af62-2a250ac9852b", "value": 244736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708087686, "uuid": "4abd71e0-fd56-49b7-80b1-5cdc4b990f0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708087686, "uuid": "3e2c3167-74be-4960-9f4d-4198f7739900", "value": "1708087685ad6e94871d09a7bf3f5a504e80f58fd877e71e564720112b039928f9fdb2d12e776.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1e58dda-cce7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1708100572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708100572, "uuid": "f9eb062d-176c-416f-b509-4d26a4192938", "comment": "Malware payload (RiseProStealer)", "value": "72424dd99d1997b1ee73a385587457cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708100572, "uuid": "b7ae1956-91cc-4743-a7f2-bb2c0534ebb6", "comment": "Malware payload (RiseProStealer)", "value": "96e8d424262797ec751a704afb963911f2744a7b890edf1493184ceeec0dbf1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708100572, "uuid": "f89710b7-23dc-4ad2-8688-8114bed3fd71", "comment": "Malware payload (RiseProStealer)", "value": "6a079f81240777237e3ad72daee274d410d21bcb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708100572, "uuid": "14ffe73d-9dd2-4efb-9bcf-da7bb90acd2c", "comment": "Malware payload (RiseProStealer)", "value": "64feeec417b0189a6f86e6056300b8cc67c51d1da38d6dc45fe675af25be6b7db35e3578ef99f0537e422758022bd2c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708100572, "uuid": "2ad28e85-667f-4c5d-ba78-70c731976706", "value": "T1771512CEAD418057EB84377808D2FA7D036FFD84BD5980C86CC9BFA77632A19192256D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708100572, "uuid": "04198ba4-ed78-4ef7-bfd5-c1bf0d49b0e9", "value": "2388fee6ad8ce4f4a35dbaf64e2da01a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708100572, "uuid": "9dc05937-c7e6-4a8f-b724-72676c3fe25f", "value": "24576:hDgB0ooEH+osho9f0XfBCbOP6RggQWRv6hauofsuQ:h80fEeowo9f0XfBCbOPWRBR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708100572, "uuid": "478053a6-9add-4a16-ba79-e75ef99589b7", "value": 921696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708100572, "uuid": "70a7ab66-a21c-4dc5-b080-b675aa8dbfc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708100572, "uuid": "22b59edc-d3b0-4be3-85db-cb880a81ebec", "value": "SecuriteInfo.com.HEUR.Trojan.Win32.Generic.6327.7739", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36d8339a-cc8b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1708060878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708060878, "uuid": "a4120c9c-59b9-4075-9430-96f64e3dd291", "comment": "Malware payload (Formbook)", "value": "cae74512f661579fc340b2203b159af4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708060878, "uuid": "8266c6ab-7185-4fbf-96c5-ce00e433d3c0", "comment": "Malware payload (Formbook)", "value": "986b0bd9617fe3f2a0956754996c45298cdc3cdd2703ec837fa2d966028f5c8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708060878, "uuid": "e57cd1b9-11a7-4023-b063-3fe8cef80398", "comment": "Malware payload (Formbook)", "value": "ff253d244ae5e7322527c31611fef4a7ae3b8d50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708060878, "uuid": "dfa5d17c-d394-4293-981f-e968bdea8294", "comment": "Malware payload (Formbook)", "value": "6f17ecbecc0df10002d095c949287c9fd9fa0d17f70cc26f5486c567f0f5e117e631a715b37ba8cc043e7f9f5acfd19a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708060878, "uuid": "55294e49-5d59-412a-97fb-cf02eff3eff4", "value": "T189F4237E76ACE76ACAA89BB454F22928473D6C069432F2F60F45B4F72D533485701343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708060878, "uuid": "f84c11c2-da1d-4fef-83c0-1690c50cfd61", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708060878, "uuid": "9b2ecd95-9867-4dba-8bf2-1ef51cc53117", "value": "12288:c/Q4W365TXhHVtuQBeA0kTNKFGJwYyrLk0TjahZ0Ot9WES/qizkTfG4tdmEPLWZ4:6A65TBVhe5EgOyPk0TeoOm/qizCfG4DR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708060878, "uuid": "a197b8aa-031f-4476-8f79-ec18003b3ed7", "value": 728576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708060878, "uuid": "dfcaf4fb-8f40-44c1-bf7f-9f69809bc405", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708060878, "uuid": "13d03f82-eb93-405d-9ec9-a7285665064a", "value": "SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.10548.32571", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2444e32-cc9d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708068843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068843, "uuid": "ca2bc43c-e02a-4f14-b081-3ee2638862e2", "comment": "Malware payload", "value": "e97559c1d33cee7eb1ad75418d4abb32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068843, "uuid": "da9fc5e2-e92e-4613-b28c-aeb36fc8ee6e", "comment": "Malware payload", "value": "98db15de240e7a18cb723c234d8a464527d42893fff62334295503d6ba14dc2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068843, "uuid": "a335847f-f67b-4f36-af1a-bf94252d487e", "comment": "Malware payload", "value": "538351b33d9cb948da070d5933b57ba8c677191d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068843, "uuid": "250703a8-427e-4171-aa1d-dbd142fdaca6", "comment": "Malware payload", "value": "f76e5562d1fe6a29edbfbaa6677d49e0bc80d4307c5dcd1601bf515623421988d4a44a1eea134c8fa9f982af9e7625d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068843, "uuid": "86158692-fad5-481b-b744-cb3c2da8ff63", "value": "T12C031A538A1D50A1E64A8AB20977C1B63933BD621F415D8B384AFB4C3E717877AB131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068843, "uuid": "57f82b78-8536-464c-9e62-379829d33c46", "value": "ce4d2ad0df69fc87d8d19b9b2cabf6de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068843, "uuid": "d82d8a43-2eb8-48cd-9672-e8f7988c0a3a", "value": "768:jQ0MMwAtxY0nll89SlCTUdFMMCRIIL/4Fw4:jQ0MMIY8p4dFMM6Yn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708068843, "uuid": "05a519bc-d6a8-42e4-9a3a-bc92d1b14865", "value": 38000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708068843, "uuid": "ca1cec38-e090-48c5-be18-e5b1d9830c5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068843, "uuid": "62ec4598-70cb-414e-a1ff-00f6727d67b5", "value": "SecuriteInfo.com.Trojan.Win32.Agent.30636.20186", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5efff0b-cce6-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708100256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708100256, "uuid": "c28eaecb-c91b-4411-9b82-d9fa29611898", "comment": "Malware payload", "value": "c1e07e8eb1fa96d44ce25d0467263a7d", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708100256, "uuid": "0989dc06-74a8-4b1c-af72-dca5b56a2c44", "comment": "Malware payload", "value": "99d2a86c568edd700a6f40e45678f570da3546bcb4414fa3a1850f0687dddc03", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708100256, "uuid": "b1aaf2a3-d63a-46a7-9924-e3dbee9aeb41", "comment": "Malware payload", "value": "11bc2723c6f0ada8941cfdfe302e1560bdd3ea71", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708100256, "uuid": "737723be-5e7d-4932-a02f-52832b73c1ca", "comment": "Malware payload", "value": "17ace9154b82ec6da5c560b564862912b5787bb1152377e59399f8fa7ddd538696c2beb3683cdfe25f777c011347d388", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708100256, "uuid": "6ed1eb5a-ec5c-45e8-a03d-1d98e915b38d", "value": "T100E16AE5BE1C45E419BB225CDF928882AD5DA57415F88505F6BE8C0BF79FD2480F0B0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708100256, "uuid": "b0ebb426-3659-495d-a861-42dd601da80f", "value": "192:IvOuLf6+qUClbRZqwiJY5AH+W4BJeGZjf6H1XTMTqTn:IvQ+yo+yh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708100256, "uuid": "75a7991c-2175-44c3-a608-57a4f882b1e4", "value": 7316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708100256, "uuid": "2c8c584a-8f91-4a39-82af-d23a1f2a6c1b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708100256, "uuid": "80b54e87-8234-432a-b435-432ca10001c0", "value": "agent3.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0cf5756-ccfc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1708109643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708109643, "uuid": "97a2b514-3ba0-47d2-bd96-8958f489e249", "comment": "Malware payload (RedLineStealer)", "value": "fbe0c71f5b2e640322d2716d8bc916a2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708109643, "uuid": "0c62afa6-b538-4ae8-9467-4c7876aff54b", "comment": "Malware payload (RedLineStealer)", "value": "99db76619552e10826a620b4305a50915a10789522ff3668be2e611ab74a951f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708109643, "uuid": "32648faf-fae1-43a7-960d-3e445ec2536e", "comment": "Malware payload (RedLineStealer)", "value": "cc5a8a611d7cb4df5706225aa1d4ec494609e101", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708109643, "uuid": "75076c87-bd12-4230-89e3-450398fe4d33", "comment": "Malware payload (RedLineStealer)", "value": "431df420939cc16aa3a4dbffe69bd112a32066ddaf8ab168c66f3d63ae38c6cacddb04061fe171395441661200c13cca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708109643, "uuid": "e5981a51-6038-4f33-aacf-807af154d629", "value": "T108A4012032A6D032D14F22B58E34C7704EAE7C356561E9BF6FD25A3A6E24690DF2970D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708109643, "uuid": "42785ffb-722c-4785-8b3e-4f8a25208c65", "value": "701b7eda6b324e6e9073377243e2004c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708109643, "uuid": "19d2b426-4726-44a0-8e41-87a00d7f0cde", "value": "12288:id6yhKSeU29mz2NbWcWnYp5M2an6kKSlzCa5:0KSK9mZMM2a6+lz7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708109643, "uuid": "cee54700-3e29-4caf-921f-97fdb6985e1d", "value": 481280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708109643, "uuid": "28afb301-ee65-4ee5-8f91-9e9b99e953ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708109643, "uuid": "d3993bdc-0a6d-4a9f-b977-d23707864276", "value": "fbe0c71f5b2e640322d2716d8bc916a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "526225a3-ccf9-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708108169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108169, "uuid": "8dc22f90-e996-4884-aab6-24bfdabf578c", "comment": "Malware payload", "value": "de9a58312ce5268c2b0af4febaf8157d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108169, "uuid": "49da04b1-ef59-4cdc-9701-a8c72b931c5d", "comment": "Malware payload", "value": "9a26525156fe878ad6e0c9edc7ae46e2a97381e20583ce9b2c9b8772a5e20c7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108169, "uuid": "c72310a3-e6a1-4955-b094-d7d835a9bf6a", "comment": "Malware payload", "value": "260a311c37e3d4127f9313e9f3e2ebae3331b9bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108169, "uuid": "da30765d-1007-4ea4-9f0f-314873d1ea90", "comment": "Malware payload", "value": "8b91c91f68d1a032d93dc8bfa5120856bed9f9c220f6d4dd5e6a6aa7caa37e554b9c3209a6560561ca8ee7b0ec2a9265", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108169, "uuid": "64f22c6b-e063-42f3-8003-c5dbab27a589", "value": "T18B64CF346BDCC647D3C943BA58E541527BB2A5127083F78BF0692AE93E033929D1778E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108169, "uuid": "fc85c5e5-2aa3-48e3-8add-4d21ef8388b7", "value": "6144:wxos49zLRsIIGTbgNn0OG/zGY04fgwjoNSF1BGyq:wRozFrgNnhG/zGY04ow0NkG7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708108169, "uuid": "5d338eb0-5231-407e-a1ea-aa8264fa331d", "value": 326144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708108169, "uuid": "d9e0e78f-13d3-43cd-a4a5-af9190985d98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108169, "uuid": "3ede9a08-3088-46c5-89c6-38d732d2bb0c", "value": "SecuriteInfo.com.Trojan.Siggen23.2641.21127.7002", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c605734-ccd8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Vjw0rm)", "timestamp": 1708094120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708094120, "uuid": "a6a32edc-fc1e-47e1-a3c9-124abc516109", "comment": "Malware payload (Vjw0rm)", "value": "edd277e7a04ec062c49bafdb7d8b07af", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708094120, "uuid": "5038ec1f-e8f0-4bbc-a1b7-267e07829d22", "comment": "Malware payload (Vjw0rm)", "value": "9b647c40e98c2de028ce703d6b5558b6a9a9d75a59c7cdd81d78e71aea0c25d7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708094120, "uuid": "f0f8c65b-ad5b-4992-96df-7fc624468b69", "comment": "Malware payload (Vjw0rm)", "value": "1ff9c18bacf61a830f4f7001c5e19f8868ceb6b8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708094120, "uuid": "1da43ac6-92bc-4725-ac64-5ee54d8ef55f", "comment": "Malware payload (Vjw0rm)", "value": "7030f7f9106c1071fdd1b8f08c08d86b963efe055ea8e24c9eadd7ea3b265914650e35189939f4502faa90fa08a21c36", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708094120, "uuid": "0c3ef1bc-3af4-4bb4-a03b-b8678b5c9d27", "value": "T157E156AC73CADD1F27CE1A07EDB058DA643AC475A2D832D7835E7D4C81A95A7C508CC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708094120, "uuid": "d849bb8e-8221-49b6-8c4f-34b4edd06f54", "value": "96:FnYZH1uypXd3HofJBslCFGJc9lBdqlr+bXcCnTBw5BdeCldb+rNeUo0:BYZVhDrLlriXcCnTBw5BdnldCrNHo0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708094120, "uuid": "0a7a9a8b-5e6c-4fbf-93e4-61ad8be48d34", "value": 6900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708094120, "uuid": "f1ac7d3e-c04f-47e5-acb9-75e127d5ff92", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708094120, "uuid": "59cff3b3-6423-4f07-9efb-b1ad17e62fe1", "value": "54676885.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb9d956f-ccc8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708087300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708087300, "uuid": "78dbdca2-ad40-4e49-ac77-998259238c9d", "comment": "Malware payload (Mirai)", "value": "202a6600159e7b0a05f6974794750c90", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708087300, "uuid": "1c5080f8-297a-481f-8e5e-6aa6f3ab8bec", "comment": "Malware payload (Mirai)", "value": "9cc27a095b1be9266a98b511b1876e711f5d3dcf3d1c42b143a7e589aae541cf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708087300, "uuid": "be8ba047-7070-4972-b05f-0db2a19059aa", "comment": "Malware payload (Mirai)", "value": "a4a072354f64d7d3bbb2e0d6dfdf8a07a0941fd0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708087300, "uuid": "17774c90-7b22-4586-82ca-b70e8186cdff", "comment": "Malware payload (Mirai)", "value": "0a37d73ccacb1f6d3f13a662d5a6b76232f59434ca000547f620f255c3fafa40451c603df9149a9874583353ba99ecd4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708087300, "uuid": "9ef46e89-35e8-48b6-aba6-ce6f588c1165", "value": "T12C041A46EA404B13C0D727B9F6DF42453323ABA497EB73069528AFB43F8779E4E22505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708087300, "uuid": "1e6fb9f2-0960-4530-8bac-74062c0aa3af", "value": "3072:ER5gcLF3Br8cwhyma0ttqkoqQ4T/bBXaiTtRsohM/RTyaUi:UNVBr8Rsma0ttqkoVGBKiTjxhM/RGaUi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708087300, "uuid": "6fa9bdc6-1e48-4aa9-bfeb-a3fa70288c08", "value": 187677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708087300, "uuid": "f0dc20d3-0c5e-42a1-9ff2-076b46142242", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708087300, "uuid": "d9ed7351-47f7-48a3-8418-e0d00807dae6", "value": "202a6600159e7b0a05f6974794750c90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77eedc42-cc67-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1708045526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708045526, "uuid": "ab00098a-02e7-4d69-8a9b-0767d3d6e12c", "comment": "Malware payload (DCRat)", "value": "0e7aa6895ede51b9905576ddc16fb8a7", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708045526, "uuid": "f00b0f30-142e-4971-b127-979ec94a0f06", "comment": "Malware payload (DCRat)", "value": "9d8f29d19107d566fa521fbd3955cba07deb77db3148d38eabb6f2cca080283f", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708045526, "uuid": "657abf0b-36c5-441a-ae43-f2f3b6b6aca0", "comment": "Malware payload (DCRat)", "value": "0dcaa560749bedb9a78e1e5ffe03d10e69ac23b6", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708045526, "uuid": "19c28403-c5ca-4554-885e-db562151a1fe", "comment": "Malware payload (DCRat)", "value": "0a93fbc245664a2efbc521f4bf01caa663b0033500937d902f717eca650a8490f0bdbcb1e5aeee9aac949ebf5ebca0cc", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708045526, "uuid": "b4b99336-0edd-4a8d-95cf-4513d5cd5c92", "value": "T17F06F11A59930E3BD3644B324057013D8295DB753A72FB0E3A0F60E5AD13BB5CA762BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708045526, "uuid": "ce17096b-f2d1-4f5f-a7e6-8861fa12c03d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708045526, "uuid": "8384371a-bd41-4274-ae73-c853cfb8c8e2", "value": "98304:XIRVdVkuW4Wnd9jDa3IFxpN6JLKYvRfonI403kw:XIRXuuW46d9Ho1B2gk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708045526, "uuid": "d5910f2a-5211-4dde-98f8-135a2cd8f504", "value": 3697152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708045526, "uuid": "149a8836-dc5f-4ac4-9ec5-260ea507683c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708045526, "uuid": "d65bb6eb-2e09-4a57-bf1f-0710b8ec465b", "value": "0e7aa6895ede51b9905576ddc16fb8a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdb8345c-cc8c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Tsunami)", "timestamp": 1708061641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708061641, "uuid": "10ef6742-86f2-4e4d-9700-f4a63a010ed8", "comment": "Malware payload (Tsunami)", "value": "6f6b023ad575ccd0af8d1e3e6ff30cfd", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708061641, "uuid": "47b789e4-1eff-4391-808c-65ca44176070", "comment": "Malware payload (Tsunami)", "value": "9e591d106e024a7541886bf8810232d8af2f0ba6eaebfc2a2821874fe86668e9", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708061641, "uuid": "93dffe15-ab0b-4224-b6d7-60367c943488", "comment": "Malware payload (Tsunami)", "value": "3983433ab46273795ca2bcf5ec08c55bafd1e2ff", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708061641, "uuid": "b63a39f5-c26d-4624-84e7-ccb1d55d5a87", "comment": "Malware payload (Tsunami)", "value": "4cab1cae16dc06ffd11f7900b0c86a4a7515f185e8571ccabca9058979289e43030b1b22b4c89e3d1f23e4ed9172425b", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708061641, "uuid": "ccb74050-eaf0-457e-8571-2d41d2403609", "value": "T1E7A35C276652C3FEC09B46B527DB5511AC23B83B0B2B620133D5FDA93F0ADC85D693A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708061641, "uuid": "5932e1ef-9765-4f32-a835-0a2f62cdd473", "value": "3072:y6eT3HcIGXej7CV/YE7TPF8KQTeDmToTJFiv5uGbW:tgCVAOPF8feDmToTJFiv5uGbW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708061641, "uuid": "7f829854-2583-4f84-8209-c8d18f8c42d4", "value": 98683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708061641, "uuid": "adfc8a09-a96e-4b7e-8966-675fb0cf0a50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708061641, "uuid": "61cb27c0-ecd8-4310-8dc6-d36ccaa889d0", "value": "6f6b023ad575ccd0af8d1e3e6ff30cfd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bae2ac61-ccc7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708086870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086870, "uuid": "539c8479-5b9a-4626-bac6-6f23b3604e0c", "comment": "Malware payload (Mirai)", "value": "1d365e8ebc57f6fe358635f1c5b5d886", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086870, "uuid": "a7d41d10-4b6f-4d19-93c6-fa4cf0ed7e0c", "comment": "Malware payload (Mirai)", "value": "9ed4a36ba7c628535be96a3f497ab61a1715b74dd54412c0fa17959b7455384a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086870, "uuid": "5f3f10bb-9d51-4eec-8d2c-8aec8f1f360c", "comment": "Malware payload (Mirai)", "value": "ae6a6ae25d98072d03ecc82ed2efdecc8cc9b360", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086870, "uuid": "10087e65-aae3-4f03-b8e4-38259b2e421a", "comment": "Malware payload (Mirai)", "value": "776138f1e0b6f62cafe8fc88339748a7926607c9a7c8152b77aebf20d2a55a43cfe54dd3d27f931b2f22dbb61b168d5f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086870, "uuid": "0592b472-d512-4ac5-905c-17e72204ed3c", "value": "T10CD30845F8415F23C6D612B7FB5E428D3B2A17A8D3EE72039D216F20378A95B0E37646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086870, "uuid": "a9310969-49ae-4a39-b755-8084f391b8f3", "value": "1536:fei2BNl0AdzGVG5vxOjxM74SFPN1e10ATRm4VktuTxD3OP8FNg7q1bIpPL8lcWwT:fepVGyt0Sf010z4Uux3OP8dbIJL6Ve", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708086870, "uuid": "67e6345e-fef3-4663-b6c2-14921de350c7", "value": 137984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708086870, "uuid": "419bcd83-64d4-4e6a-a2b4-95c861ffb546", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086870, "uuid": "7a1cde6c-4d9e-4cf7-af46-f8383ab8f4e2", "value": "1d365e8ebc57f6fe358635f1c5b5d886", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86a297b7-ccfd-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708109975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708109975, "uuid": "f1eb3f52-36fc-4447-bc8c-6e602c7eeec4", "comment": "Malware payload", "value": "b6393392e402d73b4010ca2c298f476b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708109975, "uuid": "c9364a16-a433-4d2e-81e1-5ac3ed4ae957", "comment": "Malware payload", "value": "9f63b7cd7513e6f3c68b8dfeb07b33f22143d561da4b2fa88a094b3f796c3cc8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708109975, "uuid": "85798b78-7811-440e-a906-b8f30c58dd73", "comment": "Malware payload", "value": "e4443679eb49a1fd321da20894e09208ccc4a856", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708109975, "uuid": "a06775fd-2a41-4290-b9b8-5e08e1a9a622", "comment": "Malware payload", "value": "6ea39544b0bc5e8652a8645d57dbbd7875b0b5e553ca03fd9dc8fa3961a4abe3c25ea4fb4e9c2fae1e0d1ff8eaafa73f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708109975, "uuid": "4ff562bc-f9e2-420e-b568-d918f57af5ad", "value": "T1FCB42316DAB30813C180C5FD60E59B1E7BBF611E652EE456E910F7AABA783F0D036187", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708109975, "uuid": "b5614dae-887f-4946-b896-ce8b98655fce", "value": "45a74cbf9993e123825ca926eea3ec62", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708109975, "uuid": "0ed40cec-f9ec-40f4-826a-36819b3e3221", "value": "12288:GwRxbtiT2T9yW0ky3m4kS3mGL5FtsbJ2ZilWH0JHN:Geh13sm6v2J2UlWwN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708109975, "uuid": "67727df1-917b-4b31-9d18-49883ec92a13", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708109975, "uuid": "a3847dc5-65c6-4574-838f-9c230468a41f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708109975, "uuid": "4011f6fb-056c-483e-a3b9-57433d535672", "value": "9f63b7cd7513e6f3c68b8dfeb07b33f22143d561da4b2fa88a094b3f796c3cc8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "530c491f-ccf9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1708108170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108170, "uuid": "1575a444-066e-4755-a21b-dd0fc3ebbbf7", "comment": "Malware payload (AgentTesla)", "value": "b1eb3acc94ed60b0438876d882458157", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108170, "uuid": "04c8b82d-6c34-46d3-a039-bb3d08a892f6", "comment": "Malware payload (AgentTesla)", "value": "a111c4f71eff009bd6e9bfb327109bcde57864c37c6fdd14d037f35ac859c765", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108170, "uuid": "88c43b78-7215-4f7f-80d6-3ee441003dd8", "comment": "Malware payload (AgentTesla)", "value": "0d54b58b0556c02b229a06ee3921c0a73ed325bd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108170, "uuid": "b360a45a-cd77-41a6-a55b-2cc8d6750f1c", "comment": "Malware payload (AgentTesla)", "value": "21691d1ea93577a82bdab14b91a103d00f9dbab3bef8a26d45f0ec426a02bd76e27ac662681a2c4f3de7a8f2a08bd938", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108170, "uuid": "c3924fd1-6e69-4c01-a56e-ac2e007ca9e3", "value": "T180E42254353B2737CAA821FE04E2216503F9948A5691E3CBCEEDA1F616C2FF16B46943", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108170, "uuid": "bb437c5e-ba9b-4ebe-8de0-483735276431", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108170, "uuid": "89716129-7cfc-4f5c-8a65-f9f99e5a2790", "value": "12288:zUcEhQ4W39hmSYGc9OMMsJp2dMRw39Dy54ZLiytXK8swWeT4qqJd9Pwm:SA90zG2ZMCpIWwNDRtiylVSd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708108170, "uuid": "394b1677-adba-4e08-a440-250c67ff2c2b", "value": 693760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708108170, "uuid": "8d5f7dde-175e-4d5b-ba34-ddaf791c04eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108170, "uuid": "365eaeb1-373d-4b68-8bb3-87f63f12dd86", "value": "SecuriteInfo.com.Trojan.MulDropNET.68.25834.10722", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdab5c89-ccc5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1708086015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086015, "uuid": "7ec1b62b-ed2b-400f-94df-274e532cd80c", "comment": "Malware payload (AgentTesla)", "value": "9151bc59e92c486c8b7b54f7ecbf9f41", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086015, "uuid": "4a204827-11c0-4539-be8a-e8fa85c21af2", "comment": "Malware payload (AgentTesla)", "value": "a124676bf9a40cfe2f94425f28218604602259d1d95b1d049d1fe2a6d69b47a5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086015, "uuid": "c9fd0cdd-11b8-4d13-88d1-70144c45005d", "comment": "Malware payload (AgentTesla)", "value": "77dbf9fbaf0c3838dfd3056a5ad6225c641f98f9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086015, "uuid": "9dd4d00e-3120-4193-bb0c-15eb2e8f6669", "comment": "Malware payload (AgentTesla)", "value": "3c7a301fe7abb0e473734bc34449f0f6098486f620a524d8b34335092fb557ea27266e24d88ee76b66e33b3f14d9425d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086015, "uuid": "1d77e260-46c2-4a0a-9878-ddc87f63ca62", "value": "T12BE4235DF3736421CDFA27EBC9D901255A84B5A4C4CBBACB7E6B50E90E7D25180CF08A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086015, "uuid": "d1d633cb-b095-49ec-852b-7630ac914ea9", "value": "12288:Z5UAVW/NfVI9BpuHSTfBBf+7aJp2zIGeZ/FKrcYy8+ySzRLdEtYRElGIQCJUTHo:ZmMUf+HuyjB7Jp2EGeto7y8zSp+Y6asT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708086015, "uuid": "906d3f2e-c18d-4d3c-8c17-ab456f2bdad9", "value": 692988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708086015, "uuid": "e0ede073-101f-45c8-a997-487b4470bb82", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086015, "uuid": "17fdbaf2-7259-4c50-b3f3-ab06362e78ab", "value": "\u03a0\u03a1\u039f\u03a3\u03a6\u039f\u03a1\u0391 # 5G.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9edac48-cc9d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708068829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068829, "uuid": "9f109b60-4264-42ba-8638-6cc58efd9662", "comment": "Malware payload", "value": "79204cd9705f242a0466409bf1faa988", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068829, "uuid": "def24b0d-c075-47c5-aa86-046ee34dd5d6", "comment": "Malware payload", "value": "a12eac6740d107c7cf699fb48e2cbc849f1b7373b18922aa32bbf7b7912aac9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068829, "uuid": "28a433af-6a6e-452d-a011-6cb320d43dcd", "comment": "Malware payload", "value": "1784f1c0c661321893936ce40dba038d9379141b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068829, "uuid": "1f1f902c-1c61-4a0a-b0c6-4e2a30096d48", "comment": "Malware payload", "value": "14bcc253a65c9f587813fb3597b85a8cbcb5ee6a520318bc86324c4593af18513b3e0c279753b6a62a51a729ee6476b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068829, "uuid": "405110fc-3786-4461-a7f4-f54bcb3fee0b", "value": "T192058C02B6D280F2C6571530086A7736EA76FA064B15CFC393B8DF6D5D72381A93727A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068829, "uuid": "7b6ccda6-ca6b-43fa-9c9f-2b12171a26b1", "value": "8618b6a2285f10df362d7ad49e0ac223", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068829, "uuid": "3743556d-7790-496f-86a8-39fe35a89c25", "value": "12288:61dU3gjl5ehrGiu/bcYSErSVxEWjYKKnP7I442qG3VuX:6aiHeZGiabcYNrSXJKnP42qG3q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708068829, "uuid": "bc656f63-3468-4dbf-ae90-ab5146f58d36", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708068829, "uuid": "ee5fc46e-96e4-4bb9-8a9d-bcaa647dadef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068829, "uuid": "92633592-970c-4565-aeab-802ff3256845", "value": "SecuriteInfo.com.FileRepMalware.18841.17192", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "555b1046-cd0a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1708115476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708115476, "uuid": "3a5ef190-cdbc-46f0-acf3-966d189938bf", "comment": "Malware payload (RemcosRAT)", "value": "1ebe49c58035c4521d998e998253260d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708115476, "uuid": "8cf195c5-4d87-4c41-9af7-15f4c2a8d4d3", "comment": "Malware payload (RemcosRAT)", "value": "a32d57511ebc8b2c48fc43e2228b227bfb7eed8b34f9d55cdc9958de86bb64d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708115476, "uuid": "d88a42c9-b3a5-46f9-8e52-b446d6d3c5d0", "comment": "Malware payload (RemcosRAT)", "value": "7bde1b01007542cef137080ec42e4b2390d99a33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708115476, "uuid": "a8797a94-c3f1-4611-a233-6c2dfc09e8b0", "comment": "Malware payload (RemcosRAT)", "value": "209f91ae4e064849a5111e774ee86b12b49a291e40805e88e46a1749a7325a1cf4a2d679246bf743c5f65d7df3aeac33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708115476, "uuid": "2f66be91-0b54-457a-a5ef-e8ab903edd9e", "value": "T1CA73081937FDAB26E9BE5BF99970940007B1746E7521E31C1EC220DB29B2F10DA81F5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708115476, "uuid": "a5e85153-0502-40fa-a075-da8546be801a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708115476, "uuid": "4b4b0ad0-47b3-4dfe-b271-60b70b1bb980", "value": "768:tiyTdqssLTzWlSrky5qimuGdk2mxXl9fmNNS9VWzIzlBaCAWGiLFTsaBD0pdXRNv:GU0fWzOl5ZTsaBD054S5+cnl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708115476, "uuid": "297018f5-3afb-4a5f-803a-4a9200bc3437", "value": 73728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708115476, "uuid": "a24fed6d-2863-44b7-8286-42a58931e523", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708115476, "uuid": "dd450704-31c4-48be-b785-c8dd06fb1dd1", "value": "SecuriteInfo.com.Win32.RATX-gen.30107.2695", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab5a7452-ccc1-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708084267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708084267, "uuid": "c051228e-997a-4f13-ac8f-7b12a81424e1", "comment": "Malware payload", "value": "cef8afbcabf733326ebb30042de7fac5", "object_relation": "md5", "Tag": [ { "name": "812800", "colour": "#7950EB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708084267, "uuid": "10d30cc0-cf1b-4bf8-a19e-6022188dd419", "comment": "Malware payload", "value": "a4c9f9779f7892d05bd07b49a0a087a6f17f63a00318110bf0d2f2e64589af1b", "object_relation": "sha256", "Tag": [ { "name": "812800", "colour": "#7950EB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708084267, "uuid": "2272501d-8799-4329-881c-0e2413004bdd", "comment": "Malware payload", "value": "2d4cbd92118a4eafaeb175acc627c7268184e105", "object_relation": "sha1", "Tag": [ { "name": "812800", "colour": "#7950EB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708084267, "uuid": "abf12618-36bb-4370-8b3a-4d6ec5ae1da5", "comment": "Malware payload", "value": "07264873772fad9417a01a5c03c93578bc9739a97fb81c101d3dd3bd96648e2b40b0efc7852a56f72fed8b1c2b94fa39", "object_relation": "sha3-384", "Tag": [ { "name": "812800", "colour": "#7950EB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708084267, "uuid": "affccd9f-dae9-4b8b-80c6-388310d84bf5", "value": "T1331264F65E1042D39A36CF647E4E3211D69EBD471E88BB842042CA729C02499DBFB42B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708084267, "uuid": "c87b664d-a8fe-4991-9743-0e861bc94756", "value": "24:9O+AAyWpYyAAztDHYAQbnWrIfB1PvZNzAA7KAAL:9Ogp7tDHEqIbHk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708084267, "uuid": "b42018cb-7132-4b0b-9bd8-1306c4465de2", "value": 9061, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708084267, "uuid": "d06b5a52-7246-4096-8b0b-12bf555c6727", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708084267, "uuid": "f92e13d9-8939-4169-9034-688515c71eb4", "value": "Facttur525252525252.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b40c7ba3-cc9d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708068819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068819, "uuid": "d9081f56-7b49-4c20-a9f1-cdb24df98b16", "comment": "Malware payload", "value": "15f811d3617ee1f34534e7b68721d1ed", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068819, "uuid": "a160c4ba-4cb4-43de-ae70-fc2e7b3ab276", "comment": "Malware payload", "value": "a5743eeea27f2ca89053ade8e478795d621b407435bec5c96ba147d7a16289ee", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068819, "uuid": "ad9d664f-7f18-4334-9054-8c57b2c38669", "comment": "Malware payload", "value": "9a0e612a07841dcbd8d0f09b77f30ae99fb68402", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068819, "uuid": "3391bd46-abac-4f17-97aa-1516934e475e", "comment": "Malware payload", "value": "60ac132761d59023c4578524cd644ab39bb6d48186c48e484ea4d3e312f98eabbdc5a672b643d42bfd123ef55f0b96af", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068819, "uuid": "10f954e4-3804-471e-93ec-117b1478431b", "value": "T1DFA38C03B554C876DC29057541ACDA16BA35EF810D62984332E9FF8F3FB27D6AB32189", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068819, "uuid": "769633c1-4264-40b2-97ba-2b491f5f8980", "value": "1536:vx6l59XhDJfqu5WArMp4gv8HaeEn8JjYms7XqXzCb04Haee0pRiHaeI:M1d4p4gpRkjYmpw0lZ0RL3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708068819, "uuid": "1ed0c0b1-7844-41e0-8529-48752ca04494", "value": 105984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708068819, "uuid": "c35a6d72-7dab-4530-a7b2-4d9d44d1c62b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068819, "uuid": "f6fd324f-2a6a-4405-aa5f-1dd75c67f380", "value": "SecuriteInfo.com.Trojan.Win32.Vindor.354.6310", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4190ab1-cc8c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Tsunami)", "timestamp": 1708061598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708061598, "uuid": "86056156-06ec-4f9d-9cf0-85af7f7dfadd", "comment": "Malware payload (Tsunami)", "value": "40e32a258b9ae93097053572feb7f2cd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708061598, "uuid": "323deac2-7cdb-477b-a22b-1f7fd37a8c54", "comment": "Malware payload (Tsunami)", "value": "a6b03e495f7f816ce4de8b4cce6cc46982f8c7be4159f7081dec6598979a8b2f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708061598, "uuid": "53b23741-db6c-4d89-8dc3-149130bff95b", "comment": "Malware payload (Tsunami)", "value": "53eec7ef8442b13ca0727f4d1768997d6cf66c18", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708061598, "uuid": "cda7fdec-dbd0-4fd2-b3ba-0185b3012970", "comment": "Malware payload (Tsunami)", "value": "d3f407829accc66ef702982c055c77ae38935aad8ca5141552a98fb94906309885fbc5380c030a4f7d06186e912d0c87", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708061598, "uuid": "d5ef4ddb-b6dc-4445-a985-27baa1c85ab0", "value": "T1AFF32B05FB508B37C1D127BAFA5B838933328BA4A7973342D9286BF42FC27995D32554", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708061598, "uuid": "813688b4-699e-4038-a338-81eec6e2c9c8", "value": "3072:fE0gigFLuc9G0/UeNXahSLsydvIBPBveayUKG44ufm20YlsGr3ZN+h0ldhQzuGhS:A8y+6m7YWGrJ8hIdEuGhIsCcDqtB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708061598, "uuid": "1b3b0fc8-1c24-4882-b45f-5cc43c259033", "value": 162832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708061598, "uuid": "9815e085-3c51-49fb-b3ad-9067c2ef0be6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708061598, "uuid": "f470de0d-2869-4056-b646-eea15b4db7be", "value": "40e32a258b9ae93097053572feb7f2cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "569999d9-ccc6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1708086272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086272, "uuid": "d8d8c1f6-2f6b-44d0-aadc-bd04fb300bda", "comment": "Malware payload (Formbook)", "value": "0927450566d7e66119e174ba3b88752a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086272, "uuid": "9d4e5cbc-2891-41d6-b816-83184d010b74", "comment": "Malware payload (Formbook)", "value": "a9359763ff1173541367f262ddfe77cf70ce3656976e6b087bc1531d81f880bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086272, "uuid": "87530fc0-1cb8-4f0e-8674-67041fe88969", "comment": "Malware payload (Formbook)", "value": "86a6e53cadb774a48af133bcf26825d10febef2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086272, "uuid": "cbe74da7-9bc2-4f6e-8fad-d28e0306a6e3", "comment": "Malware payload (Formbook)", "value": "17f66c93e6dc27c6ecc6028b73911cedcfede2db0ef8b32d9f4dee225bf2395062e0c1c2b7ad4f39205da1f8da28e597", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086272, "uuid": "7540d669-797f-4100-a0f6-f6398688b681", "value": "T14EE42362A25DCB36E97C4FF390E7286823356C071475FBDABDC4A4EB1593B01C62225B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086272, "uuid": "26043d7a-18bd-418e-b6cf-84683f913b4a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086272, "uuid": "a12d488c-256f-4e25-8926-7bcd20ba58f1", "value": "12288:EBQ4W3//bAOsoLnvD6osouieOBOIFk/BJQsyf1hn1wQajj/MK7v9Q7DQ0++P:MA//bAO/21ouieOBV+BUdbwjU6r0+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708086272, "uuid": "3a0cfa65-181d-42c8-a87f-391dce053eaf", "value": 710656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708086272, "uuid": "f21fdfbf-f491-410a-99e7-21b258b9859a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086272, "uuid": "0adc8bde-118e-4925-95fc-f5663440b065", "value": "SC_TR11670000_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c38ee1f7-cc9d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708068845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068845, "uuid": "47fe2687-b52b-40e2-989e-924f9a59c570", "comment": "Malware payload", "value": "c65a96857ceee9eed70261b7bf55f4f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068845, "uuid": "fbe6ef0f-fd85-4767-935a-57fc8f64764e", "comment": "Malware payload", "value": "a9d88eb0ecc2514cf266cfac4fe01ecbbb678e7072507ed9f872bdfd84ee202d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068845, "uuid": "301bbf04-a416-43eb-8d77-5f8f9583c3a0", "comment": "Malware payload", "value": "35d8b3009e7af79e3c1624b0840f08cef5d517c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068845, "uuid": "8b27b55a-010b-4095-abf5-f04d7a1ee897", "comment": "Malware payload", "value": "9beead1ac7ac3e06b72f21824d1330edbbb9e636030bc99ccf1a337c5bc6e149467477480d94734b48f0dfd3e1ca207d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068845, "uuid": "15d0ba25-f0b8-4afd-8e02-ed5e1b9dbaee", "value": "T10D334ACB41207537CDD65A7092DAD727DDB1B2802B98C18B14B4C587BE87BE1277E20E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068845, "uuid": "c5df0600-774d-4cc0-860f-6be7d771a4f6", "value": "528ac7a1e034801d1f20238971c6ec19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068845, "uuid": "b902c8b0-900b-41d2-85f0-a7f4204cb460", "value": "384:qJcJkYnYPLQa6j20eMMPRz0vnYPLQa6j20eMyEkIZG9ntmnB1djnzcYn4bmFnh6Y:qJmymet0vym6iG9tmGrhGX3d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708068845, "uuid": "ad573e01-68b4-458f-9342-26aff055c0e8", "value": 52396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708068845, "uuid": "dfd886b7-9faf-4d04-9dab-95222a3ed30d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068845, "uuid": "141f1401-093e-462b-8c72-5a65d2ef5d6b", "value": "SecuriteInfo.com.Heuristic.HEUR.AGEN.1361323.14096.13888", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df4bf6dd-cccb-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1708088649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708088649, "uuid": "34add55e-8cba-4c61-83d2-1e4f256d111e", "comment": "Malware payload (Formbook)", "value": "e1e802fb878301d7cef61a933f96bac9", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708088649, "uuid": "d02f9dcd-bf61-4955-b97c-099eb0cff7fb", "comment": "Malware payload (Formbook)", "value": "aba8965046ef789af4dff4813e508cb38b9b3931e80311b114c0862127bc957b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708088649, "uuid": "256e13a5-988c-4393-8929-4052ac635dc3", "comment": "Malware payload (Formbook)", "value": "55d4bf154c05224bebffa58855e7c3d25dfbd169", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708088649, "uuid": "db48f418-59f5-4847-879a-6f0d74ffaabe", "comment": "Malware payload (Formbook)", "value": "68301697cd1ea7a95eab2177d16508492ab33c7c7c26ea283861b646d7ac3d0f4a188858d4df5721d6ad8c0823f0353b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708088649, "uuid": "869818c2-101c-4212-8b21-395df21ef2c6", "value": "T1C4D423D2A9007DD9F421FC39BA1479E4A46F43C129194065A1F222C43BFE4FD88AF47B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708088649, "uuid": "5ed5f8a1-e934-4110-9a24-731d2a230d10", "value": "12288:RxsKLRCSAyLVT/HPhTnQ4AWaRx2JWeQ7kIEACUxS1jKWe8HdslD79:rzRCgVT/HPhTQJWaX2Ud7kI0AFJF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708088649, "uuid": "417649a1-dca9-4e63-aff2-abd8b0f1a5af", "value": 617432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708088649, "uuid": "466b79a1-da67-4664-a68d-d9e6743fe47a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708088649, "uuid": "0696409f-5202-4f07-9012-2dad27417f01", "value": "BBG76865646 PDF.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9af6856-cc8c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Tsunami)", "timestamp": 1708061581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708061581, "uuid": "a06c0864-ba2a-4e1c-b61f-a79e1c37169b", "comment": "Malware payload (Tsunami)", "value": "073e50a796bae9a3004bb92e98b19207", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708061581, "uuid": "2f919694-ec2f-4804-a018-54f42b626475", "comment": "Malware payload (Tsunami)", "value": "ac8116f2daece95f4d0ce7a323587a1c963e2ac540eccbe7d44fb948e5348068", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708061581, "uuid": "8023d673-4ff0-4701-a28e-57f5f81e13e4", "comment": "Malware payload (Tsunami)", "value": "f4d75f0f895637ac0586fc322178739a025362d6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708061581, "uuid": "b983605f-5d6c-4e65-8a5f-1e9abf606a80", "comment": "Malware payload (Tsunami)", "value": "abcb745a3a76c5eea69710cb2c9561ef71b6ced549e2c7b6edcb71d79668c55b4f3c5080764fc96327cf32656237ae5d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708061581, "uuid": "eb760a39-9587-4691-b8ca-f3a04721b411", "value": "T11E834B46AA52CAF3C8530FB50297669D0B25F9364E7A9F81F31C7CF09B525C8392B790", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708061581, "uuid": "a12052fc-f8f0-4d78-872d-02dd254bb546", "value": "1536:huv0YACW5mccjJxQV8HlXujYdhQzM1H+Y5M0npAvCPVFL3ApQITA:KG55cjJxiMlIYdhQzM1H/MsAKPVFLQpw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708061581, "uuid": "91a75576-ac69-4245-9e8d-32633429ad33", "value": 83853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708061581, "uuid": "227464c1-405b-4202-a44f-1c748c2ffa67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708061581, "uuid": "be2259b5-9c9b-4c52-a185-a1fd9577f6fc", "value": "073e50a796bae9a3004bb92e98b19207", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eb8a285-ccb4-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708078528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708078528, "uuid": "deaa03bb-b658-48c6-a8b6-39a12beaf2f3", "comment": "Malware payload", "value": "152da3e5fd958151d1841b3622ff0a44", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708078528, "uuid": "38f781f5-714b-4aab-a38c-a5cd76e6afd4", "comment": "Malware payload", "value": "ad5b99bbcb9efe65a47d250497eb5d88d28a53ad0dc5d8989f3da4504b4c00f8", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708078528, "uuid": "85b46284-e076-4c2e-aeda-652866b7095f", "comment": "Malware payload", "value": "e84ca4bd144ce506c1c325c7d85d7957d27fb80b", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708078528, "uuid": "f1aa02e4-3954-4878-904c-413d1873ce6c", "comment": "Malware payload", "value": "c8b382dbded1ea437e7070b9a2750e9b6a0c9cf247f4f336a984b4080d68a887a2866c66a8786bbf63df457fc90d48cb", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708078528, "uuid": "74cc9504-fb82-43c0-8675-1aba3213f2de", "value": "T1777533DE92350A7BA67EB5691F8B2BC47A113FD70F705C69600E19A10E393FE2D83185", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708078528, "uuid": "7c186edc-b987-46c3-bb14-a05430bd3960", "value": "24576:+qJHMkL0IT4WV3l/oWWE0crxG/4r447bgErDDI1JfMCBJXiNA4hgkM8Ct8PXiVzT:+yHL0IJVVlocr9r42g1BbbgM58PXiNtJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708078528, "uuid": "830ca0af-35e9-4371-8cc2-488e0d893657", "value": 1553560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708078528, "uuid": "2fa5240c-475f-447f-a63c-95cdbdf46586", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708078528, "uuid": "aa827fd7-19bc-47f3-96fc-39aaedc85c2b", "value": "152da3e5fd958151d1841b3622ff0a44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33d032ae-ccf8-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708107688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708107688, "uuid": "d45dd5e6-a851-4645-b91b-9a4889d5d78d", "comment": "Malware payload", "value": "fb30a63da1aecf60f178423f1aa583e8", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708107688, "uuid": "c88a860e-2e55-4dce-8780-44d11d38ed58", "comment": "Malware payload", "value": "adc03f589635033063d30e4b478715b29f2aae7a881d28b9982b5955dc226088", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708107688, "uuid": "d9bdcd40-47e7-47a1-af75-7abff15b18bc", "comment": "Malware payload", "value": "5268bf7a88e7feb1089985d9340d8d7d8fa3f3a4", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708107688, "uuid": "70b565d5-58a2-4bd5-9cbc-91ffaac4bf28", "comment": "Malware payload", "value": "f8940512744a56deb18410844b58b984ba20584d395367de19ccdf7e17ec33fb17203afae3946835590ce7f4d1f80128", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708107688, "uuid": "21124d7e-f1aa-481e-979b-f5b293aa0e3f", "value": "T1E4614BB6FC9E26A1C590B3B894EA071919B20B506184FDA3098E0DEA49C37D17141AB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708107688, "uuid": "025aad35-a0b2-4d1e-b811-f36f46f5bce4", "value": "48:9gLXhxoRAs2WTE5NnvjGFBMthRQUuERemOqXqVOSV3RPr:Cj0As2gE5Vv6FBehRQUu8esXqVPJpr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708107688, "uuid": "e18b0994-2a43-4d69-891a-952331168c9b", "value": 3369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708107688, "uuid": "556c8e7a-d970-4e2a-a736-d56db84374a2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708107688, "uuid": "30df45d1-335a-4304-ab8f-197de9931d52", "value": "damaged_items.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba1dfdf8-ccc1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Guildma)", "timestamp": 1708084291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708084291, "uuid": "9fabb496-3d2c-49bd-8ee5-df988b74966e", "comment": "Malware payload (Guildma)", "value": "2e99d2e741771b8747bdf14001b3ff79", "object_relation": "md5", "Tag": [ { "name": "812800", "colour": "#7950EB", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708084291, "uuid": "604034fd-e25c-4996-8c0d-4e549adf3397", "comment": "Malware payload (Guildma)", "value": "ae8bda2021bc7f56c9f400d048ba59b16194c94d04b9614fe0a1f58b0296700b", "object_relation": "sha256", "Tag": [ { "name": "812800", "colour": "#7950EB", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708084291, "uuid": "a957a152-ac83-42e5-9a95-44fb637deabe", "comment": "Malware payload (Guildma)", "value": "e862f01cd9a97e09c1decb929822eee476f031a0", "object_relation": "sha1", "Tag": [ { "name": "812800", "colour": "#7950EB", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708084291, "uuid": "16d89b52-cea4-48f1-b56a-043babc1b0bc", "comment": "Malware payload (Guildma)", "value": "80ddad73c3250b5ff3df57aee1b1d14a8e05c9c22779aabe8722c0aa7743c23d222a00cc114dd51c2276b8b68196109d", "object_relation": "sha3-384", "Tag": [ { "name": "812800", "colour": "#7950EB", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708084291, "uuid": "1bad42d5-382f-4e16-b887-9a2daa68c0ad", "value": "T1E001AFA653A80EBF88B39288CC356D0C44FA8CB30E5F909EEA633540C56D1920FC0748", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708084291, "uuid": "11a1bd49-bb9e-41e7-b0e4-04a70256d2c6", "value": "12:fd80Ln5m0oA6b9lPGds981EuGNOVIz87KZIxEITASxVIAVUaVuvK:fd80L5m1AOYgcE1b40uEITf0DaF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708084291, "uuid": "15cb4238-690a-4390-989d-55c46b8e9558", "value": 738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708084291, "uuid": "24ffdbdd-96c2-41f8-938c-718349284047", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708084291, "uuid": "b685d02e-de12-4f75-b964-7299d4efe652", "value": "RYRPNPGF.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e246925-ccc5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708085962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708085962, "uuid": "b167dc8e-e909-440d-b33d-3312c7b5917b", "comment": "Malware payload", "value": "8309540f302c866fa679afd5e4614262", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708085962, "uuid": "62c54635-edfd-4705-9d4b-12be19bd06d3", "comment": "Malware payload", "value": "afdfcdd8caadaf17df70a8a7a092cedd1f7443efcea081a8481947a728b2da05", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708085962, "uuid": "856dcf0d-cf8a-430a-b487-7d9521a8b046", "comment": "Malware payload", "value": "9b1752cc0a6f528aaec2ae22f194fd82027349ab", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708085962, "uuid": "6eca1e75-9594-4afa-9bfa-59a3e13116c4", "comment": "Malware payload", "value": "c63e7894fadd166606928f9c69faf1c212c96df219ad5ff3dda8c8a20b12efb51b128ff5c9217ca98a2b8ca6e72d6f22", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708085962, "uuid": "8ffa877b-2898-4997-b11b-fc4e993f64b3", "value": "T14B115AAA53781EBBC4B242B4CC35AE0C89FA8C730E1E919DEA633080C97C2911FC0759", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708085962, "uuid": "27c669b0-763c-4709-8697-8eca0ee5975b", "value": "24:8rBJlFA4XaARDd80L5m1AOYgcE1b40uEITf0Daq:8VJrAM5Dd80L5A+c2Tf0Daq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708085962, "uuid": "84260aef-7682-418d-b359-d3c7947103bf", "value": 1050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708085962, "uuid": "1febfbff-38cb-4ef7-8b05-1ce7dd2f3726", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708085962, "uuid": "81ba8e82-b9fb-4396-b1da-06141b1ae863", "value": "Facttur525252525252.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2f22634-cc9d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708068844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068844, "uuid": "57b5af85-8bbc-44fe-b065-3d5d9084a74a", "comment": "Malware payload", "value": "4393dd8e7f17c04e0e03a58d9eab7eb3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068844, "uuid": "193a4302-3d50-49fc-90e4-cd2b36495d19", "comment": "Malware payload", "value": "aff14357dc944e7818b2c0f0a690b0fa14d0805be1545618b4e58d65655a2f82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068844, "uuid": "ff610515-0db0-4c1a-ba6c-c13724dccb8d", "comment": "Malware payload", "value": "ab9faf62990bfc709cdac3df08cf9d9ec7698b9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068844, "uuid": "e237984b-dfb8-4e69-b6ef-78d8e8455e9b", "comment": "Malware payload", "value": "0dd74a779225f74ad10e0410ee0c525560f6c042e6171f57541f53b3f42c8b058383e09eb017ec401585a2fdde726b2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068844, "uuid": "aa39f2dc-c468-4691-ac32-9d44cd3b6cc3", "value": "T1DD154B21E2924837D5735A39491B969C6C26FE2C1AE4C54A2EFCFD8C1F79641383CDA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068844, "uuid": "9fea8b39-522c-4c40-bd08-ac81ba18ffc6", "value": "a71b0e0f5a595fefc903cb4a8b8ddfb2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068844, "uuid": "d68c5b45-f127-4ee5-ab28-b6008407597a", "value": "24576:c8IeS+GmaKj4pNFlYHhqSzMSCa9eUvWP5VL4E65/OAeG7tyzv+ymWS:VNA74EIY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708068844, "uuid": "932a6102-55a8-4217-955b-a1656f3c85e5", "value": 916480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708068844, "uuid": "1e02d5f7-3843-4cc3-9ccf-60445a31e22c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068844, "uuid": "63fb4299-f495-4984-a767-26bd737987db", "value": "SecuriteInfo.com.Trojan.FakeAV.29350.22172", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbaf1800-cc9d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708068859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068859, "uuid": "d0c93722-492f-4a1d-aeb7-7bc274cd5f26", "comment": "Malware payload", "value": "6e9ef60a0b28d3fe9c5752cb6dae6404", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068859, "uuid": "6347487a-3e0d-4322-9c8a-836825ff78df", "comment": "Malware payload", "value": "b06dd57e66d8c649e11d586daa3c869f39c3f635de028c579b6f1a073b765852", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068859, "uuid": "970edae7-856d-48c8-b2b6-98e58748b983", "comment": "Malware payload", "value": "c879aa594131f0aa1c7459aa549372af4f238175", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068859, "uuid": "95fb11e0-3d53-4e6d-9afb-40d1f6d1a76a", "comment": "Malware payload", "value": "d4caeafe6e726df396c888b3dc861d2364fb597ea46267a6c7a0631dbe5efbc889e517580f565dd2b438b76ed77f7a0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068859, "uuid": "b32ede38-f3b4-4806-a339-00d5544d4c8a", "value": "T1D3D53301A932C930D8B186755EF20CBE873BF76858BC2815316D8FE61F4B8958B54EBD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068859, "uuid": "6cb4203f-4296-4f27-b0e4-247882c2a431", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068859, "uuid": "66463920-2c2c-437c-a15b-9e7b04fb2ec7", "value": "49152:FaBEkWJaTtAmaPH00EF6W3LR7Lqb798D+Sbrivw5ubr1PF4IkmqS4X0KJLmKWuTu:EBEkJAjUNv7RHE7CD+eirNF4IkmqS4Xs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708068859, "uuid": "c1e1853c-531f-411a-aec7-00ce9f8e9e81", "value": 2991664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708068859, "uuid": "7f256bc4-38cf-4f62-85ff-a1cd95175c3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068859, "uuid": "74ffebed-11f6-41ed-9d9c-14687d6d5a80", "value": "SecuriteInfo.com.not-a-virus.HEUR.Monitor.Win32.OsMonitor.gen.914.32092", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39113d80-ccde-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708096530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708096530, "uuid": "77a9f1d2-7f37-4113-9453-57713101f5cc", "comment": "Malware payload", "value": "35c0b588c4face1e8fbb6b51c04d4049", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708096530, "uuid": "a76a134d-5313-47b9-ab15-1547996fd57f", "comment": "Malware payload", "value": "b20da2560202b2a24a0bf7833d8f29ae17564196e38a9ac9b9b04ba788b4da0b", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708096530, "uuid": "767dc161-7fa1-4714-b63b-444d49128a21", "comment": "Malware payload", "value": "d8083d07e2ce6e2bfa4d4a4c28c41416b58bc5cc", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708096530, "uuid": "d30b0d66-8a27-4531-9300-7e88110312ef", "comment": "Malware payload", "value": "2edb6407848fc19507d17e4cffd621491ff4c3104fca9d0d7a8cfe7530dfdc91de4bba807bc158e36257c1f20979efc2", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708096530, "uuid": "d5b0c34c-a1fc-4725-9034-9021f06a7e20", "value": "T1E8D423C6AA0D27296CD301C381DD13C48B35E985E9AF941D50BFE5FCF0EE46A95EC9A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708096530, "uuid": "a9139bbd-388f-4885-a3e6-eb6d06edad50", "value": "12288:ogEiAe+N/ovSlFA3V52m0fhB41mNBi1JInhp3baHPtjsnKF/hNVVCKqYpSII+t9w:tEiMN/oKHA3V52bTPBcJkbaHPBFhNHQL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708096530, "uuid": "69734b2c-960a-4446-831f-4fa683b057bb", "value": 622722, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708096530, "uuid": "1dc2da83-c27d-4d87-bacf-bf9b38bd48f5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708096530, "uuid": "2dab8666-242a-4899-9bf2-50b08b4721d1", "value": "Confirm!!!.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bb9cd2c-ccf8-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708107621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708107621, "uuid": "c518403e-750c-4073-91f6-205125d7757e", "comment": "Malware payload", "value": "73551802336f0575dc4b66522662fad3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708107621, "uuid": "31334bc3-ad89-463c-8eec-318e6e44be30", "comment": "Malware payload", "value": "b2116a9cf4d4ccc1d6af08c523e8e7766efd2f1d338f6f2a8235fa8ecd59dc4a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708107621, "uuid": "7f4b59ec-6ded-46f5-b6b8-2885d69da1b7", "comment": "Malware payload", "value": "2d9993462377b12de731e97b72efb9969df07a18", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708107621, "uuid": "b09c8b02-ed36-4acf-88be-4d03dc88d581", "comment": "Malware payload", "value": "c0bff9ec6f4de52b28d3d77733a80d48df51544d2aedf106aabfb3b8e3af108a6383a288a55586613fc9a5260be76a60", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708107621, "uuid": "fdc5a0be-4847-43c0-a119-58326b82bcdb", "value": "T10641194263FA0204F5F36A08993611760F3BBD65A43AC65C0A9C294E5FF3E558C61FB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708107621, "uuid": "ed859358-9bfe-4574-a8a1-1f39bbf7c615", "value": "24:QxofwTnxdbh0Hb2E6B3b2Bb26uf4o3LK8fNuN+cb3C3GjgqK4GlifQWbQHzQYbZV:WTnJ0ahoYj4O28fiTCqnb0ZZXZS09", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708107621, "uuid": "4ba44536-a635-4ae1-9ede-7f120bf992d1", "value": 1966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708107621, "uuid": "29acf05d-a085-4d97-834a-1c699389e8f5", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708107621, "uuid": "fb20117b-ee72-4f49-9758-092904683dc5", "value": "damaged_items.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25373bda-ccf8-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708107664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708107664, "uuid": "7a682a17-aab6-4808-aeec-c5fb395e2896", "comment": "Malware payload", "value": "2053cf8388087b8ebdbdc8c43d8e1e26", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708107664, "uuid": "94d260cc-6ea5-4ca8-a615-e9f92965a614", "comment": "Malware payload", "value": "b2c95b78d93f84d7fe82d29ea8e107a48de21307246d44694faa3d6383c9a874", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708107664, "uuid": "45ff7d3d-72bb-4c75-8834-5556fed8de52", "comment": "Malware payload", "value": "16c1f95c01f37a0e70fc5300b12d932c377026a1", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708107664, "uuid": "35038e50-9e18-4a62-9d65-b5bb9d844b1e", "comment": "Malware payload", "value": "e989243d504e1859733d955f1152127fdf196a89ab19d9a63218f237cb35124eb9386d227825d3421b82da18384278fe", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708107664, "uuid": "485245da-abf7-40f5-8d59-79c8bc629799", "value": "T15D45750157F60111F2B367388A7222215B7BBD51727A864E3A5C270C0FF7A81CD62FAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708107664, "uuid": "8e2c068d-7eb8-4803-b06b-0caf63e0988e", "value": "48:5jFFsb4Lyj8yDUP7lUJQFPw0TnJ0ahoYj4O28fiTCqnb0ZZXZS04:55ykGjvDUSJQFPwYZhoY8J8fL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708107664, "uuid": "689c75e6-cea8-4df0-b9fa-a15d67cebdd0", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708107664, "uuid": "882ac425-15a9-466b-9d26-8831c998c562", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708107664, "uuid": "38826441-aa12-4617-a887-441caf5600bc", "value": "damaged_items.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54a18aa9-cca7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1708072954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708072954, "uuid": "d11fcc17-1b1f-4462-a5fa-f5c98a3f8367", "comment": "Malware payload (AsyncRAT)", "value": "2c9aa8a32bf4b5b06dde3c3682f93944", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708072954, "uuid": "f15b7791-9d74-49f4-8c67-8249ca298a98", "comment": "Malware payload (AsyncRAT)", "value": "b35a62cb65fda42082da39f67e5c67b21bddc2581e84692972815f286b3cbdb1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708072954, "uuid": "d38a8a9d-df79-4782-ab90-da239b51c595", "comment": "Malware payload (AsyncRAT)", "value": "d93aecd90c4b03c1cf809549e93cdbb7fe2c6862", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708072954, "uuid": "c6eb2679-4074-4c65-b099-6c3b62c0b41d", "comment": "Malware payload (AsyncRAT)", "value": "ecd4167434bcefdea35825a360b554c77f85b3622aeb29d33d08c57ecbf13444e53441ce658fd4ddb692cbedf158f37b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708072954, "uuid": "38f0a11b-c68e-4fca-bd16-3f611f99c03b", "value": "T1E3F23B483B908225E9FE6FF429B2A12913B4D507DD17EB5F0CD481DA2B67BC18B017E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708072954, "uuid": "8feac872-0144-472e-a334-20cabb84f584", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708072954, "uuid": "87e89bfe-dbaf-4dbd-bbb8-aca16dae6e67", "value": "768:T1XrJ6AhS6dQLkMTYdP/PKjzsjyOTFye9CLOjh6b/+v:T1XlcUdPusbFd9CLOj4+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708072954, "uuid": "08828be8-140b-4d5d-acfb-b5e8e964e4e4", "value": 36352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708072954, "uuid": "f57f1854-5c2e-4a64-aeb5-f55e10855eb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708072954, "uuid": "dfbabf4a-7e36-43fe-9ee2-570d2f8e0f3d", "value": "2c9aa8a32bf4b5b06dde3c3682f93944", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74b05a8f-ccf2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1708105220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708105220, "uuid": "2f7385f8-71d9-4e35-a1b8-2e62ab18b16e", "comment": "Malware payload (Amadey)", "value": "7c0037e1b94dd1b38ebe76d997ec624d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708105220, "uuid": "17b7bd4b-1c7c-438c-8434-86214e6b1a84", "comment": "Malware payload (Amadey)", "value": "b4237596d1932835a05caffb6e08bab498f13c4a0589ad49e842434de392508d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708105220, "uuid": "382ff611-6c8b-4c51-a8ad-51b837941c52", "comment": "Malware payload (Amadey)", "value": "e83f14b373ea3363b0133047dddd5af0f27cc008", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708105220, "uuid": "04d098ed-779b-4047-89fb-9a829af66c42", "comment": "Malware payload (Amadey)", "value": "f03891908ac9c03959d3fa12686f20b2fb7bf838401511f81ef7bf9a2615791f177814a9eb16ed4c60aa97039c7aadce", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708105220, "uuid": "e14b6323-2ef7-4ad6-8240-278c725eb856", "value": "T143368DA1B90661DFE48E16799467CE82997D43F94F304483EC6CF47A7E63CC216EAC24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708105220, "uuid": "e747d62d-b80b-4d5e-a47a-7b9489f18778", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708105220, "uuid": "a8ecedcc-8137-4411-8f41-083230b36b1a", "value": "98304:xihWAxDgYE4geJVOkt39luuuGVCwKcuPzA+Q0xrC1oYccm2Oun:xRRcluKVCwgznQZGdcmW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708105220, "uuid": "6b13af3b-b3e4-419c-8b64-da363009c0dd", "value": 4972544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708105220, "uuid": "694fb10b-319b-4fb3-9a6b-e0afa2ba176b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708105220, "uuid": "2e866f16-5786-4148-ac2f-cb8495aecfb9", "value": "fb0000.explorgu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bba81a43-ccc5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708086012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086012, "uuid": "6334d952-a705-47f4-a698-b8983768ea55", "comment": "Malware payload", "value": "33d33e32134191de2d7a75b3e9c4b289", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086012, "uuid": "a5c06ac3-0465-400f-9988-65f186208f5c", "comment": "Malware payload", "value": "b629c386aad3d232fcab9767273721b1a31277cf7ff2397d1b6b5cc8920cc68a", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086012, "uuid": "d0a7ca94-795c-4905-bbb5-35e71e77936b", "comment": "Malware payload", "value": "a66979de85535a31eb6a0c199f8598a4581291f2", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086012, "uuid": "4c9f0e21-2a95-4a0e-8bcb-46551ec83f1f", "comment": "Malware payload", "value": "191ab81a6184fc50a627c615a0403f49da2f8b988d5e29fe0ca1244add41088bbb6839c3792ae5b12ad4f506d8b7f8b9", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086012, "uuid": "eb70ec42-7c65-464f-9b74-ce345aacaf1d", "value": "T11225E157F6D37A65E6BFD2B6C6B1DD2C21B3349603B0938F778125892912392493CB0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086012, "uuid": "bb42dd90-e4e9-49cb-ac26-01ccabc0f24d", "value": "d4c9759f791ea559bbad095fb49820d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086012, "uuid": "0f9aa62b-d69d-4dbc-a512-6b557400d3d2", "value": "24576:3oOOMX1f+QHT+dAodK0h8jzTv6JDs2cfp2G:3oOOm+QHsf8jzTv6ksG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708086012, "uuid": "7581306a-4a73-4803-b86c-882471bb7196", "value": 1002496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708086012, "uuid": "01ec4ef1-9c1f-4c41-8006-669c4bb0a153", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086012, "uuid": "0aab11aa-567d-4998-802b-3f5e56334a80", "value": "ESTADO_DE_CUENTA.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c343f8f4-ccc7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708086884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086884, "uuid": "7e2963f4-c87a-444a-8046-aa05ff316684", "comment": "Malware payload (Mirai)", "value": "72a9b366cded75d441a099099ca5237f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086884, "uuid": "7164a958-39ab-4228-b58e-6650d667c48c", "comment": "Malware payload (Mirai)", "value": "b772db897aaad8fff62d8545e06cfb107b69d60a04233052573a89661bc0e3e4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086884, "uuid": "fac1df47-da3f-4803-b589-18a5b5c3b5e5", "comment": "Malware payload (Mirai)", "value": "67fb209e56fa5e022537f8dc1c845d3b3702907f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086884, "uuid": "3853f090-4cf8-455b-908f-4073b423c115", "comment": "Malware payload (Mirai)", "value": "274ff78a90478b242ad0b3199f44961676e3144a2114b92117ba0f77173acfd3bfc4c32f6b424f4e9f06aae31bc19667", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086884, "uuid": "fd6a908d-7fb1-4dfa-825c-f80422975930", "value": "T1DC042A45EB404B13C0D627B5FADF42453323AB9497EB73069628ABF43F8679E4F22905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086884, "uuid": "1ed582bb-4c62-4972-8992-ea47f0c1e009", "value": "3072:lZfpNpblLfAVGkoa7EZ+Gkw4DT/6wBjYz2cJsoyM/RH+qIN:lZRnlLfkBoa7EZ+HwkdB8z2+xyM/ReDN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708086884, "uuid": "64a7ad23-702a-4da6-b1d5-1b52ab9b0dea", "value": 179811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708086884, "uuid": "c57b12b0-1cc7-47ef-be71-b5ccf2592758", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086884, "uuid": "981307ed-c28d-4d36-8577-704d047249f6", "value": "72a9b366cded75d441a099099ca5237f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5667f40-ccc7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708086914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086914, "uuid": "8b8eea12-172b-41c6-8fdb-4e29fb5d5d46", "comment": "Malware payload (Mirai)", "value": "7cf2c8aa198e2bb5a657ef1597079ac9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086914, "uuid": "7270a990-c206-47a5-b728-fb4366a031c5", "comment": "Malware payload (Mirai)", "value": "b9ad960535f8f850f9759c0e76d800e5c64977a488025514a74052807eb05917", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086914, "uuid": "6c0d37f1-88d8-4187-8963-37c76e0e58ae", "comment": "Malware payload (Mirai)", "value": "00961103dff57f42dad4420c7d8907ca05f847c2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086914, "uuid": "4abfb4f3-4be4-42d2-baef-51bc9fcced7f", "comment": "Malware payload (Mirai)", "value": "adaff7dadcbe6ba35cd31a2e7d28d7c0a14c57898a7d2d850e6431a3b66d793d220b560734c25e47e0b74589921348b5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086914, "uuid": "f653071b-6504-46c3-a7cf-cc6b47c13fae", "value": "T172C31945F8505B13C6C612BBFB5E428D3B2A17A8D3EE72039D216F21378B95B0E37642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086914, "uuid": "229c831d-d22e-4a98-a519-635c9859a1c0", "value": "1536:Jh7JW6nG5k8wfa2FA3FY1LAthi4VvtnTV+jrsoSJejpChnDmblfOwyw8FAUo42iP:P7JHgMF8C1Lh4XnR+jrslApClcrjw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708086914, "uuid": "960b6643-b48f-4d3a-b0fe-2a5c4c7dc662", "value": 129792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708086914, "uuid": "710ca347-7303-40db-918f-d11ecee89805", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086914, "uuid": "5784fc5c-8678-4eaf-b724-34a1d07aff68", "value": "7cf2c8aa198e2bb5a657ef1597079ac9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10d9c880-cd02-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708111925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708111925, "uuid": "5516c805-8ca6-4ce6-837b-f14301bbda9d", "comment": "Malware payload", "value": "26d37f7b860fbf9c54da121163aa8509", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708111925, "uuid": "72dd65af-e5a7-416b-9d25-f901e07bd0dc", "comment": "Malware payload", "value": "bbfb393c5f06bc1dc6a74d098c06c88409c361b6041bc9553f7efd28122f4f36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708111925, "uuid": "f0321ca0-a86f-4c59-9e3c-288278985800", "comment": "Malware payload", "value": "13548d9be940b1233ac9a480dac8c97682801a29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708111925, "uuid": "d5c44ab3-cdec-4e7b-958e-c19cb65434dc", "comment": "Malware payload", "value": "b516edb47ebb9fa7812a81841f88441b040484b307f2a4827e2bd3431f3b16fbc1c90646aef93d189bc9aaa40993e123", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708111925, "uuid": "a26bb528-e694-4b4c-977f-fe376e37958b", "value": "T1D01512CD6C808467E79437B054C2F7BC026EFC61BA5150DE6CD8BF6B7973A28182652D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708111925, "uuid": "7bead88d-9072-4671-95b6-6295565bcbc4", "value": "2388fee6ad8ce4f4a35dbaf64e2da01a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708111925, "uuid": "d7623dd9-a0a3-4996-b816-3d6085c03446", "value": "12288:FxldIkKS38K5ph6HTZCgzhfo6AlhAlh6AhSDVnrVjq+TkQF7c2UC6POQx4:FxASMkpozfhfMgl3hSpnrjkQF7jwPO0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708111925, "uuid": "83dfef2a-e853-463d-af4c-de2b5f5d0ffc", "value": 921904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708111925, "uuid": "55b813a6-6b30-49d2-9610-fb3e1323b8f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708111925, "uuid": "e61878d8-460c-44ef-be46-602605cc3f3d", "value": "SecuriteInfo.com.HEUR.Trojan.Win32.Generic.17813.2877", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8b6a2df-cc8c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Tsunami)", "timestamp": 1708061633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708061633, "uuid": "95bad358-b244-4f7f-9429-a0264e4b0c02", "comment": "Malware payload (Tsunami)", "value": "cbdc5287e0d04b625206d1043b35241b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708061633, "uuid": "ee63081d-0ee5-4cac-9143-64994dde5789", "comment": "Malware payload (Tsunami)", "value": "bd465b724e2da32004c7ac77772ff7a2663db0a1d5922148bbe4290b7353f176", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708061633, "uuid": "78982634-13fe-4431-aa61-ef570b88ab6c", "comment": "Malware payload (Tsunami)", "value": "8436dec2284b8393b9cc6a4a1e948ef1daf6d4fd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708061633, "uuid": "4834d44b-49f0-47e0-a27c-406a73cd3be6", "comment": "Malware payload (Tsunami)", "value": "e8980e2b49d67b7fa927af5da704d1248838287d030e54d3ad572394f5d5b0c3085002b81c5fe77148b1324ab4b0d903", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708061633, "uuid": "14acde52-052d-4864-8448-b1762523cbc8", "value": "T1F2C3C56A3E11AFFBE5A8863107F35B70C3D9719226A29781E26CDB185F7128D0C5F790", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708061633, "uuid": "4b87af9a-ae05-4f99-941e-5d2425a0f4e8", "value": "3072:+UlbHJnZuFEkRXdhQzytKq3Ih4gw6Gb9uOW:1JHJ0FfXdEytd3Ih4gw6Gb9uOW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708061633, "uuid": "0e7bb3a0-55f8-4601-b54c-36820eeb63a9", "value": 124567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708061633, "uuid": "28595ffc-779f-4472-b651-d9825a0c21f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708061633, "uuid": "f6addac7-21f7-4369-8ac4-dfb7b5a0cce9", "value": "cbdc5287e0d04b625206d1043b35241b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37769e13-cc8b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1708060879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708060879, "uuid": "5f9e7031-be7d-4118-b4c6-2de2a090cffd", "comment": "Malware payload (Formbook)", "value": "a8106094acac9b0600f0da9656513469", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708060879, "uuid": "6751d59b-903a-4e67-8d61-d4998f530582", "comment": "Malware payload (Formbook)", "value": "bd6cc17506faa8bcefc0131b2017636381df3ff71a2a58399facf165cb877140", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708060879, "uuid": "39fbdade-91d1-4833-b175-e4969e72ebe0", "comment": "Malware payload (Formbook)", "value": "c9de213aff1a39b287d2854096a13c0223556d24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708060879, "uuid": "a8bb7564-6d64-4eaf-96d8-ad1fb351e7dc", "comment": "Malware payload (Formbook)", "value": "2191f0da1b62ddbdc88f7f0b12c6cea9a37bcb55837ff028beb4b9e44d0f9e5d52b3ecd87dead4f07543e6db0b5260e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708060879, "uuid": "4cd588d5-307f-4644-b7c9-05c75927295f", "value": "T15DE423392BA86766C7F85FF1C4B2652C0B39AE091D16F3855F8E34EE2A72700561631F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708060879, "uuid": "29c83232-cdf3-4afd-82b0-f2a0bfdc2d35", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708060879, "uuid": "38e3e588-2aef-4c9b-9161-fe2d21339f4d", "value": "12288:eKQ4W3MtHaV6pjbHFyPIHpgwsnKbVYhjzU/YU2PAyj+i0Syn2T:HA0HaVYsQCjnKbGRzVUOj+ikn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708060879, "uuid": "05014255-bfed-402f-93c2-73b37fcf0c16", "value": 709120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708060879, "uuid": "6288f483-a4ff-4ecc-92d1-f86f0b1c32c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708060879, "uuid": "becaba09-9629-423c-85fc-66fc9828239b", "value": "SecuriteInfo.com.Win32.PWSX-gen.24208.31788", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0898f66-ccfb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708109186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708109186, "uuid": "24a78438-de10-4acb-a372-460b383edd96", "comment": "Malware payload", "value": "f19443fd047c5d2bfb3d7529b3513521", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708109186, "uuid": "f2335edf-5691-418e-8027-e4b6ae3b3ac9", "comment": "Malware payload", "value": "bdb91201e8db674e66de033efa2f1b7d4cabd562361f88ebf7d91c9541c334a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708109186, "uuid": "1421bb1c-e5de-4adf-950a-e250de6e00e1", "comment": "Malware payload", "value": "dabdd4b95025864a96b78f3ada3574c17401ac3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708109186, "uuid": "8a6b257f-0c5b-4ddb-b855-2e8484e79cd2", "comment": "Malware payload", "value": "df862245d1edc686e844c0abdc3fd264fbd9a7aa68ac07cb01570ed4c384fb979dffacefee76eb1f6396e7a8229cf0c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708109186, "uuid": "2f5a4f52-24a5-4b05-a487-5610bd849661", "value": "T197A3BF9AF620ADC4C0890674C852CF95AC757D108F3082DBB0B87E5F3E772D6A139BA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708109186, "uuid": "b7ab534b-1b77-48b1-89c1-97aac39b53c1", "value": "131c7fe83e13da0ea849431f5bea3c8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708109186, "uuid": "69fff540-da8e-4693-aa77-09558826a950", "value": "1536:r6tVKanQZ+hhuKL8lkQRrkcm464OBbYL53GJr95WAxJnolVR:GtAJohYkQr0jeLwJr95rJoN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708109186, "uuid": "f8ea034f-dee2-4263-89a3-2b57093f93b9", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708109186, "uuid": "fe8cd74f-7720-47bd-b7ac-010fd6e527c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708109186, "uuid": "79122f9d-c254-4dac-9ee6-67018564b4cd", "value": "wmpshare.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b6e4fa9-cccd-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708089367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708089367, "uuid": "6121f538-5f5b-4b54-850c-8ed0c8aff3a7", "comment": "Malware payload", "value": "a5f3bb528d20cb7a922fb32a73c06e2c", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708089367, "uuid": "b4876902-b81d-466e-bbde-448706af3bb4", "comment": "Malware payload", "value": "be7ec5e6830caf67bde61d7f3ebb99e9003a9b13dd6c64115f5333d6f273885c", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708089367, "uuid": "c3535670-e45e-4dfe-a6c3-66a7cb86bf4d", "comment": "Malware payload", "value": "121872a3620226e6338a00b44dbfd010d0d59f6c", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708089367, "uuid": "ee4a8d45-f50c-4fd5-8896-a01bac0298bd", "comment": "Malware payload", "value": "1317428c9d912c6598bcd0f88e5f9e21540fcb2c46edc92885f23bdfa9f6f2dbf4c1a9696b8678d2ef0142a54d69e067", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708089367, "uuid": "69f0adf6-4c6f-4255-84da-5fd47427e783", "value": "T17A95E00A37164BA2D7AE5F36E46B810403E1D95AA3D7D70BB2C912A717773BACF41243", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708089367, "uuid": "44adc100-97ff-45e4-b0f5-43d6b806e499", "value": "49152:ipS63bhVbThsSAaBDBJBbxiuqdJh/iTJRfq8V2:iLhtT2HQNJBbxNqx/iv9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708089367, "uuid": "eed67667-151e-4832-a0d6-009f1f6190f6", "value": 1992704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708089367, "uuid": "a7a5799f-87ad-4cfc-8960-df56c01572da", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708089367, "uuid": "087d25cb-0a66-497c-8f11-6010972093c9", "value": "SOA 8400139526XXFEB024.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48d8e7e9-cca2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708070787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708070787, "uuid": "89197540-cc55-4555-95c9-a76532c7908e", "comment": "Malware payload (Mirai)", "value": "53e6fa2e803f334e7a1e7880ab3876c8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708070787, "uuid": "01357770-953b-40b4-9b16-a9b279919b58", "comment": "Malware payload (Mirai)", "value": "be81963dc686669c691ea41a0cee32d9726f4eea73916ebacdf6ff2fd0d05aa5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708070787, "uuid": "2bbc1eee-1610-4bc6-a2e4-0e41faecb1ab", "comment": "Malware payload (Mirai)", "value": "0d7c00ff8513795854c726603037c6c365493dce", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708070787, "uuid": "d9d68c82-d76e-493c-a044-d7391f67b483", "comment": "Malware payload (Mirai)", "value": "146e21f7ca81e370a53a102bffbf34ceee44ed4a150de5c2fa17bf24edc00d99c32bc506549a704818d984feacfa5c05", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708070787, "uuid": "626d78ce-018b-4337-8e3b-727bd1b9e68f", "value": "T10F14975E6E228F7DF6A8873547B74E25975C23DA27E1D680E1ACC1101F6038E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708070787, "uuid": "a24179a4-32bb-4132-84ea-9ee15304790d", "value": "3072:flWQHj5jHKHczWDzY6GrVxDZQWd7O9uVRwu3+9Yt6:fsQHMHca5YVBOWFO9Kwuu966", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708070787, "uuid": "c27d2ef6-ce17-4e01-969c-9da78b142bc3", "value": 190356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708070787, "uuid": "c9e4b605-4bb1-4f4c-96da-88f6fcb8a028", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708070787, "uuid": "34003179-ec3b-48d2-b5b1-69e273b8788f", "value": "huhu.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "915d274d-cca6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Meterpreter)", "timestamp": 1708072627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708072627, "uuid": "01991e66-6843-4147-bc32-729721813384", "comment": "Malware payload (Meterpreter)", "value": "dce8b513cdb9d4813f6cc230b9174c99", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708072627, "uuid": "001043d9-a7a6-4b5a-9999-ddb4566bc224", "comment": "Malware payload (Meterpreter)", "value": "c0bf9433464c88659f795e4e84526278268003265063809cd1b93041fa509e07", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708072627, "uuid": "1f6c2afb-dd93-47e1-94e9-95df5876f742", "comment": "Malware payload (Meterpreter)", "value": "6594c29e1c5e81b1f83d1e5a8d0797bd0f419b4d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708072627, "uuid": "97b0bc63-860e-4eaf-bfb4-1545b35d3cf9", "comment": "Malware payload (Meterpreter)", "value": "ad7f02f0c3c13dce4f77ba978dc5272f9c16b6f6497d6d23ad41f7bfa0c4b25abecac46f0282e267cd54c7b8945ef918", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708072627, "uuid": "2d2be2bf-63e1-43be-8447-82acb5a14288", "value": "T1D673BF42EAC45075C1A6113E5AB137B9E974F1F63612C3DA368CC9F9E7C18A0A6363C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708072627, "uuid": "18fb9c7d-dd3a-4412-b196-0526a2c89c40", "value": "481f47bbb2c9c21e108d65f52b04c448", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708072627, "uuid": "6a580324-c6b8-41c4-bb60-29b894f09550", "value": "1536:I9ltjG6Os+F1v8eMG40GxLFh5mMb+KR0Nc8QsJq39:ClFAF18B7ee0Nc8QsC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708072627, "uuid": "723d4a22-4c34-42c3-a393-c50d990e3de5", "value": 73802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708072627, "uuid": "5aaff247-bbde-4dc0-b4a6-af15e28d5cc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708072627, "uuid": "2f1d9ca6-29f8-47e5-b2d3-972c01a42787", "value": "dce8b513cdb9d4813f6cc230b9174c99", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "137627d6-ccc6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1708086159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086159, "uuid": "36e17848-d469-4d71-855c-c59b16ea0c6d", "comment": "Malware payload (AgentTesla)", "value": "1d2fed0caf34279cbd76addf12e00f76", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086159, "uuid": "0051f101-8c4e-4635-b4e8-f4de58fbe960", "comment": "Malware payload (AgentTesla)", "value": "c2394975ab1e2e84e50f40ea2e3859f542c57efc12f84d32e066ee91c2dd46d1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086159, "uuid": "8d496b8a-d643-4bf2-95c2-f5e00bf14023", "comment": "Malware payload (AgentTesla)", "value": "c643d71fd52c2e36be8f65099acaf8a6f8078966", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086159, "uuid": "b646697e-3f8d-43f3-b5c6-b201e2756584", "comment": "Malware payload (AgentTesla)", "value": "3c2f4ff4810dbe1611ac7d32454ae65a69548713ea35445737f819c4fc4decd8f7245757e738c937259d1fba3e802263", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086159, "uuid": "6fdd723b-b2ac-436a-abf9-e2ff8e3a3cd7", "value": "T137B3B40776989711C82168B281EF593203E1AEEB5B33E6D53F4C67AD0F417A3DE85B09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086159, "uuid": "4ef352d4-026c-4b04-b4dc-a5073cd10baa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086159, "uuid": "06638eb8-7272-4310-a027-f3da1e917e40", "value": "3072:kDKa9x/oRAUixFdvq4XJGJhmhy+9rTIXAJ:SNxjUivdy4XMfiTqAJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708086159, "uuid": "898cb35e-a763-41c6-8f49-a4c086608eaa", "value": 110152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708086159, "uuid": "7e8b5831-0f4e-4fb6-a14f-6f85184cdabc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086159, "uuid": "df59de14-19a7-44e5-8176-313cb36ac957", "value": "DEKONT-16-02-2024-98766789098765456789876567898765678.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b84c7352-cc9d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708068826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068826, "uuid": "5b9c82a2-44ca-4717-9b29-712e4f1bb82d", "comment": "Malware payload", "value": "7937d5b447fc7ccd8b2f81d726ee7d1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068826, "uuid": "9c50fab6-1796-41b9-885f-8abc749d202a", "comment": "Malware payload", "value": "c3bda34c2eef6565d26a3414b66b7a0aa2865e3fcde5e75f5be74ccc3cc5ebcb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068826, "uuid": "ade90c21-7d18-4098-a4ea-052c46f308ee", "comment": "Malware payload", "value": "38cbb78c04d7e6b30d3ab0b2fbfa573387744263", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068826, "uuid": "fc32f243-4f91-4841-a7dc-f1d36ac87d20", "comment": "Malware payload", "value": "3ec91b14dfe2092fb8a854c7d681d9dec2f2b83627e8a95045862fb64ced4e1588aff547dc66256cff80215864469964", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068826, "uuid": "6344212e-e5e1-41e6-bb1e-971d7b045774", "value": "T1E0F48D01B6C380F5DB692532096A773AEAB5EA4A4F148FC3936CDDAE1D326C1DC37116", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068826, "uuid": "204dcf3f-b9c8-4574-8235-9df74e90d8d0", "value": "cb22cb3fc942d4d5a96cdb9695f8190e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068826, "uuid": "6f69fe22-b16f-4855-842d-7104e13802b1", "value": "12288:D1ZcdZt0yMdKukvPEZxj5DFyQBuHp67i8bL/6v:D8dUysK9vPEZRyuuHkJ/6v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708068826, "uuid": "1d36970f-39d2-4c56-90e2-9e46f81081c2", "value": 761856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708068826, "uuid": "0618211d-d508-49a4-95d5-56af50bb2c3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068826, "uuid": "bdbaa9e6-3433-4a93-9e2d-872914286f63", "value": "SecuriteInfo.com.Win32.Evo-gen.28137.783", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8100fd3a-ccfa-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1708108677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108677, "uuid": "9c6631e1-4aef-4e03-8cda-a6f5e12bb1b4", "comment": "Malware payload (Smoke Loader)", "value": "28c17350f0da6941f68bbea0eb5af380", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108677, "uuid": "06539933-74e4-4e9f-9432-02a7a9b559f1", "comment": "Malware payload (Smoke Loader)", "value": "c40fe915433c1a8094a858affe62c6079154c668645f8e17751e7f39ebf4d31b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108677, "uuid": "d4d10a3e-fd76-414b-9c67-ae8e4e000d44", "comment": "Malware payload (Smoke Loader)", "value": "42d3ea0b53b6f76b729a9cef45341fae29933d88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108677, "uuid": "3a183030-7027-4073-a8b1-411a26b62b59", "comment": "Malware payload (Smoke Loader)", "value": "dd3fe5c6e73f910ebde5045e39b29f2e273d8b6df1bc052a0857d74cee0667953e1a94a9ed4536f1d39bc3dfd4738f8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108677, "uuid": "f258d503-100c-460f-ba98-ff6d63c7f355", "value": "T10C24AD24E3D0C071D29321BC89B0CBB10EBA7C667272E98F5FD55A7A1FF5A909324359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108677, "uuid": "e7135382-7a13-4c6e-9b6a-f18f1caa277b", "value": "701b7eda6b324e6e9073377243e2004c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108677, "uuid": "e84ab205-8138-460f-8143-61a64de483f0", "value": "3072:BIVw4zCuQGezasu4/2z6EuQ/yu0ZsBMRpSQDB8mm3CmO:BIm4GudBsukQ5o8NR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708108677, "uuid": "2d381c40-692f-43c6-904c-4d97921dc6c3", "value": 216064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708108677, "uuid": "ec7abe39-062e-47df-8a87-1a1f623a30ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108677, "uuid": "e7a434b5-67da-4205-9462-ccb27046aa6b", "value": "RnnWoAEP9mUhOXN_9mNdOzaP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6869ed35-ccc6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1708086302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086302, "uuid": "12e74529-d165-4365-9cf5-9330ae19658e", "comment": "Malware payload (Formbook)", "value": "5b135b762f37ef94793e8c11ce71423d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086302, "uuid": "bf0f0225-81cb-48f4-876e-d8d08a6a1a05", "comment": "Malware payload (Formbook)", "value": "c41dd0baefd5ef67d6be4acec7c9e0dc7d87b56800ff9df9424eb72731c504af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086302, "uuid": "34989097-e81d-4990-a256-ede6c06b411b", "comment": "Malware payload (Formbook)", "value": "66f4bf1bcf7725027b36829f1d74852d00bdcea3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086302, "uuid": "172daf57-b4ff-4ead-beca-910175ea8e58", "comment": "Malware payload (Formbook)", "value": "b62faecea3991eee8120069e0182ec1df087b80f3ae25cd2a4a894e66486968eca728c6eb0a73ce429be6a84db2655fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086302, "uuid": "09d5ed46-1ca2-4fb4-9ea8-56e4ae6ea42a", "value": "T1A9E42337BA502B70C9EB97F2757204348338E91AB625F7A03FE622DB3AB7314455254B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086302, "uuid": "9bb983f6-1ade-4cde-872c-615ed1c6f9b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086302, "uuid": "88a0dbcb-908a-4fea-9ffe-06468190d9bf", "value": "12288:8sQ4W3iWou2vq6sKQWSIlMorKYGnbpTrh/NOaUivlEXD+Gbmcr:TAiVuEAWVzgdTrhnUuGx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708086302, "uuid": "bb98e84f-1325-4ab6-a5b8-6ff0ceeb81ee", "value": 709632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708086302, "uuid": "927db79b-abe0-4234-bc62-6ebac0f7de71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086302, "uuid": "6dfcfcf8-b9d5-4ff6-a6f0-dbab4705b47e", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5238cc3b-cd0a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1708115470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708115470, "uuid": "bc17928e-71f9-4a4c-b8a3-8d59db6b5f21", "comment": "Malware payload (AgentTesla)", "value": "e37167cc9197965963184969112ee606", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708115470, "uuid": "814e5952-2c80-4b5e-86e6-08d1739a9e67", "comment": "Malware payload (AgentTesla)", "value": "c4e8c058d4f4a9976ca89a275963e6c4e2b3a2a7e90ad2dd095e173c2f5859bf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708115470, "uuid": "7a367c9d-4bc1-495d-b0b8-3ef82df31ac6", "comment": "Malware payload (AgentTesla)", "value": "63551ba6551e9760ce74b2c539518269df22901f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708115470, "uuid": "77d4d5f7-e7f5-4ad5-a9eb-b63e73d9bbbd", "comment": "Malware payload (AgentTesla)", "value": "b9091ae38a74a2faa16adcb0135e860c3401c54851c00e95f887d595c80981899c883b68af82e512f7b76dd68338001c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708115470, "uuid": "5074497c-66a6-453e-966c-8571fac9b61b", "value": "T148E42320B5E83F2EE7AC47F10224200157F4A35AF193E785DDFAB4DB09A37640656EA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708115470, "uuid": "588c82b5-db1a-4c6b-b445-ba9de2948bff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708115470, "uuid": "2967c53b-8af6-4a0d-95e8-93d468404000", "value": "12288:OdQ4W3C0PmP9oY4+1ral3UNgZzplOBo9DwF4Lv6pMR/+MMh5wVCqEF0h4pHN:OvACVPzelaCOGwF4Lv6+VV9Cpt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708115470, "uuid": "020f0c61-cab8-44d7-aed3-8fd035ed9d67", "value": 694272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708115470, "uuid": "e2e0d395-e598-414e-85fd-4646234b16fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708115470, "uuid": "76f3b232-aa06-46eb-85e8-f526c42d7016", "value": "SecuriteInfo.com.Win32.PWSX-gen.15243.30628", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b33f3d4a-cc9d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708068818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068818, "uuid": "4e74b19b-b623-419b-bdb9-4cf43e016da1", "comment": "Malware payload", "value": "4ad19ab56449fe22edbcc5d485bed515", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068818, "uuid": "d82625a6-e714-433b-bb6d-3b4820536944", "comment": "Malware payload", "value": "c542f2d42a5ea405412954b911b9a9a560c681d7a46c9d96e8e0788ffa326430", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068818, "uuid": "5ae67304-91cc-4b37-ae65-408a0a63747c", "comment": "Malware payload", "value": "72556bc25cc2aec46f0f986de72782200dd493ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068818, "uuid": "e9b3687c-8ff6-4d63-b605-a9cd4750698d", "comment": "Malware payload", "value": "95b0949284fd697ce3537d62e9c09c1ff9108305215f9503c698df8bb8a24807cef1c92719bb4d331940e503546f4d09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068818, "uuid": "3eb5bf97-51bf-470d-83cb-f8a280c4b86a", "value": "T12C05C65AF9818C2ADB6844304AB39731B976AD71FE80CE3761483E1D3C3A3752A5E4D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068818, "uuid": "222ec3be-bb52-491f-9991-188ef51c569e", "value": "821c455b475c3595aa1e4e6ad93e77fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068818, "uuid": "270b6d73-c9f8-4a64-9684-29915ab113a3", "value": "6144:X/SsZT59VZZi/UEiNaEB6fMxaEDSpCEaHM:X/SsZTQ8wCSEM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708068818, "uuid": "fadc2160-22dd-4248-ad31-61f6bf3b9bb9", "value": 813566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708068818, "uuid": "3f2f5507-6480-4d74-b13c-dfa574b2f3e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068818, "uuid": "656ce04e-d72b-4532-a4a5-d0ef4c0e7473", "value": "SecuriteInfo.com.Trojan.Win32.29095.15843", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d407364-cca2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708070794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708070794, "uuid": "86666281-bd8b-4eb9-a892-442db288d146", "comment": "Malware payload (Mirai)", "value": "7021213a8d47e67d682a4c6a7d46d865", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708070794, "uuid": "1463667f-b580-4c22-9e64-127209ae0050", "comment": "Malware payload (Mirai)", "value": "c57d4ce298b7bec7dd8c0a5a661917652735ae8743edc7429bfadb20a25bb028", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708070794, "uuid": "af9f0d81-1122-490f-aee0-76420b5beb50", "comment": "Malware payload (Mirai)", "value": "238c7b8d6d21871eaa8e5e34aef0cddca1c27572", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708070794, "uuid": "2930c9c9-f75b-4dcd-85f8-e14b289632be", "comment": "Malware payload (Mirai)", "value": "caa7218899434ca1a665cd24a3442882befe97bf03cab4bbe0724f2a71ee437e8b0c80660cdfe361f76df85467b0e4da", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708070794, "uuid": "0539f3aa-3489-40ce-aced-694174613998", "value": "T172141A46EA404B13C4D627B9FADF42453333AB5493EB73069528ABB43F8679E4F23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708070794, "uuid": "1bcc06bd-cba5-4578-b9f4-d09986a4bf2a", "value": "3072:SsnsjeSRRM/R4kIGaq+6u0QufTQcp9Y/eu30NrcogM/Rpz:HnrQM/+XGaq+6u0Qy79k13urhgM/Rpz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708070794, "uuid": "44bcca3a-ecde-424d-aca1-f0e307e08019", "value": 192658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708070794, "uuid": "514e3ec7-694f-4042-834c-05b71c025bec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708070794, "uuid": "dc490358-6ac9-4e1e-9493-c86c579b72a6", "value": "huhu.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c58b4c27-ccc8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708087317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708087317, "uuid": "642e2b25-8365-4233-a9d5-4019fb4dbb70", "comment": "Malware payload (Mirai)", "value": "cb811511570f2ec85139254b91b85f0d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708087317, "uuid": "365afd64-f42d-4351-a597-e5945af7818c", "comment": "Malware payload (Mirai)", "value": "c5d78132cf6cd269deffc74021c0fb10bf0d08f96ee1ee3df3ef8347c6388bc1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708087317, "uuid": "2fb2a527-16d0-4754-a493-ba3f3be38b96", "comment": "Malware payload (Mirai)", "value": "5d5456181c56e76717f12f4f7d53358befc9308c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708087317, "uuid": "b08f79f5-c5de-4b7d-8b47-4d50c7efbb83", "comment": "Malware payload (Mirai)", "value": "79d9ad24f0764f441dfa4b6edd2423afa6cb85ebfb5c45f8fe2bf697d153dd485dd7bc709262ad274a68b339940d26dd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708087317, "uuid": "a4e1d6c2-66af-43fd-8515-e239495c4ed5", "value": "T17803E00EC5E12DC3CBAD4C7BA0ED13A4948D31F3169E5B8E6B188C85E39E843A05227D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708087317, "uuid": "d81eb3f8-3449-4086-8cdf-e679152186ad", "value": "768:RsE3RFPZsIEd4k6iOeURmrTpIt2MmQQiWWMW:RsKPZsIEO19tm3h/G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708087317, "uuid": "c2e70200-36be-410f-8d33-98a7864b208d", "value": 38520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708087317, "uuid": "d25450c8-d700-48af-b735-bae894edc25c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708087317, "uuid": "3c9d7d9e-31e4-412c-9548-0bf3b91e5a84", "value": "cb811511570f2ec85139254b91b85f0d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b54f11e6-cc9d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708068821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068821, "uuid": "5f3149d6-cbf6-44b6-8730-eb528cab92b6", "comment": "Malware payload", "value": "ae3148fa82d6b25ebde30a698ca8ddb8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068821, "uuid": "b146938b-f2d4-41dc-8d2b-2754c5565219", "comment": "Malware payload", "value": "c689d2bcc9f19b45b7035c356a0b49e55ebc3da2cb30d2edc4f877a2bcf94c66", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068821, "uuid": "b832caa8-4258-4771-ab7f-e6ac3d0821bb", "comment": "Malware payload", "value": "5f3ca89088ad9cb5b0989df904b242756828e0e2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068821, "uuid": "e0b4db69-b4b6-44e8-b3aa-907c799d69d0", "comment": "Malware payload", "value": "55937f1025c72408a6afa5902d823e478129fe997e3fc8c2f8319beb3d6b6aec318b4dd85b918e1957e446275152f2e7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068821, "uuid": "8d53d96b-c1a8-49c7-9881-94cdaef45ce0", "value": "T180C11983D7F904A7E5B702302A7E4B1011BAFC1017BEA33E56E4612E1C3BB90D595765", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068821, "uuid": "f90672e8-ac05-40eb-8541-3e5a50420bce", "value": "05797c3914cf80e9cc666b7c52c51d27", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068821, "uuid": "bf4ce5ce-a9e5-45aa-bea5-71d38080a354", "value": "96:GOiB//qQFAuMzLrKDITMz45pAJybyMCLFy6O16rgUnXDKzX5ZjV:1WbVM2DITS45pqZMQ41mgcO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708068821, "uuid": "c51777a2-6cc8-4c2a-905d-e8ffcb9cbb3b", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708068821, "uuid": "745a983d-f88d-489d-8cd7-fa4e2ec42301", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068821, "uuid": "b3f3df54-fe51-4392-a30e-6ad2c283a15b", "value": "SecuriteInfo.com.Riskware.SPDialer.32603.6990", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd5a050e-cc9d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708068862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068862, "uuid": "0f628295-771b-49ac-89e9-2013cf6e6eab", "comment": "Malware payload", "value": "c4ea82c7a7ce176e9c17e5775c0040cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068862, "uuid": "db5057c1-9b36-443c-94f4-6bc25b6d938f", "comment": "Malware payload", "value": "c8060814d4b936e31287ece49990e92c36b44bd7d282d9f4910e080c8fb8332d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068862, "uuid": "c2e7b469-164c-4a37-ba07-3ee994dae93d", "comment": "Malware payload", "value": "0b88a65fda79a38daa208bff425d418bd23d1240", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068862, "uuid": "2e2fd052-9d98-4ed7-a7b0-880f96647bb7", "comment": "Malware payload", "value": "54851d73b2419d4ab0d196d90d473491624165f3f023d0bf1530d0d06eb58c4a38f69b0e8ae7a650fa286cf0de423e69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068862, "uuid": "13b29672-80a6-4c42-9d79-62ac62cf032d", "value": "T152345D0377D5C252D16642314A64B3512A7FBA718BA85F2B76880F9DFE710C0AF64FE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068862, "uuid": "a667b9c7-b067-4ece-bde2-ddd0068536f6", "value": "1536:APNwN9idMdeA4piljleAXil5RigTs5rQJWGrEk1nOn7zRdsWglZIEcfda5FsWjc9:6abidMdeQpleKilfSAprImlZQda5qyZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708068862, "uuid": "abeb7e42-a60b-4f82-ad82-f6270e3e4ddf", "value": 249856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708068862, "uuid": "9958b7c2-8e28-4f17-8bec-d91d019dc793", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068862, "uuid": "c928890b-75eb-412d-af8e-30a802bb748a", "value": "SecuriteInfo.com.Trojan-Spy.Agent.25036.21850", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f42217c9-cc8c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Tsunami)", "timestamp": 1708061625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708061625, "uuid": "39608785-1161-4f24-a6c0-9dea9d8400a9", "comment": "Malware payload (Tsunami)", "value": "b70e228b2e9a0fd2b635f93bf0337576", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708061625, "uuid": "ad1000e0-5066-4fa4-a333-4880ef183b74", "comment": "Malware payload (Tsunami)", "value": "c8b65b91abe397986ce3fc18691d74a022199b9574258e43028ae4701a1d0c2d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708061625, "uuid": "474f7a7c-260a-4599-8916-63742ea1b9fb", "comment": "Malware payload (Tsunami)", "value": "8d7e476f8cd9f993427766d036c1b9a9edb61d71", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708061625, "uuid": "09b3a903-4d8a-468f-8ce2-2919205c8082", "comment": "Malware payload (Tsunami)", "value": "0a4bbdd2fe4293dddea41fc465ca3ff7099b4cbc3c924b0ecd75e5a2073f6a2dfe7691c8e21cd23c2f5b6293208a6ddf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708061625, "uuid": "5096cfbd-0328-44b0-81e5-80cb0c22fe0d", "value": "T1BDC3C70BAB51CEB7D85FCD77069A420110CDE55A12D9A76F72B4CA6CE74B88F48E3D80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708061625, "uuid": "bfbdd750-d1a2-4c59-8c1a-1f216e7c813a", "value": "3072:9Cxmp0zPh96sdhQzlJKY5mLc203Ih4gw6Gb9uOW:9Fp0dDdElJD4c203Ih4gw6Gb9uOW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708061625, "uuid": "cce055b7-07cd-45eb-827f-e332bd0abc59", "value": 124711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708061625, "uuid": "4fca4b48-0ae6-4c1a-a50a-813320c93518", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708061625, "uuid": "46f865cb-2940-448d-a6e8-0ee5b5770850", "value": "b70e228b2e9a0fd2b635f93bf0337576", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0d6fe4f-ccc5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1708086021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086021, "uuid": "5b46e0ef-61ad-4ba3-af7f-7d2cf9ae7e2a", "comment": "Malware payload (AgentTesla)", "value": "9289edd02a68aaad6594bd882cc80899", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086021, "uuid": "f32cf7ea-b70c-4195-b641-4b74395673ac", "comment": "Malware payload (AgentTesla)", "value": "c940e8a531e26ffdaed0a134574f5f9ff2e039c723fd79edfd58f44dbc251f4d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086021, "uuid": "9477ad51-0209-48ca-b3aa-0da092d400d7", "comment": "Malware payload (AgentTesla)", "value": "2162cf915513ffcc26beb5f07594a7b8edef4400", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086021, "uuid": "7a813ab0-4544-4571-aed8-a1f409f47be0", "comment": "Malware payload (AgentTesla)", "value": "6aec71f5b4af425da44c7a8421ca3f2b071dfa97dfa7c82c7e6ff122398e9a4ada6cbdb2dd1cdbfa95163388e4c28168", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086021, "uuid": "d6feb4e2-f5df-4a85-8e56-d3dc1e0205fd", "value": "T1EFE43368930C5C4AFAEA73F6EAD42048C3237B21D9511C54EC623D6F1ABA90CBD19B74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086021, "uuid": "2f644d8c-20f3-4d7c-b2ea-01ee78c90885", "value": "12288:bcnWGiw8rOFbzgmhtGDdAuPE3uCvNk9IRlwg9XjzQZ4AN1lg+F9UMPLMFbuWugAQ:4r8aFb8lykow4jJANJLP4Fzld8O8RE3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708086021, "uuid": "f3744a10-f7cd-4cd1-a377-d91d2b8f4da9", "value": 721479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708086021, "uuid": "2fcf8ac7-a4c9-4276-be94-4bd113444fcd", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086021, "uuid": "d4fa640a-f630-41ae-aac0-573c3a4980a8", "value": "UNI-45733-DS.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ec0c7fd-cccf-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708090097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708090097, "uuid": "5a0098e9-56e0-4c52-b09a-69a6b1075adf", "comment": "Malware payload", "value": "baadaedc15fe5ed8aafb3c74cf4f2f3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708090097, "uuid": "ba5adb4b-b9f9-48ed-b349-59ecaf25c4db", "comment": "Malware payload", "value": "cad643944905d6bdde925f12412ae8141bf36c62be073243a2d989250b6a8beb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708090097, "uuid": "07f1e32a-0c5a-47cb-bc60-97df69954c43", "comment": "Malware payload", "value": "3d8495202660c61d4ea7d6b9e6d3512987b304f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708090097, "uuid": "0451184f-c8c6-4266-a0f9-1100c4dc8a4e", "comment": "Malware payload", "value": "923be74e03e4b13300b4980d2779f01c3b9baccd2247f14e95a5b0739ba892b723e7dab1a57ec00107717943a98d067b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708090097, "uuid": "889556fc-e0a9-494a-a6b9-0e83847541e9", "value": "T111552215B2D0C036D1BB163036F4E1B149BEBD314A758DAF6794136D5E301C1EB2ABAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708090097, "uuid": "ee0a71a4-4641-48e5-be79-b865143a2307", "value": "e6f4169f2a5c3a8f93171d9f593bd22a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708090097, "uuid": "b77b9057-ee89-4beb-a378-844ead3fbbda", "value": "24576:pZtdiBOXjcL9aZ3gXs7WL0JhLgAnHAS+u/oGUs0XP5iVh4XysZSSwkkPZSvhf/Q:9MBQcEZQi/L5XoG05ChlszkSJA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708090097, "uuid": "2ade72d2-abc8-43f6-b12c-3560845d086b", "value": 1294336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708090097, "uuid": "90e6f0d5-2114-4cfc-bb62-5828b4a0152c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708090097, "uuid": "6bfea3f1-b4e0-4c33-b120-bbec5c9dc522", "value": "0923840932020004-3-0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f228212-cd02-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Adware.Generic)", "timestamp": 1708111922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708111922, "uuid": "8af64720-0a4a-458b-b5f8-654fe426796e", "comment": "Malware payload (Adware.Generic)", "value": "66a629121c9090b06610e823d1cb6747", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708111922, "uuid": "dc6c499a-7a31-44bb-b437-306e045821db", "comment": "Malware payload (Adware.Generic)", "value": "cc8c6bb31a8e0d63091c8a794c2ad10dd45d9798b7b6bb900ca09e551172b0d7", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708111922, "uuid": "435aee7e-a771-4b7c-b0d2-19d44b41c5c0", "comment": "Malware payload (Adware.Generic)", "value": "b207964540787001d1a3f59a83ded397dedb3cda", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708111922, "uuid": "e44611c8-7afc-4ba3-b023-f28482e56f32", "comment": "Malware payload (Adware.Generic)", "value": "96f931a98f5d0f9a2021f5880178f1ab58b732a88dd04170a8794d735d1e217566109d83379fc759102b0fa957ec0e53", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708111922, "uuid": "8ef644dc-64cf-44ef-b7f3-a9ff8806879f", "value": "T18BE6233FB268723EC96A5B3245B393509A7BB651641BCC0E43F8451CCF7B4601E3BA5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708111922, "uuid": "894aff8d-ba0a-46fc-b949-409f29c71e22", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708111922, "uuid": "c2d933bd-bb5c-4c41-b5a1-672c55646ec7", "value": "393216:Xw4v2SKy9nkVe0WQBuRZZB15LZz/Ca0wLtOD44L1JwsV:g4eSnu58/bTNCa0r/9V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708111922, "uuid": "75147ace-5d2f-4137-9a35-03a00852c6a1", "value": 14421864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708111922, "uuid": "389771b3-2533-4f59-9f88-a1614ac18489", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708111922, "uuid": "9047e84b-e6f0-41f8-991c-cd3d1d9842d5", "value": "SecuriteInfo.com.Trojan-PSW.Discord.7757.32005", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0c0af02-ccfa-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RaspberryRobin)", "timestamp": 1708108811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108811, "uuid": "77350ded-9c14-47ce-9ec1-d4551439377c", "comment": "Malware payload (RaspberryRobin)", "value": "25593d2dd5e7ef268a2400068987caf7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaspberryRobin", "colour": "#B085E7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108811, "uuid": "14bd19a7-0987-4b50-a113-9f30bd13f743", "comment": "Malware payload (RaspberryRobin)", "value": "cd01c326183994911094c1699ddc9da5b1b6f5798b9a2fb9e346b4f2d96de8a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaspberryRobin", "colour": "#B085E7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108811, "uuid": "d8f9e8c7-2a98-4e1e-8b0f-96b805cfa947", "comment": "Malware payload (RaspberryRobin)", "value": "661dde84788e4e0afa52d1c5eeb42279bc6b14da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaspberryRobin", "colour": "#B085E7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108811, "uuid": "6ddbce08-2abc-41e6-b4ac-b60c5cb0e537", "comment": "Malware payload (RaspberryRobin)", "value": "aeb85f098eaf499fe9c73159609473dabc98a2f2584a5b9ab856c5a2c542d067a8eed0130a878f821a919ea8ef974ef3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaspberryRobin", "colour": "#B085E7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108811, "uuid": "17c85e17-a6d8-4fec-af25-30b9b70ac7a7", "value": "T18EA52322B6C48971D07319335A7267622538BC622F3747DB63E0396DCF715C0AA35BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108811, "uuid": "c61fd0bb-1a15-438f-a2f3-f19c2db2563a", "value": "10b73c5f7fc148e21f974da703236659", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108811, "uuid": "41b86ab9-8f86-4a10-be46-ceb987126f01", "value": "49152:1monDubw59oT+l4CcvhGf5gs6kbtYYyLYEGW3qUQXz:1mo6gw+lqvgfbzYYyJGWaUez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708108811, "uuid": "ff94950a-b8d3-451d-bf10-8ea306302b86", "value": 2155166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708108811, "uuid": "85470f9f-702b-4eb4-8bb9-c9a725aa2b3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108811, "uuid": "bebfba7b-c5e8-4327-a3f4-e44416d5685b", "value": "IG6AfqVfWdoMqoJaBWBWvDjF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce1e19e7-cc9d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708068863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068863, "uuid": "92a37990-f83e-43c4-8622-1e09b687b991", "comment": "Malware payload", "value": "9fdaf41dffacfeafefd1570c384d58d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068863, "uuid": "94bfefee-cd02-4dbd-8daa-844cc157da1e", "comment": "Malware payload", "value": "d0e2bbf10ed192699ddb38e916d2ed137934499a494068b6624815e4a70722ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068863, "uuid": "e0a4304b-c4bb-4f88-96fb-ea3e2ad4d0ba", "comment": "Malware payload", "value": "f3a1ba8f8b44793e8b9a16c0ad5ef1bb9e20a5f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068863, "uuid": "e8cc8f90-f4ad-46d7-ba24-a439b1c7973d", "comment": "Malware payload", "value": "44491eb9481c8ab27bbeb1568b820acc5e47adfe7cecca5b2a391f3c9ba784583a8ccfc8e06056432b49e6b56c3a9bae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068863, "uuid": "8421a0f0-132c-44c5-8b64-7434b8b1731e", "value": "T189651205BF73C462E05D4D31CDDA6BD8DE72EC10EDD0C76B2FA9694E3E21254CA624A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068863, "uuid": "91a4fe35-a0c6-4b4e-9b25-4852cf4a155b", "value": "ccae7705d3bafed6b8f5ee79b27d03ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068863, "uuid": "1ba5146d-69b5-4601-ad29-890105d658c7", "value": "24576:XWp3wTD6IRvbJcK/KxoGrpzVmQa78x/1Bhl71N1C19o0OmF/FcwgFgGg0:UlI5JLETqxoxNBh/NE1m0OC/jgqGR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708068863, "uuid": "dadb9b47-6b28-4582-bbb1-182ee4396803", "value": 1417324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708068863, "uuid": "9047f163-037e-4b70-8d25-5e2645f5f801", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068863, "uuid": "a82d664c-3ccb-4a70-9878-ea7092026dc0", "value": "SecuriteInfo.com.Trojan.Packed.650.21433.31096", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1804337-ccc7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708086934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086934, "uuid": "f6f4240b-a2d6-4b72-b783-2248b6a85fd5", "comment": "Malware payload (Mirai)", "value": "281ceb72233c8645766f8ec2305b56ab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086934, "uuid": "7a30465e-7eb4-4556-82a3-8808f29b7184", "comment": "Malware payload (Mirai)", "value": "d0e6c07d445314fa108cc4bc6bce17d67895f2deaad45f5b9ccb322080d9f014", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086934, "uuid": "6e6c4b52-e339-4bee-b722-e1770c85b8a8", "comment": "Malware payload (Mirai)", "value": "5dc4efec36896f5814daddf73d1b52959b183bc6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086934, "uuid": "4ce69c71-33a5-4ace-804e-aaca082d252b", "comment": "Malware payload (Mirai)", "value": "01968504b80ef984ef81a57a1a502497826a941705e33d746ea7957854e78d362aedbbbe777bed578e18210d3aaa2b7f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086934, "uuid": "1d395a79-7773-4ee3-8b96-01fc873ca364", "value": "T19CE319D7F800DEFAF80AE33748530806B530B7E245925A372257797BED3A1991867E87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086934, "uuid": "3102ebfa-34b6-4eb6-b270-ff695c01cd0d", "value": "3072:KVIrqcAhb7+zbSiH1nA4UkZijVrjbiJLXRGSoyaiFai:8IrFfHVA0Zi4LXRIyakai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708086934, "uuid": "032b6e04-9b4c-4b89-9183-6651a9e9785b", "value": 150464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708086934, "uuid": "113aeed6-2b8e-4846-a547-f2ed62476c96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086934, "uuid": "a5f86aac-bdcf-4eb9-b305-7538fd13753b", "value": "281ceb72233c8645766f8ec2305b56ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "987ef16c-cca6-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708072639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708072639, "uuid": "29b90d26-9b51-4b3b-9261-2d0c644e1a04", "comment": "Malware payload", "value": "bb02000d02ecbb1be74be0d892e4d75c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708072639, "uuid": "25bcbeb7-3b06-4d50-9290-51f3d149103f", "comment": "Malware payload", "value": "d12015c722dc46c42a1d446e56c4e96a60525314de358ad0e0410f7a037baef1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708072639, "uuid": "6b137dc5-6562-48b5-99f5-f66f0bcfe4ce", "comment": "Malware payload", "value": "bd080bc8e104b90f8123cbba763618f6ac6c6923", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708072639, "uuid": "f07f2652-41ad-4c24-8f1a-94f0ccf9574a", "comment": "Malware payload", "value": "9d7ef6964e98ef61d34ff370889592ecf2df0c3189591e9885dc375ac226e1efc0a1c9fca63fd0cfb46dfcc5ca13b9d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708072639, "uuid": "7af737da-cc23-47d0-859f-cccc515436ea", "value": "T160B35C22F2016176E5B701F4E87D5B5F81ADEF204BA440DFB7CA4A9E0A742D2EE32517", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708072639, "uuid": "d5487d1a-ceab-437e-9bc8-037e54f0d997", "value": "108c6edea2305b1b83fd390f20149efe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708072639, "uuid": "82a2920c-c6ad-42f2-95b5-3f1e1300f4fc", "value": "3072:PYMEWromwPS5jVRhR6OkFZoCDj2W6EWNfynxjpY0DLIS3JT:PFSPw6DoCPAOLII", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708072639, "uuid": "6e090175-785b-4794-8922-22a1a35818e6", "value": 113152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708072639, "uuid": "2eaf90e0-82da-41cd-a4a2-951c03fca50d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708072639, "uuid": "4ca5acbf-4c69-4a6b-89be-885207a65a07", "value": "SecuriteInfo.com.Trojan.Encoder.37357.5649.25968", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "789002a7-cce5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1708099643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708099643, "uuid": "de30a54d-2408-4cfa-8ab7-02b4ff74787f", "comment": "Malware payload (QuasarRAT)", "value": "d554b7ab2ef4f1699f6d77ceb470d01e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708099643, "uuid": "fba814ef-c84b-4640-a770-c76494aaa937", "comment": "Malware payload (QuasarRAT)", "value": "d13a25f8c9dcf0cd27369a3889e37cfa00801ccaf9ac0a5da9e68d6b9cade24b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708099643, "uuid": "895f04bb-0b1f-4f64-9171-0769be74074b", "comment": "Malware payload (QuasarRAT)", "value": "a77b165e67682ef32c10f9e4dc4a235f4cc9e01c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708099643, "uuid": "6d2a2369-59b1-45c6-adf0-ada9a4587a78", "comment": "Malware payload (QuasarRAT)", "value": "3056395e32fe282f786b8d4cff23e70f576dae79cc1eb2cd8574d18493ac94cbe45ce80c18d2a5c91a6e19607ffac1cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708099643, "uuid": "32ddf245-6fb0-472a-9301-12607b29a6ea", "value": "T1BD748C2377E8E93BD1BD173AF5320A145BB1D407B616E38B5A5859BC2C133868E817B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708099643, "uuid": "aa7232a3-d4f9-477a-8cfc-09487c240a65", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708099643, "uuid": "aae56875-4257-42b9-a336-3252033bc7da", "value": "6144:bzNHXf500M2zw/HXLo6K2bXZvWhJzAUKIVZA6:/d50oUHXlKKhvIE6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708099643, "uuid": "0163a3e9-7193-41ae-babd-ac8c29415f72", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708099643, "uuid": "e7d6741b-bcc9-495f-acda-709eadd90b19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708099643, "uuid": "791645c2-cf19-4419-af3f-99934151e9f8", "value": "bTAg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "785256cc-ccfc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1708109521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708109521, "uuid": "649c8c94-ee5c-4bf7-9de0-be45ab936737", "comment": "Malware payload (AsyncRAT)", "value": "616bbb20648eb8f2fbd5c9cffe6d4fc1", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708109521, "uuid": "8e4fa3ba-95d4-4139-9f56-a35a77436713", "comment": "Malware payload (AsyncRAT)", "value": "d378d93d8361b1d8eb61e430b810443b87866758b60416748fc822b8d07f6783", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708109521, "uuid": "223f5653-fa7b-4f05-8521-4bcc7e322f09", "comment": "Malware payload (AsyncRAT)", "value": "de5f7ae1098bb25f5c76085f1b1d65baad6c0058", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708109521, "uuid": "dad6e6d2-833e-465f-8e36-836990c00cec", "comment": "Malware payload (AsyncRAT)", "value": "ba9c7460b2d0f8f7311a1fe53c6095026b6551653b4755656dc0e56eab4f2b82d7e1d31beb0878b95eb327c7f5a799d6", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708109521, "uuid": "79516290-1777-4cb5-966a-d97f838a5f9c", "value": "T1B65319053BE88126E2BE8F7458F6768445F9F56F2A02C91D1CC914DB16327C2A942EFF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708109521, "uuid": "c703df39-ecfd-4ba3-bb51-5f59eeb09a99", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708109521, "uuid": "013e9b09-d506-4653-927d-f436d0095d4d", "value": "1536:428Mz91pk1nukMPaoljhSnOuVY8hE8PU6aOzbcBReKqcobhg28T5N/F8rBTRtx:428Mz91pkdE8PU6aOsYKmbh2yJXx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708109521, "uuid": "b4bd3e89-b76d-4bca-94b4-a640c3aa1aa7", "value": 66560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708109521, "uuid": "f3f069b2-207a-4769-a49a-92bb750d4ac1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708109521, "uuid": "555d4349-2cb9-4bcf-b503-fa6045b6af29", "value": "616bbb20648eb8f2fbd5c9cffe6d4fc1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e36a88f-ccf9-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708108162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108162, "uuid": "62bd810e-c6c3-4382-950d-8e711e90f7d1", "comment": "Malware payload", "value": "4a550bd51e9f54eb4c49c9467f8a2d61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108162, "uuid": "eb285529-3092-48a6-abda-ebf56f3f9682", "comment": "Malware payload", "value": "d37ace9c3df2af311fddee923e4ccfc1422bcbcedd7cbef7f31f4fbf08ba6715", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108162, "uuid": "971254cc-0673-497e-8b4d-137399cf6687", "comment": "Malware payload", "value": "82df7deb1582cfa8bfd1f3b4b31fd8f915058c70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108162, "uuid": "2d404cb8-caa5-4419-8d7d-8a56249a808a", "comment": "Malware payload", "value": "bfaf4922782d3f1016c4a21a93677e9359b0a734683a30da4a424d546f2fefd24a2b5fdf298ac2014f93d7fdd047b0e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108162, "uuid": "42330eb0-dbee-413e-bf3d-0276ce033e70", "value": "T1CE1501047BE99D66C98C07BA506305B927B0FC6FF943F3AF644A29AC3E4B3607855067", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108162, "uuid": "665d5fd1-4d37-4ba8-a3ce-e8fea97b08eb", "value": "24576:l7jmOnpIBv4hDdLXvOc5HdPOOTGtKDebT:JmOpIBv4t1vOc59/uKDe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708108162, "uuid": "5ad8b9a3-7462-4674-92c6-e7983ab57db6", "value": 944128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708108162, "uuid": "a6b6d81e-2b96-49f2-bdee-a2aadc8238a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108162, "uuid": "8b091f2a-8d48-40b1-8358-7314060fddda", "value": "SecuriteInfo.com.Win64.MalwareX-gen.2935.31710", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31bf1108-ccc6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DarkCloud)", "timestamp": 1708086210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086210, "uuid": "8b8218f7-928b-4927-b1c9-a14a36c8b4d1", "comment": "Malware payload (DarkCloud)", "value": "d098f3ed0eb918e39c25e8e3ed83dfda", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086210, "uuid": "6641ebcf-2db4-4812-9483-5609bd04bb36", "comment": "Malware payload (DarkCloud)", "value": "d3d505c2312850804d72f4fbe3c6ef1a5ce8c1cb515a96996fd34087c22c076d", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086210, "uuid": "4a0e668d-bddb-4134-b6d6-c807c0f4802f", "comment": "Malware payload (DarkCloud)", "value": "8ebe528ca844ae07082918868a425251ce4132df", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086210, "uuid": "b36cab2b-d876-42e7-abaa-8a78993529e1", "comment": "Malware payload (DarkCloud)", "value": "04791b86aba06f788a918c0d0609b1228482d7e1429708a9d699dbc45a86c10eeb5430c7eccd34f9892412a4c3b28963", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086210, "uuid": "d6e326d9-bdee-4a54-89ed-d0698c8d0d37", "value": "T1EFC43AC118CFC40DC34E3633A5E1C52968D4CE32645B532EB71AAF8EB43B74A574E6A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086210, "uuid": "669f9ba9-0135-41da-82f0-9b0d6cf838b0", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086210, "uuid": "dedf7b5e-dcd3-4b64-8ea8-afbf5625e341", "value": "12288:8YTpFXxX0sH2QSsgZrV3NXXpYOcu1eFIYvUHmgRmlAQyK:8YtD2QS5ZLXpDX4FIeUNRxBK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708086210, "uuid": "a2f22484-7802-452a-81f4-2444aaada357", "value": 592303, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708086210, "uuid": "75c82293-6a81-4512-a3e4-1c9aedfabe1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086210, "uuid": "f0455cf5-c281-4a79-9ac6-15b85d4f7c28", "value": "Fatura282789.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3227656-ccd6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1708093272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708093272, "uuid": "33d70206-5c74-45d9-a044-42d76d34ec01", "comment": "Malware payload (AgentTesla)", "value": "a7db6a6c78af45c1f7c3ba6cf6bc0365", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708093272, "uuid": "d77fc08d-caa8-4b30-9ed8-9f444256cbcb", "comment": "Malware payload (AgentTesla)", "value": "d57bd0f4e9c749e3236908ed76d66c9d28f3d0d29809a90a95c9b90ee166f141", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708093272, "uuid": "f505b97a-dac6-49c5-9a17-a978b15d0a8b", "comment": "Malware payload (AgentTesla)", "value": "68181b4c33d1545e78cc45089e4c7b724ebb84cd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708093272, "uuid": "e82a67fd-2b39-4701-bc47-b150c66c6700", "comment": "Malware payload (AgentTesla)", "value": "5c6a2c16a97eebe303f6bb95d10a35022f4f737be7ff063bf8e3f57bb189d83e638e70e74f9e65029f9e3ba908961dc9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708093272, "uuid": "f7b76d70-7c9f-4707-9ca7-11c54b5abbaa", "value": "T114E423C098ECEF30E5BFC3F62C7521A0CB72E9058821E3698CF250E517A2759579B697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708093272, "uuid": "f1553fd0-35ad-4288-ac67-f99b8bf82363", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708093272, "uuid": "e8305adb-2ab5-4c2d-a3f5-1af4781a0a93", "value": "12288:d4Q4W3nf42mMKHDPEAvD4Lz1r2OVcUGPmdzRg6Iph5h6mTGny3w5W:OAiHAhfRaU5d9BIphbB4y3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708093272, "uuid": "e537d495-86b4-4904-b61f-cbafaa26d118", "value": 682496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708093272, "uuid": "dbd96338-fe6a-4aa2-84fd-8e4fdacf4e8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708093272, "uuid": "4d35549c-f3f0-4147-8d27-ca04a014c765", "value": "MBL HBL DRAFT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4201fd6b-ccde-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708096545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708096545, "uuid": "b61c048c-1b86-4f67-89d5-7e031605ed2d", "comment": "Malware payload", "value": "6a4c99c2e02297e23f3a3c35b5546585", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708096545, "uuid": "6ba2f448-701f-4383-9390-a263f6296a23", "comment": "Malware payload", "value": "d734447cac7e7f4656b9eeae3a3afbbbdb5de5383a086258e8c2bbd60af69489", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708096545, "uuid": "54756749-f1c8-4d55-b625-4fb92428ebdb", "comment": "Malware payload", "value": "6a72cee5b724cd1adfd20f6c8b221ceca1b9dac8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708096545, "uuid": "39d9f42f-3313-42a2-8b7d-bf98ed3ef6d7", "comment": "Malware payload", "value": "ea3193dd31024ad7b886a32fbca157cc1ff54adbc29a0562b6095cd24f3853aa1089f4772c665f23cc5273c11d993d49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708096545, "uuid": "d9c4301d-0fbb-4da4-bee0-0c295ad20ec1", "value": "T1ECF4BE4D93204397F1182BB5DA6A3E150370187D74C6EBE4FDA5765BEEE2BA2143302B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708096545, "uuid": "43ce258b-dba3-42fc-b049-144b08d1ca0f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708096545, "uuid": "9bbe7e45-16dc-4a86-adb9-cb4f51e8c3e8", "value": "12288:aBjQ4W3y/D/3cV+NSh79LJzmkLal4Cf0GomwB2Qlx1c3C/71YIXye/VW:KVAyLfLSh79LJzmkLTywB2Kxo6Cug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708096545, "uuid": "2723eee9-5676-47d5-8e81-f73160f0ca05", "value": 730112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708096545, "uuid": "7db204cb-7b85-4ff1-af83-8698e35dccdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708096545, "uuid": "0b49ec43-bc05-421e-accd-2527749e042c", "value": "Confirm!!!.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bb364f5-ccb4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CobaltStrike)", "timestamp": 1708078523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708078523, "uuid": "d1758631-5f5a-4957-a0e8-6c1ebc86e8b7", "comment": "Malware payload (CobaltStrike)", "value": "a136aa371eb80d61a757fa41be426770", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708078523, "uuid": "b4ca6548-b70a-4494-9aed-04ee70df2479", "comment": "Malware payload (CobaltStrike)", "value": "d8674a668cb51fe0d8dc89740c03e95d1f659fb6cb66ec8c896e3b1af748662f", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708078523, "uuid": "d3c6f4d1-27cc-4eb0-a707-84350cc88866", "comment": "Malware payload (CobaltStrike)", "value": "ff150eca8f4f5c34d73824b622089f32f5c39857", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708078523, "uuid": "a0f9f0d2-4d8f-4198-9a94-ee28032de3d9", "comment": "Malware payload (CobaltStrike)", "value": "ac27b1b1f4d82bb8851291b11b88da3e055e5e411ce3110d509d95b59beed3bef27fa8b45e19a18e0c5d0c157cf9b546", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708078523, "uuid": "6ac5fa18-1eba-40b7-8498-df6e850131ab", "value": "T1D454BF19B8DB740DD9225B7ED1E16C33E2B67C6FB827E5040A2FDEA35A601440909BFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708078523, "uuid": "2a57112d-ad2e-4a52-acb9-25e79c2542ce", "value": "bed5688a4a2b5ea6984115b458755e90", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708078523, "uuid": "c84165a5-c8a1-476d-96a3-a6667526afcf", "value": "6144:fK/br6Yfiu1RHz6Pt9MhykrjE3nb0l0fZNocDsCRLNY/kgY4:faKIXVz6Pt9MhykknRRmcQCRLNykE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708078523, "uuid": "8ad04e67-5088-49ba-b3d9-20deddd27626", "value": 289280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708078523, "uuid": "13c8ef2c-dd3b-4490-9081-45b286e43fad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708078523, "uuid": "4d27e510-a4a7-40a4-a565-636d8fe23a08", "value": "a136aa371eb80d61a757fa41be426770", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0bd51b5-cc9d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708068867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068867, "uuid": "afa00667-7866-4235-8529-a6aa1d529e53", "comment": "Malware payload", "value": "5feb7554591870699370753536360c9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068867, "uuid": "7d4893e2-9981-4c75-9451-4f1847460913", "comment": "Malware payload", "value": "d90e20fed04e39a4e1af407cee362380750d5dadf7bd7792d9463cdc1b74a8e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068867, "uuid": "6cc1ab21-7788-446d-9655-d1c6d0e5b232", "comment": "Malware payload", "value": "5130e2d902f782dc0d070db1d1b5c064e14a93c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068867, "uuid": "4252b49b-9959-47eb-89e1-7534eb2453b1", "comment": "Malware payload", "value": "9dba24efa7c3ed3a032cfd24c80e09b7038bfdc06037b711325bab5668757bc4dba4f067c40f0044fb4091daa8cd81cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068867, "uuid": "8addde53-2ddb-485f-9a51-d5b50fed47a3", "value": "T13B0429EAA5229C1AE77E86F2152E29782C3D7D13B0409D2FE146F41DE93AB13F15431B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068867, "uuid": "c73d1d47-a6e0-4232-9d43-6daa5f908d8c", "value": "743b05722dc12548930f9e6143a60d40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068867, "uuid": "e5cd81e4-b214-4ccc-b887-4512e3706cf8", "value": "3072:R2tTAcZwMLEaWdsVuBAzOetra5kxKYmwkHK8N:cmceMLlnVuB2OpP8+F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708068867, "uuid": "297ddf26-52c0-4bec-bf2e-9c83513c5ed5", "value": 177264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708068867, "uuid": "a8cb2710-b9f4-4ccb-a9ea-cfbe5644cebe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068867, "uuid": "a5c28af5-4fc9-492e-8240-ba9a2074be4c", "value": "SecuriteInfo.com.not-a-virus.HEUR.Monitor.Win32.OsMonitor.gen.11810.12252", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b31f6466-ccc5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (StrelaStealer)", "timestamp": 1708085998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708085998, "uuid": "5fd8f32e-1c37-4f08-8acb-3ddee9bec5f6", "comment": "Malware payload (StrelaStealer)", "value": "8b5f798bc01985c75d37510670f046b8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708085998, "uuid": "d3ef34c5-7d03-40e2-8cd6-a06f0dfd04d9", "comment": "Malware payload (StrelaStealer)", "value": "d910b9c7e64514dbbceb22bae74790984731877c5e45f06d9e716ae48e1b986a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708085998, "uuid": "2eba363c-426f-4142-84d3-60ef042d0aee", "comment": "Malware payload (StrelaStealer)", "value": "dc65db3178e9089186160059399ee85cb61e487e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708085998, "uuid": "036971c6-8753-4c1c-a407-350bd0009383", "comment": "Malware payload (StrelaStealer)", "value": "8257545e0f575c61478dac86a6b14cf4c8d0e2ac90a9a8e0612b125c793601b05d0ffb9dea9877b1e496b0e5fd29a67d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708085998, "uuid": "adb8522c-7b5e-47d6-8e4f-2794d9f15639", "value": "T1E09509F476E07BD70FB5690D73CE80B23D14B857F4EDAD8612890E1E928035999BBDA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708085998, "uuid": "76ceaba7-efb8-4da4-9483-3f698076a959", "value": "24576:SMTFh49if/ba2nHcQehtzEhlDgBQk2nQHuXeMAbdOw4riQxfeftvIaojSoOsyeSP:Vi+zI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708085998, "uuid": "c5238fe8-4a44-4206-83ce-7ed9acb36c8a", "value": 1906502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708085998, "uuid": "9ada5a20-0697-4cca-9dc3-b6e183f3c8ec", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708085998, "uuid": "ce89ca5a-9f25-43e0-b6c9-b42440c295bb", "value": "9573_21597333807.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff7c10c5-ccc9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1708087844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708087844, "uuid": "d728b12c-5865-423a-9cb1-fe4e76f4ef45", "comment": "Malware payload (Formbook)", "value": "3ca6304b3d5ef4d501119bf31b4e78e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708087844, "uuid": "18bdd2c2-20b9-4733-8980-79837444430d", "comment": "Malware payload (Formbook)", "value": "d9431a1c7c33cba1f32ef80b1a04bf857b377990f4515ee39337d6af65707d2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708087844, "uuid": "3ab79fdf-4d6a-48ad-89d7-0f97a8eae01d", "comment": "Malware payload (Formbook)", "value": "ec2965fbe61a94fe8c82c3b021209bb61c7264f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708087844, "uuid": "9fb602af-5c5f-431f-89f7-d418abc388bf", "comment": "Malware payload (Formbook)", "value": "636f97dbe4edf9b2e28df379717ad4e94799e22931ee104a5b12c4e6ecc449ba414bd68443fdf6cbcc47651f35a2a00a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708087844, "uuid": "baf10d62-e9ce-4146-943e-f102803aff9d", "value": "T1C6D4124A92EE471AE67907F96630045A27F1B48B3975EBC80F92B4D78923F814760F73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708087844, "uuid": "f0ea5bd6-f9b2-477c-ba8d-e8682ffd9cd9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708087844, "uuid": "582f3058-8d46-4763-901c-f97256fdd003", "value": "12288:TUG3TdhkZja23fvf9H3OAXvbVft2sUhdP553v5sN:nTdhAVXOAXvbVlO/BtvK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708087844, "uuid": "61a56422-4b08-4714-930b-82fbd5922325", "value": 619008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708087844, "uuid": "7d5373ca-5c51-4e1b-a8c1-fbb4cdd4a1db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708087844, "uuid": "786b249a-1b62-4004-96a4-bbcecf2e9efa", "value": "rBancofiecompro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bae64c69-cc9d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708068831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068831, "uuid": "0e0ee685-df9b-4c6a-aee6-9e483bc7ba7f", "comment": "Malware payload", "value": "97df0f86caf24a0526c251f3ec53af0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068831, "uuid": "ee8683ae-773c-4952-a2b8-c8b82a250cac", "comment": "Malware payload", "value": "da318c1f018778802db0b8cae16c8f3197011c29175e509108b36688fdba51b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068831, "uuid": "db675adb-7e9a-4bc6-bca4-4ee5415e8ca1", "comment": "Malware payload", "value": "e08610dca4e659964b7c1ab2e1c41f7209eafe9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068831, "uuid": "4e875acd-1691-4f3a-a664-978b401204b4", "comment": "Malware payload", "value": "317cd6cde5f93b8c33544fc80d4f9156520a064e3551d996eb42e052d293a5be93180fe6ad5c8a4334794e246c5baa3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068831, "uuid": "17620e40-05e7-4dd4-82bb-e72c219275ef", "value": "T17AF28D0673AAC6FAC2622431D657FFB976EE9E1100D1849B6F211B8E1F21651ED3E307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068831, "uuid": "c2cb59f9-e31a-4148-b4d9-05264a202549", "value": "f56a1b7a171a25f42a873fcd6d46dfa7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068831, "uuid": "d3d24042-7117-412a-a7b4-33543d55a9e2", "value": "384:oXk55lgTcKqhhx34Gd/eWrb/O/HMmC2lwPMR7QfGTE9gMJlp2j5m0Lo4rSYiy/Sc:ttvhDPtV32/HfaG4xUTyl0Nufecc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708068831, "uuid": "926eebec-36c1-47a7-8e5a-8a8b12706f0a", "value": 35840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708068831, "uuid": "6d80e61a-b76a-4ea7-9440-36a0bf93dd2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068831, "uuid": "091e6121-a6b2-47a6-9fcb-0a767bba86b0", "value": "SecuriteInfo.com.Trojan.Inject1.12051.24166.1683", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfd41a24-cc9d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708068839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068839, "uuid": "fa9d4080-8311-41bf-ad39-0b5457ce6212", "comment": "Malware payload", "value": "995a7c00611fcf4e869ce3155c18e4a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068839, "uuid": "ab9624c2-f0ea-420d-bb75-25af2a7f1554", "comment": "Malware payload", "value": "da6d8d46e7add1a18d5b094b9aba092f0a6ac7f4f8e82c86f80d1e460feb7ae4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068839, "uuid": "7e5bfa8d-b68f-4e4e-b743-9abbc5c673d6", "comment": "Malware payload", "value": "1f64b92bc7d6fd020d72e24dcbe7418c7428ee15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068839, "uuid": "e7cc55a9-b651-4f2b-af25-74ef6b7ef893", "comment": "Malware payload", "value": "4f21a3abfedd05682a3e4679b507347d643f171ad2312fc70f2112f2dc4d2670dab81fa506d9f28818d04d3afd18709b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068839, "uuid": "0ccbbba0-2908-4e3d-8f8e-8a92bbd9e657", "value": "T12EE20AA3962C6073E69C8BF1047682F53832BE742A105D47299DDE583DB23537AF022F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068839, "uuid": "3b83f14f-1875-48a1-aeaa-6fe58734efec", "value": "0760e15bc4018d108c24494d5b636531", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068839, "uuid": "031e2cb4-bd77-4dc7-93a1-89888df5622f", "value": "384:VFe2775l5lyGyD0kj7vkOUGR672JDa0su722775l5lyI/3mirIL/PAFuN:VMdGyD0I+UpKm2dI+IIL/4U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708068839, "uuid": "0de08705-33b9-44a2-84c4-3ded9dac7c8b", "value": 33904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708068839, "uuid": "ae48396b-0245-4fe5-9c4c-f1a971e7b1d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068839, "uuid": "fa88dc9e-727b-460a-9cc4-3475ee52e3c2", "value": "SecuriteInfo.com.not-a-virus.HEUR.Monitor.Win32.OsMonitor.gen.12361.21500", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4950628-ccc5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1708086000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086000, "uuid": "98a438bc-e8a7-4d0a-a7e7-f552b27514d5", "comment": "Malware payload (XWorm)", "value": "a3e82bfb3affe03337cb216a65db943f", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086000, "uuid": "a45a3285-8240-4f33-8bb6-41935111240f", "comment": "Malware payload (XWorm)", "value": "db72ae0337d3edac28c3ad0acd80f5ef24a8f54afb98484217021d26359e224e", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086000, "uuid": "dc616e59-565a-4bd4-872d-1255da9b04dd", "comment": "Malware payload (XWorm)", "value": "090c97ca503f39c11b2244429f58d9cb95d63da9", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086000, "uuid": "99f04a88-90d7-4285-b468-a8b145fdd595", "comment": "Malware payload (XWorm)", "value": "498cd0d664aa4ca16da4dfde7053fa38fadb4ea44cdcc6fe5e8a8ed4625e7c449aec3fd44faf03cd5de1297cc35b2a3f", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086000, "uuid": "21929d28-d6a9-4552-804c-920435fb076c", "value": "T1A2F09602B7F5050CB2FB5F195A3010685B7FBD459C35C61C0250194F0CF2B45D9A5B77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086000, "uuid": "c67a70cc-c1b6-4804-90ed-05b4b90f8284", "value": "12:Q27dKNK+AOSkExsyCYdKNVplgsbOEdKNJEhKND9rqtpFf8fD5:Q27X/OBExsy9m66OEURpOpFf8fD5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708086000, "uuid": "77c59a77-c9ab-42f2-81be-4ab137af9858", "value": 636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708086000, "uuid": "e1cf03cf-f592-435a-9b3b-26ea3326a594", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086000, "uuid": "49a9a501-3eee-4146-9a63-ef23e4140272", "value": "item_pictures.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0ca3791-cc9d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708068814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068814, "uuid": "cfcbe98c-6ad1-43f8-b7a0-fbd4e2d16ea0", "comment": "Malware payload", "value": "d2e1a44d0235b321c79dfd3e8c33b70e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068814, "uuid": "0adf2f80-d926-4b1b-b04a-f1bc19d32259", "comment": "Malware payload", "value": "dcbc3d60628cb1c9a087a8cd48f3418da59d71c2633b75008cbd38c33fc2ec0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068814, "uuid": "c589e32a-6384-4df4-b382-8289fd21cc17", "comment": "Malware payload", "value": "c46526ee34d5f21d212cf62551a145d25da216d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068814, "uuid": "dea93fb0-fc5b-4f08-bde6-e83742825c3c", "comment": "Malware payload", "value": "bfdcadc4c88a489a1350159ab00b5279dd5ae3aa9e5be496d6d4dafca02eafe7ef9955ff3c7af2b9c7840bd9652373aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068814, "uuid": "86c2649d-9dd6-4c65-bc48-774dee5373bd", "value": "T185058D21BAE280F1C6172C311AB77335BE79AD151E418F93A3A6FD2C5D321A16C3716B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068814, "uuid": "5173ac66-f041-4b13-afaf-232d7fb96ec6", "value": "9d9746a5483166f10e26ae3330e8fc9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068814, "uuid": "df989338-db0e-45e3-9c03-9694dbc45ac5", "value": "12288:XdJJTLLSasRZTCPxWmm+CKXsridZsV9/AY9/d:XdJhLz6TixBm+jX/jo979l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708068814, "uuid": "69ede6e3-baf6-49a6-afe5-21fd1809f4a8", "value": 864256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708068814, "uuid": "1d929fac-6894-4d57-af82-14039d14a116", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068814, "uuid": "d6d3b26c-b608-40ea-9b97-4cf6ede76d45", "value": "SecuriteInfo.com.Trojan.Inject1.22908.21883.5379", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d22058d6-ccc7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708086909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086909, "uuid": "038b4cce-21c3-477d-a642-6033d316d7fa", "comment": "Malware payload (Mirai)", "value": "5d0cd7af5c01ae0d2b9d9f53c0e3e268", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086909, "uuid": "66fab124-3641-4222-b8a8-f7f857f14b36", "comment": "Malware payload (Mirai)", "value": "de991273f15d0ea6f042c38ffd21cdae5a081e88cc90c9c7b0f837f137a619e2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086909, "uuid": "7d6a7820-b3fe-4c0a-8d72-67653e6931e8", "comment": "Malware payload (Mirai)", "value": "4f0e0490d8c116821d2a3ada05f32b8f43b7d110", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086909, "uuid": "5c122f2d-391c-4158-b306-5969704d7991", "comment": "Malware payload (Mirai)", "value": "0eea0ec447fdb6d8197cba04af5dc6bf9bcdc7bed09f9b71756a5be86f767b95591159bf6bfaee320a37f049f1faf9ff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086909, "uuid": "3296a395-d9ad-44d3-ab8f-b4c394143d9f", "value": "T14EB35A73C8256F98C15AE1B4B0B18F792F63958182471FBA15B2C2B54483DDEFA05BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086909, "uuid": "dddfd5ec-a761-4a27-8516-c7fcf1de1f7f", "value": "1536:eatX4U/LeAgVgJFu5iJotvyfKOi8Xe5L07uCaC7WCbo4lNXQUyIbCWlcHOV06fKH:epU8VoOsbIXWCu7/paWvQtDDjz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708086909, "uuid": "12859929-b88c-4f8e-ae11-c879f0f56a6a", "value": 116512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708086909, "uuid": "85e921c9-6ad8-4d59-95c6-631d713219aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086909, "uuid": "30b98bbf-f5af-4c36-ae33-cd0bd9690c90", "value": "5d0cd7af5c01ae0d2b9d9f53c0e3e268", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "287a8ad4-ccdd-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1708096073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708096073, "uuid": "a29825e5-23c8-4fed-b934-c0cf8fc8cad8", "comment": "Malware payload (AsyncRAT)", "value": "6562a3c05a741eea182a566c4403f512", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708096073, "uuid": "41d01d22-7dec-4aa6-88fd-45485edcfd15", "comment": "Malware payload (AsyncRAT)", "value": "df37b362150d37374f604ed290c613701e5167d84abae499b82bc74f970d966b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708096073, "uuid": "08595a18-464e-4ca1-a7b7-29b6566ed4bb", "comment": "Malware payload (AsyncRAT)", "value": "6eaf2c977dea1a6f9f6083c90ad7489bafd68792", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708096073, "uuid": "48faa1a0-a834-4b28-b27e-d65c2b76cb2c", "comment": "Malware payload (AsyncRAT)", "value": "66579c7f676178ef5b79c930d3b92b89e674970aa6750100fd3aaa95b0045f5f06299fd9956b74477bd19fe839554608", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708096073, "uuid": "376008af-df37-4e55-9dd7-dd4b82af69e8", "value": "T179235D403798C136F6FD4BB4ACF2A2058679D66B2A03D7597CC811AE1B13BC596036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708096073, "uuid": "7be59802-9528-4593-b33a-e0923a111b78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708096073, "uuid": "5e61e477-b311-43af-909c-69b1ceb1c4bc", "value": "768:Eq+s3pUtDILNCCa+DiPAPfDOBLe0wbijy3YbagetzOPKvEgK/JDZVc6KN:Eq+AGtQOYPfILdyobN+yinkJDZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708096073, "uuid": "b7f0892d-ccf4-47fe-aa52-d383210e8edc", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708096073, "uuid": "56a1b2b4-0717-4c15-9b3c-73cb3142fff9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708096073, "uuid": "ede4c6c2-5238-4c5d-98f5-ea4d89b37f97", "value": "bT9W.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d183ba4a-ccc9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1708087767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708087767, "uuid": "a3659db7-c758-4266-919b-6453158e2934", "comment": "Malware payload (AgentTesla)", "value": "029d8bf20e57c4951e74764c290feb63", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708087767, "uuid": "064e6458-532c-44e1-ac42-f84d11fad401", "comment": "Malware payload (AgentTesla)", "value": "e0a542a41badfacb07736f419450f252f15e42b969385e99ad0b2c41487cc476", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708087767, "uuid": "1edca8b9-48f7-4c63-b6a0-26ee640c2c74", "comment": "Malware payload (AgentTesla)", "value": "be44354419a20606f1a4face811f3fd3306f7bfc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708087767, "uuid": "6584b5b6-2ccb-41ec-ac4d-8579246631d0", "comment": "Malware payload (AgentTesla)", "value": "fef66761b1115679d0b2cdb864d6ed2c678bf07cb883a3be42d20746fd748e3b7cdc281319005e4667e03b82abece7f4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708087767, "uuid": "a68db735-3ddb-4b3c-8078-148cbb924b91", "value": "T15BE422896AFC1B14D5BDC3F224167101D376B556A560F79C8C9AB0E93BF3B800B93A4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708087767, "uuid": "b39185b8-116a-4037-a8d8-c25e4e691d7a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708087767, "uuid": "f24ef84c-2841-4ae5-adf5-cc4ccd9002b4", "value": "12288:ZtQ4W3kOtacSMdpkY4G48mtOVU8kZnQPlY8L1KG5W97apBdQ/OVgBO6pUAUM9w:1A/7Pk76U8kRD8L1KNGlQ/7wWUL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708087767, "uuid": "bf3c8b2e-12e9-4b1a-937f-f299693db797", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708087767, "uuid": "ac83dd6d-98ac-4c93-8540-5fe409310a63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708087767, "uuid": "784ff05f-e5d4-4a51-9e30-be0b8880f67c", "value": "rMEDUAE9552508835512.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34fb6642-ccc6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1708086215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086215, "uuid": "016ec036-4b07-49ed-bcd5-034f59ccbde0", "comment": "Malware payload (AgentTesla)", "value": "2004e2902f0671f9ccf376bd00fe3a8a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086215, "uuid": "44508ed1-9d47-4bd3-975a-f787c726149e", "comment": "Malware payload (AgentTesla)", "value": "e1b2bdcecafc712713647e95e0a5eb4f66c180d2fe0a357016772a85f7a0b86c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086215, "uuid": "bafb353c-b0c4-4ee8-9f77-21fd9e1ef2fa", "comment": "Malware payload (AgentTesla)", "value": "66d91d31b56164b3e47f82f48ba9c32c254b8c2d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086215, "uuid": "dfb233b7-b585-49b0-9d7c-b81dea572043", "comment": "Malware payload (AgentTesla)", "value": "be69ac605a0c8417672b2437bea9674ca09b2c8fd9809a6757e87557098011d8954ea7fcf7a1e4654e4a1f09afb3804e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086215, "uuid": "dda677c8-4840-4962-82e3-b171cd11674c", "value": "T1DFE42286AEF82721EB79C3F218702115DB79B175E150E33D9ED793FA1AA3B141B12207", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086215, "uuid": "0af629c6-0171-452b-8775-bb90c81c6fd0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086215, "uuid": "ad242ebe-7ce4-4068-aa9c-676de8174079", "value": "12288:Y4FQ4W3bN5gngXEvICrcml42ri91/FMVfqg4oWSRyq2xkd+6dIGG:3AbN5P0ACIzntMVzbWSRn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708086215, "uuid": "661ddcde-53a3-4ee6-8841-34c18f7a787a", "value": 680960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708086215, "uuid": "feee152f-3d4c-4f7d-bede-049f3844350d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086215, "uuid": "1034052a-059a-4d17-a168-0c5218157079", "value": "TEKL\u0130F TALEP VE F\u0130YAT TEKL\u0130F\u0130_xlxs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0ec8eee-ccfa-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1708108730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108730, "uuid": "5a794a60-1dc6-4e25-9e50-d593c4c25ba7", "comment": "Malware payload (RemcosRAT)", "value": "68081357946ab2e632f5d87628f7ea19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108730, "uuid": "0450edb3-925e-418d-8ae6-b827705a49ce", "comment": "Malware payload (RemcosRAT)", "value": "e2f8e4920fccffba6e5c1f0f7b0af4b1f945402081e688fb5732fc2b2a74130a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108730, "uuid": "231844a9-95d4-4cb7-a509-f55279f6a9b8", "comment": "Malware payload (RemcosRAT)", "value": "60305adc6d7235485493584550591b62b1d89066", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108730, "uuid": "7697898c-3a31-4702-ae4a-503d754c4669", "comment": "Malware payload (RemcosRAT)", "value": "e5957a564b4410e512859315a78af337a7d977adc1a128c6e045359d4e2b1f2d5e08c15b07c3b568e26abe489c82b80e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108730, "uuid": "64b4d05a-4cc1-4201-a4a6-dfaf0980bc98", "value": "T13635015626A7EC22D38557745522E33D8AA2FE861971C2737BE4AD9F7608F313C0C3A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108730, "uuid": "22ee818d-5d80-4c09-8209-5e837806b32e", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108730, "uuid": "0a56e971-557c-43b9-8543-28fc37d873cd", "value": "24576:V4aYCN9l+1TTBu9yldNF4tWH7/KFCbYVI3CrIMLF6:yqrgp2WbGCbqIykMU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708108730, "uuid": "76dabdb0-c0e7-443b-a7fa-c1816fe5692c", "value": 1112504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708108730, "uuid": "fd2c1af5-49c9-47d1-8b99-d65b5f22d995", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108730, "uuid": "9cf0b3e9-76d5-44f8-aa70-3f8f02dea6b5", "value": "Sweetsystemdoo-02162024001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54727024-cca2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708070806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708070806, "uuid": "15dc0da3-14ce-481f-8bd2-bdd66ca6725f", "comment": "Malware payload (Mirai)", "value": "c9c5ba0978084db4a5b9f37d0308b051", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708070806, "uuid": "de5689b5-bea1-4986-8e17-f5f99b07ff02", "comment": "Malware payload (Mirai)", "value": "e50db1ebe42b2368e4657c1a92aed4f7cbcac6f82daec250b2c9386c76240e65", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708070806, "uuid": "0b152434-c186-446a-9408-12ca471e860e", "comment": "Malware payload (Mirai)", "value": "3639d4a191acef6af059a5024ae1bcf796ca75b4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708070806, "uuid": "8fbb65fd-3e1c-41aa-adcc-678289edd9b1", "comment": "Malware payload (Mirai)", "value": "7838f2725aaa3e935085ac6c0c6bbae2e47292c018fd888a081f63c7c5b8aa410812e91a37e93755f7df6a5250512c54", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708070806, "uuid": "b696c4d3-f986-4fbe-92c3-8c4482778589", "value": "T1E1E35B0BB5C184FDC4DAC1B44B9EBA36DD32F49D1238B16B27D4AA222D5DE305F1DA44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708070806, "uuid": "6811a1ed-7c5d-4b13-b482-b704ddadb6ac", "value": "3072:CPcmzjA+DVFkb7cUmrWKdpn617FnD/McPp1DrLjsr1L:CPcmzjA+DVFkba6BjcL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708070806, "uuid": "612e0f23-2cac-4067-bedc-6572de3f8c78", "value": 152024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708070806, "uuid": "b9e000db-428f-4abd-824f-facae4e1202a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708070806, "uuid": "a06d2f8f-2ae9-4c78-bc3b-ca3c6a971645", "value": "huhu.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caf0108b-ccc7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708086897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086897, "uuid": "6830326f-ad3e-4b69-b8ad-ab278ac0c499", "comment": "Malware payload (Mirai)", "value": "d92e0377be781729be25d55a400ecfcb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086897, "uuid": "51ce579a-1388-4a58-9d52-7b20d5d514f8", "comment": "Malware payload (Mirai)", "value": "e59f4fab5fe3bae05c0303c128c06d58f6bd525f381db3c4c31e42a14aa0e96d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086897, "uuid": "1a2b537b-5d8c-4400-a541-a40a3636a8cc", "comment": "Malware payload (Mirai)", "value": "493798a97cd528899ef27a31609eafd0ce37e96f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086897, "uuid": "2d20a678-19e0-4ad3-a38d-6d29754446a6", "comment": "Malware payload (Mirai)", "value": "92b3cee88c02f1d299a3820dc690a6ff72bc2958120da97a91c7f78ca521514d2413e2ff695b2c4009695f3287d51605", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086897, "uuid": "e345235f-011d-4045-acb9-22ccb510c954", "value": "T128D33A06B31C0A47D1632EB03A3F27E097EFEAC121E4F640695F9A8A9171D375586ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086897, "uuid": "e06e7385-7930-4e68-85b9-e571a9c7e81d", "value": "1536:gr4Wki1ldd4m4hu1MJ8+6xkDvUoxOP0VkuLyiCrJ/vASPIBgK3NLq2viXVu7:greicJ8+6x+coQeLy7rySfXVu7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708086897, "uuid": "d34a62ea-3f91-487e-8141-fd9fe2ceff09", "value": 139224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708086897, "uuid": "cf741a33-21ef-4670-8bdb-c59803db40ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086897, "uuid": "d79dd43f-8d21-44d5-93c4-51cf0fe45426", "value": "d92e0377be781729be25d55a400ecfcb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4cac3be-ccc7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708086940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086940, "uuid": "125ae577-ca11-44ff-aa7b-a3a1465d8ad2", "comment": "Malware payload (Mirai)", "value": "ad7fe89ca32331b8ba5966e0bc1be43d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086940, "uuid": "84cd5faf-8e28-457c-abb0-c62640655925", "comment": "Malware payload (Mirai)", "value": "e88d4995a256a1d98376e2901bc48752a2c348697ee9c9c7cba75fe81e47e6c9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086940, "uuid": "40907a97-02ba-4187-ba02-a1f771b6508e", "comment": "Malware payload (Mirai)", "value": "85d2f5b20d00fc4ae1a252e4771e5a89b4d29c9b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086940, "uuid": "af03d22d-ee40-49f2-9d8c-bac653a71661", "comment": "Malware payload (Mirai)", "value": "bdfbf8f6e0b9baffd1c976f28dc6f0619c5a032eae28a96d555a05f4e6948bc05176e60ecdb0b82c161d9a35c0346df8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086940, "uuid": "859068d5-1df5-49c7-bf68-06aabe9a6882", "value": "T17ED32A06B30C0A47D2632EF43A3F67E093EFDAC121E4F640256FAA8A9171D365585EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086940, "uuid": "71fccf9d-bc5e-4d40-9dfd-bc10ff55c05d", "value": "1536:CApYWLEkgvb5IMX+31kyxgxpzvTLLNMkUFo4g/LPMngvAVIxcb3W93qqS524k+ul:GFXekyxgx97f1EgjPMlVI+uj1D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708086940, "uuid": "4564984c-41dc-4983-846d-530839c969fe", "value": 132344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708086940, "uuid": "092c842a-dd8f-490d-a208-04a9e5bd6677", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086940, "uuid": "323466a6-2813-4852-a130-90ae76f1a510", "value": "ad7fe89ca32331b8ba5966e0bc1be43d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8db23e4-ccc7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708086947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086947, "uuid": "b7a2fa10-95d9-419d-a49c-a669160c4caa", "comment": "Malware payload (Mirai)", "value": "5d0a375d030db637a2620c39c88d9f6f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086947, "uuid": "f164ddf4-98a7-4b11-9aeb-6d5451555805", "comment": "Malware payload (Mirai)", "value": "e918d37cc8a98616ac1475a9b86484e51e20e707d380cd81ec54b2338deecc68", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086947, "uuid": "9b082aca-782a-4707-8c4f-5b24d2bf4b8c", "comment": "Malware payload (Mirai)", "value": "6feb924a0ab2d579e5da9e275f071ba84ca834e4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086947, "uuid": "5524d0de-4d3a-4264-8385-5b9c48809a5d", "comment": "Malware payload (Mirai)", "value": "342c07e1011801652f96cc9080a0a2d684a6443b8cc56eba7c33a547ae56ecee477a9bad54c359217febcfc181d64dd7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086947, "uuid": "68e6ac31-e548-4bb6-b92a-7f30b811517c", "value": "T15CE33AC7F800DEBEF80AE33748530905B530B7D215925B37629B79BBED3A1991427E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086947, "uuid": "6a0b989a-03dd-4e0a-922a-8faef229bd0b", "value": "3072:6wInnqb0T2UJJZJbPyRIxN7IHUVrjbikLxjVVnydV91Y:VInoSNPMIzIHsLxjfydX1Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708086947, "uuid": "639c9b5c-6c1b-435c-be7b-44e91310100b", "value": 157024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708086947, "uuid": "a1f78605-911c-4747-98f2-549c0b602cf1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086947, "uuid": "6d39854d-9b7d-45cd-83ca-f37d0b8b447c", "value": "5d0a375d030db637a2620c39c88d9f6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aea47b6a-ccfa-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1708108753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108753, "uuid": "6501c333-7097-4e4f-88e5-b0b742d22a9c", "comment": "Malware payload (Socks5Systemz)", "value": "328c4a28573f115ea95531fe5e1dcffa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108753, "uuid": "bab8ae39-600c-4bc5-9162-05c44ba4e4c4", "comment": "Malware payload (Socks5Systemz)", "value": "e9a73a061546af0a2537f329054096700473cb962924f3a51716e1844b0d7d1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108753, "uuid": "309d18b5-118f-41ed-8d59-3052b841c736", "comment": "Malware payload (Socks5Systemz)", "value": "a576ffc8e39bd462256610ae249cc056866ca31b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108753, "uuid": "6a828768-b8bb-403e-823e-b603b49953fc", "comment": "Malware payload (Socks5Systemz)", "value": "fe1d08d1d6dba9129ac235567d6539b122cd135e2a8bd019363340bbcd3d4783936344c14824e12dfa185188766bdc27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108753, "uuid": "fae71442-7fa9-4115-9074-bc8d1a28ee7f", "value": "T13A263396BBD66438ED319F350C5AD4201DB36F546C7FBAAC200C31DD874B4DEAA057A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108753, "uuid": "0000f3b6-2a79-4814-8b14-38d6e6ea9813", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108753, "uuid": "6f65468f-9dc6-40c3-beea-1012a202f60e", "value": "98304:IW91j+LYgYCg1KEijGJ17ex/1Unx06zI+pSuQtwt3KWaOdL:h1jwTTGJwl1cIaJdF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708108753, "uuid": "8aa9494a-3118-4327-b079-fec79d22c388", "value": 4572196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708108753, "uuid": "a349ceb4-64f8-433e-a01c-45c0469f2d28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108753, "uuid": "39b1b727-00eb-4702-81c9-e128e35c0f1a", "value": "6RkimYHFikrug3msTIA2GOCf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51c115d8-ccf9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1708108168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108168, "uuid": "e459a44a-338a-4df0-b1dd-28631d475c82", "comment": "Malware payload (RiseProStealer)", "value": "f8ad51561a618f29fdb37b7f17ca6fe0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108168, "uuid": "c0bec926-521c-4d76-b055-769d77689498", "comment": "Malware payload (RiseProStealer)", "value": "ea956420a8461b1aea880e09f5a85ae28cf70373f9e2e87a7304413f8be0ac8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108168, "uuid": "ea368874-22e6-4410-9910-21a4982d94aa", "comment": "Malware payload (RiseProStealer)", "value": "a845a35bef35d6ceb479aafcff732fccc1e1ac55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108168, "uuid": "c7e6d7e2-219b-4146-8e21-4fca2e341c45", "comment": "Malware payload (RiseProStealer)", "value": "9851d64fd197349db98c6ef9d72855b742e3e9e2aa192fa376a0d4c2d34a67176f85150c806209802a669a2ef6f7ae8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108168, "uuid": "1e395600-3051-4a5c-bdae-665b149b96b9", "value": "T1261512CE9D80446BE6A4777800C2F7BC022EFC91F95960DA6CE9BB9B3633D19192351D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108168, "uuid": "5198662b-4223-438a-b91c-ad736d7c199a", "value": "2388fee6ad8ce4f4a35dbaf64e2da01a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108168, "uuid": "e85996a5-94ed-4956-a20b-7c3d0ed42f27", "value": "24576:4hTQu9uJOw4GT7KbykaOjbmZF1viYhitYAJo:4BQukH48eWO0ItYEo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708108168, "uuid": "97ce52b2-6051-4397-8831-323c528553f4", "value": 921680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708108168, "uuid": "8ca0b5b8-abd0-4701-80d3-25bc94c24379", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108168, "uuid": "3dbc68b6-dbcb-4953-a80f-9ca4b3433e6b", "value": "SecuriteInfo.com.HEUR.Trojan.Win32.Generic.27091.14153", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc9b756b-cc9d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708068860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068860, "uuid": "2fec0798-ee02-4b90-8916-62def6f86ce4", "comment": "Malware payload", "value": "987dcd00b8856b17349ab661dd88aff3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068860, "uuid": "ba9bd0cf-1c4a-4477-ad38-8db74b55bae3", "comment": "Malware payload", "value": "eae62288bf71fdddf52c4b6156adce2df754072ab0a57be3f1338d5ba4d18e39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068860, "uuid": "92fedaec-8fae-4cb7-903d-db03c366c3c6", "comment": "Malware payload", "value": "77f81dfab7f843143e01686fb6a602b54a62ce08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068860, "uuid": "122ded50-115d-4445-9991-0d0d6c563dce", "comment": "Malware payload", "value": "2210b64597a018d424d3c0998a39e8ae0330c0850efc5b40b1588eba2d18d0fb33150d01dcf0d369b94cf671a29d68b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068860, "uuid": "52119595-9083-4c2d-888a-3ccc4e352621", "value": "T1DD858D13BE5158C8E5C525F809A293399D3926731B728ED3321FEDF9EF311A0996B231", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068860, "uuid": "1eaaf93b-8407-4925-bec0-b07a5efee589", "value": "24576:a2kFkhtOI+M0wwyFmv1GmiJbUNU9+tBIgG3:apI+M0B8mOmhQg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708068860, "uuid": "8f92f6b4-71e8-4722-af9c-3480862bd64d", "value": 1728512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708068860, "uuid": "3176a754-bdbf-4fed-a8a2-9c130afc0e7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068860, "uuid": "98a873f3-7341-478f-8cce-a7ae53c612a5", "value": "SecuriteInfo.com.HEUR.8032.14573", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3a32e3d-ccc7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708086857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086857, "uuid": "dfa2e499-74bc-490d-8713-6c287c12b452", "comment": "Malware payload (Mirai)", "value": "9a4cdbd0b8b2fc26a4191b684b7668d5", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086857, "uuid": "17dc3b91-74dd-486a-b9c6-a08306535ed7", "comment": "Malware payload (Mirai)", "value": "ebdd7ef4dc560f26044bdee1bd8a0a4fbf59f4111c3146721ebe259047b78a28", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086857, "uuid": "f0cbec25-e330-41b9-b94b-eb29cb6133c0", "comment": "Malware payload (Mirai)", "value": "42275bf1adddf5248a74a89cde962926be3d9f93", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086857, "uuid": "dfb7c31e-6fd4-4cac-801e-3e574140992f", "comment": "Malware payload (Mirai)", "value": "ea8bc5449ac523623f0d8504c91df5751e9663ec2082eca8d50fa4e6966147841284f1541b874f229246c81712377466", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086857, "uuid": "3fda54f0-2bcd-4eff-8e97-b28c651d74bd", "value": "T1EBD33A1BB4C180FDC4DAC5B44F9AF53ADD32B1A81238B16B27D4AB225E8DE315F1DA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086857, "uuid": "25da8200-61f6-4488-9daf-138e0faf30fe", "value": "3072:DX+wXNsuOXWYmqnQVkt1TosPipRlOaogXk72IElN7CcY3w3ymPd:DX+wXNsuOXWYmClPuk7uR3ymPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708086857, "uuid": "d805f537-b5fe-4659-88ae-f6ef6c67ee93", "value": 139576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708086857, "uuid": "a8693e07-9dff-4086-929d-ddcdd93e30ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086857, "uuid": "ab68114e-1af4-4f79-949c-d74ebe20f21c", "value": "9a4cdbd0b8b2fc26a4191b684b7668d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0334f37a-ccec-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708102453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708102453, "uuid": "0f04cb01-a521-448a-814c-8f4d1f63346c", "comment": "Malware payload", "value": "8712e900c0180a0fda31669c6652f94a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708102453, "uuid": "404d7e3d-62dc-4614-8c1d-9d759adbf2ab", "comment": "Malware payload", "value": "ed24826a2231038de59ebc6aa550d0c6ba34748af5c7ba8e652696f0140cafc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708102453, "uuid": "caffd47b-07aa-4850-973a-0124b64c743b", "comment": "Malware payload", "value": "ebde7e89f198ff722a2cd60c0e6055df161a0498", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708102453, "uuid": "9f466eeb-3425-4497-aa62-3566e0988949", "comment": "Malware payload", "value": "4999bdd1e7dbbfdf37f196715dc65a85b5edff2761995acb00414f9990471b64ebd66857aaa198b0c7775dd8267abd4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708102453, "uuid": "b995e06b-93e1-4876-a29c-90678ec7badf", "value": "T193159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708102453, "uuid": "69f14078-6051-4859-9965-36dcaad15cf9", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708102453, "uuid": "714134fd-4edd-46db-ad1c-f5488e63666a", "value": "12288:3qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgalTY:3qDEvCTbMWu7rQYlBQcBiT6rprG8aRY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708102453, "uuid": "c341596a-790e-464d-ab45-7ce1ef953c9f", "value": 918016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708102453, "uuid": "dfaa6a3d-b6f1-4b5b-a7bc-98658f41ea5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708102453, "uuid": "af25b633-e84b-4e95-8cba-e67feb046016", "value": "oGo_jOZdZJP_yUA_g0QT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0136735-ccfa-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1708108729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108729, "uuid": "bba459fb-ba15-453c-8fdf-409168340e49", "comment": "Malware payload (RemcosRAT)", "value": "5e33c3e87a74657a89ecc8b15dbd1be4", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108729, "uuid": "d676a543-d40e-4a1c-95fc-fa98a5498fa0", "comment": "Malware payload (RemcosRAT)", "value": "edfa2134ba71730b0ef6207199d0ab49681d38862c5c0bd2b76727b0b07b7cdb", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108729, "uuid": "db4f21a6-c9a4-4c6f-adb9-38efd57258d3", "comment": "Malware payload (RemcosRAT)", "value": "3178371a0d974a1eb9598837d9035963e48417ce", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708108729, "uuid": "1e64a80a-9a8a-458f-b2af-a15acbf300f2", "comment": "Malware payload (RemcosRAT)", "value": "81fb8349d392df5d295fb6f9e92e78a996253217db79e3bfa96a22b3e488977ce8b3ba0458faea35b3e7b94b609920bf", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108729, "uuid": "9243eb8b-aa68-4e2e-8d43-cea275fed67a", "value": "T1372533DD3A02E4264AEB8E252C1BE28217BE74304C1B9DF2F48D717D4780B756E469F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108729, "uuid": "2bdd2687-a509-467a-b862-2f033993592e", "value": "24576:U86zCUC69g+dT5BE9rlC6F4wUA7QroyLiV8DNraw:U8jd7rHxU0ByLo8pWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708108729, "uuid": "3851f271-a478-4d6f-891e-c6196093fc99", "value": 964202, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708108729, "uuid": "6f8a4ecf-da79-44ad-8753-85cecba1d4e9", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708108729, "uuid": "def90819-743f-4d6f-b8d3-8d7a511301b1", "value": "Sweetsystemdoo-02162024001.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3d991a4-ccfd-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708110077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708110077, "uuid": "f2104542-9531-485c-a0ca-97e91cf28d39", "comment": "Malware payload", "value": "b0d5d246a536c95194355bcd16b52a48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708110077, "uuid": "f7dc5073-dda5-40e6-b5ff-8c625f7bb9d4", "comment": "Malware payload", "value": "ee10715a737eca25439d1b68aa0e99bb9be6105df20e074ec7a7b4356cbbf922", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708110077, "uuid": "35ec5e18-603b-4c70-afd7-cb0f4c178cd0", "comment": "Malware payload", "value": "23e3db9a903bc7b6439ad97d9154b80aad81f75e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708110077, "uuid": "c3448ad5-661b-4eb9-894d-fec1c8792416", "comment": "Malware payload", "value": "04a95752dd8339b84c7ae4a35ff89546fa0792f3a17b148a35962d64067645cb3c986d019604fc579a88734fcaf18b3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708110077, "uuid": "efd78942-f550-4aed-9e24-c4f02a87ae76", "value": "T1EEB42316DBB30813C180C5FD60D59B1E7BBF611E656EE426A900F7AAAB783F0D036187", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708110077, "uuid": "3ab9dbc8-2677-43b7-a031-76189d80f347", "value": "45a74cbf9993e123825ca926eea3ec62", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708110077, "uuid": "b32766b3-025d-4463-ad01-a2a9676bcbc5", "value": "12288:TRRxbtiT2T9yW0ky3m4kS3mGL5FtsbJ2ZilWH0JHN:TPh13sm6v2J2UlWwN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708110077, "uuid": "da160efc-77b7-4879-82e9-389670a32256", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708110077, "uuid": "32e9dd67-0975-481a-a603-cb5fafb3c568", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708110077, "uuid": "f33fb867-3f98-440d-9c28-005ce38396f2", "value": "400000.E_MountLite_66.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "425e2657-cc6a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1708046724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708046724, "uuid": "3093a586-dbd1-40cb-af15-a1d409517c91", "comment": "Malware payload (DCRat)", "value": "15847a8d8ad61ec7ae75ab10f21fecfb", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708046724, "uuid": "1a146720-18cf-44e7-8456-eb62b2a5f946", "comment": "Malware payload (DCRat)", "value": "ef8ca9548082bc58b1bbe0fb16193449b582371704af80bda53f8f184d24187a", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708046724, "uuid": "ac79f6e2-b106-4daf-acfe-019dcd9b246b", "comment": "Malware payload (DCRat)", "value": "d3a5c44372c47c4c957fd2003d9f69c970036da7", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708046724, "uuid": "15dbea65-22ff-420b-99cd-271de67549cf", "comment": "Malware payload (DCRat)", "value": "cafeb0950061b79110ad7986acbea4a2f9f5611e084183e5f982ab8c6dafe6b0630846b686989ddb2924c194bb7d1c13", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708046724, "uuid": "b1fca380-d7d0-48b2-959e-31f6279bd756", "value": "T141C5DF02BE44CE11F0191633C3EF45084BB4A9516BA6E32B7DBA37AE64123977D0D9DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708046724, "uuid": "0af738a1-c8d5-464f-8591-3944ac296081", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708046724, "uuid": "fe058625-e758-4e0c-94bb-370530cbe1d6", "value": "49152:6+gwP7VCJiCmhgLZvRYbP0tGnb8IymbDya7/ttorF6H:6HwPkJbmhy5tMbimbmab8kH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708046724, "uuid": "8195f95f-cb1e-4100-bf30-1e3c764c7c8c", "value": 2529280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708046724, "uuid": "73e19e76-4af1-47d9-9976-a9a71fc66d08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708046724, "uuid": "f57b9b08-8f0e-4c6e-9b86-39107c95b0b1", "value": "15847a8d8ad61ec7ae75ab10f21fecfb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba68aef6-cd1d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708123806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708123806, "uuid": "c94bc8db-2d01-467c-adae-c6d349ab5539", "comment": "Malware payload", "value": "91394c8b01b23c37caff2a4718f5b942", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708123806, "uuid": "5c45a39d-8c34-4109-9357-74675e0ca181", "comment": "Malware payload", "value": "f040de436fe288c464241fa931efb580309590bb2b9f6a16886b43d76aaeb93d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708123806, "uuid": "bb0e4a97-cf7b-481d-b906-1e1cb578ed3f", "comment": "Malware payload", "value": "1b785e97da56de5bb15708ba354c6efdc0be5d80", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708123806, "uuid": "0deadee4-c821-413b-87c7-98296fc0bec7", "comment": "Malware payload", "value": "8c62a995dc02e817c23943f710917e275a3ca99a3f891b6b0c2a6b6196573c9d0f2c740f2afe6541d1cf23c1dc612e4f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708123806, "uuid": "2ec31e0f-7f74-41ae-b87c-206bd0b734a8", "value": "T1133328C0DC03D9F6DD05167514B7EB3367B2E1B90129FAA3EBC9E536BC42601A64B29C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708123806, "uuid": "e4461579-abad-48b0-8bb5-046d7bc6e6d9", "value": "1536:uwraewfyqufis5qtJ9JTRSYpzqc/ff6ipQR:uwmzfyqufB2J9zTpzP/HN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708123806, "uuid": "391ae587-6b1e-46a7-be3c-1b4364050e2c", "value": 54532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708123806, "uuid": "104370c6-77b2-4164-85fd-680a04f4be30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708123806, "uuid": "fc9e61d4-dd50-4e9a-9063-0f404d5acdf2", "value": "jklx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a4c5e27-ccf5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708106518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708106518, "uuid": "e487adb3-5350-4f4f-a950-c12440054e6e", "comment": "Malware payload", "value": "1d08ea9c2b5742989ddd848f545ddf00", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708106518, "uuid": "6d2df939-9fe5-4f31-990a-1c385b38cc6f", "comment": "Malware payload", "value": "f0e4e2656467459bfde295f51d68f5b1de5c03a504c2c7c8dc4f0d635ed0da26", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708106518, "uuid": "4974ac56-77d1-4f26-926f-ac1c5920aeeb", "comment": "Malware payload", "value": "1f3c851f34b0d5d852e6aded505636eb3b8114c8", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708106518, "uuid": "39e9847c-fe13-4844-b2c8-4a30324a4ffb", "comment": "Malware payload", "value": "26469262c8cc4ae7a2e98ea23bfb4cab0a8f781c9d9ef7ac0e31056f00e868118ee3a7c68df3d1c5c635ac303d790ab5", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708106518, "uuid": "10dc3a80-8f3d-4238-96e8-aa5c018a890a", "value": "T146F03A5253F95204A2B75F18AD3464E54B3B7E1A6E6C824D02A0080E0CE0A46CDB5BB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708106518, "uuid": "fda34851-25f3-4be0-a51e-2b69e11fa07c", "value": "12:Q2k330+FT6UAWQHDRIuIovVlgMhUADHneAU0991pqEtneYzhpqsF4Ff8fB:Q2CEzSOTIeV6MhvHeAU09k6ej04Ff8fB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708106518, "uuid": "0ba3d5d6-b4af-41bf-9578-a7cd70d42b88", "value": 560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708106518, "uuid": "4ffb22c0-39d5-4480-a066-f1d654536c57", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708106518, "uuid": "7a617ca4-20bd-4825-94ea-33e74e2e6ba2", "value": "damaged_item.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5da6531c-cc9f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1708069533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708069533, "uuid": "0dbcd8ab-1552-4ae9-84bb-64719469b28d", "comment": "Malware payload (RedLineStealer)", "value": "0151fb724c05f336230cd113ebd0a065", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708069533, "uuid": "b2c8d260-ef06-40eb-ae94-cbbfd53d7fc0", "comment": "Malware payload (RedLineStealer)", "value": "f176d6e006a07b2827d6d0290faaf0201bef14b93364d835c9924248ec3c7f11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708069533, "uuid": "21265438-c300-464d-befd-4d6c9b040976", "comment": "Malware payload (RedLineStealer)", "value": "dcee95f5abadabb1ecc634b5ded142e9df7a1fb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708069533, "uuid": "90460747-5c16-4947-a3bb-2575db747fb0", "comment": "Malware payload (RedLineStealer)", "value": "7ce7fc63a63c29c58ab006c555abe2a10328f638c5053aaa78ad129c685f4fa05e53ff01f9f517b82ef4e8c4d7604f97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708069533, "uuid": "25257cd2-6603-4c32-a158-dea429027bf1", "value": "T189E4BF05BB61CA15CBA52AB1A09788384B62E1537673F31F2F6D5DAB7C433B24E443C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708069533, "uuid": "772ac9bc-c2c6-4a66-ac17-7c35929fe88b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708069533, "uuid": "58660460-6f8f-4520-a156-ae6cd04428bb", "value": "12288:XLDyU3mD4wz7tzE/0qei9PEjav7p+dGO6r56NiVzmR6lY3:nRmD4wlqe4QaFWGV560l8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708069533, "uuid": "ffc3f8a7-babf-48d1-9022-76a8fbf81f5d", "value": 667136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708069533, "uuid": "879dd3ca-d6e4-46bf-aae8-b7957cec2253", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708069533, "uuid": "d005f721-ea86-4893-b45b-975c0842d462", "value": "0151fb724c05f336230cd113ebd0a065.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "418a56f8-cd23-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1708126180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708126180, "uuid": "874bcf6a-1d52-4c6f-99af-930c44ad6cb8", "comment": "Malware payload (RedLineStealer)", "value": "7fbeac72ebd7a9862fb637f408af69ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708126180, "uuid": "47a4b63e-ab69-4e59-8262-531bd33fcd28", "comment": "Malware payload (RedLineStealer)", "value": "f1f2fe4c421979d5bb23a3611a711e165b6b3d1785d9ad8ff58bc52ded4eab44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708126180, "uuid": "feda2077-1e4b-4f38-90ab-0615f44eaf31", "comment": "Malware payload (RedLineStealer)", "value": "45fbb6934c00c1c1d8d094221d398b00469e342e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708126180, "uuid": "c362b139-ea5b-440a-86e9-b2cc6273450b", "comment": "Malware payload (RedLineStealer)", "value": "fd6277732fda4b7816a4f889f99b55bac69faef0760a593f1998d2886529c1ecbb7f59ffcc37ebd5e5afe404c246fd61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708126180, "uuid": "01529ea0-3fd7-43a7-9508-007f7aa7a3bb", "value": "T11FA4012063E1E332E18316B74674C6B10E7B3A3971A299CD6BF756F91F347A0922931D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708126180, "uuid": "7b8114b0-2cd9-4013-917c-152e31b7b7a6", "value": "ab4b20db27905f9ef383a4e0564b2b9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708126180, "uuid": "1d9b487f-ccd4-4bf6-99b9-8c796d04ecd2", "value": "6144:ith6eZeZhE6teaIM3V9Fax2RVmSpGHUlxw8hQcH1+OZKnYvvQGZcf4WQfXWO:ithvZeZ39IGax2+sG0UcH1P0y9A4pfG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708126180, "uuid": "9cf7f374-9faa-4ce6-88fa-82cf13682590", "value": 475648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708126180, "uuid": "91fe7119-9288-44b6-a803-69c8665e047e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708126180, "uuid": "1552eebe-0709-4d11-b167-70aa2317bb95", "value": "SecuriteInfo.com.Win32.Evo-gen.7356.25392", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed197f8c-ccc7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708086954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086954, "uuid": "90c09c8b-eb28-42f2-9ae9-9271d067b290", "comment": "Malware payload (Mirai)", "value": "eee70340f3bd671d5af45ed0439cf8f5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086954, "uuid": "f4941b6a-f262-42dc-83d3-8fe541fa9eee", "comment": "Malware payload (Mirai)", "value": "f21a69e8ea5f5c616ad7c7a25dd1074fc3ae6f4716436bbf92e8435f7bf3376e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086954, "uuid": "acdc131c-8aaf-4668-a85b-db70f65342c6", "comment": "Malware payload (Mirai)", "value": "f03fb41ba02a9e32f0c176c40b6b9a2aea7430cd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086954, "uuid": "b9d53e4f-7abd-4c4f-8597-038bf20dbef2", "comment": "Malware payload (Mirai)", "value": "c228c9dff3c1f06cd17e2ac33024b5877c75907776425fa1de62359f1757fcd0e25c819fbc12a76149b221fe20e18907", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086954, "uuid": "fbb2750c-a75f-48b2-aefb-83edb7055302", "value": "T14E04FA1AAB510FBBDCAFDD3706E90B1139CCA54722A93B363678D524F50B50B49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086954, "uuid": "2c524227-23bf-4d3e-82ff-3057bb121c94", "value": "3072:uCQDElnTshX5MZ6vKOgwRl6adAbVNjVK/iy8:uCQQRghaZ6vFg+ljmLpK/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708086954, "uuid": "af4a37fc-e319-41ae-b6ef-ac028cc853a3", "value": 177856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708086954, "uuid": "bd7785f8-a64a-428e-a66d-19cce48274a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086954, "uuid": "e4cd227e-a6b2-400a-9538-ae0e0d08cb01", "value": "eee70340f3bd671d5af45ed0439cf8f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e199991-ccf2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1708105209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708105209, "uuid": "accb86e2-33ac-4fe4-aabe-d840c93697ac", "comment": "Malware payload (CoinMiner)", "value": "36668345aef7c7c7835067c731ada5ae", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708105209, "uuid": "0f076dcc-0155-4846-b1fa-b3fa90cf6b38", "comment": "Malware payload (CoinMiner)", "value": "f2894a2000f0a51219a491d1e905ec28d6199fbfd10680da5fb99ee288b1159d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708105209, "uuid": "054fd72e-3402-49d7-a492-10294e489adb", "comment": "Malware payload (CoinMiner)", "value": "4105c01c987d6f47209a943162538da3714bc068", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708105209, "uuid": "a84d24b2-28ed-44ff-afd8-685a3c18cf6a", "comment": "Malware payload (CoinMiner)", "value": "96b1e57cc3a1874c72c16830f01d220dd64835b4fb7d00b5a17cb29dbddbcb26807090c93a441b9e4d6100736e473cac", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708105209, "uuid": "82132581-0f0d-4915-bae3-5046cc66e7d3", "value": "T1C133090A378535FCE7E28071DA5B6B32156B78114B31B5FB07E1A6212E31BC0AB39F52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708105209, "uuid": "f388a04f-1f7e-43dd-9c2c-3eaf610fe35e", "value": "5d68de0544abec4f6be91e05245b348d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708105209, "uuid": "8ed0bc36-38cc-4cfc-a439-98de1bca0d75", "value": "384:97pii1fK6hqstaFAf705oR1OL0I8jF8kbibCTto3iQv3j6BwzDB:EiIA1OL0fqAECTt+5TZB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708105209, "uuid": "287a2565-2d96-4143-805c-8b7df72ff35e", "value": 53248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708105209, "uuid": "d8024541-5e98-4460-b6f0-866fd19499fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708105209, "uuid": "6afa18be-31be-47a2-b256-2fbde2cac67a", "value": "140000000.conhost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b24ed5e-cca6-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708072643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708072643, "uuid": "919e87a7-b134-429b-9067-4410df8ea7bd", "comment": "Malware payload", "value": "f4e35f2b41b30aa272367ff68bfe29f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708072643, "uuid": "cc458c14-3da6-4e2c-9210-6af84a7338aa", "comment": "Malware payload", "value": "f4d018d30b9a5d0f49bdb7dc5bae4e680ec162eddbbaa1ba943100e763d908bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708072643, "uuid": "2f175254-933d-4516-9d9c-7227974a909f", "comment": "Malware payload", "value": "7953a2b45d52bd7dac66681a87ce15e48d21d992", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708072643, "uuid": "5559c5bf-9c1c-4258-9bde-310aac41242f", "comment": "Malware payload", "value": "b5758408371e4159bcb9e9601ca59ec2e055df66ff93328277eba2942abace334ec2d5a29c271b6a6f8c26a94a36c12f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708072643, "uuid": "7c563e8d-eae3-47b2-94e4-c1d089d2d20c", "value": "T1D724AF1263D3C4F6E89A11BD44EB5B2FAB3452040726CAFBD3A42E5EEC313D056762D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708072643, "uuid": "4caad3fd-a0ac-489c-a103-ba2a20da9388", "value": "e7bb7584354a5a69b4dc5d9a4c5ba279", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708072643, "uuid": "c794eebf-bd0d-4989-949c-80ea45e39038", "value": "6144:upYpIvYKnDYBonRjrbmtCgtgUvQNAOoxuw:nIwMYBonRjryDvwVw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708072643, "uuid": "d0ca3eba-b4e7-4dba-b4b3-aadeae987016", "value": 228266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708072643, "uuid": "23d5f157-eb17-434a-924a-445f3e072d3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708072643, "uuid": "f97ce0a0-66cc-4d2a-a44e-257436e4dbfb", "value": "SecuriteInfo.com.Trojan.Agent.17175.6441", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cbc0ca6-ccc0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1708083625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708083625, "uuid": "cc3805cb-960e-4068-986f-f63fd3ba7d2b", "comment": "Malware payload (GuLoader)", "value": "1df153c19e79b02c6a534353c605c258", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708083625, "uuid": "7964920e-a48e-4b34-bfce-b8824310a2c6", "comment": "Malware payload (GuLoader)", "value": "f65a3978e069f13d9d4a06bcb950a1bdf73ea29b05ad0db70fbdbe9168003dbb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708083625, "uuid": "a4f1b95e-0502-47bb-bcaf-fc569ea1e7da", "comment": "Malware payload (GuLoader)", "value": "57305fa2288eb4405af1b82ebaac7f703de782b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708083625, "uuid": "66584084-5fe5-4430-a699-d0aabaa161ac", "comment": "Malware payload (GuLoader)", "value": "6178ad91652c9e358dadd50910feed069cf5fb16464adc160cffbbc4cb2da272b6376e7bc00e80b7df6b1658117288ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708083625, "uuid": "40242761-a294-424c-adf8-ea9cfd9ce4ce", "value": "T19735021612A6EC52E38017789665E63C8AA2FE871971C33777F0AC9BB519F313C1D3A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708083625, "uuid": "4d96921a-fde5-4ffa-8e68-5985bc44e812", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708083625, "uuid": "7be04287-5341-4324-bb7c-d00444eddafa", "value": "24576:W4aECtxu8N+hPUP3WEG7MO0RKbHIrT/4bI5SVkW:JDCtY8fG7tcP/4bQSV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708083625, "uuid": "45212396-f3d5-4fe0-8cbe-52b768679626", "value": 1083960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708083625, "uuid": "0160d9e0-0e70-47af-8200-ddc7116914a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708083625, "uuid": "1f7e5ce7-9fee-4e73-9a14-fa35c44858b5", "value": "BANKA HAVALE F\u0130\u015e\u0130 + FATURALAR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3da73153-ccc6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1708086230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086230, "uuid": "c24e0825-ddf8-43d1-b6d5-5e04b3758fdf", "comment": "Malware payload (Formbook)", "value": "0ebc73c2bf2f42bf9b4aa9fb101d21fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086230, "uuid": "f99b8a20-4447-4c30-8402-15a142148a12", "comment": "Malware payload (Formbook)", "value": "f6f49abe480eba571ce7f27566bf4e486e80c3b8a61b89f230eeab0298b436cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086230, "uuid": "620083d3-d045-4300-9cab-6c7cdd3dca4e", "comment": "Malware payload (Formbook)", "value": "52c303a4dcf0a3cdc5f7922da55babc334eae68f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086230, "uuid": "54d70427-a2f9-4cca-846c-5422dfb94b8f", "comment": "Malware payload (Formbook)", "value": "9d3f97b63cc07eac07189a0074cc39ee5474fd565e31c55f9a85ef28961760ab946a512c616b53a1b024f9a2b5173d5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086230, "uuid": "571c6c79-4415-4158-860e-771b0a845337", "value": "T15BE41383B6FDCB3AE47A5BF89174010907BA79DD3961E3585E0630EA24B37905A64F33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086230, "uuid": "c4e2350a-e555-4770-b021-b67ceca07817", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086230, "uuid": "f2284124-d89e-4076-bdb4-5657f2f5aea9", "value": "12288:DZAxtMHnMP9jnLdzWfld5aVUL9RDe7Klk5I321eOAbCGtWx6rFs:DGxtMHU5zWv56UXe7KlkzMOA2Oc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708086230, "uuid": "4fab536e-e675-4d6e-be45-cc5a5bddd841", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708086230, "uuid": "d9675746-6da2-4dbe-b90d-f7e2507c02f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086230, "uuid": "394f1365-df74-45c2-82a8-db8221a2b7ca", "value": "INVOICE_#TNT564600.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9cd408b-ccc6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1708086546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086546, "uuid": "b48b601e-342a-444b-8272-b66950195380", "comment": "Malware payload (AgentTesla)", "value": "810e7d4fc23dc3fe58dba275217d9281", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086546, "uuid": "e8ca4b8d-416c-4b6f-8e73-bb4827df1bde", "comment": "Malware payload (AgentTesla)", "value": "f76de7e13236b109f94997a7e83436a3efa5f63726e392516ba364be5619ca22", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086546, "uuid": "00327eaf-56fd-4de5-9e99-c01c70334ef9", "comment": "Malware payload (AgentTesla)", "value": "ff8a2eacbe7a18906b012b688969e171e5724c35", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086546, "uuid": "63fd9787-02ec-437d-8159-cb070264314e", "comment": "Malware payload (AgentTesla)", "value": "a0c908affd0d657408f2ce4a7b409d00049c8ca621017cd6519b598dfffaf7f5ac79c501760ed20205a430627e274ff3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086546, "uuid": "29f665de-99ff-4f98-96fa-0426f26d4db2", "value": "T1A0340E037E84EB11E1A97E3792EF2C2453B2B4C71633860FAF49AF9524512925C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086546, "uuid": "f863cf8b-661b-4cca-8438-b9d10bc2ed3e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086546, "uuid": "79535452-8ffd-407b-a2ee-e4cde5cc7ffc", "value": "3072:R0DH3jH7HY9NZxsY+DvDigNaMYW83fv9B5PxwBot5:63jH7HY9NZMLOka5x3fv99wa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708086546, "uuid": "7a7f721c-c37b-4b8e-95b8-08ad71d030d4", "value": 244736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708086546, "uuid": "5f22a885-60a7-46cd-8183-26fb5a6a38b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086546, "uuid": "1fe69f65-3365-4c07-9418-ef9b6ea95777", "value": "1708086544ddf5e91d5da622263b109e097b89bb59e2fe440e58b026596a02ae71c4f804fb946.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0b72ea0-cc9d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708068841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068841, "uuid": "871f8848-d166-41cb-85b5-a61eb04e4fa9", "comment": "Malware payload", "value": "04be8a0e346157901d3fc885bb59d17e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068841, "uuid": "a6476fc9-0a2e-4ae4-8984-d0453f7c3c4d", "comment": "Malware payload", "value": "f8ae198ad395e6c133d20525dfd1caf7726e4e998d57dd381c8abd27b679f61b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068841, "uuid": "db483512-5000-4d82-aaee-5e9c2fbdbd5a", "comment": "Malware payload", "value": "1fb2956bccb947b6f89eb543ecff68314901bf66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708068841, "uuid": "f3974494-c9d5-47e0-adeb-d947e328abf6", "comment": "Malware payload", "value": "737d9ccedfd1e2d1f7302af36ea5f98a5cdd22c5ce45504caf572f4d04a7a78c84b97f73e360378ce8c324952b32ccd8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068841, "uuid": "99cad53b-ed73-4ab4-8b3a-415a3880b734", "value": "T1B9942362AC1EC551C2689C3CAA4F49590F80FF9BBE9A46310D737618EEBD76174AF304", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068841, "uuid": "d757a074-edeb-45ba-9e22-138579e67d95", "value": "23615023d461e78d0629dc17085ae148", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068841, "uuid": "16520bcb-fb8a-469c-abf0-476560eb69d2", "value": "6144:kQW9uDYAb0EpYTJgR9OvPGeW7iTqxJvG2c4gtE6BvroyaVC5sscQm+YZbShTILUV:cSb54O9KnqfA4gdBvroysCLngZxLL9I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708068841, "uuid": "cd621bb3-8f4b-4fee-8d20-358184df1685", "value": 409886, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708068841, "uuid": "112cfa98-147c-4c6e-91ed-b7c5587ba17f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708068841, "uuid": "0b8459aa-3593-4f7b-a052-1c9ac543ea45", "value": "SecuriteInfo.com.BackDoor.Pigeon.72.27362.27574", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf44d77c-ccc5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1708086018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086018, "uuid": "1ca92839-e5d6-452e-aa9b-dd6a5e8fae45", "comment": "Malware payload (AgentTesla)", "value": "07542f5b703f5d2ffafb8747e711bb5a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086018, "uuid": "b65a54b0-6441-4aae-85c0-89c87087c32d", "comment": "Malware payload (AgentTesla)", "value": "f8f1e4cba7ff359de7b01dbe1205bac6d886fb1de9190d4f2f614a76b618a9a1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086018, "uuid": "4324fe78-6bb1-441f-ba73-99e952fd346c", "comment": "Malware payload (AgentTesla)", "value": "d03e0038173f13d6a9c92a783a3dae9b9df42081", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086018, "uuid": "c4880477-242b-44d2-8979-c5fc65377dc1", "comment": "Malware payload (AgentTesla)", "value": "4ff17cd25ad1a50a37336f05292459efbf6b1c5aa4f3f8bf585311cb575408f8632cd5bbbfcd2ac7dcc610aeffd9f52b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086018, "uuid": "6ea9d585-9bed-4b60-b9ed-dde45ee261ee", "value": "T13DC533ABE5C8D001E9ED1A3F93897B03D77D0C5204C928113E7665A4ADC786B67EC4FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086018, "uuid": "66a16c55-b644-4542-b396-2174558bc96a", "value": "49152:auFFhmqD9lkc/ym1rtnKENOohKFpaQkNvU6CGRxYcZrF:LBzko1tXXhKF8QkNvtgQF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708086018, "uuid": "5fbbb167-daf6-4777-823d-80982ce7df52", "value": 2585445, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708086018, "uuid": "d6eb2fbb-6e8f-42d1-bf52-ba3e5d2aeb3b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086018, "uuid": "12ecfcc7-bbd3-4341-9ce7-c98001a30380", "value": "Chitanta bancara - #113243.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "194a73e5-ccdd-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1708096047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708096047, "uuid": "d1d28330-9659-464c-8298-fafd53f21594", "comment": "Malware payload (AsyncRAT)", "value": "a189727939fc22996e532f704d2ec317", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708096047, "uuid": "5597cb4a-ebd9-494a-b267-d7647321cb1e", "comment": "Malware payload (AsyncRAT)", "value": "f93a1d7d6fe9d5b8210963f708214c797855d976baf3a39d7b4475b170a910b7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708096047, "uuid": "99ac32cb-1017-4264-ac1b-f2a8c4b3c7af", "comment": "Malware payload (AsyncRAT)", "value": "f6895f82517eca726e4b4be46546acd5bdd3b96f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708096047, "uuid": "779f0cec-e6c3-451e-aae5-d6808a182dc6", "comment": "Malware payload (AsyncRAT)", "value": "004d625db49dc85580d23d804d33f9e371eb6670637460d6909ac12573ba367bbe3884413acdcea43f572d6720fe7ea4", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708096047, "uuid": "733361cf-8c6f-4e5e-bf84-8ef9cd4dc237", "value": "T102235C0037A8C13AE6BC4BB4A9F3924582B5D65B5D03C6997CC824EA1B13BC597036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708096047, "uuid": "2ab55f2d-f5f2-4b1c-92df-bbd3edb6e0e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708096047, "uuid": "7fb8742c-9dfa-4e3e-86c9-d6bf8b1336c6", "value": "768:gq+s3pUtDILNCCa+DiatGAgiFlYbyge1wOvEgK/JHZVc6KN:gq+AGtQOatGWeb1CZnkJHZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708096047, "uuid": "bf50d4ce-081e-496a-8045-134d2bec2870", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708096047, "uuid": "91da9a68-3dc6-4840-b25e-241ba4a6b9a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708096047, "uuid": "ac57151f-d272-4eb3-a1cf-80bfa834a789", "value": "bTAb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "823ad2fb-ccae-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708076037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708076037, "uuid": "1f7437cf-8f39-4e03-b4a9-56df4343297e", "comment": "Malware payload", "value": "c8a8ac2a817fc3793012e218d53868d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708076037, "uuid": "05d9df00-92e5-4fe0-93b1-1fdef2837950", "comment": "Malware payload", "value": "fac0abdf38c9fd1b6eeb7b67ca18f2b1eddb0a7bd0e2a7d44b92abf0d2e2a736", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708076037, "uuid": "ddd91209-a2d0-44ea-b957-e22974c36d7b", "comment": "Malware payload", "value": "7e458b5279f04bb567b0a1546c63f951d22413f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708076037, "uuid": "382fcae7-f167-4760-aa99-75175898d7ab", "comment": "Malware payload", "value": "f98b7def7e224f581c3d062dcbcf145b28b57cc434f68d39fb2944e3429f28011e6a3d00d9322b051ac516225d6b1b7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708076037, "uuid": "d351e355-c14c-4408-8f62-dfc173efd199", "value": "T123328E1387E44B79F5770BF22CF7166516B5A362A19BD7381BCA531F2F1B0108A12BE1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708076037, "uuid": "79bbd053-7445-41ea-90c3-be911e7662a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708076037, "uuid": "724c2457-142e-4027-a661-461d9084a0c5", "value": "192:518JZd4M5qHNXoMuaCzGu7y+KtvOoclbojFkuM7dX4UJ86c:51iiHJF/mj7y7WoclQWt7l4Uu6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708076037, "uuid": "b8220d0e-663f-421b-b90a-7e593ae026ac", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708076037, "uuid": "00e87797-88a0-4ada-a147-9a24c387e18e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708076037, "uuid": "ae2f76d9-c06b-4f52-989d-6cec1a1ae720", "value": "SecuriteInfo.com.Win32.TrojanX-gen.11884.9244", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f3fc0bb-ccc6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1708086286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086286, "uuid": "0ae4cc93-5a30-457c-9dc3-243de9b3cbeb", "comment": "Malware payload (Formbook)", "value": "d7fd24a871589c5a3de2dc37feec1985", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086286, "uuid": "b3931ea9-b6cf-4e1f-be88-f1641f8c0278", "comment": "Malware payload (Formbook)", "value": "fc1bc12b9fd30ac827862bbdcb650af53170b938ad575092afe6f85929d6dae0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086286, "uuid": "e4dca481-e658-4cbe-89d8-02ee98d2557d", "comment": "Malware payload (Formbook)", "value": "fc0752aa3164d64ebda6be42971c1dd65c646c14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708086286, "uuid": "1ab84a8c-4d65-4337-998a-07a19be98473", "comment": "Malware payload (Formbook)", "value": "43915c86cec8156189866b22c818685abd52b8747ff8553a7ce4c0dd738245faded6cd9afb061ff0f0a36824f45506fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086286, "uuid": "425c6355-26d2-499b-b449-a0d4e9a94664", "value": "T12C55CF6872783522DE6DC63390E26E0447B79D05AFE7D31B24C4796C2A767FE4B03682", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086286, "uuid": "580b6488-99c0-4b00-8653-43014c13eafd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086286, "uuid": "a2f931f9-10c4-4558-bfa7-5c83849fba3a", "value": "24576:C3ATxFrxIKXn4cJIpr5UmMfB7/lCuwAlNqMG:Y5cJIwDoHAJG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708086286, "uuid": "909ec002-5d80-4794-ba3b-8ff26bd49caa", "value": 1310448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708086286, "uuid": "a19adb6d-c32d-4d22-863b-ea2c5aceb318", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708086286, "uuid": "78e3acf9-2a67-4cfe-aaf9-14cbe4131e01", "value": "QUOTATION_FEBQTRA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8378e46-ccc8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708087321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708087321, "uuid": "956309a7-30db-4c90-891b-90346e6677a8", "comment": "Malware payload (Mirai)", "value": "e80f330e22f89b4dcb858595b6c05868", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708087321, "uuid": "0fc43d90-0f94-4850-b671-af30d3d2960f", "comment": "Malware payload (Mirai)", "value": "fd34d0e2c8ec5312902f8634852f4d564e64787bc83125bedc32b81776b7c24c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708087321, "uuid": "c94ec88f-1770-4d3a-9387-a5c49739ccb3", "comment": "Malware payload (Mirai)", "value": "07b3b3447d537651f43db1afdb08a13f7ad512f7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708087321, "uuid": "9a6d3757-665a-46c7-8c19-5ce65ef102fd", "comment": "Malware payload (Mirai)", "value": "e4b851051664c3e45653f9d1eaf622c3d29c9a390e3e43110fc372da5123b27527c8bb855b344a4d4a7c35ed4a0d3ec5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708087321, "uuid": "c0854e8c-d05d-44a1-a996-1069a0d2f050", "value": "T183937DC4F343D4F5E95704711277EB369B73E079121AEA53C378AE32ACA1542EA06B9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708087321, "uuid": "6679bcee-a35c-4e2d-ba20-10cf9f522886", "value": "1536:VCuLcw/F/nVBysNdiu7RjKoaXKn7Tfr4qcm0TyNTWuQn/E6uTuSsRXtZ:Lcw/F/VssNdioKBX87TfjBayQuQRY3AZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708087321, "uuid": "787c386c-de13-4e64-99c5-d20ce13dcfd9", "value": 95912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708087321, "uuid": "c2f1158b-0226-449e-ba1f-684d94d16075", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708087321, "uuid": "21f3c41b-196b-4aec-aa52-0d5aed74da6e", "value": "e80f330e22f89b4dcb858595b6c05868", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a3149de-cca2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708070789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708070789, "uuid": "bbb57e0a-7f10-4701-b4f1-5c4c46d9a5a9", "comment": "Malware payload (Mirai)", "value": "348fba7887c381088d5394adb0764d02", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708070789, "uuid": "b9c40449-fb21-4cba-bec5-d9bfa1b65921", "comment": "Malware payload (Mirai)", "value": "fd4fd5a07645222beae85e5614d051d9dc93f23efec5e2b1101c6dcac0091576", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708070789, "uuid": "ddabd3b7-8951-4158-a3d3-884a7130417e", "comment": "Malware payload (Mirai)", "value": "1f88f88238f8dcce5d6a02b50b578b76ab613e4b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708070789, "uuid": "2b239aca-87b9-4b08-86b8-caeb46c5ce6f", "comment": "Malware payload (Mirai)", "value": "e85ec0d0646ef069d49c6cf941f66ee287e05f6803e19588ad993455479f1437272ad2227e87822db08da8ded923f17e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708070789, "uuid": "78dadcbf-4b8b-4f04-ae41-21ecda937a90", "value": "T1B6A37CD0FB43D4F5E84305B5207BEF365B72E0B9601ADA52C3B99E32AC51452D60BBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708070789, "uuid": "4b1102a3-2fb5-4806-8b6e-6979219bf6c6", "value": "1536:BIQyv/zvY4NKtk9dKtx+3yVPdfAXOmw4SYnanbO3SfYZI4xo2K8:2Qyv/zvY4Ok3Ktx+3YP4Omd/nUaCfO2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708070789, "uuid": "131016e1-87cd-41e1-a123-dacfd1a721dd", "value": 100808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708070789, "uuid": "ea183710-2659-4c29-b28b-0f8dd3f36bec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708070789, "uuid": "41b09fcd-599a-481d-8eee-d8b1e14daed7", "value": "huhu.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51a2f6c1-cca2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708070802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708070802, "uuid": "d563c9b7-2dc2-419f-9b85-fd478aa1b67d", "comment": "Malware payload (Mirai)", "value": "257d97a0dc6b34ab2f2204cda71e189e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708070802, "uuid": "2c802e62-468f-461f-a696-2ea73dc1bf1d", "comment": "Malware payload (Mirai)", "value": "fd6a5432047a26ae089bb380f8c7c7590d105dd8ce592a46135ac8b262baa53b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708070802, "uuid": "a678e5e9-c588-4a45-9349-17da3b9e6cd6", "comment": "Malware payload (Mirai)", "value": "16d2d74f036a3574d9d17e5bcce03739e013748b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708070802, "uuid": "4c4f303c-8286-4e2e-b76c-d584e92a5432", "comment": "Malware payload (Mirai)", "value": "f8d293ad8359c43ed05637101923dd7dc885798cb25b5714ecde37787e3fa31079d4fcfc019f1c778d7e7ee1671c49fd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708070802, "uuid": "3f025175-2614-4e3d-9eab-52a989e84518", "value": "T17014D81AAB510FBBDCAFDD3706E90B0139CCA54722A83B363674D528F54A54B49E3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708070802, "uuid": "0cf494bb-ffbf-44f9-974a-2a1812dc2d5f", "value": "3072:yeobGz6ISnxCKi/e+6ofAnRRjhUOEzmYCWfC:yazGnxC1e+6Y4RNXymJW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708070802, "uuid": "908b15ee-e7ed-47ed-ab5e-3b66f5123eaf", "value": 190868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708070802, "uuid": "e3aec5fc-2d13-4146-b30f-82b6a5f5bba3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708070802, "uuid": "b5c6e0b9-5a18-4a84-b0e9-496b5f623022", "value": "huhu.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fb93873-cd22-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SchoolBoy)", "timestamp": 1708125881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708125881, "uuid": "1d8f93d9-47c1-4ef6-99df-b44685445a53", "comment": "Malware payload (SchoolBoy)", "value": "8de49100b064dfce5ae0403ff6c72517", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SchoolBoy", "colour": "#609074", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708125881, "uuid": "701715b8-5828-477d-9606-d13be9e8e989", "comment": "Malware payload (SchoolBoy)", "value": "fe711664a565566cbc710d5e678a9a30063a2db151ebec226e2abcd24c0a7e68", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SchoolBoy", "colour": "#609074", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708125881, "uuid": "7c47f10c-789e-4608-addb-ad81a7b71b5d", "comment": "Malware payload (SchoolBoy)", "value": "281c595207a0046e95985a48f533931651a82f57", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SchoolBoy", "colour": "#609074", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708125881, "uuid": "b6d23a7a-7cce-4f22-a53b-8cf28a4030aa", "comment": "Malware payload (SchoolBoy)", "value": "3bc8d170b0ca92ca72f12cc0db099b18ca34a59937f23ed11fc30597d88e8035aa9d6ad0d3c92292c191e8b88ecdada7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SchoolBoy", "colour": "#609074", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708125881, "uuid": "0c51a941-2d98-479a-9925-d195cc7c94d4", "value": "T1B006F133F245F53EC4AA05354677A694993FF7A2B8598C5A57E0088CCF291806F3A78F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708125881, "uuid": "5c46beea-ef84-436b-94c3-b0fb80a4dc16", "value": "ecb712bfe0d1558ffce8f8c2df526278", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708125881, "uuid": "107c5474-9e8e-49f7-a4bd-f42d77441cee", "value": "98304:8l7UGD5GK1yNEdVMzN4moGbiwTswBnSY1:8l3D5GnEd+zN4moGWGRSY1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708125881, "uuid": "794116be-baed-409c-b49b-14356e60ca1d", "value": 4017157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708125881, "uuid": "17c7d469-9259-41d9-af4d-40781f54b2fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708125881, "uuid": "0ab8af7a-ecc4-48b5-965b-0ef3a15406e0", "value": "fe711664a565566cbc710d5e678a9a30063a2db151ebec226e2abcd24c0a7e68.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }