{ "Event": { "published": true, "date": "2023-09-01", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-09-01", "timestamp": 1693612981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "bcbdb11c-f894-4924-9a47-f48d172beeb2", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da4c98ad-48df-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693583677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693583677, "uuid": "543c5dd7-9b68-4668-aff0-a0e88ca03941", "comment": "Malware payload", "value": "033685e976a78fbd22b3c956542ad1c9", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693583677, "uuid": "3d2349d1-1f70-42bd-9fe2-ac9ec4edda36", "comment": "Malware payload", "value": "016468b087cdbe5123189b68965cb65dc95ba1a59fc3ed32144b92d1274d13b6", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693583677, "uuid": "caa82908-508b-43ec-a018-a926ad42fa52", "comment": "Malware payload", "value": "1cf564dbd3a06f42ddad0042bc968471230f3329", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693583677, "uuid": "c0d96144-d542-4bb4-953e-64d801dfca0f", "comment": "Malware payload", "value": "2b9140ec752400692bfa273d485993cb1ee8a7d4cb0bc08af4678023e3b0c0442f5ab2e7cd59052de82ab0fa72aa822a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693583677, "uuid": "d54e5c0b-f535-4eaa-b7cf-e2431807e868", "value": "T1905413286E22468308AC8C297CF05749FAFC9D48C15DFEEF209FB3AD73A1B456A45355", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693583677, "uuid": "dbe00c6d-9fa6-41b9-b02d-43c7b354669f", "value": "6144:AQgW4DlcWJkY8b6NrGEpGpituH1CyLJFuOOTaK22o9V:AQgeW2Y82Ap+uH1CuFu/amWV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693583677, "uuid": "d3ba24f5-9a60-4525-887e-96791bcf189d", "value": 291516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693583677, "uuid": "0331050e-b7d6-4544-8f91-81f4986d64a3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693583677, "uuid": "960b75ef-90d2-44a1-8efb-3cee4f1afc9e", "value": "Unconfirmed-Invoices.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84fb1999-48cb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693574944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574944, "uuid": "68ed7bf5-6d64-46d7-bb35-44b1c6b4cf65", "comment": "Malware payload", "value": "5348e830d574b34f2a7e11c3a45a936b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574944, "uuid": "9797e456-4dc6-43c7-9220-9e520b6b7364", "comment": "Malware payload", "value": "029ddaba215839fa5a335af0dc9f15d51515873e3761f0c72751502c659e7ea2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574944, "uuid": "f9ed20bc-8a7f-4047-88c7-923ce6dda424", "comment": "Malware payload", "value": "3234802affac5a81d093508c7c71f082de387b69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574944, "uuid": "edf001ff-9f1a-41b6-a249-2f9f07b352a4", "comment": "Malware payload", "value": "ddcbdddcf62ba96349b5eacdb19aa45925ea90da5f451c32f526d677ebf245823b6226c054aa4e2925f853ec84d670d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693574944, "uuid": "c677136d-b112-417b-8418-d286615b9556", "value": "T1F20502EB779AC9F2C1585B3AD2B700035362DE4DBE53D325A85B729A1C733ED2A4410B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693574944, "uuid": "d5ea060b-2fd3-4ece-91b1-32665972026a", "value": "12288:tZEXGRqpvtjPeFrlhh/Of8ZMF3MPpmbGM5OVftG3Me+IVbbocHY8KK/4bGmkW:cvpljP8rFOEZMCp8wftGcyVPYS43z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693574944, "uuid": "2a86e40e-0041-488b-813d-492f57349fa7", "value": 802304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693574944, "uuid": "2c56616c-9056-474c-b3bb-0ab459da7ec4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693574944, "uuid": "eeff0bd6-f848-4ef9-8d09-c9d241232d06", "value": "ADNOC RFQ 97571784.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55883cd9-48de-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1693583024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693583024, "uuid": "ece17ca2-d9c4-4728-9bd2-a0bc7d89752a", "comment": "Malware payload (Smoke Loader)", "value": "94a6c3b42400c62f37c3e09781478ee1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693583024, "uuid": "112fe294-58b6-47da-9130-5544f8903110", "comment": "Malware payload (Smoke Loader)", "value": "02afba9405a5b480a7b1b80ec9abab41e462f8c30567f1926105a63eaf13e059", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693583024, "uuid": "b7f4b40a-1ab6-4039-91ce-ddfd23e77bc0", "comment": "Malware payload (Smoke Loader)", "value": "d56d09178e01a29fe063a0b3a77e94c7de24a6ef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693583024, "uuid": "a405b771-c8a0-456b-ac83-b800d4e099ed", "comment": "Malware payload (Smoke Loader)", "value": "1b8d40181a934fb5e06d550c181e8d5ac573910019f9b2092af6583b8068d0ba0332a982c96b7fb82aa5da70664150a9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693583024, "uuid": "577ebeb5-f362-4222-8aef-24b2bf839669", "value": "T12F84D74382E17D5AEA258B72DF1FC6F8770DF5608E0D7B69A2189E2F00B2176C263715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693583024, "uuid": "032add87-f142-4ae2-adf7-81ebb5c471a0", "value": "66ea1a1f8d77fef0e49a3a72b298c0f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693583024, "uuid": "65570169-6ec4-44f5-8489-d3ded5aa2a5d", "value": "3072:2Pwu1IGdhH2Snwk9zkp+weq7EngB9g7Hznro5OvkrWalKNKLPcOJdxH/W5f:AfdZ2ST9zbweq7zBCzzrPvgLUebH/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693583024, "uuid": "21dc0702-a9ad-4132-be76-c4fe03ce6391", "value": 394752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693583024, "uuid": "97769626-7bb6-409c-8bc4-b85026775d28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693583024, "uuid": "ebc2bf73-3d1f-4397-86c7-316ba4862dde", "value": "94a6c3b42400c62f37c3e09781478ee1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aaefc3a-489e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1693555519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693555519, "uuid": "1c3a89bf-56ac-4013-823d-febca49aa5ae", "comment": "Malware payload (DCRat)", "value": "ae239d86a9a6c5c7624b41b3af7ba5f4", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693555519, "uuid": "3e1070f3-a247-409c-a072-deac0869278a", "comment": "Malware payload (DCRat)", "value": "0490f32d01e376bc73ce39618eab7ef347b480fb5ea113e18d49e2df958e4b63", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693555519, "uuid": "eecd35f4-1dbd-4064-8c66-bd78e1c691f0", "comment": "Malware payload (DCRat)", "value": "2f7a649dbd87dc866a9f2550d5b339002de5b9ce", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693555519, "uuid": "2ead049f-c700-455b-af84-944952e2f884", "comment": "Malware payload (DCRat)", "value": "0f1caaf80e2f6dc9b983d161793b6a1039776a86399a5d6fb97114c8b3e0347d4b403145af7f193c857617c5914dcad9", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693555519, "uuid": "ec609f76-7526-4fb8-8c83-e4ec7a578096", "value": "T160352312FAE880B2D4B53BF058F742D31B3BBE8109B8C7277396795619B20842979777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693555519, "uuid": "5e40dced-e065-447b-a250-64bd41c8bed4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693555519, "uuid": "f294e1b5-d9a8-4f94-be13-12fe5aafb015", "value": "24576:myJdckYFEQaJRgp+6UQHD5XLLme5yeCEWv1Oq:1PVYFzaPQZnyeCEsk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693555519, "uuid": "987a0fa2-cb2b-4f74-9c6b-1ed391b6d26e", "value": 1149440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693555519, "uuid": "471d354d-5cb8-490b-b9b0-313a566fee8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693555519, "uuid": "c652c7b4-b712-4924-a588-0ec8f0cc98d6", "value": "ae239d86a9a6c5c7624b41b3af7ba5f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae856232-4866-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693531634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693531634, "uuid": "49391832-71c4-49b8-b80b-58d4811bf867", "comment": "Malware payload (Mirai)", "value": "f2bbbbb97cf2bbe83b85ccc4524ea4e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693531634, "uuid": "e6a43794-c296-4904-aa11-6edb81cd4b19", "comment": "Malware payload (Mirai)", "value": "04f44d9c15dad887c4c9a38c034e8fc345ef964b6b5b48f2fac363128f7cb564", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693531634, "uuid": "1d1aecb8-15ba-46bd-ba08-4d1314519e1c", "comment": "Malware payload (Mirai)", "value": "e7882cf0f61e78c041574e3dfeea908249645274", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693531634, "uuid": "ab2456e1-c689-4726-a8eb-b84ba0948142", "comment": "Malware payload (Mirai)", "value": "1b68a1b32b229ca618f6f7b3a9b0c7e85ebb63f489ab2a3ae4b8d03f648989aff9dffd34d0c66ae9bce975397fba5736", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693531634, "uuid": "47edd4f4-78f3-4b0b-8eb2-c7df056d59e2", "value": "T1B2C2D0E6E65D1E0ACBFF84B31D91CB9173941F187634C8DEA044F7535A2D9259A02EC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693531634, "uuid": "e3adafcd-75f5-496b-99cc-a7958328861b", "value": "768:1qMkNa3MeiQoOX1UO5sHLSz+4uVcqgw09Z:agMetbX1UO2H+z+4u+qgw09Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693531634, "uuid": "ea369906-d038-4e6e-850e-8bb83493661e", "value": 27056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693531634, "uuid": "8ff4ee8c-678a-4869-bed0-6db8faea9821", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693531634, "uuid": "6286efef-6080-402a-8701-b0898e3c6268", "value": "f2bbbbb97cf2bbe83b85ccc4524ea4e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61c010f4-4905-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693599795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693599795, "uuid": "3eda255f-b5a1-41c1-8b51-09ed6797a1b5", "comment": "Malware payload", "value": "72ee476a03543ec99ce674e0e94f99f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693599795, "uuid": "9986fcf4-571f-47aa-b275-3c5e6471661c", "comment": "Malware payload", "value": "0585e54fe9e2a1db7649a750cfbe7e8f561b67d98c8904c4e85b9083cb3bc3e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693599795, "uuid": "b98e1e20-3749-405e-ba5a-14443a46d5e8", "comment": "Malware payload", "value": "6cb281596b70aa5e5ecb871b9571238159c08940", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693599795, "uuid": "315c270e-20c7-4c3c-8ff7-a30d70951082", "comment": "Malware payload", "value": "a176d927df10b83fe555c6519e50cfc0838293ed8efd2faa77864e56b30de3f187b7bca8f223714fcdc8f02c5ed24ebf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693599795, "uuid": "178882f2-3302-42eb-892c-91a5ab80509f", "value": "T111C43A43D2E17D58EA258B729F1FCEF8770DF5608E097BA962189E1B00B5076C26371B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693599795, "uuid": "7ee2b518-5573-40bf-90a4-d3d356423660", "value": "66ea1a1f8d77fef0e49a3a72b298c0f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693599795, "uuid": "19759030-113d-43f2-af5e-1f08d75fd9f1", "value": "6144:aE32RNe/ylMH2JpnvsA1N88oaDZle6aXSh8rMEuOfNdNHgLUebH/:aE32RhlMHwpnh88ooraXzldVTgLUeL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693599795, "uuid": "fcbbdc08-6944-42d2-907a-db0e9c535a68", "value": 550912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693599795, "uuid": "77948d75-9c03-4ba8-b839-9b81ebdff86a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693599795, "uuid": "ebc36180-9a9b-4aee-8988-99bd4f941633", "value": "72ee476a03543ec99ce674e0e94f99f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfe6973d-4866-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693531663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693531663, "uuid": "f104d00b-8c5c-41a8-8314-a659161ebaf1", "comment": "Malware payload (Mirai)", "value": "df4089a2c26b79bb2a8166718bc697b6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693531663, "uuid": "d858b947-0cc4-4d46-aebd-2e8b76bdc062", "comment": "Malware payload (Mirai)", "value": "06ad89b13360edc4d7c64b4459d89a04d7da658af179a2bab82224c798650a22", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693531663, "uuid": "f76ede9c-6182-4ac8-9c7e-303231fd9fee", "comment": "Malware payload (Mirai)", "value": "67b766107cf239d5784516cce2c785cda5fe31ae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693531663, "uuid": "99c83d20-967a-4464-be24-72134d1f0290", "comment": "Malware payload (Mirai)", "value": "5310a7a15845583a60b3a4acc27dde5384626552a6976156087e02123d06dbb5efb982def5fe14ae8f0942bc661762b0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693531663, "uuid": "311c6c93-5f0e-417e-8e5c-ac07c912a31f", "value": "T16CD2F16C39C5A6EB8C9DCA39BA0F8139304EB4FEB2F59332B705C9475B56240E522D4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693531663, "uuid": "4085de3b-df37-414e-8178-07e1bb112f9c", "value": "384:MJd/PxEDLd2TwcMzP6lowYcEaqsY9WC4t0LomNw2XYyXhUEnDHvhZNyA:+lxKd2NMWxEnsY9OQNwqrnbMA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693531663, "uuid": "2883dda2-5b2c-4e00-a122-adf445988a21", "value": 29464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693531663, "uuid": "6e1c8eef-3f77-44e2-8d00-73f5313d9be5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693531663, "uuid": "400af6e0-fbd7-47cd-ba95-579a2dfe9ed9", "value": "df4089a2c26b79bb2a8166718bc697b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29dd1d03-48b1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1693563624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693563624, "uuid": "00cb797f-5cc8-417d-b5a9-11b0162059e7", "comment": "Malware payload (DCRat)", "value": "c5f9d9dc7e13a940e287e3479dab7c0e", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693563624, "uuid": "f3afeb63-86a7-45f3-ad79-9d9333095719", "comment": "Malware payload (DCRat)", "value": "0761b5edc91f2b038672bd159ddc727621388ce10080adcadba5a8d799916fab", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693563624, "uuid": "677463a7-6653-4e9c-a5b7-54423163fced", "comment": "Malware payload (DCRat)", "value": "f770a67d862f400e2283f94aaf329dac4abc6821", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693563624, "uuid": "76fbefd5-6182-4040-87cb-ec5487b04a1f", "comment": "Malware payload (DCRat)", "value": "db0e9882c8d87bc007719ab8ce5620d33b7dd3441a743c7d43b19cc1d9111dac1029a207427572ae8eed4ea2a15fe3d2", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693563624, "uuid": "0a7b9465-ee84-4219-9492-0c342b7159fd", "value": "T1E2352313BEEC0573DC762B701CF722670B3A7CA05A78935B2F5A684D48332589676B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693563624, "uuid": "ebd88bc6-28e9-4452-9bfc-2a6203e9784d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693563624, "uuid": "69c151c9-449c-4a44-aeb5-7cd46098d011", "value": "24576:mypO10+mOA9yMPoWu/B7DWz1qXNME0V0wHduJdVNvavD:1pWLmOA9yCoB7DWzkXCE0VM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693563624, "uuid": "18f02c44-6fcb-4cb2-824b-8cc3c2783889", "value": 1150464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693563624, "uuid": "e55bdca5-06f2-4257-b3ed-48cfb0b2967f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693563624, "uuid": "28fb0fb9-399a-4b0c-bb7a-663eba379d34", "value": "c5f9d9dc7e13a940e287e3479dab7c0e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "883ffc06-48a0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693556481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693556481, "uuid": "b356f467-bf93-4db1-aa5a-39e310bb0fcf", "comment": "Malware payload (AgentTesla)", "value": "d0516f6fdf58038b85214c6ef2f0413b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693556481, "uuid": "eb51ba05-3481-412f-abe5-0a0f15c027a9", "comment": "Malware payload (AgentTesla)", "value": "078328ca5c518c95e1eee7a379c206516102f342d61906f43ab470fa8f66b4af", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693556481, "uuid": "4c1ccf9e-52a0-4c3f-b220-2cd29138507e", "comment": "Malware payload (AgentTesla)", "value": "ec004bd27bc61caae0e9527e2e71648892f76720", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693556481, "uuid": "96f5b611-fa56-4e66-a560-03e4ae08d6d0", "comment": "Malware payload (AgentTesla)", "value": "737e98ddd9c5e418e2612efa5512bb2a42c8f9f5a498a7f03cc0927ebabbfb1e299215c92961f3055b692b68fb0f751a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693556481, "uuid": "7baf2776-9ae7-4bf1-9a97-61ac87662d7f", "value": "T1F505D1523185ED9ED06729F6545FD86012F8BC8E9131CA0F3F43BA1764E7B8120ABB5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693556481, "uuid": "3d0f9938-b9cf-4f09-b2f6-90f305e1643c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693556481, "uuid": "2284982e-6254-4805-a2cf-be695f0462ef", "value": "24576:aoDLZQpyPywxdl9flpkHTJzdhjwAJ6i880Cb+omd8:aoDLZQu3xdl9tpkNzdSAYTK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693556481, "uuid": "0d707329-16e4-4de3-ad34-9d1456e85456", "value": 855552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693556481, "uuid": "74907b36-fc40-491e-b970-71e5bbaefc63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693556481, "uuid": "4db61e21-c732-4e2d-bc10-2f3406b95389", "value": "62867252.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef6208c7-486f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (KnightCrypt)", "timestamp": 1693535608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693535608, "uuid": "a5388110-73b5-442f-8012-86c6184731ce", "comment": "Malware payload (KnightCrypt)", "value": "38bbf15ad24646c068eedd87ba96dd30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KnightCrypt", "colour": "#81A14D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693535608, "uuid": "b122e1c8-9641-48ec-aa38-fe483f3dd463", "comment": "Malware payload (KnightCrypt)", "value": "08d8bd49d5248a1ceca14cd69f327f6685dbc44887aab5a14eb79c71baa123c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KnightCrypt", "colour": "#81A14D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693535608, "uuid": "594d52af-a954-4613-89ff-5231a9a79430", "comment": "Malware payload (KnightCrypt)", "value": "b8a5d32149bdd5beb05bb32d2501132ca968b989", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KnightCrypt", "colour": "#81A14D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693535608, "uuid": "55f15663-571a-4dec-9f97-36dabed2528c", "comment": "Malware payload (KnightCrypt)", "value": "f8b85f75ddabc6192b3d0ab44113022bf7cee233cba8a39ed121f7b9510344247a6f8d8e9585b78322804e676b8c28d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KnightCrypt", "colour": "#81A14D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693535608, "uuid": "e6184ae7-0f7a-4c72-b643-f48aa7e5e25e", "value": "T1FD556B07B69941E8D43AC1B0CA564332EE71BC950F34A9DF0690B3592F7BEE46B3A711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693535608, "uuid": "975db69b-288a-4022-8f41-05191e49c181", "value": "92ed8fb21c381a073a5e7ca35347f90e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693535608, "uuid": "937706b0-ddb8-4b3f-81c2-472e0a626962", "value": "12288:hBVVtkNBJOlMmXP0447OdMyogfJ7gwPueClVVRWM5YDh8xpoP5ouMA+nkGGCp+sE:STcCG0447AMVgfdnTClVm4Q5cGRmS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693535608, "uuid": "78775fec-e9cf-43c7-8040-0755928e01dc", "value": 1392760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693535608, "uuid": "d63f6d3e-dde9-400c-8385-910299bbab03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693535608, "uuid": "6805f9c3-fac7-48e2-85a4-b7df46231fc6", "value": "SecuriteInfo.com.Trojan.Encoder.37908.28060.21780", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c579a232-4888-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693546276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693546276, "uuid": "81388fea-27b7-4785-a430-8795e1b80434", "comment": "Malware payload", "value": "6bba1bc5885d967d035e5fcfecc8c691", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693546276, "uuid": "0b2102ed-7b51-4768-ae62-5a57f8a094a2", "comment": "Malware payload", "value": "09bd2e123035b018d0b5073425e2f8e98232de8d1ee19560903495fb426048c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693546276, "uuid": "08a21ebc-b953-4770-b4ba-c1ad55c9e119", "comment": "Malware payload", "value": "fef89aefabc44e3cf6938e9ecc5aa7d3a0bc7550", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693546276, "uuid": "ecc2291a-ed48-4690-8a68-6890c98c3da7", "comment": "Malware payload", "value": "f71df5a109c56f7fccca6c9a6339925b16281eec047b9b57b37cefe316e1178a231bb91550c265c22d15a48826bd0028", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693546276, "uuid": "1099412a-321f-48a3-b517-81d1b3f25d76", "value": "T18873D607F92B89F2C684577AC59B41040365E682F393F70AF98E6369148F7EBD90163B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693546276, "uuid": "0cb5f6e5-4db3-471f-b8e3-5b10bd248175", "value": "1536:7X6PYJx38TZmKNrpZkm4Gam4GvcSNiEw0xSgktNuSWcRKRp2VwF:2PYJx4oKNrDTv7IgktNuSWcRK6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693546276, "uuid": "82df246f-4e97-4b21-b1d2-3cab21a256f0", "value": 78848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693546276, "uuid": "a8193fa0-818d-489e-bbc0-d8e46c6c9460", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693546276, "uuid": "a974f502-7a47-4bf9-9af7-b3f5d560a0d7", "value": "SecuriteInfo.com.Win64.MalwareX-gen.20078.11196", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63726647-4921-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693611824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693611824, "uuid": "f1091545-2d32-4080-b27f-6cae23a86d29", "comment": "Malware payload", "value": "3bc7772c454eaab1b0b3e52ad8b3eff0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693611824, "uuid": "8389cc4f-af7a-4154-b9c5-c4fd268781d5", "comment": "Malware payload", "value": "0a418ab7982b9ed6884fbdd61ace096076abb6908729d1b706897ea80114c2e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693611824, "uuid": "24936770-7488-41d4-8c40-7c2315229016", "comment": "Malware payload", "value": "a00db0864f330e788bc54c599894ae3d97b9cf39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693611824, "uuid": "a2fa0b6b-6f1e-4573-a730-366b40cff7ce", "comment": "Malware payload", "value": "3974e7d7843dd789430e6f999dbd1a1887019d344e450eebeee9042034826dc03e66aa1673cc5fe9c1c499fac5ec9c6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693611824, "uuid": "38e31c44-55cf-4fb9-8c7b-d5f47dee447d", "value": "T112A53341D3CBB1F8D0AEDE351C6A9807B2828E5282B2AC7DD17774DB6A73751C111A3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693611824, "uuid": "91243d23-b115-4ef0-a551-74fc8e725d73", "value": "e74c8ae3503a17604f2a2d84ae3389c4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693611824, "uuid": "7300259d-e27f-464a-8e2e-68235591a052", "value": "49152:+iw8WKBpmnht67MducKpPL54UAxQhD7MzrPhDhilI:+iDbBpmnv67MypPV4Txw+DhDhi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693611824, "uuid": "a683e15c-b613-4014-aaf4-049584c6677a", "value": 2078720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693611824, "uuid": "5a749299-db5f-4417-ab27-3320346cddca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693611824, "uuid": "5c7cb88d-3152-457a-987f-9c1c10562416", "value": "SecuriteInfo.com.Win64.CrypterX-gen.6888.31806", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00c6dc3e-4861-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693529195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693529195, "uuid": "9c75b9f2-5e74-46b1-88ed-bf7f2bbaea24", "comment": "Malware payload (RedLineStealer)", "value": "686ab02eb6ffcb31d58c9c8ca19d2d36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693529195, "uuid": "73604ec7-5d2e-4ddf-8fa6-b5c727650d1c", "comment": "Malware payload (RedLineStealer)", "value": "0b830ec86137a0e93bb892190f894830e35ebe4ce18dd5efb3b5124fb63cd534", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693529195, "uuid": "8acbbf31-64ca-4621-a19b-8f6564a05539", "comment": "Malware payload (RedLineStealer)", "value": "1c894794ad123b296979545418ffe0cfc1d86b0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693529195, "uuid": "51b4e5d3-2686-403f-9ce5-b0d8a971fe13", "comment": "Malware payload (RedLineStealer)", "value": "f84d3c2c102d59caf0a8165089a6a97c3637be047312809820a7c1559326e1b31468384f47b69acc014daff2c969c957", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693529195, "uuid": "ddedbc66-1537-43b3-800b-9b988e011e5b", "value": "T1A2052303E7D98437E8F0177048FF038306367DB68978939B574AA4AB0872B95997376B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693529195, "uuid": "b471e52d-0772-49f0-9f5a-6c51f8cc166c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693529195, "uuid": "77b08655-9bab-4d6c-9d46-9f0eb82fe5c2", "value": "24576:ZydcAlZrQUg6KnO5U0nV9O1IcZxz80qodvpIYBG:MhlVQUgDuU0nLO1nZW0qo9H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693529195, "uuid": "29306b0f-c07f-4fd4-a8ac-2904e4fca25f", "value": 846336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693529195, "uuid": "f860fd1c-17bb-45e7-9561-662f2121c0fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693529195, "uuid": "406e591b-8ca1-42bc-bb1e-1fb261ddbc35", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad21e0ee-490e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693603787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693603787, "uuid": "8e7238f1-69b8-4ff8-8229-b4bdf5db55f8", "comment": "Malware payload", "value": "56f093195c2d94fc9ac5d7738d9d53b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693603787, "uuid": "08686757-5a29-4563-a884-dd939922421a", "comment": "Malware payload", "value": "0c40ce0b3135299434d0963480b3b12108e45019c56739d6c9bb3b1272d5497c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693603787, "uuid": "37814678-b297-41c3-83a0-874bd5b5cb36", "comment": "Malware payload", "value": "ad3b26f8b8a5b1208047b9e0cd8748b21b585f01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693603787, "uuid": "c0d23681-cf18-4f26-a7b1-e1eb4764c51e", "comment": "Malware payload", "value": "3e10e6e88c6db358c41357ce4eec53ca011543d6504420ff3f7563e3249c45421f84295566524f58a93ed6ee2a96b68c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693603787, "uuid": "0188cfe0-c120-43fe-bd8f-a052f90cc489", "value": "T1CB052302DBE98422D9F62B7485F207831E34BDA25CB957677319581A1CF3BE4B832727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693603787, "uuid": "1a113a90-4a08-4b0b-97bc-5baede522508", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693603787, "uuid": "d1a24264-2491-48ef-9d0a-04871898429e", "value": "12288:VMrPy90K7MaqQq8FXPzGySGQKXIHat0bzjd1h3ev990fTKEcM4pPVLiQ2djf:2yHJqOFUXA0bzjdLs90bKEcRp9/Wjf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693603787, "uuid": "88909415-d336-469e-9c84-511dcf7de4d1", "value": 842240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693603787, "uuid": "92afb92d-fdde-49df-9b11-fddd42fe1c73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693603787, "uuid": "237028ca-eae4-4a0b-8eb4-58c0a21ca398", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b22afb1-48c3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1693571518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693571518, "uuid": "95553381-4345-421c-93f9-520f7958c513", "comment": "Malware payload (RemcosRAT)", "value": "99e699809de0ea723d5f3ad3aeb81f13", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693571518, "uuid": "cc9fa75c-6895-486f-9a5b-2fd104c1bb53", "comment": "Malware payload (RemcosRAT)", "value": "0c6fe2c0d46a37a9bfcad2e6716351ad62497bf91484be42f7928a539de29c42", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693571518, "uuid": "2eb5d1b2-0922-486a-acf5-8ee5a314942e", "comment": "Malware payload (RemcosRAT)", "value": "6806cdc0f8d61ab1a36e60f74c725e6fc0ba0096", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693571518, "uuid": "3fdcf214-c776-4c01-93a8-14e2a1b5ffcb", "comment": "Malware payload (RemcosRAT)", "value": "7fd516e122e5e7d5716b76de00574809f5f962b771dc4969fff9e57ea575988411122afcda711288eb46209e6f67e731", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693571518, "uuid": "bb4210db-4919-453a-8f0c-ba58063cf9a9", "value": "T1F4E3E837B65A85B2C644573AC797600403E7E781A2B3D70A398ED35E5B033EA49CD72B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693571518, "uuid": "c6734fa2-3e47-4c48-b2be-abaf1c93e747", "value": "1536:mNqFIZsnSJ/y3VbGBv4jMZ5LGKqn3LvMM/vnwhxgY3H6K+i3:wsSJ/cCuwqTnwbgYX6Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693571518, "uuid": "09916050-014a-4302-b2b5-46e4ea5d7b2c", "value": 143360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693571518, "uuid": "0d9a6ed3-43d3-451f-81ae-c56c96920aed", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693571518, "uuid": "251755f0-7019-4680-bf9a-ddf400079ac2", "value": "HB23090003.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e992fdeb-4910-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693604748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693604748, "uuid": "44d2ef09-9165-43ba-8884-be85a85ae326", "comment": "Malware payload", "value": "3046494fcfbe90eea5b692fb8b752b36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693604748, "uuid": "719f155b-dac9-47df-9b18-ca1418068a55", "comment": "Malware payload", "value": "0c744dfee7acbaa52ab1fc1c1dd11abe966ea1702585492bdfeefb64d8471412", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693604748, "uuid": "23fcee95-01c2-4e69-b080-be9a865fde63", "comment": "Malware payload", "value": "5218623baf563b99ec2073fa4be7e6f0c4088939", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693604748, "uuid": "68928f58-8d11-4e9d-b46b-cadef918f507", "comment": "Malware payload", "value": "40b11887532131282c529ea3bbff6ea723e72c2ef17494df9cdc836be5382361c9f883f589ebfec51027be3642083ea6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693604748, "uuid": "4a14045d-0827-4ae7-aed7-95ef174457fd", "value": "T16984D743D2E13D58EA268B729F1FCAFC770DF560AE497BA922189E1F00B1176C263715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693604748, "uuid": "4dfb704b-a9b0-4915-9d3c-f9ea074e3fc4", "value": "05ee59df2bbc43c078e8ef99811a7d49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693604748, "uuid": "d37f040b-f164-40d5-ae41-bcf0c2e1ee02", "value": "6144:8TwGNJP+4aO+3qz+/WpNbD/GQtd3fpvMdOgLUebH/:8TwGNJt+azXNbDpd3fp8OgLUeL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693604748, "uuid": "f9488fcc-66c7-4045-af67-88ea7d7625ab", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693604748, "uuid": "32943649-43ec-46bc-8887-f282e1982556", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693604748, "uuid": "55d1d9e3-dfd6-467d-b7a4-ef03bd89007c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e3d1c73-48e4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Glupteba)", "timestamp": 1693585697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693585697, "uuid": "fab71a9a-4e2e-42e0-a9f9-30a05a545660", "comment": "Malware payload (Glupteba)", "value": "1d80dd9f0e5db1a685c6bb9e9a91b222", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693585697, "uuid": "c121395e-026c-4a3b-a9ea-2569158b5b95", "comment": "Malware payload (Glupteba)", "value": "0ed14c1e8965c13065a00f7d3159a4c711faa24643b4c4815e88299cba495ba0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693585697, "uuid": "8892fa0a-8763-4afb-b341-018adde0e4ae", "comment": "Malware payload (Glupteba)", "value": "cbaf6eb478cfaac67372a130f527c63ae4dc496e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693585697, "uuid": "b7d4a308-7794-4ad4-9649-75b5a5a033a4", "comment": "Malware payload (Glupteba)", "value": "b592e2b3b3b4d025dda06068657a5776ee86688b156852296653b4b22427058fefad5637af3dba30adcea6f4d0959c10", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693585697, "uuid": "6f3c4a22-1e5f-4df2-8873-79b4cbcbd671", "value": "T17226228382D17D68E62DCB739F1FCAF8762DF5609E197B6922289E5B04B1073C163352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693585697, "uuid": "8eea8dce-322f-4dad-bea7-0ca39fc6a0e3", "value": "66ea1a1f8d77fef0e49a3a72b298c0f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693585697, "uuid": "487cf892-069d-4cc2-bec5-8ad21a6983fb", "value": "98304:dxb902OlvMVLD1fTBjOy7TiWlrDfASFqZL4A3KmFn/K0p/7v2/gLB:dxq2OlUV9fUkT1BYEqNpPZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693585697, "uuid": "cf6de556-f699-4881-b5dd-810cb2c42e86", "value": 4474240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693585697, "uuid": "276ccc7c-2a47-4f62-a01d-627892f261de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693585697, "uuid": "60e7f969-59ee-4295-bf4c-9e5a9e07f75b", "value": "1d80dd9f0e5db1a685c6bb9e9a91b222", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6be77c3-48ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693597442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597442, "uuid": "47c50bfd-e965-4740-acad-eba647a2aad5", "comment": "Malware payload (Mirai)", "value": "e379f4928aa034f450f38f361485159d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597442, "uuid": "055b1c72-6042-47bd-88b6-176d160a4acc", "comment": "Malware payload (Mirai)", "value": "0ed8a8d2bcd65b50c2fa0d828ee5c05c41f4b0b920bd2de9cea162e14ddb8041", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597442, "uuid": "5e7c3dc8-d0b2-4a13-a5a8-9d3e9f4bb730", "comment": "Malware payload (Mirai)", "value": "984d5c53bd261fc5a92848b7c3aa3cac5166c7f7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597442, "uuid": "3ded8c9d-c505-4590-8f97-4334853d951d", "comment": "Malware payload (Mirai)", "value": "637989e26308ed80bb75ec64d350c0b9c62f446490aa6177e9325280314946a93206346fc2775fa3bc1c21a3e1fc1ef3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693597442, "uuid": "df18956e-b899-4b0f-91fa-c4957dbb639c", "value": "T134E32A30D4504B17C2D213FAA79E825E3F221F9793DB33115B38BAB41FE279A1D69924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693597442, "uuid": "a90e0e6f-69af-4656-86f6-00f163499817", "value": "3072:Cv/WwsLgaq353qHiCOvhOp8qkDQHbeskmhxQwoVSUNu:KPLaq351hOp8qkLskmhxQwoVSUNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693597442, "uuid": "51960f0d-50e7-4e11-8887-fe80359cdd66", "value": 143019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693597442, "uuid": "4fa52d97-cc48-4f67-bd6b-d3f09d0a23ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693597442, "uuid": "214cd72d-6e4c-4ab8-967d-ac62bcd96102", "value": "e379f4928aa034f450f38f361485159d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e30ccaa-4905-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Vidar)", "timestamp": 1693599789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693599789, "uuid": "dfe10016-7d77-4bdb-8043-d8ae5806ff0e", "comment": "Malware payload (Vidar)", "value": "1ac8badb0d90cc9b48dc953bf9ef5353", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693599789, "uuid": "cb3ebbef-c8ae-455c-a762-c87d4841a231", "comment": "Malware payload (Vidar)", "value": "0fa308dbeca68c5692a1040f4989a8c8379261660240e9d693e65283bcd987a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693599789, "uuid": "3ad3ad69-cfea-4527-95aa-ae9fda862fa9", "comment": "Malware payload (Vidar)", "value": "13628db9c29d8c57498b90859a0debc6a6f0ea72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693599789, "uuid": "81aad214-103a-49f6-bbe7-0d18c80062ee", "comment": "Malware payload (Vidar)", "value": "1231792059fbc72c22a639f476f5683bb0f28ede1a2d552c07f84fd4edfc74b645c4ca3558fa378b2ab73d7bea4b3b7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693599789, "uuid": "f3f582cb-fa12-4cac-92c5-85330cd0c639", "value": "T15DA4E84392E13D58EA2D8B729F1FC6F8770EF1608E497BA922389E1F04B1176C263715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693599789, "uuid": "70f6f283-be56-41d6-ba0a-ddc041d41846", "value": "66ea1a1f8d77fef0e49a3a72b298c0f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693599789, "uuid": "ecdedd2f-e6dc-43fa-be32-35fd8e1a7427", "value": "6144:TJpMzhbM+15BgpsU+Q5/q6re258ARpgLUebH/:TJpMzhlQy6yXAXgLUeL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693599789, "uuid": "0b7a0bbe-ba9b-4ee7-ae33-5c63a4cbaad1", "value": 457216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693599789, "uuid": "6debc5f6-bcb9-4e21-84d6-57a4927e57fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693599789, "uuid": "d03522c0-1913-4942-b377-de0b07c99cc4", "value": "1ac8badb0d90cc9b48dc953bf9ef5353.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5633e5aa-48aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693560692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693560692, "uuid": "d3659359-115f-42ca-a578-797f77268380", "comment": "Malware payload (RedLineStealer)", "value": "e785b8d686d97cea7f16ee1ff56dad95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693560692, "uuid": "0217e57b-1e5f-4358-ba33-9efb79581cfd", "comment": "Malware payload (RedLineStealer)", "value": "101fcdb29f0d4e59a8e988bf22b66e11a589a9aeeadfb657ec3d25ba75bbfb0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693560692, "uuid": "2b7700f9-254a-4893-bf46-287d7cfaffac", "comment": "Malware payload (RedLineStealer)", "value": "c4383cd67e8707e54619db399931e4f40b823102", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693560692, "uuid": "b96bd69a-183d-491d-8cbe-8a5f915459fe", "comment": "Malware payload (RedLineStealer)", "value": "d47dbe64f3d9d54235c31fa49c580a9c4569160af1cc720f14fb8e2ea44f396f05fc3699cbcf234735cdc21210be977e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693560692, "uuid": "d6f44352-e52e-483b-8611-3955fb60910b", "value": "T14A9417B73E465CD3E7617D31ACA14FB0818C31EF4D7A27CA27D9C2525FB6AA44922C09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693560692, "uuid": "13012fa8-af86-44a9-9d22-0c685e705791", "value": "79949fb04969b0ad00a160f76c9427ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693560692, "uuid": "c81ad591-5c77-4715-9867-0470df3806a0", "value": "6144:xe6AjjfhUhIjeNhvWAQf4DtdqUoSCdqVJEDlJeZv4eDRsXM:xe6yNjAhv04ZdqUoIEDlJav1GXM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693560692, "uuid": "44cafbf3-67f4-45ee-b6e5-9b48f52300bd", "value": 439808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693560692, "uuid": "a61b8f9d-076d-4543-8419-afce14486016", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693560692, "uuid": "2e32e164-ac88-440d-bb12-246658eeb48c", "value": "SecuriteInfo.com.Win32.CrypterX-gen.29675.21385", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88fdc18c-4902-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693598573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598573, "uuid": "14219549-7394-46ba-b59e-a0b9c4350c86", "comment": "Malware payload", "value": "fdf8a604286d2d165b6d95dbea197131", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598573, "uuid": "b5a5ecab-d831-4af3-9933-53a315407032", "comment": "Malware payload", "value": "119f49a91b9d90c0ac224496d700547501ef5ab05d21b5918620a00f722950e0", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598573, "uuid": "8b7ac472-0cdb-459d-8565-2a1d61387b72", "comment": "Malware payload", "value": "b7169697b21d167edd3a18db6eeea81b0c311991", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598573, "uuid": "bb452b52-ce13-449b-a56d-0aa8f0ef0022", "comment": "Malware payload", "value": "15efdfe874989079bf0f1126d2dd4ddcca87b26a30bac69246fe015dd380989d21d9e126d190d77a4261346507caa423", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598573, "uuid": "d5a89e22-a139-4e30-b72f-5c224783114f", "value": "T1FE41E10533D86716E3BA4E3680B7F34546357861EC2AD79E42D492CC6860B04FC72F1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598573, "uuid": "2910ffae-b34c-41af-8c4f-4da51c288221", "value": "24:83OJ5DGW5kGOAxx+/FAPyu+/anxnxs4I07CLyUWIm3Aq:8291dl7lpIWYWI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693598573, "uuid": "6c8ec926-25a6-4241-b169-c486969d09d6", "value": 2211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693598573, "uuid": "828d8955-84ff-4cc4-b183-6177464790c3", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598573, "uuid": "df8c0895-b185-4651-b1d0-16a32902be8b", "value": "lebenslauf_20230808.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "290fd590-48ca-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693574360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574360, "uuid": "bf5302da-38a6-4e02-8cde-cae53ee3427f", "comment": "Malware payload (Mirai)", "value": "0c53b2368f9c8d97556fe8c070a857be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574360, "uuid": "c7755335-d0e5-4246-8b7d-8dfbdc58d0f8", "comment": "Malware payload (Mirai)", "value": "124510d9e126585415722e3744d263de4392fe90f4466da9a07dd9377de03a86", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574360, "uuid": "ba56ef1d-eac0-49e6-8d7f-5f3253790224", "comment": "Malware payload (Mirai)", "value": "af6456db04b6beb82b777446eb84ab04ac2f1cc0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574360, "uuid": "390c368e-95a1-459d-9163-f34106901e6f", "comment": "Malware payload (Mirai)", "value": "b717b39a069d02e1f955daf9a6f56da13da5b37900b186b687b6f9e0cc5f693491c1a503147e8620fce96551627d638a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693574360, "uuid": "ec3ba541-3ef0-45bf-9f4e-0336e93c4e05", "value": "T177539FA5C5ACAE58C71441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693574360, "uuid": "a44693e8-d35b-4025-8d85-d2965ba851d9", "value": "1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwN0T0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693574360, "uuid": "7d20fc78-cd41-4fc0-a1e6-728825b46c1b", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693574360, "uuid": "44d1a53d-5e41-4a56-85b4-c433074d426d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693574360, "uuid": "65445fb5-9e28-415e-a1e4-04e114f5311e", "value": "0c53b2368f9c8d97556fe8c070a857be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6feff7e-48ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693597415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597415, "uuid": "a09d1048-da0e-466b-a9bc-a193b799fef6", "comment": "Malware payload (Mirai)", "value": "c85af2fc764c62dad2d107da460dce6e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597415, "uuid": "e28443dd-d044-43f5-9353-1025fce83eb8", "comment": "Malware payload (Mirai)", "value": "12f84e4eab411366e4a9adcd3ac1ae92714c9d405670e10fbfb3ff1167b2ebbe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597415, "uuid": "91bb43dd-a601-46de-9bec-daf232d7f07a", "comment": "Malware payload (Mirai)", "value": "42706af38e54e7f8c777092c8f0b77ae5203e31a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597415, "uuid": "19dfa633-fc16-407a-a95f-11079bdef391", "comment": "Malware payload (Mirai)", "value": "c9a41c4af3d482c80fbf073a172106622e616b8a547ed37824f2a7e773502b24d0904faf4080379a375569d49ab52265", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693597415, "uuid": "39b6b186-c9e4-4118-b141-3e05988096e2", "value": "T179A3F831A641C973D04305F212A7DB660D32FDBB1A6AAE56E32C3CB0DE360C5B565E9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693597415, "uuid": "1c29d83e-7063-457a-a979-467521b30636", "value": "3072:VK1z13U6HzHoXRtmTUhQogyEmmFVcqq0GnDZT:VK7DDeKlogyEmmFVcqq0GnDZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693597415, "uuid": "9d76fade-ed5c-4afa-b4ee-306f1bfd2a8c", "value": 100042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693597415, "uuid": "df777632-c4f0-4efb-a42f-8d5adfa0a8d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693597415, "uuid": "4ec11cb1-013e-46bd-8c4c-0d5446390a9d", "value": "c85af2fc764c62dad2d107da460dce6e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff8eb877-48ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693597483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597483, "uuid": "80c66337-226f-4578-b4ed-9564995df5cf", "comment": "Malware payload (Mirai)", "value": "6ffd23cb3b51c117ee691a5bd1a63307", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597483, "uuid": "d9c4f172-1a8d-4323-a4b9-5090c3b30ce7", "comment": "Malware payload (Mirai)", "value": "131aa9fd79744724bf1a4157151411fc455bbab0a4adbb02c8775bfab8058a0c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597483, "uuid": "b8f4ee9b-7e38-4310-b074-8358ec3cdddc", "comment": "Malware payload (Mirai)", "value": "d2474c42561e8d999d2fe31e3b22c139230023e5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597483, "uuid": "a2d7e98e-40dc-4eec-afbd-c0124a020515", "comment": "Malware payload (Mirai)", "value": "a9369fc15dcd6a58a34b3f65bd93da4690c087762f51ecd19ccb754bc1823476023bf979b3ee15295783fcb33bda42c6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693597483, "uuid": "7e1ba843-7cbf-4904-be2b-c600ed4c49fd", "value": "T1BAA3F872E643CAB2C4430AF201A7DA6B0D21BE6B0A7A5A85F31C7CB09F334C57655F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693597483, "uuid": "cf8a80fe-672f-4487-a01f-fc620f7d9d87", "value": "3072:wW8FUmgujld6Mkxm6AJ+4f2HmmFVcqq0GnDZT:wJFv4Lm6AJ+4f2HmmFVcqq0GnDZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693597483, "uuid": "ba5e8dac-0cc1-459a-b201-3967d3f62475", "value": 104138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693597483, "uuid": "aedc8441-2d57-4b3d-8682-f2c91f5190b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693597483, "uuid": "001826bb-6c44-4736-88b6-fdbd5376ae8f", "value": "6ffd23cb3b51c117ee691a5bd1a63307", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eb2c05b-4876-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693538426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693538426, "uuid": "1b1278a1-8807-4847-9ab6-1b7b39da56de", "comment": "Malware payload (AgentTesla)", "value": "a8f0dd45a224370d627a3c583f988c69", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693538426, "uuid": "6b1a47dd-d3c2-4846-9a41-5d8b2c34ba4f", "comment": "Malware payload (AgentTesla)", "value": "13f42936315ac387d6e73817bf166f25d29797095f6b2ad3c16197132391efe5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693538426, "uuid": "b9809592-b34b-4ab4-b16b-e28ff22995c8", "comment": "Malware payload (AgentTesla)", "value": "9c85e227dc4f0d7f06b141b9372b0b8f7b5f6e12", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693538426, "uuid": "b6b1429e-d709-4f43-877a-d5b745e7be6c", "comment": "Malware payload (AgentTesla)", "value": "ab1d0dc6e1d094b0102ede2f89d94a7893bd4d42d60f1f1b0d5a87f9539d922edcd76d7b9279e979dc77ee13f20836a9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693538426, "uuid": "63e86295-1343-45eb-8bad-e0c6547f5354", "value": "T13EA423FCE859EC27F6513DA491E0D19AD7015392BDB92EC3A27A4A4CDA31FDD4C248C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693538426, "uuid": "416c7788-71b3-4c23-91b1-0b5d940d48a7", "value": "12288:6P5LDw+RmSHfU8Qrx/OTaYnDrvTEorkvHm:6xLDw+RmerexGTaYDrvlYm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693538426, "uuid": "ecd5438b-8215-45d9-af6a-37f664475853", "value": 484528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693538426, "uuid": "dc4660b9-1d05-41d3-b92c-9393deba9cb3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693538426, "uuid": "eab6a188-55e2-42be-93d6-c42983bb8b01", "value": "708e198608b5b463224c3fb77fcf708b845d0c7b5dbc6e9cab9e185c489be089.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34d9bcb5-4905-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Arechclient2)", "timestamp": 1693599720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693599720, "uuid": "604d2e1d-c349-4ce0-8d1d-0e3cfe5253d4", "comment": "Malware payload (Arechclient2)", "value": "08bdc43521f668dcb513e885229c1882", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693599720, "uuid": "6f198fdb-4c36-4db9-b977-a7fe005d4b62", "comment": "Malware payload (Arechclient2)", "value": "14960898c1d93223a3a32e7ae886e693e178ec0b2ee6ba23821bdd966fa8c4ed", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693599720, "uuid": "bb4b9647-f1c5-48d2-ad1f-9354851b6acc", "comment": "Malware payload (Arechclient2)", "value": "5a42068786c693f12a05a6c5d2919996aaaee989", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693599720, "uuid": "a3d8c6c5-8a7a-4a5a-9464-28d6a3d1b070", "comment": "Malware payload (Arechclient2)", "value": "3599ab6d3322ee7354a816c20c1413d8280c6bc0102233f9cea92e8dd7478e2314754483dea543f55c8a7f3d44e58a9b", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693599720, "uuid": "f22b40e4-dc0e-47d5-b736-972deca00d7c", "value": "T1ABD533E1D268396FC6250DF341A237462B115D5019FA06C93BAD73BA3F3B40FE6D2299", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693599720, "uuid": "1e7164c4-cd7f-434f-b46b-6a33475a838e", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693599720, "uuid": "902dea8e-3188-4695-a37d-83aaaa81fde2", "value": "49152:WatUoawh5iWr6hSuc4fxP35asuec+m4IkGkvG8xQYp1UQ:WOprx6aC30DyIjclyqp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693599720, "uuid": "e09b8a15-7a8e-4d15-84cc-234fe1e54450", "value": 2787840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693599720, "uuid": "014bf60e-0c07-48f5-ace8-c29dc13318c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693599720, "uuid": "a59934f1-5d46-44d2-9fa3-44ae3e9c9555", "value": "08bdc43521f668dcb513e885229c1882.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03a8d55e-4900-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693597490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597490, "uuid": "b27be9b6-dadb-46da-835e-c54fe733da75", "comment": "Malware payload (Mirai)", "value": "88668f73e4ed6b178138f506e75892e3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597490, "uuid": "6b258123-02ce-4f9a-981a-b34c4a864962", "comment": "Malware payload (Mirai)", "value": "15380764b4bcb5d39f62ef822a7c4cd0414a004e6cd80ef7a34aa7f63921d037", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597490, "uuid": "20243274-294f-4082-afd3-cf99545e366d", "comment": "Malware payload (Mirai)", "value": "ebad5bbb658a4b0c2985331417a58768b414c64a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597490, "uuid": "b2ae24ee-1c09-4274-bdc6-f051fe213444", "comment": "Malware payload (Mirai)", "value": "2d3eb71e387c2a0a9d1fb1666ed73b7997a28e2958ceb367fa3a664b785972e6dc77d1cd4d89208dd771dc4c20938081", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693597490, "uuid": "346f56ce-8247-4036-8c5e-33b388376302", "value": "T13EC3E730E8044B1BC2D223F6E75A869E3F351E9797A733155B3879B02FF27991E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693597490, "uuid": "1f01db40-7cbe-41ca-b452-1400e1c2d31e", "value": "3072:4jDy/+mh1vtbPIKa2bpcUPium7/L7QsvmGfIiNb:mOJ1vxfa2bywm7/L7QsvmGfIiNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693597490, "uuid": "0d30e1d6-f72e-466d-8ecd-5539060b30ac", "value": 125008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693597490, "uuid": "5275f70f-d9e8-4769-b562-e344a19e110b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693597490, "uuid": "ac90f866-4367-4344-9014-bcdfa15bf7eb", "value": "88668f73e4ed6b178138f506e75892e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94a2f7d5-48c3-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693571534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693571534, "uuid": "608359d9-b89a-484d-a4a0-2ed892722755", "comment": "Malware payload", "value": "a8052c2b12e95eee0a52138ff9102978", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693571534, "uuid": "0a5aeb70-9392-4e63-8479-313f5cc895ce", "comment": "Malware payload", "value": "156152f54f312319fe549334dd30b95ee2da25bec25d9f35eeef4ce9ef6f6c07", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693571534, "uuid": "2aa023a8-bdd5-4c4d-a0ee-40c5ef1cbd54", "comment": "Malware payload", "value": "c5d84e5e33b7248e489a6735d89d3a541271041b", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693571534, "uuid": "9aa90fe7-d70d-4ad8-9288-9a3f9265bb74", "comment": "Malware payload", "value": "0ed32f7d21ee358120b777194e4243dac0f4974512aca567649014fb768be245d5dadbad2d528d66900f9b9586c5f7a6", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693571534, "uuid": "b9985cb8-dedf-4d50-9a13-4a6944234a8b", "value": "T1F333E134C6C35C19CF1AD838521821F6D28C7973C985D875782896A85F437D74F9EB8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693571534, "uuid": "7a224076-49b9-493d-a8ca-5171237a6ec0", "value": "768:BjiBECISvMTh3X5zoD0j9R1Zqdbf+PXJJVx0C6Jw5WZyxy3IZXrRc9Z5gy:B+EmElxjSdjkJJViC6JYWZyxyYHc9Zt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693571534, "uuid": "0f52f415-71c2-447e-b739-09bd0591a257", "value": 50648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693571534, "uuid": "30047de1-1199-4356-859e-721f1a85c314", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693571534, "uuid": "657246cf-1111-4f2c-ac1c-511bb89fbdce", "value": "Bultman Genealogy Running file%0D%0A Final Sept 2023.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04f2581e-48ca-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693574299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574299, "uuid": "9f22a572-cd69-4bf4-bd14-b1263c664516", "comment": "Malware payload (Amadey)", "value": "beb2e8773837d5eb4747d5a3bb7b9055", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574299, "uuid": "9a52f807-8f43-4988-914b-611a7237f046", "comment": "Malware payload (Amadey)", "value": "15f64ac14c10595ee75d3fc25730c0498a1a8ac794ecdfbe5a8cd75c1a61d84b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574299, "uuid": "5ca5f35d-7cab-428c-b07e-91984974a05f", "comment": "Malware payload (Amadey)", "value": "8830b745cea26f01c268b642fbaafee964cc52c6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574299, "uuid": "c3a44cc4-cbac-43e5-b024-d2f2467fb154", "comment": "Malware payload (Amadey)", "value": "71f7a745befbfd21b14d99c614f1556aa481fda272b955991576527f63d6279d0fed6e9ea0fecd17b8a1d56f621b334f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693574299, "uuid": "9d3de48b-ba1f-4d37-86e4-fd4389503bd1", "value": "T1F7051217FBE44433D8712BB058F603931E36BD625A35D31B2746A86E0CB36D0A571BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693574299, "uuid": "136142a9-187f-4521-bb61-4d19a22261c8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693574299, "uuid": "a288cfbd-b2c7-405d-82fa-a3ed6da43f64", "value": "12288:JMrDy909cHxUZ9Nly7p68uj0xuonhbCJ/zsAlXM+Zj8R1xHOqXBZp8FZaO:GyvjuYuonhGJ/z5lXM+Zj8Hoqxv8FZr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693574299, "uuid": "d14f81f8-c37a-47ac-9867-24d10e4c507f", "value": 849408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693574299, "uuid": "6e22398a-6566-4046-90b4-6caa26b3c13e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693574299, "uuid": "340fbe92-4bff-41f0-86ec-de40b3b89501", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ea8a5dd-48dc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693582261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693582261, "uuid": "b115e740-2058-41e8-af72-b1c9805151b7", "comment": "Malware payload", "value": "30024851af06e8771c12c65abf94b86e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693582261, "uuid": "e32cef28-c73a-4682-b16a-3099bf197763", "comment": "Malware payload", "value": "1625c90e0b9dc6813f1c069e8b6eefef6135ce9d7d684960b424e5b9cbaed879", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693582261, "uuid": "da3a0156-87c2-4a96-bf0c-ff9a6ff39e62", "comment": "Malware payload", "value": "198162a655afe3225a652f96ea0b0084df743b67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693582261, "uuid": "ceacabb8-10a5-4dd7-b74c-f38044e9c241", "comment": "Malware payload", "value": "c192db8fbed8394f87198e6ba3225d2c3f24ff6b49b0596429c04fa494e93f87d62466486e157bc7387381daa9272dfa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693582261, "uuid": "b9971d75-376f-49f7-962e-89e8a479c474", "value": "T1AEE37B1135D180B0E5B302768AB9AA51567DFDB10BA656CB3BD80E8D8F741C0BF357A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693582261, "uuid": "d934e73e-ccb1-42be-b039-4820b8429aa3", "value": "9a58fc00e30ef68c11185d72a515672c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693582261, "uuid": "08a64e8d-0cbb-4575-a1c9-2f2e6ca94d99", "value": "3072:Iv2wwSUdu962JRr8U5K+DJOZPd+c99/uVh:Iv2BSUK62JR4eKcOuVh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693582261, "uuid": "b7792273-1be8-4208-82b6-f8220e730d3d", "value": 151552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693582261, "uuid": "e08482ef-14dc-4fea-a9fc-0cf92d13c0c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693582261, "uuid": "4f5457e6-848e-4ef6-8f14-2b5fa79b43e2", "value": "SecuriteInfo.com.Win32.InjectorX-gen.21021.23248", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3b79ffe-4862-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693530005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693530005, "uuid": "90fbe376-0989-4532-b2fd-551a22728af8", "comment": "Malware payload (Mirai)", "value": "b3ab00a7c2ab4586aa2360593582dbd2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693530005, "uuid": "73e4ffc3-70bb-4e4e-be08-8757d745292c", "comment": "Malware payload (Mirai)", "value": "1876ff4c3005e5ba6b5c925ac6defb85956c624e288aa37c193bf1d42ae333b8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693530005, "uuid": "90e3ddff-6893-4a97-bacc-3c9a220d9a9a", "comment": "Malware payload (Mirai)", "value": "41f72e56a0bb0d8d57c7b2affdcc5bf6cd4f8508", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693530005, "uuid": "1ee70c45-6d0e-423d-b604-5a3131d315ed", "comment": "Malware payload (Mirai)", "value": "a6c3597c0beb08e2918cbd3a5a9cb98574683bade979b89510426e0b200bacaf6bd0db56c4bfc5df0ee39c665c917418", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693530005, "uuid": "9b7eea03-d8b0-479e-957c-106a4c9c33d3", "value": "T14D33F291806E9DB5CCB02D75D89459E07AFD1A6CF58BB32FBA049AC130C71976FF4048", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693530005, "uuid": "faadd16a-6b41-4e9a-b1b3-7b89c392c0b8", "value": "768:LEbPpQwNueqlA/gS8wgXFuCAIDRFLoBco0eZ9q3UELjCHVIpH3UQJc2ZVYCYjK04:I+wg7A/ww96joWLm1IpXVJc21+3on1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693530005, "uuid": "c99d610c-00dd-4169-bf8d-8fadf75e35d2", "value": 52524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693530005, "uuid": "cdd7da8d-9a22-4fb4-a7d5-2c32bf596365", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693530005, "uuid": "ffe71e9e-0a2b-407a-ab75-231ad82dc12b", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "499cb6c9-491b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693609204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693609204, "uuid": "3c18230d-4a93-4c7e-abaa-cc7107399f61", "comment": "Malware payload (Mirai)", "value": "89c63deb77a41ef41b1cf1ae144a9b1e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693609204, "uuid": "1a8e94c9-4066-46ef-8f72-c1163f127b4f", "comment": "Malware payload (Mirai)", "value": "18c7d57cf690e5210eff413007b36d2948c786a68765f2a1a48dfe03a55587ad", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693609204, "uuid": "68a6e46c-0ca5-46a9-8cb2-f775f7e2f211", "comment": "Malware payload (Mirai)", "value": "b2f66d0a4a97e17f14df4ede01fef9efaaf032f5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693609204, "uuid": "d9f675b3-94eb-4746-a0ea-5c523a9f2997", "comment": "Malware payload (Mirai)", "value": "f3536ca8d51cc37172e7305b5e1b7055f3809102dd3192569ba926975567f9c26098c7e73af30cf452918948782e52a0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693609204, "uuid": "7ce61b31-b5cc-4bff-97ab-ee70a7717f48", "value": "T109D32A46FA414B13C0D6137ABAAF42493322A7E593DB730699285FB43F8679F4E23D05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693609204, "uuid": "904dd57c-21f0-4273-ae53-f1ede2076c14", "value": "3072:VZtkw99/vJovIyqASmYu2bWk7YXsD8B9M62Lz1M/96N9I:VZtkw99/vJ0q1Bu2bWkkcDSC62LZM/9T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693609204, "uuid": "6fa20683-0aa1-49cc-a2aa-2183c5fffe48", "value": 142396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693609204, "uuid": "ff526ccb-0887-43e2-8b9c-c6b6e75c6a24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693609204, "uuid": "8a87ba4f-e814-48fc-94fe-7f8959f649c3", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2eaf940-485c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693527320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693527320, "uuid": "c4016041-4442-464b-814a-cef4b2dfbc2b", "comment": "Malware payload (Amadey)", "value": "0d452a303963752465ce34ccc7601a67", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693527320, "uuid": "5ecd7dac-8df7-4726-aa44-930b81df651b", "comment": "Malware payload (Amadey)", "value": "19408301e3543c90ef7115c5cbc4018af41fa1ae85457e2a2ebdbffb37116ced", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693527320, "uuid": "5b081e3d-6179-42af-b804-edafc664d5ce", "comment": "Malware payload (Amadey)", "value": "c6ae7a604ff1c176482fad3757aa3986bff4c23c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693527320, "uuid": "283489e3-6e9c-4867-a485-4454a1928868", "comment": "Malware payload (Amadey)", "value": "90f20600a68ed7ecf5140ccf8a65bd889611b7057a57f8d9318a2b17230ad4a0bb84b522b0ab61687add358a84b9f052", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693527320, "uuid": "190b5019-fee4-4216-ab1d-1eab81fd4ae0", "value": "T1AE352343AAEC5071D9F42B706CF613C3233A7D941E78839B9744A4894DB2AE0B5B6377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693527320, "uuid": "6bab6da6-6c07-4ce1-8052-fff2fe08130b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693527320, "uuid": "b1df1295-5ce0-4a89-82cd-4ee524f9aec4", "value": "24576:pyf2I8Rfx0xA2dRwgzVopC4Xdtuz75tQLsUB9vYcKN4:c78Rf2xdjwtLttuz7HQBvhK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693527320, "uuid": "9f8d8772-c12a-4fad-97f3-06a829fcc00e", "value": 1147392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693527320, "uuid": "bcee4dbf-e852-40c3-be69-17e332c1bd69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693527320, "uuid": "806d9d08-8b67-4629-a3f2-972e3f1e7bfe", "value": "0d452a303963752465ce34ccc7601a67.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab661e68-489c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1693554822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693554822, "uuid": "57a0683f-9da8-4066-97b9-b9c56041be3b", "comment": "Malware payload (Formbook)", "value": "b7a2f8a222e9a20ba4e1c1a2d4b11fe7", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693554822, "uuid": "45ec81b3-8506-4164-ae46-19c3b222b189", "comment": "Malware payload (Formbook)", "value": "1ee8f74b653016439763a3ddd7dda2fc684143585a3bb84453061279001a5f4f", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693554822, "uuid": "5c7df812-20d8-4d38-83a5-a0bb49e5a464", "comment": "Malware payload (Formbook)", "value": "726ec69f9cc02f71d2b9b9503d5b2a4ff4ecee32", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693554822, "uuid": "e4bf46dd-f823-4827-9c62-ca0bb919459f", "comment": "Malware payload (Formbook)", "value": "022fc1faa94b944a4d23b4389e1a1a1cc92f1a46145f139ebffab3a08eae0948cb92347904e34a8720da63355364e801", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693554822, "uuid": "a9fa1744-0182-4ef3-8c76-dd4bdd9da2a1", "value": "T11054CF84D1F1AE5B8AE7BB51350A2C5D81952E8742D993F0D408A5F3E3F7E69CC3AC11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693554822, "uuid": "21fb764f-1a00-4e36-a48e-e4d69e647678", "value": "6144:aWe+EhI5HXCCrufClEsJLqnE5q/iawq4Ec:ad+EO5Xtu2Es4n2s47", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693554822, "uuid": "641a0ff9-84da-48c9-81ac-a9159797cbc4", "value": 294692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693554822, "uuid": "5384b695-19c0-4d7e-857c-5bb2eda80da4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693554822, "uuid": "77db079f-b47b-4fd5-ae57-115fb94c2443", "value": "1.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53301714-4882-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693543507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693543507, "uuid": "54a0c1e6-5991-4514-b30e-82195a17646e", "comment": "Malware payload", "value": "1b70f8e707e87670379870bcc1d0cf20", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693543507, "uuid": "76e88178-d6ff-4075-a762-c23e89b856a4", "comment": "Malware payload", "value": "1fbe84e404996de7de12e721b12f18dd4bdfe391d0bb10e5e8dc7fa0a0ade9c7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693543507, "uuid": "7b7efc5f-f895-4a64-bf77-8e6c8c700649", "comment": "Malware payload", "value": "986acdb32a37264651f437df3d21767ea8e169f2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693543507, "uuid": "776e84ca-4655-4527-a9f5-2eeb6929a063", "comment": "Malware payload", "value": "12deaec96126e4694315e8b21df93e91d4ed0bb3309a49a6c4ef9f24a5321a85ab2b83a855a03ec9aaed98ea14ce5f34", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693543507, "uuid": "0e4b0866-fc88-4ca6-9fc1-26732f26ae8a", "value": "T19B2329DBF800E9BAF81EE73B8453040AB270F39641921B362357756BED761D40976F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693543507, "uuid": "a07c94b3-0296-4ca2-b241-d4d063183abb", "value": "768:P4ahW4nT0aFiXxsn2IaC8GNC1Op7Sy4nhQfx2dvXv3hevzg9wWFI1:P84IaIXxl88gqOp7cn+5cvXv3he7geyW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693543507, "uuid": "a03f7139-c55c-4c12-8090-d3c87a18453f", "value": 46112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693543507, "uuid": "e8314390-a3b2-49ee-a64b-be7f7f22b0d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693543507, "uuid": "5fe72277-4df0-4234-8863-ce6b3d13909e", "value": "1b70f8e707e87670379870bcc1d0cf20", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62135bf3-489f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693555987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693555987, "uuid": "ebe7adb4-1bc6-425d-bc44-3b7df8320574", "comment": "Malware payload (AgentTesla)", "value": "2bb2ba1141328725f32357820c9078c8", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693555987, "uuid": "b4ed6d2d-1215-4b5d-a9c2-4b1b0a27a192", "comment": "Malware payload (AgentTesla)", "value": "1fcb1225ae8b8ad7712c3c7870f30b7a47a113a055b12387f3598ba27b7f6f24", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693555987, "uuid": "8161349d-4ab8-4da6-99af-cf777bc6c38d", "comment": "Malware payload (AgentTesla)", "value": "c8a26dd775807da0bad3d7722c0eeebdf6a8fe7a", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693555987, "uuid": "09df1ca7-bec3-44c1-9fa0-ff6ea13d1017", "comment": "Malware payload (AgentTesla)", "value": "4d95382fe02c5816ac6646a5ae00e0c1709dbbfd7643cb01d9f12bf9c3bf2a1c9252edc8de32f9976521e07d12b57d3c", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693555987, "uuid": "46ff74df-8522-4161-8233-499ade5c7ef1", "value": "T10BE43361510E0A6DFD7E17F40610698F230AAC4F6BC148EED756A3AE5133E80B1F6EC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693555987, "uuid": "61edc17d-3a3c-4f35-a038-f7513bc866d5", "value": "12288:AYYYYCdnSIEuGna8ctneoep+BigArSzxBUulRaKpUVzlAjetFTnkd6LIEWWBygob:vSfu3ZJ2o3sSzTRaa0lZFodGggxXfDHG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693555987, "uuid": "8b1a7ff4-306a-4b6f-b5dc-84074162dae8", "value": 700997, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693555987, "uuid": "ee2f5e29-b784-455b-bc44-deab32dde5f0", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693555987, "uuid": "3343cdf2-75c8-4a32-aa3c-c85bbc5d25e7", "value": "RE. SOA attached Eml..7z.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "803ff81f-486f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RecordBreaker)", "timestamp": 1693535422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693535422, "uuid": "2f61be44-6fb5-4db3-9650-173451fa40db", "comment": "Malware payload (RecordBreaker)", "value": "58b23b64c58d3ee911bbbb5d2e53a9a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693535422, "uuid": "b886945d-f950-48df-a298-1c7155d1b005", "comment": "Malware payload (RecordBreaker)", "value": "2007cbc9167dfe3456f5664f2d254f98a3166bfd7bfa836af9e7b73f4c98971d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693535422, "uuid": "7cc8dae9-0510-4c97-8b7e-c5c7976ddcd6", "comment": "Malware payload (RecordBreaker)", "value": "079c5576d76948b98d33a24900c01f8153243d31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693535422, "uuid": "e3db8b10-8a45-4271-b364-d693a85950d4", "comment": "Malware payload (RecordBreaker)", "value": "43ff9190bceb08143888cf9999b2fa1e553af53a84672f0673c38da1a751518a9ca385c0d2a7e66296e9c5ac29c27ce5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693535422, "uuid": "c194d1bf-5fe2-4856-a5ba-27066388e742", "value": "T16E332B17D7A8B463C9A7127122672AB15A7E7C30113F608FEB00A75B2CFC6C17A29757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693535422, "uuid": "66a45cff-ab98-481c-b2fd-bf35f7078d73", "value": "0b7c87726727704c0bbed769ae7a97d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693535422, "uuid": "ede3658e-d721-4d8c-bcad-d5642ccaf7f2", "value": "384:apHtxa1VRFIpMn1W1TxtDF7YhZZgbzyOoBogB1lTf6/wtL9:apHtCQKMT3DFkPZkzy0g11f6oL9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693535422, "uuid": "0458897b-d8e8-4e5a-9d6c-e90b49a8a0c3", "value": 53248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693535422, "uuid": "0a0bcce8-86f8-4a14-b2b5-4d46e07ebab5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693535422, "uuid": "d2aae874-a363-47ab-ba8e-afdadc208eb6", "value": "2007CBC9167DFE3456F5664F2D254F98A3166BFD7BFA8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24f35d9c-48bc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693568340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693568340, "uuid": "1db3b7ab-3dac-4d2e-a250-9eb63979c82d", "comment": "Malware payload", "value": "42ba63deb6c8bfdd80b696e533ee9f2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693568340, "uuid": "b5656b2d-db81-4425-a971-1d2511ef41f5", "comment": "Malware payload", "value": "21137e9491dedb0adf2088857f7cff726c5864c9c263d1e50740355ab62e3fdf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693568340, "uuid": "1a1d8014-26bd-4302-ac8e-8edd069dd6f2", "comment": "Malware payload", "value": "08b4a60367f8b4220a0d0116f57a7fcfce6ed402", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693568340, "uuid": "47356d22-365e-454a-bc4a-d8e5e775db71", "comment": "Malware payload", "value": "1042103434651b9525078401812da6536f147d49c47a179041d9312875319702aff762e10c2f8d71e877a83e436bd4fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693568340, "uuid": "f0c776d1-cd51-4f12-b781-ec0423e449c0", "value": "T15C96331DE6F094DEC247DAF2E2AA1C75B830F8260150D4B69624A7F16F61FE0DB9C391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693568340, "uuid": "a361e24c-76fb-448b-8dec-4dd1f5647da4", "value": "9ea5854395f99dfb3b55a7e476af7f9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693568340, "uuid": "5b84e1f3-5483-4d47-bd0b-4a18a5d7af1b", "value": "196608:IlIiOZKy0E68nFXXM7Nw77TWn8yj8UXnLAjJ88XYDwmKFpjujEptJBtKkvde+:2I50E68ZXMJw7PWn8TUMjG8XYD784itX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693568340, "uuid": "165e6951-cb8b-4cb9-b4d7-57185a9de258", "value": 9189187, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693568340, "uuid": "3811d4d0-8799-41c2-8feb-15717d337773", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693568340, "uuid": "bee1850e-b9f2-41d2-9ab8-a42a786d1ea6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d17c2c5d-48cb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693575072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693575072, "uuid": "ac1f3e39-1a20-42ad-bec6-0321c1d2d9db", "comment": "Malware payload", "value": "f823f88bb3775283b67a9227a6b2b4df", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693575072, "uuid": "7783ec8d-29aa-4778-a74b-d7ffb477ec87", "comment": "Malware payload", "value": "2141547540eff915bd7714492a8734ca3cc36782b05fe0e1d9e4732560833276", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693575072, "uuid": "5251ef86-e1b1-4cd8-a661-55b0d6d8becc", "comment": "Malware payload", "value": "db07c96acb669bddc7f522131c36118ad4f73364", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693575072, "uuid": "86ba10e7-9ffb-40d1-95ef-3a14c9924caa", "comment": "Malware payload", "value": "d8bf98b02547c36757ea616e81943630ab0a53a733dfaa86be1fba78b1eeb1deec9c4eab9914c7bf5f8163c995788540", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693575072, "uuid": "19f97acb-3716-4c55-a201-36af700de17c", "value": "T1B0A2C05DE8AA164CE8D091CEDF1E3AD8C97CB3565BE0BCE0351C590197011606BABADF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693575072, "uuid": "aa5f881f-85e5-4348-91b5-e26384c0cdd8", "value": "384:4u0Oj71ZTcKeXIuviAkMef6ugbq4BBdFRrtxslBKuWW1hVNKshxnEHdvI:4ZGZTheXfvJK6nb5slBMUVUoEHdw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693575072, "uuid": "ae0d48b2-2d01-4bee-8005-5ec84e102124", "value": 22693, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693575072, "uuid": "ded64fd1-06b7-41cd-8a7b-b836a9732990", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693575072, "uuid": "108b4f9c-ed95-4873-9837-12e04781807e", "value": "ARCHIVO_FACTURA-122360.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "990653eb-48e7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693587003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693587003, "uuid": "e2674805-ef10-4a74-9850-4715bef7f1b8", "comment": "Malware payload (Mirai)", "value": "6f40efb0b59050f5c021ceb9db3d60a0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693587003, "uuid": "21678b4b-7c11-4e6c-87e8-2b973751ad5f", "comment": "Malware payload (Mirai)", "value": "216381543849d4297fb99314dd7b3fc99a334cedf7c50bef85f52aff5df5e211", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693587003, "uuid": "b31dfa19-08a8-464d-b8dc-69e783032875", "comment": "Malware payload (Mirai)", "value": "a267d2b62f0bbde64c70cf1a19e1d9b7df548e0d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693587003, "uuid": "90feebb9-626b-4922-8caf-e66ab7e3992a", "comment": "Malware payload (Mirai)", "value": "a80bb422bc664aac78ff8affac1c1fc85e87f72b5f3a0b2b3548203d179c7a9a42585b9357347b5bbc15429ec2081d5f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693587003, "uuid": "038e9c5e-ad9d-4686-a83e-ffa8d72de297", "value": "T13D134AC5DA83D8F5F85301B5613AEB768776F5392118EB93C3A9D933F841600A62B28D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693587003, "uuid": "115f6b98-8fc7-4386-8c0d-dc55c7cd4396", "value": "768:iz9JenUEW70rQDL5S7f3+xVjpPSPbkqD3Tefa74OiZTG5wqcNzx7V8tbStI6:iz9JenUEWIrQX5SWjwPYKjv9Si59c1xJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693587003, "uuid": "46e02789-bf57-40db-95ba-37855ad0299a", "value": 43984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693587003, "uuid": "bbf4b1ac-52ef-4b6e-a2ea-7221c727e999", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693587003, "uuid": "1ca6f0dc-2582-4946-9a28-928cb29e429c", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81fa48c8-4911-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693605003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693605003, "uuid": "43d115be-40e5-4843-822b-0480ccf08768", "comment": "Malware payload (Mirai)", "value": "040ca4bffcffe7f53707e83f467786a9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693605003, "uuid": "5f111dcb-a0c3-4c0e-b93f-54d1c3083cd2", "comment": "Malware payload (Mirai)", "value": "2243519315b67ece4532963a7a560392ae45fa69dc792dfa95b6770ee8db6758", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693605003, "uuid": "d7f2465b-4b68-4f2b-8fb1-fd3b777460d7", "comment": "Malware payload (Mirai)", "value": "df6cfa39336c5e5d6d9bea647be52e697a2bb53a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693605003, "uuid": "5833b97f-778d-43db-a068-a1c02e4537ec", "comment": "Malware payload (Mirai)", "value": "ceb441103ec35af35593016835743133cb514d73aeeba8f12019fd515d056b8ce807ce513fb20ec9c37131cf77f0b363", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693605003, "uuid": "bb7a07c0-e3f6-4a51-a659-93e6d59acd6d", "value": "T1DDD2F170AE9EBE4990D5673A5C9ADCAF34CCB8635F76920C1B4009A1B237C12A5F4CD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693605003, "uuid": "e89c85eb-5f92-40f3-94aa-a509a842af04", "value": "768:WN8f6tfoQmQAXV7E1QDvjnVjA2mCT6oqq:2MJXFl7IQjGAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693605003, "uuid": "5533c384-3c3a-465c-a01a-3a1ca682e074", "value": 29904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693605003, "uuid": "4a1db360-c0ff-4e17-a021-a78a1b805227", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693605003, "uuid": "69903a14-ab8e-423e-90a3-3dc9db0f022a", "value": "z3hir.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3166c52e-4913-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693605727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693605727, "uuid": "09323ab9-6bb0-4476-a093-9d79ae181c01", "comment": "Malware payload (Mirai)", "value": "bfdf4ca502d6264cc4a44bffb979a8f5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693605727, "uuid": "a16f4ee3-b8b8-43e4-b23f-6d8641c8a030", "comment": "Malware payload (Mirai)", "value": "2281130337b9406875f961f9edb76aa8ea26b1669bf7c278838f7b26e87ed0dd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693605727, "uuid": "3287141e-c7a3-4e0c-8f8e-d06bf10c3f64", "comment": "Malware payload (Mirai)", "value": "08005a0ed9c8cf16ea6620fb7861bfd86b3c9161", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693605727, "uuid": "ddc0a498-fbc9-41fb-a6e1-427dfbdbea59", "comment": "Malware payload (Mirai)", "value": "d7d4f1f4db6950e8fb8953dabf4428605fb0f55f9524fe196f04ce34958ae41dff752d347f3ba082988993bd2506dabf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693605727, "uuid": "0737507f-639b-4264-a218-8d51efd8211e", "value": "T1DDF2E0622945CDA5CFF0323AE6E072017FA95E7CD16474B211612F18BBCFD8F61A128B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693605727, "uuid": "64c359d5-b82b-406d-b21d-367ccb9cdf5e", "value": "768:Lb+GsIbn0XpiTAPB4bT9bOs26GIa+UqaXYo9q3UELQR:Lb+GsLidbT4s26dVUqaIRLI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693605727, "uuid": "46e959d9-4c60-4485-86ad-c6c58c7ca5fd", "value": 34488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693605727, "uuid": "4d2357c7-94e4-4890-b9d6-c6c8773d380d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693605727, "uuid": "e3078fab-34bc-4b59-9998-625b0852faea", "value": "bfdf4ca502d6264cc4a44bffb979a8f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddb3eb05-48f8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693594420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693594420, "uuid": "e930096f-bc34-401e-a1d4-d62dea7c7964", "comment": "Malware payload", "value": "8d1a671e28f03850e0f8fb30f30cffdb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693594420, "uuid": "a4eaf67e-5a44-47ad-b374-fc5183eadb3a", "comment": "Malware payload", "value": "230e3c15f94ae64f191170e9d335b5caae4ac3d1fda5b70c1946426dc6b0d138", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693594420, "uuid": "30fccd5c-ac73-4d5b-adb6-845fda7330cd", "comment": "Malware payload", "value": "99019fe2b04cef2b04bf3e4689d9982b685df755", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693594420, "uuid": "d3a7b956-5a14-4f65-bc8d-c90ab859cc61", "comment": "Malware payload", "value": "a780e654028993c27519774284f4fb4df08890053c634a5f0eba8632dbc2ca5060ebf16ff02d96dc4e38c61d475fd231", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693594420, "uuid": "5c2e0696-1409-4a4e-b173-f410dde19d91", "value": "T122936C1E66E520FBD4BA83B884E302A3E77178B11B5A1AFF12D4C5BC5E036D17135B1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693594420, "uuid": "096b89d5-ff02-4522-8180-509907ed69d9", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693594420, "uuid": "1fc3d158-afdf-47a5-b54f-865c893582f1", "value": "1536:Lrae78zjORCDGwfdCSog01313Ds5gn6fNH24CkFsPuPO2dzU5E:hahKyd2n31I5NW4CbGDuG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693594420, "uuid": "9a724730-41b9-44f3-b1e9-bc487cca8c61", "value": 91648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693594420, "uuid": "d7a93ce5-73d2-4815-bd82-668c87221981", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693594420, "uuid": "7c8d870e-0612-42a4-9dda-e05c5a85c115", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e35069af-4902-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693598724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598724, "uuid": "5603ec20-7953-46ea-ad56-5704e578aa58", "comment": "Malware payload", "value": "d55a2942737b0aba4aae42fb07ff601e", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598724, "uuid": "8c39c7f2-ed32-4a30-b3fd-5ac6e7fc942b", "comment": "Malware payload", "value": "230fbad9f71ad9df263b345b14d83505ad169697b0cce731c0613735c2f21abf", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598724, "uuid": "bd013f12-8c8c-4d59-82a9-ab78d32717d5", "comment": "Malware payload", "value": "fbc87aeadebc4d76ed9ee997b294cfbecdc916ee", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598724, "uuid": "495e34b2-8935-4ed9-a972-afcf9a0ce0ab", "comment": "Malware payload", "value": "7623e30cbb0a77d9ef265a7ed5a70191037bff1c6827894ad203be24480959b610c4c114d6c6885ae843f6d35c0cbc06", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598724, "uuid": "b8a243b5-33ef-409a-a399-279f562ea1d4", "value": "T10F953381D3CF51FC14AED169142B0413B246C7A3C3B7EC7C5277B8EF9AA2895C654A1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598724, "uuid": "68f6b2cb-50db-4edd-a8ef-edeee03429b4", "value": "49152:T0EoWCJpCn5t6vwdu6ubpLlCSU1GLB5yxTPhRhiTcR:T0LZJpCnn6vwMbphCP1mO7hRhiI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693598724, "uuid": "3ebe7ce6-f18d-4c2d-808b-9df4819b42fe", "value": 1981133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693598724, "uuid": "f2f8a00d-d3f0-4d4e-8a59-a3c493e0cbf8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598724, "uuid": "3a2f4a8c-df74-4b6a-92d1-5bfc76712ce2", "value": "LPO# - 00007174580021477 Xls.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75cd936c-48b0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693563322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693563322, "uuid": "d7b0418f-4df8-4863-baeb-d26a7c610c28", "comment": "Malware payload (RedLineStealer)", "value": "8ae45656386a3eda9c1a0f5a46bf9d60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693563322, "uuid": "a4e2a13b-b80a-47ca-8f2f-c29e93695895", "comment": "Malware payload (RedLineStealer)", "value": "24be0a42944827cffa615838b59d3d57041797cf1e12337066bb772acf42153d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693563322, "uuid": "64f73edf-0e6d-4812-bb89-2ac2cafa6a09", "comment": "Malware payload (RedLineStealer)", "value": "ea243bd7658f6cabc1958fc9f1a60721c40d31a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693563322, "uuid": "16ae7b5b-143b-4fe8-8374-78c983776ad4", "comment": "Malware payload (RedLineStealer)", "value": "13a4081b6078a93d9167ab16cfd23b73c0155226cb56fc646e86ddfba4bcdc601b1142f57cca8a56408ab4a53f2daada", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693563322, "uuid": "3e6b1355-d519-4a67-b200-7be19fc8e86c", "value": "T15A352387E7EC9036DCF61B7158F622871B32BCA24939D75B2300684B5C31B84E9767A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693563322, "uuid": "2fcd265b-b763-4bc3-97ab-7cc34e8bce0d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693563322, "uuid": "91caad8d-f91e-4f0f-b055-5e6c52035d56", "value": "24576:3yA5c2ZuAxrHarO38RC5RpMBoiWfUQC8BirMu:CA5dBxDl35pyhiirM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693563322, "uuid": "f1d41aab-b0c5-4019-950d-097447b574bd", "value": 1147904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693563322, "uuid": "b868818f-1b0e-4737-bca4-5967dd124abe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693563322, "uuid": "80812373-6380-4ada-a56e-f70404e35fe1", "value": "8ae45656386a3eda9c1a0f5a46bf9d60.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f787ce76-488c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (JanelaRAT)", "timestamp": 1693548078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693548078, "uuid": "b547a46a-7476-4dde-9adc-ac76c6565a3d", "comment": "Malware payload (JanelaRAT)", "value": "402e23ce4930554914e635e29fe14dbd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "JanelaRAT", "colour": "#63718C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693548078, "uuid": "d2c2365a-37b6-4833-a3eb-c31d6c051b61", "comment": "Malware payload (JanelaRAT)", "value": "25079f0ad009ed34dbed8d0a63fe8d7656c92953ffd43e534c1bbfb2caff8351", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "JanelaRAT", "colour": "#63718C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693548078, "uuid": "8f49981c-260d-430f-b34c-9456d725cf8d", "comment": "Malware payload (JanelaRAT)", "value": "6333bebc4ea5736b3c6cc4b9bcdc04ef071cb465", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "JanelaRAT", "colour": "#63718C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693548078, "uuid": "0cf3c18f-2479-470f-82eb-abbf144f71be", "comment": "Malware payload (JanelaRAT)", "value": "7397641eede17c1595ac4c70ff4b041ebd85214d8e119473afa5ba6e69b1573bf1525d299aa3f6136bcb8b95b62be85e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "JanelaRAT", "colour": "#63718C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693548078, "uuid": "ea19e332-d97b-4c7e-9fc7-0ac5e02f7755", "value": "T12535619C766072EFC857D472DEA82CA8FA6074BB931F4213902715AD9E4D99BCF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693548078, "uuid": "3698f578-9830-4dfb-8412-faa7f7dbf28a", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693548078, "uuid": "b59631ea-e2dd-4e79-b16e-0da8ed5ed510", "value": "12288:XdOQliWUWEkZfYmptsywWuvC/Z/XYQlLB1psvpYGhc45w6CtxlfWu+7hR4x9iXgo:7lRZpsRWuvmN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693548078, "uuid": "a2bffd3e-b67d-47f7-ae85-b37ecfe58764", "value": 1099776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693548078, "uuid": "b5ca671b-21c4-446b-be7d-60cdc7b37ea3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693548078, "uuid": "088d4af1-ea88-4f30-ac79-1fac0cb1c45d", "value": "gagu4gmirt.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f286a0b9-48ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693597461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597461, "uuid": "ab96f0ff-481f-4af4-a186-c7dfbc65e8d0", "comment": "Malware payload (Mirai)", "value": "0c8df98405a28782f17a4cf828674ea8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597461, "uuid": "012e6f89-8e50-4243-8505-6bac6c0b200c", "comment": "Malware payload (Mirai)", "value": "270fe3f929946b89f2fd278f55225f2205541d8440cd5b4a35aa7d456fd9a934", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597461, "uuid": "c30adb79-df8a-4ff8-8171-02f11e38b994", "comment": "Malware payload (Mirai)", "value": "3a0a27c9d3116296139befea755c3ee276f9c03c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597461, "uuid": "f1e417cd-7e62-47fd-9193-6c38560af7dc", "comment": "Malware payload (Mirai)", "value": "0f6b5eeef275e7547662affb7f36058ff3d286d16743cd2dfc89a5bbda9181623b221c57c31de1fb6a67b9740efb9c81", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693597461, "uuid": "2362f302-7eea-4049-b7a9-0590cf4ba0de", "value": "T1D9E3A53E7A11AFBEE168827107F29F70CF9529D326A19381E26CF6185E7118D0C9EB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693597461, "uuid": "733a0068-3acc-4b58-933f-314345cce377", "value": "3072:JW6dm9tS1aRGQdK76t/zCXI5mrThPaLEnvPrNb:c6IG+LComrThPaLEnvPrNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693597461, "uuid": "76b7010d-f1cf-477f-90f9-e017554348e4", "value": 155428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693597461, "uuid": "1c9485d8-1a16-4631-8045-d7566c53c6e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693597461, "uuid": "54f2091a-e89d-4de2-a17e-6a5d7c43596f", "value": "0c8df98405a28782f17a4cf828674ea8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b93e571f-48ca-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693574602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574602, "uuid": "db139ccb-95b2-44e3-a02f-1b2e33956c88", "comment": "Malware payload (AgentTesla)", "value": "b70c3736f06a6e0fea7e719cae72d06f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574602, "uuid": "46c472cb-0f2c-493c-b108-4e025cc6ee1b", "comment": "Malware payload (AgentTesla)", "value": "28fb4137db1dc5813064025021d0c18ca4117a2de7371629b8a5aae5bfe03523", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574602, "uuid": "cec137ba-6969-41fb-a278-b27077bda9e5", "comment": "Malware payload (AgentTesla)", "value": "6b60ebdbf8a8bb2691d76920359cd42edecb6a75", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574602, "uuid": "eeb8b3a2-ddd9-4182-a121-eb1a5ea5228c", "comment": "Malware payload (AgentTesla)", "value": "08f195fb1d427f1f2f9d874a3cfa4d37ddd916cf11f396a4f791df2b84bd0b8e517ad2831fd60ee7f6736b0027b1e390", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693574602, "uuid": "370ffbcb-7818-498d-887b-4aa32cd6a896", "value": "T1E7A40413319AD4C861E27A835BCBF5B45BFFA6E51A3E146A20DC430787E28548E593F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693574602, "uuid": "db0bb4e0-59dc-4c5b-b8d2-c0580858f4ef", "value": "12288:PMcBa9v7L+Vis12PY8EAwkwn0wYwqCsw/wDkr2cr1tmS:3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693574602, "uuid": "6e40a510-30e9-462b-8e64-b854e7f33d0f", "value": 486014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693574602, "uuid": "7bf0c16e-0396-49f9-862f-4d961b5c0346", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693574602, "uuid": "901f0799-7192-4b3f-8402-724452051ed2", "value": "razle.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d0811d7-48c7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693573185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693573185, "uuid": "b100091a-4b08-42d7-b66a-c6ed4b6e2748", "comment": "Malware payload (AgentTesla)", "value": "69cd9b12205c5d18117d3386c5781813", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693573185, "uuid": "8a2165a8-be3f-410c-b1a9-fb2042db0af5", "comment": "Malware payload (AgentTesla)", "value": "2b4251f0b47b29ce53da52100ad6ac602b99be0b6701f326defdf0fbf5e2b5fa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693573185, "uuid": "f80f8afa-15c7-49fc-b34e-54f1522451b7", "comment": "Malware payload (AgentTesla)", "value": "d67f854f3a234c7625dc7612b6fedf6ada8c5a99", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693573185, "uuid": "d3c117f3-0c87-484c-92db-27ef6d054d55", "comment": "Malware payload (AgentTesla)", "value": "d543c4b28b3ae8607813576fa34d22908fe55849dcae9a3a7d52976ca78115e09e770e48f9460c47636cd9c2810a354e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693573185, "uuid": "00e02ef6-413e-47f5-839e-4e33a342e265", "value": "T1F1558124D06073F6FA4117B87537E76002415FFCB9AC60AC6EEB7D0AA1B33921A7D592", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693573185, "uuid": "a86e150f-5730-4739-a973-8b0e6d99f3cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693573185, "uuid": "9798439e-3cfa-436a-942c-bc4399b2fa16", "value": "24576:hXIkfrIkf26KMpqaGwjnOlu4R0Ba0Vu+SUV9M1q:RbppqaJOlJqhLF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693573185, "uuid": "0881e948-e760-4a68-9179-13aec165033b", "value": 1328128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693573185, "uuid": "d2984cc2-8174-4187-b70f-e08a207ed45c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693573185, "uuid": "f937dc27-b76d-418b-af15-7ae4714f2ae2", "value": "RE. SOA attached Eml.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6fc422c-4913-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693606032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693606032, "uuid": "a38b9691-d3ce-4854-8bec-ecaac04c9817", "comment": "Malware payload", "value": "92d059fe007b8ad08485a7a99e878c19", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693606032, "uuid": "a4b1e189-e4fe-4192-9293-0f5c2bd0d92e", "comment": "Malware payload", "value": "2b9346783531da7f7bd59813eb27a7261f5cb50cc32bd973308204d3f4a7268f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693606032, "uuid": "b7812c1f-0911-44e4-b14c-7dd60a8fac1f", "comment": "Malware payload", "value": "05af750f37b0d4f2c3fabfa7ad5f88c140731552", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693606032, "uuid": "06b49944-b00e-4787-ae0c-ac4dea3bd25b", "comment": "Malware payload", "value": "e9828e8d05ee078f40ee4db067823e0efb99aa548950346910729e7910e826903d486b07926819746587b642071f0b2a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693606032, "uuid": "966d6fc3-0747-4841-a801-ad75dcbab655", "value": "T187B5231476C080B1D8A31D761BE1A732A77EBD301B758BEB87942A6F9E301D0DB26747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693606032, "uuid": "e4eeed8c-651e-4f78-a103-6cdb7cd49c02", "value": "fa8d20faea9ef7b4e2b7fbfe93442593", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693606032, "uuid": "886d5bce-5300-4c0f-b6fb-05938e6e57a2", "value": "49152:acbz6d3uwY1/PHXL0yx8TRv5c/Y8kHlsTg+Y7zKSLpCdLWLh:acbeuw0/ws89Rc/Y8oCg+OzNLpWLQh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693606032, "uuid": "377424ee-2819-4e51-9d04-8b9ddfe0b03b", "value": 2366614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693606032, "uuid": "15aeaf01-ad2b-4062-b237-b79bd3a51aae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693606032, "uuid": "c4bb04bb-7356-4c34-abf6-fa82b5688a74", "value": "92d059fe007b8ad08485a7a99e878c19", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6454680-48f6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693593468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693593468, "uuid": "45b4f19c-20ff-450b-8555-7321c23e008b", "comment": "Malware payload", "value": "58f10f89b507fc07d0ebdddbeb09e235", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693593468, "uuid": "0790a4e9-dc71-462e-8174-6aad19b946e3", "comment": "Malware payload", "value": "2b937c4be4c13665f3d570e8fbe4585cf52a0e1280ac12e456aa1501eccdafe8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693593468, "uuid": "9c8bb8d9-bc62-4821-8ff3-59e6e3df6692", "comment": "Malware payload", "value": "1b9b499f98c459d0192f6f45ea9252706d5e5895", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693593468, "uuid": "4fb680c6-4cec-4754-abfe-b329f35b04f9", "comment": "Malware payload", "value": "047b346f6a42c6119e665644408924bb2da8fceff86d5215aa495738342db7c73754c1fb7450692bc9e1a99f6f117019", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693593468, "uuid": "e4912030-b174-4491-a521-b4ef04be61d9", "value": "T1A984D64392E17D58EA264B728F1FCAFC760DF6708F497BA9221C9A2F04B1176C263715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693593468, "uuid": "121a8dec-98ad-4578-b2a2-c42ec29aabab", "value": "0d5ccc78ff50fbd2fc0370addad4c1f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693593468, "uuid": "1e56fa22-3132-4db9-9bfd-abab6c374b23", "value": "3072:ziTMZan4A/mD3l3Tb+kT7Itto2mJKSheS08ZDhpi03AmMfg68anTK2P3OBdxw/Pf:Uz3+3g2IttIKSh8y3AfhW2/Obw/3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693593468, "uuid": "48f9e93e-fcb1-4448-b9d3-a05c58a6528d", "value": 402432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693593468, "uuid": "d4b92347-8201-41ba-ac71-c3a98677171a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693593468, "uuid": "9860061f-4c61-40c8-9549-141cbad3dbcd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4e32146-4888-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693546275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693546275, "uuid": "8ffd1d75-0f95-4d02-b633-da302dee78b5", "comment": "Malware payload", "value": "68521cae348d41b056646b5a8ddda37e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693546275, "uuid": "8bd3f6a1-7caf-4b21-a54f-77285cf1fd94", "comment": "Malware payload", "value": "2c7fe45a31622e89ae438a9b3e9ecd82fcac2abb1c7cb924c4ab31dc14b061cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693546275, "uuid": "44556070-0cff-4761-876e-9b51f73c4aa8", "comment": "Malware payload", "value": "3a7626ab20b347b3e5f9abf8bb741d9d6f87790b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693546275, "uuid": "e2fccb44-754c-4d05-a515-a24337051d69", "comment": "Malware payload", "value": "5049774f719217cd8e5c30febce1fbfa87254a765edead519f775a0c0a07fe1587dbd315a00948f8bbe092307015a556", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693546275, "uuid": "654e0ffa-d484-44f0-8948-ab517e0ed2c6", "value": "T1D9030995FD81AA03C9C10177FB5E438D372757A8E2EE7303AE19AF21378B9560E2B511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693546275, "uuid": "18b1d7dd-3600-47f4-bcdf-e62c046c3a43", "value": "768:NsEGfkMk2Rbas+eYME9zWQfeM1d3YfFgPGnInVR3wOkvSsjI:mE8asaME88j3eaGnGFkvS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693546275, "uuid": "c9abd71b-fc84-408d-9d5c-fdeef2f5af47", "value": 40520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693546275, "uuid": "8f8a1945-ba9c-42b2-8098-6d0e194b9772", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693546275, "uuid": "a44565ad-d987-4432-b23e-e8bea9772c7b", "value": "SecuriteInfo.com.Trojan.Linux.Mirai.16862.3228", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2a743ed-4862-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693530004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693530004, "uuid": "f29aad39-803e-4101-87ab-5e14f81f1745", "comment": "Malware payload (Mirai)", "value": "138064ced56c64b76f6ae6790e80f8dd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693530004, "uuid": "dd673c30-bde2-4538-8b19-eae3d9577c2f", "comment": "Malware payload (Mirai)", "value": "2cc559558030f01e203257f1b8f9aff1dd968f1e116fbedba30be92c051fc96f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693530004, "uuid": "fe1c1e67-76a5-419b-b821-c1215299e30e", "comment": "Malware payload (Mirai)", "value": "1e5a6d6aa965b9ef43a9880992b435438e29cea0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693530004, "uuid": "3b77bef4-28bb-40e7-b7b7-dff8aee75a64", "comment": "Malware payload (Mirai)", "value": "6d2e8aa3c60a0f08fe1f48ac889664eb1c3b926e5ce5cc5dea0b9f0d7a5881edb7172e339bed47dd0199a62c9c32f58d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693530004, "uuid": "226945b5-e3d5-4e3f-abdb-623e3eeeb476", "value": "T138C2E1FDB8BB6F4BDE03113AE56DA92381B4E0E5E30DB2472781501664032F5A636DD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693530004, "uuid": "6cf572b3-5c06-4c25-9d07-36256ef95089", "value": "384:MX1DMwk8JPyGktDZVEXVZVBy6gIuFm4lSm4nnLZd1ZTTqX7n06/d5e5lqQ+pNy0l:qMwaDZqFbBy6g4021ZTTq1l5eTq9a0NT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693530004, "uuid": "49a544d3-576f-44c2-b9d4-d590b5f79f9b", "value": 28048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693530004, "uuid": "f1988f32-e0f6-4f03-bdab-ad89c07f0787", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693530004, "uuid": "21ff947a-1b4e-40b1-83f3-d7bcdecef96a", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9bc9889-4902-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693598735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598735, "uuid": "2a0854ee-3927-4957-b02b-cf7237bce6de", "comment": "Malware payload (AgentTesla)", "value": "17499c6078e586f50ebb750a410bbbc7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598735, "uuid": "ff0f2327-175a-44d4-9efd-d1525ad4fb50", "comment": "Malware payload (AgentTesla)", "value": "2decf9f032b05a94f2523760f10ac0638a06a946e5eea8b9cdfbedc7339cf04a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598735, "uuid": "bf93e200-6ffa-4d97-8f9c-831f7e6593d6", "comment": "Malware payload (AgentTesla)", "value": "58352083c7388eac3b10fd98f8839d56ba7bbdca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598735, "uuid": "4476388c-9707-41dc-8e79-e504f04e757c", "comment": "Malware payload (AgentTesla)", "value": "382455009b0e695d0b3467e2848251522d21504132f0576e0b88baf18486a5d34bffed9fb8b9076f1b95650dadc2a7f5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598735, "uuid": "9b84ed5c-f856-4530-a3d7-b140e6622c26", "value": "T1ACF4E0017655C752E664B3F7D021A7F007B6EE26E5F6E2071D823CDA36B3B100A46E2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598735, "uuid": "cfdc0fcf-1637-45d6-a22e-2d21162941d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598735, "uuid": "7b96c533-fe9f-4440-adaf-a1ac42bb8fe2", "value": "12288:JUOPypIzAfOUmJZeCXhQtd94CgCAbIDk19zWqLbG4jbi9lu4VF7v:JUOPypIzAWUgZxXhI+CNy9zWkPna1b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693598735, "uuid": "9b862af3-7e9c-4070-bd3d-70f5de79e0b7", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693598735, "uuid": "e58f6448-d6fc-4788-84b0-08fbe6301403", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598735, "uuid": "fcb47aa7-89df-43f9-aa4f-695627b5564d", "value": "DHL SHIPMENT ARRIVAL - 1501388366.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b53085da-487d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693541524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693541524, "uuid": "24f36e08-f715-4793-b95c-225a7b58ff6a", "comment": "Malware payload (RedLineStealer)", "value": "512eb21f83af30cf7a13add390a340dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693541524, "uuid": "02342b1a-a791-427a-ba59-3abc3b72bf42", "comment": "Malware payload (RedLineStealer)", "value": "2e4e03f96c85b5c261ff25f715ba99f55577b0683bcc2b5c3a2fd29a29df0ddf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693541524, "uuid": "9beeb305-b2c5-4f2f-bf2e-f98dfc82cadb", "comment": "Malware payload (RedLineStealer)", "value": "44c67f3af1d4911f7f8a3478cb946e68cdf8d44f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693541524, "uuid": "a00ab9c9-c550-4a91-bc3e-884465578be4", "comment": "Malware payload (RedLineStealer)", "value": "459efc9cee387742c9dc15aed6b3d9dd43eedc034c3dafa124d2bdd9ffa7b24c1bc1e2d2615d8dd0f1454b51f9c579cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693541524, "uuid": "b5670785-0316-4b7a-b279-dfe2999fa7fa", "value": "T16C052207AED551A3D5B02BB04DFA4AD30B37BC821C6047BB5217A56A08762C4F1B6B7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693541524, "uuid": "753c1c85-2a0f-4c1e-b802-deeb4c96976f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693541524, "uuid": "d5899cff-0ebf-4b60-b9d6-356cd4d198a4", "value": "12288:jMrRy90z3yx7hheqYOnQLhvc19Ui4mw6YEvyc5dZ3Irkxe:yyE34dfYNLhU1J4JEvygIrkxe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693541524, "uuid": "cc6959fd-cd24-4135-bc38-b3def023632c", "value": 849408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693541524, "uuid": "d8b77b2e-3e31-4e04-afbb-7e02f018fba8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693541524, "uuid": "f7fbadec-3e0b-4790-bc23-fed9b97c6c71", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcffa922-4866-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693531658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693531658, "uuid": "c1635e16-b27c-41e2-903b-39643e0d144b", "comment": "Malware payload (Mirai)", "value": "4e9d5bb5284c5d01350cf864b71e99f1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693531658, "uuid": "d1d83c0f-c817-4c06-b6b4-774d683bf140", "comment": "Malware payload (Mirai)", "value": "2f7cfe04faebad6304d86975b0b903016e92b911612fff50d81f8e9580d1938e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693531658, "uuid": "9d167057-5992-45d5-8a74-f48988e34315", "comment": "Malware payload (Mirai)", "value": "71c808d14d78314ecdc081d55a79287d0d88d1f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693531658, "uuid": "b69c9726-c2e4-413a-ae0b-7c80a34e85e8", "comment": "Malware payload (Mirai)", "value": "1a062d8ef0536591415e52d97d614f1168a5d65f425f2c364de30e7761ecc23ac3d83c0af9de9aede2fb795f49f53f41", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693531658, "uuid": "6084c5fc-6662-4824-b42d-881bb53536cb", "value": "T1C7535DCAB8119E7DF5CBE6BE85210D0EB821722150931B17BB6FFC83BD721648956E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693531658, "uuid": "65a513fb-d4f4-4753-a22f-6681cf5ee77c", "value": "1536:sXyRgQFVTbSX5pxLepSGYocF1ohON2P3B+qo76E8Y:R1UvA8E9oOG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693531658, "uuid": "71094f16-1d5e-4445-9bae-9295a7d49a60", "value": 66504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693531658, "uuid": "ececab99-be35-4adb-aec9-c7b905cf2bcf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693531658, "uuid": "a3743e78-333c-4e99-b0aa-4eff4d19e68b", "value": "4e9d5bb5284c5d01350cf864b71e99f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7c8f4b3-4896-11ee-a6f9-42010a9c0055", "comment": "Malware payload (JanelaRAT)", "timestamp": 1693552346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693552346, "uuid": "df73371e-2eab-4f3d-b392-0443d53d08cc", "comment": "Malware payload (JanelaRAT)", "value": "7add85592222dacc7e5f454eae0cd89b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "JanelaRAT", "colour": "#63718C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693552346, "uuid": "60ec8773-7dee-4a33-9696-03c3fc33b89f", "comment": "Malware payload (JanelaRAT)", "value": "2fc825ad1d485461e1f4d2a58735056cc184e7e9de5f221b7fdd04b7c83914b4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "JanelaRAT", "colour": "#63718C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693552346, "uuid": "d5428e9a-aa0c-4b07-8049-6a49fc715c7a", "comment": "Malware payload (JanelaRAT)", "value": "2a57e4f617982e4130dcce2a5143cf4bb2a1cfa0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "JanelaRAT", "colour": "#63718C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693552346, "uuid": "f96ff823-f4e3-4da9-a2c9-59307760bb5c", "comment": "Malware payload (JanelaRAT)", "value": "2494489e36ce7168c05d2abefa3031a80d2750578d96ec7602fec044a06d6f22042409961ba9a3c47889be38fd9c471d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "JanelaRAT", "colour": "#63718C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693552346, "uuid": "3c5de860-f6b9-4b4d-a8c7-769cf446718d", "value": "T1D335509C766072EFC857D472DEA81C68FB6074BB931B4213902716ADAE4D997CF240F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693552346, "uuid": "315cc373-1a5d-46e1-955f-d2af77b06449", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693552346, "uuid": "a4f840fc-0a83-4ccc-b7eb-9390671968b4", "value": "12288:HdmHRmnFds+Shjw16dZNIGNetnI/sALfwheaIDojtIoEIlOgTlRVaTlnO4P2mdsU:e8nfsLVw1gpAtqDLog", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693552346, "uuid": "d6f8cfef-650d-46b0-8da2-2a403e606a7b", "value": 1099776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693552346, "uuid": "43afd095-6d37-4852-9472-671859b6627e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693552346, "uuid": "a6ebbd9f-30b9-4372-9f2a-8604a8a4f658", "value": "b8z5ifat30.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eaca03d-4877-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693538882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693538882, "uuid": "66d1b83d-8001-4834-8858-6a43d684ce77", "comment": "Malware payload (Amadey)", "value": "9b2f9081246095deb23d37a1ede8195f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693538882, "uuid": "0488d250-3e3e-4525-84b1-49eb0654045d", "comment": "Malware payload (Amadey)", "value": "2fd428c972d43a850ee2693ff160c76e12ea6f4171e657f1c623b7655b561efd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693538882, "uuid": "385ee7d9-095e-4c02-95ec-1b06b9607be5", "comment": "Malware payload (Amadey)", "value": "5eca3bdaa20f49b6516695e2cfe8937327ca969e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693538882, "uuid": "8e04dd6d-3ea6-4688-aa5f-b9f1b0294337", "comment": "Malware payload (Amadey)", "value": "2d25c18d0e45566bedd807ada18393cdbfdf4be5704174516fd366603e69fef2ba7e85670bfee80367a954453600ac39", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693538882, "uuid": "8662de86-f173-40c3-b6af-8fe0f47eb683", "value": "T11A052326ABD84432DDF85BB0A5F203971A367D315DF48257268AAD8B0C727C0B936377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693538882, "uuid": "e5479493-7e86-4ad4-9482-107f8efe2339", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693538882, "uuid": "81d6f316-a59d-4d09-baf3-9e97f3606618", "value": "12288:GMr7y90tVvF3a43TfHdEGOIcslpKizn0I0lsZkD6x6FvNHG:1y+tFhDHdEK0ls6DDFvE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693538882, "uuid": "9db3fbb2-6175-489b-a1cb-a69bab560a96", "value": 846336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693538882, "uuid": "5d0e2741-4a09-437b-8196-c534e0a1c482", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693538882, "uuid": "059ef65b-cbed-4c2c-ab2c-36002db44df4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e00e77e-48dc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DBatLoader)", "timestamp": 1693582260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693582260, "uuid": "5bc95aa4-0f30-41be-aa69-2edfc8123bdf", "comment": "Malware payload (DBatLoader)", "value": "8be37caf889d907f1ece2530c09d71f3", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693582260, "uuid": "8a492092-8970-46bd-8be7-abe69a859bb4", "comment": "Malware payload (DBatLoader)", "value": "3074b7ebb1cf86d43eb65ab8fdf650cfc5055c79ec91b2b685d74b7f244d39fb", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693582260, "uuid": "e0896596-f489-4c74-8c82-e5232b05fc3d", "comment": "Malware payload (DBatLoader)", "value": "93e57aa40c70712841ef8207e3aacc0f165b8526", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693582260, "uuid": "7f308804-c32a-4f0d-bea8-eb83e9cc567b", "comment": "Malware payload (DBatLoader)", "value": "9e629ffdc59057c506284778dfaa768975dc461b9933f67aa28e8f9138bbf9893bc12833b683235313b403571c1c63cb", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693582260, "uuid": "056841c4-2dc1-4eba-ab71-e2415af5e7db", "value": "T109455B1DA313CC71F02226398D8A97E4596F3D11766EAC5692B03DBB797239C3E1809F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693582260, "uuid": "d439c903-f730-4d26-86de-d7550c601f49", "value": "bf3ec3b6c9dfb8445a8b90a93664ca92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693582260, "uuid": "5253b316-d91b-42f4-bb34-b06f8f6833e2", "value": "24576:2JRNc81nHOgteb+Eux8cu4sA7IX3ojaFH4:2J7hn40sH4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693582260, "uuid": "67843a48-9b56-4959-94ca-dfb7b871e808", "value": 1174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693582260, "uuid": "4ceb6f23-a6e0-4734-ad7f-896abec07dc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693582260, "uuid": "228ee913-467b-4d48-9287-8b07f078b1ff", "value": "SecuriteInfo.com.W32.ModiLoader.A.gen.Eldorado.17406.4522", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "280db9b6-48f8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693594115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693594115, "uuid": "68df7a84-51c3-4431-bf47-a23781f26955", "comment": "Malware payload (RedLineStealer)", "value": "036165e9b77efcbfb658ceb2eec154df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693594115, "uuid": "6b5a6fe5-7ff8-4f49-a334-056ac48ce7cc", "comment": "Malware payload (RedLineStealer)", "value": "30df272322090057a69018f59d04540f737600d5791df8e995e2e775f61ac0bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693594115, "uuid": "b59b9cde-9681-4e50-a162-8635189fe5e8", "comment": "Malware payload (RedLineStealer)", "value": "b4875779a21fdf5d03e419cec1f0be8030405cef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693594115, "uuid": "1721b8aa-87fb-47fa-87a1-5c8b1e25409a", "comment": "Malware payload (RedLineStealer)", "value": "49dff59975c2b6b43c78791717799c4b5d9df13fad6aef3f00ce7b656b2761684b16e8b830c5d15684b4cd656bcfc86d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693594115, "uuid": "ec2e8f92-8dae-4228-8be7-dc6d50f2052c", "value": "T1ACD56B223A8A9430FFE2A07B46EC7935465DE0B01B762DDB3DC417EE87119D23B35296", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693594115, "uuid": "d03e8012-8e6b-4e6f-a895-01cc40b6c057", "value": "6cd4a8b75ea76087209f389863b0aef9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693594115, "uuid": "727a42dd-b3df-4f7b-82f4-632a78a19e64", "value": "12288:++KCtJEvo+hMurkNtNfNeNa/f7vH6RFu6MDDfWiw9wjKhkX5WNBJthuwnJbdPCFU:SjhMurOtNfNeiF6fhkX54ltU5AOIH0y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693594115, "uuid": "67c8bc7c-6488-4972-abd8-4ebf31977674", "value": 2825728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693594115, "uuid": "45af8eb3-eb9e-4c10-8304-52ed96aa2311", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693594115, "uuid": "ebeed1cc-3a52-4890-9c66-a19cafce6613", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "345d629c-48ca-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693574379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574379, "uuid": "c61244fd-5183-4fad-90a7-9a36b201a330", "comment": "Malware payload (Mirai)", "value": "a0c17ecb89471b3947c7e43e9b708430", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574379, "uuid": "b9784a4d-df51-4c8e-99c8-5f27cf535c99", "comment": "Malware payload (Mirai)", "value": "324290edf6342c609aa66a125e5d636331cfe24ce1589c4d365bbe11fb422c86", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574379, "uuid": "14103bf6-72b9-4421-b728-e28b477df6ab", "comment": "Malware payload (Mirai)", "value": "914b3f425d4b9041eeef3bbe2f9ff6b479de5061", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574379, "uuid": "25262f4a-2289-414c-a087-9f3abd4f05cd", "comment": "Malware payload (Mirai)", "value": "bee475e5640529405413a2604a00e518496000bed01db3f2b6c05f125c1909b5c1d37b5d33fefb39ef13b57d220f0675", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693574379, "uuid": "6c761af7-bfa6-48d3-800c-649ce7dd114c", "value": "T1A243F7817881AA39C7C0577BEAAF104E3314A7DCE0DA7747CC180FA176DA91B0D67B5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693574379, "uuid": "3fb0bae0-776b-4359-8b54-37fbefe7c2d7", "value": "1536:bmXou1DAd2Gmj+4jbZ92qK0zlKpg7MEhWm5uN:bm5jbZQ0z8pg7vD5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693574379, "uuid": "b240bc55-675f-469f-8b5d-5e6561b6e1d4", "value": 60304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693574379, "uuid": "a149f8f9-e5b6-4a02-a2f9-55933fd08f94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693574379, "uuid": "3b1429e0-54a7-49b2-948e-22d46be763dd", "value": "a0c17ecb89471b3947c7e43e9b708430", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "694a1bdf-48bc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693568455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693568455, "uuid": "72efd1b9-808b-4146-896c-15bceae5e6f8", "comment": "Malware payload", "value": "cd2d66edbe500051c5d2711026a84f9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693568455, "uuid": "74809fab-93aa-48ff-9046-b957811bb85e", "comment": "Malware payload", "value": "32f2561030c5fc44aa2efafeec6a0fdc70409ebd1cb5124e02466dc270f3194d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693568455, "uuid": "4dd75334-6b15-46e5-a670-3c1fa9dd66b0", "comment": "Malware payload", "value": "228297d4933ea3be5ec0c88dfe5031b5685518ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693568455, "uuid": "2a8f6ed4-a5a3-41d4-8260-c3ed97de8668", "comment": "Malware payload", "value": "053761982b609ab3a2801cf314a1178f2956a339104dc7b523833e928ae8064dac7dd269c7aaafbb68d37d288606ec13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693568455, "uuid": "79ef1bca-7c74-4dea-a678-d08023594066", "value": "T16AC401EB5ADE597CD9312AB12E4807B4AC111337FC5E5F013690A4858A3238F5F2BDA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693568455, "uuid": "6256d454-1194-40c6-b198-0740ae0187fc", "value": "12288:LBykmbr3S7BPpdBNvKraxaxKviknyJj/qSBTUCTEM82XFX4Hm7PHK:LBy7gPpPZ4axaxyRnyJLqET8IXcg/K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693568455, "uuid": "f3cb4acd-79eb-4f3b-8ea7-521c2e79b261", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693568455, "uuid": "24dd3b89-4cac-4f22-b4d3-dc11b72dd3e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693568455, "uuid": "7b16a65e-aee3-4ee5-b326-94d45e3aef78", "value": "SecuriteInfo.com.Trojan.MSIL.Crypt.27119.30583", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4482c7c7-4905-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1693599746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693599746, "uuid": "19a7f973-71a8-4a99-a8c6-59fed7379177", "comment": "Malware payload (Smoke Loader)", "value": "c20b34625df01f32a1d37676bfe43c84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693599746, "uuid": "4c0a1676-c849-48cd-b767-f9abf6dd971f", "comment": "Malware payload (Smoke Loader)", "value": "33e7df640d73c684871ff3828d1813f000c7a179e06a72f50a2ddefaac434bc8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693599746, "uuid": "6cfdef7b-baab-4607-8a1c-5e7520641339", "comment": "Malware payload (Smoke Loader)", "value": "498b6c87b8d1a616760f3e4e550f4650d5b64dc0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693599746, "uuid": "03ab60d9-5850-4675-9745-5db89de4b92b", "comment": "Malware payload (Smoke Loader)", "value": "07ae0a956be8de834b4b17f05d8b61a2a678229064573cb1e0a5469a38b5138823b5fa120d851d8296f194e701eabd10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693599746, "uuid": "a5f0a069-8ed2-4a57-b652-96b5876245c3", "value": "T12E84C843A2E13D58EA258B729F2FCAF8770DF660CE4D7B6922189E1F04B1176C263715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693599746, "uuid": "93b552ee-8ddf-4932-9676-c2c9f98c41b7", "value": "eb568a174db8395072c750a957035097", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693599746, "uuid": "d5075e56-c125-4ea8-b6c3-9b2f466ff185", "value": "6144:lVGhtukSJDYkJUXxzp9TNmrkl9BTgLUebH/i:lVGhtukS9ZOXVNmr8rTgLUeL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693599746, "uuid": "7f53a5f3-d11c-4d83-bde6-8c82f2d227b8", "value": 395264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693599746, "uuid": "ed4e6e79-b146-4065-8b9a-b2a69a9065d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693599746, "uuid": "ecbc71e9-9051-4977-bfa6-5589741eb7a0", "value": "c20b34625df01f32a1d37676bfe43c84.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3906a6df-48fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693595432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693595432, "uuid": "e65393fc-07dd-4211-8d54-1df276561b3a", "comment": "Malware payload", "value": "c49e71b9774037d536a3dec9e30abd28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693595432, "uuid": "cbc7d29a-195d-4dc2-bcc8-aeb5dfd1f48f", "comment": "Malware payload", "value": "3497ddff46b9ecdc52a704089335deab989ed8e85c6b7ab506ad47d9a44ad060", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693595432, "uuid": "3e25ac29-cf13-44a0-bac1-1ce168d9836b", "comment": "Malware payload", "value": "ca9ce992ecbecd1138af732765d13b851053a081", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693595432, "uuid": "2349363b-252f-47a6-a9b6-0aba37a7bb45", "comment": "Malware payload", "value": "5da208157ec0d22bafbd5d216d6f13a439f977fe2924006d92c7344bce3ae9a49d44a97968f28f1aeb2f1f7de78e9451", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693595432, "uuid": "71f2ff39-8a73-411e-98fc-aaade7474f8b", "value": "T12BD58C1139808229EDF230BB8AFC74658D5DA4F3CF2A05D7768816DF92109F927366DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693595432, "uuid": "371925b7-f977-43de-925c-06aa05de04da", "value": "6cd4a8b75ea76087209f389863b0aef9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693595432, "uuid": "919f9082-df0a-4bda-8b1f-0ab16dc59e7d", "value": "24576:yLhMurOtNfNeSd6fhkX5YhaszLfEHODkud9lhrCgVICSDb7+:5tNfNeU5GZom9lhrCgHC3+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693595432, "uuid": "eaf872ca-ad9b-4145-b6ac-f90779a0f1bd", "value": 2825728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693595432, "uuid": "91049e60-2e5b-441a-9224-9bd891d85e86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693595432, "uuid": "0c941ba2-91bb-447c-9db5-3e23903aab38", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19288608-48f2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693591513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693591513, "uuid": "429bce50-e772-4967-93dc-bb4a508a2a29", "comment": "Malware payload (Mirai)", "value": "f768cf64966419564d426317c3d7ceb6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693591513, "uuid": "01df4c0f-6e45-41be-96c9-07b8325cc54a", "comment": "Malware payload (Mirai)", "value": "381030fda129e1427f8721368f22f341c1eec5a7d42c4b8eed798c01f2eecb58", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693591513, "uuid": "8a296ddc-1441-4961-8713-fa2faf355f74", "comment": "Malware payload (Mirai)", "value": "bcc5f2f20e568ad77a2bde6a1a7b0b28a0cf2d03", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693591513, "uuid": "57a294a8-a7e4-4a71-82c5-2e12d0c7c929", "comment": "Malware payload (Mirai)", "value": "9ad026cae6bf3d5e409be8c6c3567135aac6dd32c6f808c31ebc31b867def789595b4ae6e35c8275cceb5ad3ecbef339", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693591513, "uuid": "0be0ed60-b2a7-48ed-89b0-3dc61e39a002", "value": "T184238D77D43A9DD0C54442B4B5368EB41B23A104C6677FBA5A89C2668043EECFA2D3F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693591513, "uuid": "3bc1a367-697a-4bcd-be83-5b8f895e2ec2", "value": "768:ma2wtwpRB5aqpU8vv8AQ/SnOQ0IXKRClh5Zo6PdiCqj:ma2wtwiEj3wnQ0IaR65e8MCq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693591513, "uuid": "2fc90352-32b6-478c-8071-dcb344837932", "value": 50104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693591513, "uuid": "da18f815-8899-42ff-9b59-1779ff6e14b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693591513, "uuid": "1a804eea-3117-46d7-a5c4-9a971af95d8d", "value": "f768cf64966419564d426317c3d7ceb6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b56875a-4902-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1693598603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598603, "uuid": "0b679e94-8663-4420-8eda-001977e09d42", "comment": "Malware payload (AveMariaRAT)", "value": "7c515201bbb80ef3664260f9cf29f014", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598603, "uuid": "1f1a9b76-ac1e-4425-a019-20567f7d785c", "comment": "Malware payload (AveMariaRAT)", "value": "383601dd286cddf2da8c84ef05cc53416cc4ad308ba53276d52a02562883024a", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598603, "uuid": "ee13273a-2311-4165-9726-9658fd59bf4d", "comment": "Malware payload (AveMariaRAT)", "value": "0b0d4cab5d79f3dc95b9d2c5244e85bdc5442f7d", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598603, "uuid": "e80a1dfc-1453-4abf-b6c9-6e46df055e81", "comment": "Malware payload (AveMariaRAT)", "value": "b508ee775dfc7f182a84f5cdd6b467c6352745c46755b40eb268b860af23f0496d61afd59882f69d0b7fb0db32e1926f", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598603, "uuid": "c48749df-7d5d-47f4-854f-be9d12fba755", "value": "T197752381F5C284B2D273193A4E3CB700997C7D341E34D75EB3C4BE6D9A7A181A625BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598603, "uuid": "d275f2f4-8bf8-478a-8beb-5140b70ae6dd", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598603, "uuid": "7f3e0455-f886-4aaa-9a77-9b8bccbbbd8a", "value": "24576:wNA3R5drXmDH/O7N4F3TGQo94youRB/Xw1vHGE8xhsUfW3Fm2KSz7dYIzLJC79wT:p5UHRmouo1vHRGUFm2DzTFC7VQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693598603, "uuid": "b9ea3689-e6d5-418f-bc2d-721990bd64aa", "value": 1612603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693598603, "uuid": "462ee945-fefc-4d0d-bbd4-a4272d21646c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598603, "uuid": "fa9c3ddd-81cd-4b1b-924e-1d39f2b39c0f", "value": "Odeme.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77bfe974-491b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1693609281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693609281, "uuid": "0400370d-97db-484e-8bf3-e5896df7447b", "comment": "Malware payload (Formbook)", "value": "bf1fc180a61d86fb6ad22cfd907d4830", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693609281, "uuid": "35dacee6-9435-4ec2-b401-64fd52a96fd1", "comment": "Malware payload (Formbook)", "value": "3b7d4417f9a93447a216f1141865854423de0b3802e1ac9b992524d4de92c1bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693609281, "uuid": "bca96bff-e92e-4f02-95f3-b1c91394da92", "comment": "Malware payload (Formbook)", "value": "04c55bed2d9462d344f5bff8c88500c79f4d6ec4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693609281, "uuid": "561184e7-7438-4981-ae6b-dd31354edd58", "comment": "Malware payload (Formbook)", "value": "0cf9b1d67604049c81f6bb7d59a30e86a62faaea52703c22df1f16c7ae12ae58a80dccaec156e599115fc9d429fdec1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693609281, "uuid": "0f192ad4-98de-49a4-ad93-01ec612e89d5", "value": "T1DF45D055E7B04436F0231938C9DBAA34AC2DBD317E14AE0B2BE9095D5B3B391781D29F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693609281, "uuid": "6efd9d95-0e95-4692-9590-18d13494a4d2", "value": "3d0dfcbc350384b57e57b16f197fa626", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693609281, "uuid": "9f1a3323-de41-457b-8bae-0ed5f54d82a4", "value": "24576:swGq5fTk3ROmX7zJDlluqezXlu+VkGdKitox:swLfTcLzJ38Vu+3EitK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693609281, "uuid": "cd356c0f-34af-47fb-8abf-a5af9bf38a1b", "value": 1263616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693609281, "uuid": "b1654d61-8e9c-4761-bb05-e98a6b91b14a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693609281, "uuid": "25884e5a-7d6a-41eb-b7e0-4d78a2806f23", "value": "Deshmi pagese.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c60f0ed5-4888-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693546277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693546277, "uuid": "b3d637f2-efae-46cc-a782-bd399afd12dc", "comment": "Malware payload", "value": "403d0c0946294fa25fbc1259dfb2ed67", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693546277, "uuid": "7d80f884-9328-43ca-aa1f-8d012f4de68d", "comment": "Malware payload", "value": "3be011c3b1c9048d9e096efc3c3a0d98c0e5ec0000ffc8cf389464a5a4650ce9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693546277, "uuid": "8aa44934-55b4-44aa-a15c-b024f155c870", "comment": "Malware payload", "value": "163a6a7918423165728c778d6c9441163275a004", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693546277, "uuid": "ed505c24-04b2-4a39-95d3-5e6f9221a017", "comment": "Malware payload", "value": "4e3b0a533c9d13b5ba1655108ae25428db0b883bddccef076fc84c9f9b4830a314198b3391b0d82959a862ecf9e87f0e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693546277, "uuid": "b1eb47de-7a14-4328-aa21-812d584c0455", "value": "T14F33A64A2E228FEDF66C83344BB70A21A76973C523E1D785E29CD5042F7038E555F7A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693546277, "uuid": "a82e4f07-1f72-4b58-8503-8a256984e853", "value": "768:Wg+7xms5j9Yl31tIZtNRox8i3tbWLlTyt/HdeACgdjzIg:Wg+7xms5j9gt4Ix8wSREeZgd3/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693546277, "uuid": "570465a2-0a50-429f-a0e9-c15ae41af07a", "value": 51704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693546277, "uuid": "bc1b011c-947c-4d76-8a3e-139e005521bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693546277, "uuid": "2ea3cebb-e7d8-4c1d-9b2f-65763685e988", "value": "SecuriteInfo.com.ELF.Mirai-AJJ.1092.17178", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f825a3d3-48ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693597471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597471, "uuid": "d88b7fea-f3dd-4040-8752-f77594e6c467", "comment": "Malware payload (Mirai)", "value": "cdf5bed994e909773a052197b793d8c0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597471, "uuid": "1686c5de-a1fe-498c-b6da-ae6f19090fe9", "comment": "Malware payload (Mirai)", "value": "3c4059f237de12f89afa5cb1b4b9951e717c5f7a0deda27fb3e5163dc8436b51", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597471, "uuid": "faa4e697-ed8a-4f5c-b23e-00a9dfeb1e83", "comment": "Malware payload (Mirai)", "value": "502462884c875fbe56823dcd522916eb99f1e9dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597471, "uuid": "1f523d65-75ec-4059-b0e8-9f83f8e5f0d9", "comment": "Malware payload (Mirai)", "value": "6e8c738838778a4434da17b645bec3bab40b1fc64d4e2fd6bc171afc621e45e635c015c99679508b2d83b1eb1126013c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693597471, "uuid": "41265bde-7e55-4a8f-8140-b12c6ff6d30e", "value": "T1E0E38536B7619E77D81ECE7305A985121C8CD98702D92B6BB2B4E51CEB6BC4F08D3D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693597471, "uuid": "90d38ba4-ddfa-450d-b85b-4fceb77c677a", "value": "3072:dgZc9h1jlnLA2PiXYeyCceVNMVGuo9mrThPaLEnvPrNb:dd7lnLA2PiIeyZeVWDo9mrThPaLEnvP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693597471, "uuid": "cde60464-e499-4660-9f13-2fc8923aa063", "value": 155476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693597471, "uuid": "b3cbd231-8f7f-4e5c-8ba5-60c2d13c1da6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693597471, "uuid": "479df883-f9e4-4f59-b613-b751d55ee82d", "value": "cdf5bed994e909773a052197b793d8c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38ef0643-4913-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693605740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693605740, "uuid": "d3c11b49-2c04-452d-88dd-f69466ac5ffd", "comment": "Malware payload (Mirai)", "value": "592b0bfe236fa9068316b2086e183508", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693605740, "uuid": "eac25ca1-4bc8-4610-a3dd-2a98bc5dc4a5", "comment": "Malware payload (Mirai)", "value": "3ce6354c4e8331b036f61420caa8b900f0e5614c1c161adbb1716ea957d693ee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693605740, "uuid": "92cc13f9-0c75-4f63-8631-948cdbd59d38", "comment": "Malware payload (Mirai)", "value": "717a5aa2b90c52fedb1b0a9ed892c3e3d59c693d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693605740, "uuid": "bae966b4-c0cc-4eea-815b-de782c816f42", "comment": "Malware payload (Mirai)", "value": "5f9b6e5bcf1f20f479afdf1faa0f16d6014b6607c61fd524db4ef7d86bfa31caf1aeb1f17c4d01bf08ecc3999da16708", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693605740, "uuid": "c0a747ce-3210-40c2-a7b5-495f6d8843a6", "value": "T12A535DD9B4119E7CF9CBEABE88224E0DF921221150931B3BBA77FD937D320949C52D06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693605740, "uuid": "bc9a90fb-fb75-4013-93d3-64d76a96a50b", "value": "1536:T0LlfwJ/meLj9OI0dXY7B8og1p2GtFFLHV2y/6CV7lR4NX8b:T/91J8Np2GXJHV2y/HRuQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693605740, "uuid": "69c70542-4e86-4d39-96bd-1fa51fafebf2", "value": 65936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693605740, "uuid": "99979d15-8910-4440-abf9-bd15a845e646", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693605740, "uuid": "89161ce3-ce8c-45cc-a0bc-049a240e8441", "value": "592b0bfe236fa9068316b2086e183508", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44ffb8e0-490a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693601895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693601895, "uuid": "93c9e6e7-c69e-4d74-8490-10f90906497d", "comment": "Malware payload", "value": "8e3aabe720391ebeca140dd333f6e9dd", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693601895, "uuid": "dc30edb4-924e-4390-80c1-297798ed1293", "comment": "Malware payload", "value": "3e23a15fbd7f9611bbec310344c63cd56c0269908c8e36735b56feb39299c4eb", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693601895, "uuid": "58931dca-f613-4a61-b0cc-be8deb4fc8a7", "comment": "Malware payload", "value": "fae88658220de1d17669da8895db1f04d3fdd94a", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693601895, "uuid": "bdbe8660-b11c-4e06-9277-5bb84e1606a7", "comment": "Malware payload", "value": "2f718fe2036c3940e04f585142d0e0a92af12b4196f89558c2bd1cf29b558dbe7a9522650e1bbb4929f0197768f39cd3", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693601895, "uuid": "680d9e2c-01e8-434f-9d2e-16eb08670280", "value": "T189216A17A1F9071CC2F14E3B1874AF0386367809AC2B8F0E725129BC18A52CCE865F7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693601895, "uuid": "22cec413-c4ab-428f-a2c3-dd42003e7faa", "value": "24:8N/LZsxEeZCwEPLZpyAzkV+/4HFr5ws4fK2ByzkhpEQeyTtTVab/2XT7w:8BbwEFoFWLfK2B8khiQBab2j7w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693601895, "uuid": "a73ac9e7-710c-46ef-807e-03a68fe53a06", "value": 1419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693601895, "uuid": "96453121-4791-428b-ba23-fa3392f34bf1", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693601895, "uuid": "df8edad3-264b-4277-b9a7-ed49555d7091", "value": "start-of-proccess.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0383c420-48ea-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1693588041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693588041, "uuid": "1ea35102-abc2-46a2-bdd4-152ada2156de", "comment": "Malware payload (CoinMiner)", "value": "d543754e6c054e141ca6602bd99fe078", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693588041, "uuid": "07823290-db2d-4279-97eb-044092dce9d9", "comment": "Malware payload (CoinMiner)", "value": "3e8c625c24615c02438b4d0dac88772792b86e715d02df78e30a15e85a08b972", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693588041, "uuid": "3cd2139b-e394-41f6-ba69-694dded3363d", "comment": "Malware payload (CoinMiner)", "value": "7495f82bccbb03ebd0f480cb5f3db43c90a337d0", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693588041, "uuid": "8ca0b88c-82b3-4808-92a9-04645e256610", "comment": "Malware payload (CoinMiner)", "value": "f6a68cd48cf913627dcf7a8f322bece8d71b6d200c1b8934d83d02f30040dbfca4abd514f5fc1d9d56b7292bdcc3e4a5", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693588041, "uuid": "f44def1f-69cb-4968-920d-b716b4699405", "value": "T10656DF18B3CCA3E4CA350AFD4DC71D7AA962AB35F8719B36782E4251318E74E5E5C603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693588041, "uuid": "680a4313-2ea0-43ba-b7a9-72761c9720f7", "value": "d3be2dc19ba54f7225d7679c3f791cf7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693588041, "uuid": "36b19f7a-2ae0-4bd5-9e5c-643acd238164", "value": "98304:wx9GQtJZjaTZwfpSAmGwSc1vGEHJRtMJj+PnYx53WcyxIP51wJ1CssqlIpxl2:wj1PfELuc1vG+JgkWIcyxo6Jo00e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693588041, "uuid": "0846adb7-19f4-4a1d-b34f-71402d6e5d48", "value": 6029624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693588041, "uuid": "304af2ac-10b7-464c-9e21-be86dc9fedb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693588041, "uuid": "74a4730f-b2b6-4518-8fc2-e08cc96b70a2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b5fc1ff-48ca-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693574364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574364, "uuid": "c053fbd2-ce5f-4bb4-8074-068cc7034010", "comment": "Malware payload (Mirai)", "value": "b25d6abd3ab7e0c67ec6b290db89f32e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574364, "uuid": "b960607d-df2f-4a56-9a9f-15048b361d7f", "comment": "Malware payload (Mirai)", "value": "3f7cbf18661c3463464863f63135bd33b6843ece737b1a7cabc70620d6e5e1b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574364, "uuid": "e68cd93c-b470-4ae6-aa1f-52a6ddb3af02", "comment": "Malware payload (Mirai)", "value": "fa48c8bec1c90cbfd6fa090575c043351114b2ec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574364, "uuid": "555f31fc-b1ca-4d38-8378-fe6b501cebd9", "comment": "Malware payload (Mirai)", "value": "8356b99690d637853de15debc66e412d362a27bd8354b6dd65065a38af7b195b2b821e1b0a94978d0dc18eff34db3705", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693574364, "uuid": "b4ef23f8-0fc4-4f32-ac86-1cc70ade7163", "value": "T181C2D084F045CA01EAE729F63948CBC6FFD42F1E7A668E812AA053D19F5C3629205DCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693574364, "uuid": "e21bb870-22f6-4096-8cb9-874281ed2a06", "value": "768:9VdafO76jpmNJJKehmA7trpfIX9KeA7PcNok4uVcqgw0F/cnppf:lam+AnKehPRa9aUNb4u+qgw0FA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693574364, "uuid": "5155b40b-40bf-44fa-be0c-6aba5d43998b", "value": 27548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693574364, "uuid": "1521e897-7d35-4970-9080-d6b85e7f4096", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693574364, "uuid": "0ec364a1-6243-4312-85bf-e5c4022c0155", "value": "b25d6abd3ab7e0c67ec6b290db89f32e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eea5e5bd-486f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (KnightCrypt)", "timestamp": 1693535607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693535607, "uuid": "3505ce2f-8adb-4218-b957-839a24388001", "comment": "Malware payload (KnightCrypt)", "value": "1db4a306d07a22b2744c412609a33509", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KnightCrypt", "colour": "#81A14D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693535607, "uuid": "2c9c1905-b95c-4dc3-862d-d236c862cb19", "comment": "Malware payload (KnightCrypt)", "value": "3fbedfb9ae1e9bcef7983491124e3a50937f9c5209b7cfc2614197a2e8045cfb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KnightCrypt", "colour": "#81A14D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693535607, "uuid": "5cb4005a-48ce-427c-9e07-aa37a6e51b68", "comment": "Malware payload (KnightCrypt)", "value": "af277577f9cc932686ac0f6b3da44133b26c3188", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KnightCrypt", "colour": "#81A14D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693535607, "uuid": "dee9ef2a-3b42-4303-9767-dd1924afe460", "comment": "Malware payload (KnightCrypt)", "value": "3b4107a9d0a4b6ff4d9f27f82003bd43b2795aa8dbf1a8600ea092fe93735df9680801055e7d6e1c0e7f440c8fff8219", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KnightCrypt", "colour": "#81A14D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693535607, "uuid": "32964b90-2cc5-4853-b642-8ed59767d7ac", "value": "T1F5556B07B69941E8D43AC1B0CA564332EE71BC950F34A9DF0690B3592F7BEE46B3A711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693535607, "uuid": "f569f74c-e199-426c-9bb1-96a9b64f9df8", "value": "92ed8fb21c381a073a5e7ca35347f90e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693535607, "uuid": "e423a3ea-57c9-4c95-b427-ccea8d3aafbe", "value": "12288:fBVVtkNBJOlMmXP0447OdMyogfJ7gwPueClVVRWM5YDh8xpoPLouMA+nkGGCp+dE:wTcCG0447AMVgfdnTClVm4QLcGRTS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693535607, "uuid": "e124a981-bbef-4ed6-aea1-d08cc8fc8a64", "value": 1392760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693535607, "uuid": "48809cbf-38b2-4769-a161-6d9be2c9c134", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693535607, "uuid": "e3a2c07d-47e2-4caf-9a23-31ad995a1e72", "value": "SecuriteInfo.com.Trojan.Encoder.37908.9450.12930", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1460d528-4905-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693599666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693599666, "uuid": "8193c278-89d5-476f-9cbb-1fc907ef4393", "comment": "Malware payload (RedLineStealer)", "value": "739e05c04e6038b20b334ae3c9b56063", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693599666, "uuid": "c37c90a9-7055-406a-bdc3-768076b8cf53", "comment": "Malware payload (RedLineStealer)", "value": "4074f369639ce557527c57013a4b567aa24628a7a6d6ae7c11391c7fcc710a62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693599666, "uuid": "bc807a14-05ba-4411-99ca-9e275b366374", "comment": "Malware payload (RedLineStealer)", "value": "40e5f6a68f4b650f60bde8ef49f5c5f123ce9cb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693599666, "uuid": "d70df5c7-e9ca-444c-88f3-ca8d76ad5845", "comment": "Malware payload (RedLineStealer)", "value": "436ef01f1453e64158fc72ab0126e3cbcb8f34ac659f9a7e72d1b5a405cf798417b89bed639fee0b42ba7029a400f5e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693599666, "uuid": "663957da-22d0-42af-a9ef-e7e79a775aa2", "value": "T12CE41246A6D89423E8F11BB41DF707830635BDE09D7447AB3B816C5A1CB32A0ED7973A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693599666, "uuid": "ecd51d95-1b05-462a-8527-31161118298d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693599666, "uuid": "e0f22d87-7dc8-487d-ad40-67a9655b3b94", "value": "12288:oMr4y9016RCKlXVZl13/RBk5b/qXX0hal1i9tbA1vMq:Ayy6f9V93/8FiXX0hi1i9tbK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693599666, "uuid": "196544ec-0663-410e-8dfe-87e9a7451764", "value": 715776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693599666, "uuid": "42882aa5-cf4b-45e0-9d99-b287753bdf2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693599666, "uuid": "446f82f1-7dfe-416a-8904-50a74279e321", "value": "739e05c04e6038b20b334ae3c9b56063.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c274d6c5-48ca-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693574617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574617, "uuid": "23023418-73b0-49f2-9a78-d1bf3d05d089", "comment": "Malware payload (RedLineStealer)", "value": "74ed1e0be9d2fedfd941a8e9ce6b12ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574617, "uuid": "0e9af7ab-5e08-4262-b388-3a39d80bb009", "comment": "Malware payload (RedLineStealer)", "value": "410de93aa921085a5217266163b2e52a1ad11750788df4e90c667eab6686db30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574617, "uuid": "f98fb41d-4d51-4ac8-b316-cf0147ef5b98", "comment": "Malware payload (RedLineStealer)", "value": "3be7f8e3d401c6e81272430c03afe5af9e15e33b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574617, "uuid": "2b0b09b9-97da-43ea-9d56-b4b6e4bc5bd2", "comment": "Malware payload (RedLineStealer)", "value": "4cdb46e17f8fd03cbb9c9fd3f54f536f151b17f105150e2b2277d2f2d349853f0c24207bc555b536787a72e485ddd3e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693574617, "uuid": "9a3f1094-b84c-490d-8952-16463b01e207", "value": "T145C43A4382E17D58EA258B728F1FC6FC770DF6608E097BA522189E9F04F11B6C263795", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693574617, "uuid": "7d9e7776-edff-48cd-b956-60281c34f622", "value": "eb568a174db8395072c750a957035097", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693574617, "uuid": "b58c4fc6-ad0b-432a-baff-6d05a0df1768", "value": "12288:TK6EIlRAUXxGwlH6gzXFJRwMG5tgLUeL/Y:TdRXvlH6gZ7VG5tgLHL/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693574617, "uuid": "2c976d82-0350-4b5d-a7b6-58a95efc7167", "value": 550912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693574617, "uuid": "6fa865fd-c5e8-4ca8-83b7-8610625cbe52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693574617, "uuid": "5b1b8d9f-37b6-46d8-9538-08a08acf85cb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea83772c-48fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1693595730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693595730, "uuid": "f0df4a19-c718-4aba-aad1-20e8f86555dc", "comment": "Malware payload (DCRat)", "value": "9256272aefd7077e6fa50666af214ecf", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693595730, "uuid": "7d14c42e-13cc-4d2b-a8d4-42ae390a73f3", "comment": "Malware payload (DCRat)", "value": "440b8fddbe5dd389f6713b53b55d1935a2f712decd58df0752892deed1cca681", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693595730, "uuid": "acacda87-0be1-4fe8-8c00-1d33dc20a8c7", "comment": "Malware payload (DCRat)", "value": "9867c7878201a63f15e6d7a59171245fbef1a70c", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693595730, "uuid": "dde8a940-5294-47e2-a227-3e7c155bd822", "comment": "Malware payload (DCRat)", "value": "8975ec7ec7cf4d1254bdecff6aa47e658580f8a1deece3f18ce066dc63bc5841999a14a6027093e3511d1933a20108a5", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693595730, "uuid": "71880978-d03a-4cc3-9588-b2976db011a7", "value": "T145352363E2E08476D8B657708CFA1AC30A3C7CD089BC42AB27456D6F5CB31D598727A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693595730, "uuid": "7994584a-dfd2-42da-a5f6-0a1dfdce320a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693595730, "uuid": "d6af6701-3aaf-40bb-b6ac-5d449c032057", "value": "24576:lyCCoUgP711YPr3yzq3So4yrbvfg98BZQieAN1hIIgYFf7g0f948:ALtgP70zg8FDdhIwg0f94", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693595730, "uuid": "130aaf25-7cce-4e3e-a262-a0bf7d5a2d31", "value": 1148928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693595730, "uuid": "b59336f2-676f-4e8f-b7a6-aba92958abd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693595730, "uuid": "9e377ea4-d44d-4826-a84d-8d8ebfd1e6d3", "value": "440b8fddbe5dd389f6713b53b55d1935a2f712decd58d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dee0206-489c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693554611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693554611, "uuid": "92bcf1b0-caeb-4baf-aabc-9194444cb817", "comment": "Malware payload (RedLineStealer)", "value": "e05ab4252fc9cef7640f3c8349170bf0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693554611, "uuid": "62c0543f-0d67-43ee-a0b8-daf9b7cf1f11", "comment": "Malware payload (RedLineStealer)", "value": "441fbd3781bfd94169af8e5e404af98224f8f67e33a66d4561d1826c51057f3b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693554611, "uuid": "f5f79e74-dd06-4758-8bb3-253d901e60ee", "comment": "Malware payload (RedLineStealer)", "value": "056049de75c914382f33a80db43cb25e38d7b56e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693554611, "uuid": "ed87920f-d231-4861-b7f9-511dc25fa16a", "comment": "Malware payload (RedLineStealer)", "value": "8e2d57ef2b03424f5763bf32ccef16f240bd84102861855a2d1d3b959757316f4d96cc39f8050e5df27c8e44ffa86cab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693554611, "uuid": "499d3bf6-f647-453a-a357-2089eaa678a1", "value": "T13F9427B73E465CD3E7617D31ACA14FB0818C31EF4D7A27CA27D9C2525FB6AA44922C09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693554611, "uuid": "545cc069-1751-4abe-b09f-4a0c20343205", "value": "79949fb04969b0ad00a160f76c9427ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693554611, "uuid": "6dbcedcc-8089-4ac4-a0c7-a219538ac428", "value": "6144:AoizW2ZUhIjeNhvWAQf4Dtdq8oSCdqVJEDlJeZv4eSRkXM:AoiKCjAhv04Zdq8oIEDlJav1HXM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693554611, "uuid": "e97ba5dc-c14e-44da-a55c-7e78a5adbc68", "value": 439808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693554611, "uuid": "7b28150c-0901-41c3-9e50-eecd4d800ce2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693554611, "uuid": "e23a126b-f605-4a24-b64f-5d0d4991753a", "value": "e05ab4252fc9cef7640f3c8349170bf0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "762ca243-48ea-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1693588233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693588233, "uuid": "a42af451-9727-410f-b200-60e3c057bdab", "comment": "Malware payload (RaccoonStealer)", "value": "0aecb987fe54d6a7ce3564e896d9474a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693588233, "uuid": "08e1f2c2-fb6f-437b-906a-3cf0583218b3", "comment": "Malware payload (RaccoonStealer)", "value": "4420d56e7d9699dc1962cb5504cd177d428aa1e2bfb96a77dfa455947d712cfe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693588233, "uuid": "cb117ac3-6154-4e33-982d-1eab340d9f74", "comment": "Malware payload (RaccoonStealer)", "value": "1d5cdcbc59881c8e4623156df12b448d92d52de0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693588233, "uuid": "36c3b9f3-fe35-4c4b-8f90-495e2edd40de", "comment": "Malware payload (RaccoonStealer)", "value": "d68b6525bb00824a3787ec367820d83302d0e396942ca9ae83dda1d26cc6fc48ec608324a9262ab1482781471c6e73e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693588233, "uuid": "9597ab79-a15e-4e24-856e-dee72860854d", "value": "T18D86E152BB478E87C5459E346863604C9CB4F0CE7F43EAA77A9C324E4E133816BE66C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693588233, "uuid": "1ac1ea80-859d-4a1d-a2c2-ae89964e9304", "value": "5aac13b454c010f0b5d38f6a34b2bd36", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693588233, "uuid": "fbd6c486-6e69-4881-93aa-e4040d3a14de", "value": "98304:H0oAscORbbtQcHoH8l5c9Br/yJenMFfYrwnYA5dsorfQYvxyvejlgAGCgbRFWMxS:H0QbbHoHs5c9xdMbfP2ejTevyZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693588233, "uuid": "f5f8165a-5394-4c57-a46a-2ba01ad704e7", "value": 8114818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693588233, "uuid": "19b57e09-281d-467c-8d7e-1b83ca6361c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693588233, "uuid": "47cdf872-24c3-4bec-a413-43879fd28a26", "value": "0aecb987fe54d6a7ce3564e896d9474a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dced01b-48fa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693595091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693595091, "uuid": "805aca14-1373-4d24-ab9d-25b32af7836e", "comment": "Malware payload (RedLineStealer)", "value": "9c515330f048d94e739050e377375665", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693595091, "uuid": "038a97ea-20fe-4e6e-a30e-6e0019dcfb55", "comment": "Malware payload (RedLineStealer)", "value": "453501d0a0803c459d4e4146cb4c934e809cf192f3d7b2aadd38c1d5699a7ef1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693595091, "uuid": "028d355d-d56f-4dc5-ac4f-8b3001b3d155", "comment": "Malware payload (RedLineStealer)", "value": "35193606209cc2384d8287117ede709d0da96fd7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693595091, "uuid": "1cade2df-873b-465a-87d4-042b6fd758f8", "comment": "Malware payload (RedLineStealer)", "value": "1f3a82cef5170ff245d876dfde60c787ccedb431d030f5d08eebb4266468c594ade2b71c6a44a2dda1b03e59cd955f07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693595091, "uuid": "1d98daaa-c559-4bd5-951d-f77583bca1e4", "value": "T15C04B458364BAA7EC96F483EAC600CD1767C6C631242A7079D8EF0E9793B7C19B051F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693595091, "uuid": "c135243b-4f5e-4ff2-88fb-9da8c8a6564a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693595091, "uuid": "e725a27a-2e54-4632-900f-11fef59732ec", "value": "3072:nbZFuR0a+I0Xf1lwOxXftjZ9CGE02s6bDYfgLaJ18e8hZ:9FS+I0Xf1lpZ9CGE0eDYfgLaz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693595091, "uuid": "a16088bf-d105-481b-a9c2-e72b076ad7ae", "value": 178176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693595091, "uuid": "40eee6ca-72b0-4019-9704-30852cd6f5ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693595091, "uuid": "86cb54b6-2f5f-421b-9bea-27f3e92447a8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9c88535-4866-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693531653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693531653, "uuid": "bd0223d4-4eff-4ee9-87bc-971d4b98411f", "comment": "Malware payload (Mirai)", "value": "1564ed85f865837f002a025b6a0b628b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693531653, "uuid": "9e16f105-4984-4075-8651-141e670a52c3", "comment": "Malware payload (Mirai)", "value": "4607f17edd08ec41942810a2f9fa7f0e9c848e2725e545995a3b852741aee2e6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693531653, "uuid": "96270321-40de-4b14-8f99-0cbfe4ab8a47", "comment": "Malware payload (Mirai)", "value": "e6b53e376eba89aa39893ccf2d8b1b9977665b91", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693531653, "uuid": "1433407c-894a-4857-8bbd-bbd4c0a160d2", "comment": "Malware payload (Mirai)", "value": "c0eeb2a96b59fe8438b36f413fa0b71c6ca7f99f7361e819eab1c01e58e5f8a7744e91aa75c5acbb7f72c35a32416ac8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693531653, "uuid": "94b91d99-3637-4db7-856c-60b404e81fb9", "value": "T1E4E2E1B94B3506A6D9F0AE76D6F6CD4253613B3C6159B443125017EC9AC260E33EA4C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693531653, "uuid": "0172f067-2703-43a8-86d1-bec4ef7f21af", "value": "768:kljOHlOTcLs7Z8FviuyIENCHBhroJ4qDkGZ1vP5AnJKhhb9q3UEL5e:kAFOqquyqBhEiQLhp36Ls", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693531653, "uuid": "d9fc31ae-4788-4af1-a955-8c8f7fa20832", "value": 33036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693531653, "uuid": "116c034f-ef09-40e1-a456-e650b68984e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693531653, "uuid": "514c075c-369d-43c0-9fdd-9d2a7b75a0be", "value": "1564ed85f865837f002a025b6a0b628b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31d68cec-48ca-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693574375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574375, "uuid": "9b383050-dfec-4590-857a-b09d413b34f4", "comment": "Malware payload (Mirai)", "value": "3aee705dc4c9b3dae1f165214c37dc13", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574375, "uuid": "f2dd7495-702a-4741-9e0e-a6fef73d3d2f", "comment": "Malware payload (Mirai)", "value": "464ac9679522818462efc7c4b49a2f1b83d02fbb8b0eee2dabfe3a2546b51065", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574375, "uuid": "6c89a418-d2ec-4c10-922d-e554181b2c3c", "comment": "Malware payload (Mirai)", "value": "398b0cad5323fee63bfa19afb0bcf946cc1c3561", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574375, "uuid": "93c5d8fc-884b-4d43-a420-afdccda63d07", "comment": "Malware payload (Mirai)", "value": "fbead8d2354a0cb13e6002173fab65cd29da826964f0d6e75fb733dc13e786524b5c6978dd3859ba6df82ee7c5ca7fa0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693574375, "uuid": "15714691-cc52-4be6-b30a-598ccb092a61", "value": "T1EAD2E093E3E19BD4C9DE82770FAEBF5F8CA5331C514896728DF0332249C8B5929955C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693574375, "uuid": "1ccae80e-04e0-4880-bb2c-b5f8768c990c", "value": "768:ZlPK4ZSlTXdRSRYuLgq4JhV2SGmBSefz8lwfYnbcuyD7UlUhf:ZlS4S0I2Sxgnouy8+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693574375, "uuid": "88b1726c-a8ca-404e-a4c1-4f25024f8f28", "value": 28460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693574375, "uuid": "2040babd-0b9a-47b7-a42c-4e8dad42668c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693574375, "uuid": "b5931ecc-c84d-42a9-9698-ede71cfad43e", "value": "3aee705dc4c9b3dae1f165214c37dc13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e17c5a05-4901-11ee-a6f9-42010a9c0055", "comment": "Malware payload (WSHRAT)", "timestamp": 1693598292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598292, "uuid": "9bce6385-b7cd-483a-bd6b-82515113e95c", "comment": "Malware payload (WSHRAT)", "value": "e6345728433a16afa4f7a0d51341aa92", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598292, "uuid": "313199d9-2b98-4485-a744-df0cd0845735", "comment": "Malware payload (WSHRAT)", "value": "48bc766326068e078cf258dea70d49dcce265e4e6dbf18f1a0ce28d310f6a89a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598292, "uuid": "e16b71ac-a67e-4218-9ee5-c6a8e0d09859", "comment": "Malware payload (WSHRAT)", "value": "b9d2abb57a98cc815feec3b09a213ef0917c54e6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598292, "uuid": "ac68b9bd-5ff2-4667-bbd5-5394d1110f19", "comment": "Malware payload (WSHRAT)", "value": "436a4b899d2b5e08ff881d93937a0c24f22561ae7a6f4f3dd778a7174bae665137fcb99a1f33b7505eb814fd91b2dcc1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598292, "uuid": "ba3dece6-5482-40f0-9b3e-ce4bdf7dc8c2", "value": "T160F1B60744720BB2667E5E2FD71983580F69C6B55B2A325FD4AFF324260AA70029EF17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598292, "uuid": "f3077f91-ef30-4402-afd4-3b09a6506d4d", "value": "96:BxIeyahwb8yHBmtQ+VUVQVPvVNVdVLmhHoi:/F7Pu+myBHzg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693598292, "uuid": "ee103776-5e83-4a27-bffa-4c952e4248f6", "value": 7935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693598292, "uuid": "1f7d3617-1c3c-4f69-858d-58029ee651ab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598292, "uuid": "9c6b1b2d-2d8f-4bef-9b8b-63460833ff36", "value": "Purchase_Order.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a760558-491b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693609205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693609205, "uuid": "35a13809-bc18-458f-8adc-a1e6fc248bd4", "comment": "Malware payload (Mirai)", "value": "9181f4ebf20a5ccdb31311efc582df6b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693609205, "uuid": "d825f679-a741-48ea-9c4f-0f7e065f0d86", "comment": "Malware payload (Mirai)", "value": "49e8aceed58370a3b65381197e2ac89f6c17d1131065e93d403a3c2e1ac0af4e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693609205, "uuid": "6ce35e4f-af06-46d5-a4c5-6c7806ae78e1", "comment": "Malware payload (Mirai)", "value": "6cf25d991df09f51ba7162c24c945b08fdd1210f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693609205, "uuid": "4bc02628-1b32-4ae4-8389-28b4860aaee5", "comment": "Malware payload (Mirai)", "value": "ef0922ecd7a3e7abed93a9bdc3283439d4bc2894666b0a1d83b5f6e9c64168d15dd5e79f8c2c85b50c222dd9347f4462", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693609205, "uuid": "9b17022f-3405-4d55-9b1b-e476f3823136", "value": "T1B5433BC4E5A3D9F5CC2201702477FF329E31E0F91266EA87E7A546736C8A7029907E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693609205, "uuid": "14216e25-5fc3-4538-91ec-055f665fad4f", "value": "1536:Ee3vqJ7/eePlJzxZSNZrgBRmDQGNML8hRo0:EUqJ7/eePlJzxZqrgBRCXY8Po", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693609205, "uuid": "ac3ec5c6-53e6-40ad-8c1c-51662416767c", "value": 59536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693609205, "uuid": "a4b706d5-1d32-4133-bdf1-de3387232cc4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693609205, "uuid": "2b2798c8-7b2c-4ed7-9779-59dfdefcdb99", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbfaec37-48ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693597477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597477, "uuid": "79d79bcb-d327-4acd-a8ac-3ada643315d7", "comment": "Malware payload (Mirai)", "value": "da69d31f304d33aafca5a245f0d15087", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597477, "uuid": "0ea915a1-e044-494a-8840-8641d98fec07", "comment": "Malware payload (Mirai)", "value": "4ace4be8eb9a6ce27fc19d4f8937820803aa777a7b40ae0ea0bb0c401e18fc47", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597477, "uuid": "08e424aa-4370-41bf-834d-9dc9664b06cb", "comment": "Malware payload (Mirai)", "value": "563161d5a0263676e514b3af1f8f21d76969a831", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597477, "uuid": "8cbe7797-acfd-4fc2-8001-f13d5747e452", "comment": "Malware payload (Mirai)", "value": "950517ac933246d64a4d899340336c36e425dffaae4ec5efabc9c1fad446fef1db50785b64146b599a9ad3a04c089f01", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693597477, "uuid": "2c81a477-ce38-4519-87d0-3ba31be0e674", "value": "T17EB33B376251C97AC08356F427EBC5729D13BCBB0B32219A33D47D60AF368DA1E99B05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693597477, "uuid": "3e3d1ff2-66e4-4ac3-9cc0-50658c5b500d", "value": "3072:kiry859a2ADJf9wHYqbgFFo8+HeAe+TRCm7FnVqfJXFWbNb:T9a2aLqkrMBsm7FnVqfJXFWbNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693597477, "uuid": "8474bafb-ead2-4f5e-adda-dcfcc35aa014", "value": 116503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693597477, "uuid": "6a587c9b-eb15-4c30-b969-85347857db60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693597477, "uuid": "4f9bbccc-52f9-44b0-a581-38789551f209", "value": "da69d31f304d33aafca5a245f0d15087", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33646423-4900-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1693597570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597570, "uuid": "8cba9ad8-cf50-4422-82a4-4d531f99e7b8", "comment": "Malware payload (SnakeKeylogger)", "value": "dd4caf43d084d3cf2283bfe11e4968c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597570, "uuid": "8f56d5f3-8eb3-4b77-9a34-2fe4ba9a31e1", "comment": "Malware payload (SnakeKeylogger)", "value": "4b8a9338146f2ca8ff7df6b87a3c3d1259be892bc9ba9bfe7be77724891ebb31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597570, "uuid": "52e712ea-512b-4580-8505-7d0b8c586e8f", "comment": "Malware payload (SnakeKeylogger)", "value": "a7cb6790fc21e8111cda37717856153a45506c38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597570, "uuid": "d17b668f-f6d3-4aae-8fc9-115e4dd423ec", "comment": "Malware payload (SnakeKeylogger)", "value": "1c7f8a3f5d167dd0522459dd558003ff6ee62346e480f060330bfcc86d893a4391b410171fd20a3e31935b8702f24bf3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693597570, "uuid": "aff5ca7c-97fb-4c67-93ec-a9b5bc181438", "value": "T1B2720D22F2989A52D2F80573CC4EA550223CEC65A86B426F6CD37D1FBF7B7311513A62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693597570, "uuid": "87824494-7b77-4493-8c6b-84546a226e6c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693597570, "uuid": "920fcdfa-f670-4aad-9b9f-530eb340476f", "value": "192:zzWGX9PcgfFj/fcX4Zf8kpRiCI/BpFNPNZJ9afe3KUu:39fFgoZk0RiCI5HNPNZJ9afe6U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693597570, "uuid": "61ea2c36-c275-458a-89cf-bde1970bc18e", "value": 16896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693597570, "uuid": "74d626d9-d7aa-414d-8c4f-47a2bf6f8142", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693597570, "uuid": "058c3377-7643-4721-8299-5f6247085730", "value": "854F1E97-5BDB-4A87-A566-55D9012B05E3 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "566f9700-4905-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Vidar)", "timestamp": 1693599776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693599776, "uuid": "e669db82-5b68-4f31-9a7a-c5e0ae5b8ac9", "comment": "Malware payload (Vidar)", "value": "f6396396db37a21511b9a79d8ecec405", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693599776, "uuid": "eab14f01-73ac-40fc-b5c1-94fd2f7d1d83", "comment": "Malware payload (Vidar)", "value": "4b91b9c26f507b6d1cf11d20933015290f37f8f19e5d7e56acf7e03dd084ea87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693599776, "uuid": "3a784f88-79c3-436f-95d5-f582ba4749ad", "comment": "Malware payload (Vidar)", "value": "e6cce88f1b317e0a64fe52c553e52afcb14fec5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693599776, "uuid": "c6b68621-0799-4f43-bc86-23c9d096f747", "comment": "Malware payload (Vidar)", "value": "b1031b9679278ab3ccc40dde71905ad275f9af9cd31104774d2c5fc8c4591c326bcbf27d5b7fda44cfea3c57a147757d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693599776, "uuid": "0dd57428-776f-4ec2-8883-3b4ea2ba9945", "value": "T1D2159D0382D17D99EA254B728F1FCAFC770EF560DE09BF6522989E2B04B1076C263756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693599776, "uuid": "c7c779e4-7c07-495a-bd8f-9bd94dcfcc0e", "value": "eb568a174db8395072c750a957035097", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693599776, "uuid": "99880183-b07a-40d2-a1fd-f347431c159c", "value": "12288:iCENZyya/upCiJQ8J3J6xHhp+u9TtOK4GgVZzdcgZCvMJnRbp0Ugo9kg3TqgLUeT:oG4CiJQc3JqpT9TIKIdt103g3GgLHL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693599776, "uuid": "b48a15d8-ec25-4557-a4d3-85c55025d85e", "value": 905728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693599776, "uuid": "211064f0-7c14-4af8-a58b-e35bc1223792", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693599776, "uuid": "7c286209-1506-40cf-848c-4f1c2f135779", "value": "f6396396db37a21511b9a79d8ecec405.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df5459ce-48e4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693585833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693585833, "uuid": "f557f5fe-d5b3-4949-89eb-d4aeb2ccc3c9", "comment": "Malware payload (RedLineStealer)", "value": "0a8b8d973e5bc3013679d46fb4aea58f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693585833, "uuid": "62937427-26ae-420d-9ad8-01840a541c39", "comment": "Malware payload (RedLineStealer)", "value": "4c8cc476763730d7e0df2e04e2d2aafa7aeacf0f74caa8f1cb9021f6981719fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693585833, "uuid": "84f656c0-20d5-47cc-a8d7-a800f584d078", "comment": "Malware payload (RedLineStealer)", "value": "35225e42638b7ef9a47ae8dec21760c8af02cf83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693585833, "uuid": "5c47a89e-f297-4a03-9d2c-ed47f57ffb03", "comment": "Malware payload (RedLineStealer)", "value": "a0379bc4cfe79ac5d33ba3ac00c36fb01588d413d627c2f73978b242ec98c0d6a7e9f9ee676c96f5ec5f2e451b879547", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693585833, "uuid": "eb48ca38-3759-430c-a19c-7349841629f9", "value": "T146E41213FAE9E076D9F12B3058F60A931F363DB39D74C32B66418C591C32A94A53277A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693585833, "uuid": "545526e1-3543-4b52-a774-84060ffc6523", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693585833, "uuid": "967614b3-6296-4d35-8555-b538804924e2", "value": "12288:gMrLy90XrSfd4Vb9E+GloEGnV1ewp23rCmIdsDSgzSZgvD2U:byrW4yEGfa7CmIK2hgvD2U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693585833, "uuid": "3894686a-8279-4a98-8fa7-a7b1f81055ab", "value": 689152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693585833, "uuid": "cd4be544-6433-455c-8322-d69066d5dd59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693585833, "uuid": "0eec623d-b358-4359-b8e1-9c2bf1c6201b", "value": "0a8b8d973e5bc3013679d46fb4aea58f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba85bb86-48ea-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Spambot.Kelihos)", "timestamp": 1693588348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693588348, "uuid": "7ec034ba-d883-4d3c-b4bb-f5b24fd19a8a", "comment": "Malware payload (Spambot.Kelihos)", "value": "58bc43389c3e720c0af4ff563d5ed7ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693588348, "uuid": "761c82cf-de22-4c83-a9e9-f4c110449727", "comment": "Malware payload (Spambot.Kelihos)", "value": "4d7a22a1f7d76310b2c8420cb2f02ef4633cb689e4b8eaaab165731b9341163f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693588348, "uuid": "d4ed2c82-8107-47b3-8275-d3fe9cfcea51", "comment": "Malware payload (Spambot.Kelihos)", "value": "3eefb63111c7ba5b569cc6481867a83c9809ff1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693588348, "uuid": "84d8d735-d253-4da6-9847-0ec91e27792e", "comment": "Malware payload (Spambot.Kelihos)", "value": "685d549b51e454a1de26b3b3f40ade780c9dd0d9c5b39117b90ea6d2364911f72499dd816de82c52b0e18880fc2df924", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693588348, "uuid": "d1d6cdd4-75ea-4a46-a36c-6228f6772c2b", "value": "T148D4FD1BC0214D1D78EB8167CF9FF869B8ECC667CE29E0CA197006D0D4EAD794E93129", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693588348, "uuid": "bf38567c-e368-41e7-8072-76d316ee8ee0", "value": "a9c887a4f18a3fede2cc29ceea138ed3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693588348, "uuid": "48d80ed1-adbc-410d-9ff4-e6425d5db7e1", "value": "12288:ZR1BzB+BS5RMmF6We5AQtL8Luq2qL5e+iNqajC2UrhOhmfnRl:ZR1BzBGS5RMmF6We5AQKLJ2qjIqa1Ur5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693588348, "uuid": "86535049-50ad-4258-a9f2-4ccf60ec0c28", "value": 602624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693588348, "uuid": "6efcc2bd-c7cf-49a4-a3d8-09ca43a3fdcc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693588348, "uuid": "8a2c8c1f-3594-42e7-8e79-ebfac20e47cf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daaec437-48ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693597421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597421, "uuid": "b853662a-01db-4940-9cd1-121fc1b4a152", "comment": "Malware payload (Mirai)", "value": "c7f2a28242348cabaae40bd20cfb4345", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597421, "uuid": "c0eaaff0-e207-41fb-803e-7e3773a31e9a", "comment": "Malware payload (Mirai)", "value": "4d7a7dfd93fde57506ffc3d57739b9ad0e6e62fe36946aec964d28198f9ac436", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597421, "uuid": "1d6af6f7-933d-47f8-9ce2-aae798b4bb4c", "comment": "Malware payload (Mirai)", "value": "550b888b03ec194df6673650ce0017d323b544fe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597421, "uuid": "a82e02cc-9388-449e-bc61-2c2baf9f4f4b", "comment": "Malware payload (Mirai)", "value": "83bc7252b973d32337b89f4c041f0a7fc8e25ba9d15e8103737ee28845253a7c0f749b58c2819af1b61e2f6297ddbe8c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693597421, "uuid": "52df76e2-7904-44b0-aa63-366b2caba79e", "value": "T124B3F872B804DF66F00A96B504D38B367E30BFA70E6316A2731B39669D331D528A7F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693597421, "uuid": "51362a44-cdff-48b1-91c7-7e4e48cdde4e", "value": "3072:Ydg8GXIDvGIk1MG8+mjypvZroamm/QcuLB1niDNb:YuFX0GIk1MHyph0amm/QcuLB1niDNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693597421, "uuid": "b3223436-6123-41cc-917f-381f2fbbacd8", "value": 118090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693597421, "uuid": "6abb1dec-ad7a-4316-b1af-2219d06d941d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693597421, "uuid": "1e41a409-39dc-4f25-8b75-2e7889d3a78a", "value": "c7f2a28242348cabaae40bd20cfb4345", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4eb200a-4902-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693598620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598620, "uuid": "14db0bc9-551f-49be-8d15-cf3fa843c825", "comment": "Malware payload (AgentTesla)", "value": "eaa3a4b44d8e2d2352c44bd30b6dc93b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598620, "uuid": "420a9d84-8448-42e2-8677-82d0ed559cfc", "comment": "Malware payload (AgentTesla)", "value": "4d9a6071be4656cdcc39fccd1082a68d0e214b20d71bad02c0f71609ece75d71", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598620, "uuid": "db3a2589-4b15-4a7f-bff3-b766dabf4c29", "comment": "Malware payload (AgentTesla)", "value": "50a1b7394f08d17920db273ce1378dafc29dfce6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598620, "uuid": "5a842dd8-8957-415f-bfb9-62380aa3615e", "comment": "Malware payload (AgentTesla)", "value": "c9f5ec0c48430ae83d3dc404566ace9225c2128d550812dec33f1a1474e6fdfe313c8a4037a1c2c25541fd6c50bfe4a3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598620, "uuid": "a3633ce1-6f16-4e82-8f04-d2d169f49656", "value": "T17F33C99C726072DFC857C472DEA82CB4EA6174BB931F5217A02715AE9E0D89BCF141F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598620, "uuid": "21534c7a-15c5-45d0-8521-df0b7f714f26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598620, "uuid": "6c19371d-5347-497b-a689-d8616e2e75f2", "value": "768:u7hTk0vEXOVDrkx8XPCdZZ48fg4Pth96mLH0kkczwZnNBh/:0vuOVHkx8fCSog4Vh96MvzwZnh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693598620, "uuid": "e8159447-ea02-4c06-a365-b63e00d5d812", "value": 50176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693598620, "uuid": "000f4b00-cfdb-4835-9748-a9a0fa3d7cd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598620, "uuid": "13b4edb9-9e13-42e8-8d9e-9b3c322cdceb", "value": "E-DEKONT01092023,PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec755c8e-486f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693535604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693535604, "uuid": "78fa2d87-a69d-4035-93c0-8a6dc4a6471c", "comment": "Malware payload", "value": "266d9145f75c39e0fc76bd135188967d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693535604, "uuid": "4118304c-1250-4f43-b798-025d03f13080", "comment": "Malware payload", "value": "4ddf90b18450b6f9bf3504316e5dfd18968a5ccd689d2ea28bf4ada6a2bdcfc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693535604, "uuid": "5467a9d1-f2fc-4941-a781-9980d84b286b", "comment": "Malware payload", "value": "434bf3b65fff7edfac20fcf8395c04d6d09ae0e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693535604, "uuid": "b024ecdc-68f3-40dc-8a2c-ad0d94434636", "comment": "Malware payload", "value": "b09828e854876edbe90a97aa574b5b2879f0602d87007e58029b610373c42c4ecb782ad7cec51c7168112b3eec6fe323", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693535604, "uuid": "2ff6e54a-bca2-40dd-8470-b3e039985937", "value": "T102E533127BC5A9F2D1B31A320AA4AB016A7E98300F62DBCFD7524C5DB9314C19B39773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693535604, "uuid": "ab3ef095-7cde-48da-b93d-86e8bed8a347", "value": "30d1665d4c796f53fba13defcdef7cf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693535604, "uuid": "4e46f480-7142-4ec5-aef4-b24d4284d0f1", "value": "49152:2WhlHLBfJXAE9RH6XXNmFSYDerdljuurxn4ZfUK2m9SGd0iXLb7xrOFUgo+QF3im:2WhlrBfKEKtmFShHjuSxBK2r4YZo7F3l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693535604, "uuid": "4ccc8b6a-fc5e-4eb8-b4f4-b90ca946fb01", "value": 3038034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693535604, "uuid": "9d40017a-2553-416d-a13e-8d0b616e5edc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693535604, "uuid": "ffd8d803-337b-4a1e-ae31-7c5b9b3c7692", "value": "SecuriteInfo.com.Win32.MalwareX-gen.21805.19296", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ace137c1-48d5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Metasploit)", "timestamp": 1693579306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693579306, "uuid": "d48b220c-52c1-41b1-9245-691b57deeaf9", "comment": "Malware payload (Metasploit)", "value": "b73e3f6f0687c02fa9b9b893dd16481e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693579306, "uuid": "e0943c15-6d3b-482d-8c2c-89066fda8003", "comment": "Malware payload (Metasploit)", "value": "504f427ff87c3d99091d5264dd31d896750fa40420ce5dd7658a4422da3f57d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693579306, "uuid": "8d2722d6-59a2-4fbd-93ca-c706c2ff3337", "comment": "Malware payload (Metasploit)", "value": "85595fda807c290041319cda4d3d78c75e8b4b8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693579306, "uuid": "ee393d32-222f-4fbb-bf25-926d108e9f80", "comment": "Malware payload (Metasploit)", "value": "a91981b3040bde5b0edeac53a2a7ed807bb531abd623488d1216960eab12adeade42aad89db9ca0403e069b75e64b0b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693579306, "uuid": "ffdffc92-19e8-4bfa-bf3e-7f19cd761d6d", "value": "T1FA84D000F1E09F61D4A96E7610FDA1B2952D723A173D8F722385273976616D0EB22F37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693579306, "uuid": "82d724be-4979-47a2-89d6-fd1098ad8b0f", "value": "d03831ea72b1e7d0b90a8f7ae51d6df2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693579306, "uuid": "c4c1861e-a412-402d-9f46-86a9ebd8ac20", "value": "6144:3pkxtOo3MEc52OIc6otmhKqDHLvRSY5NKa/G59dEGrOzL/VKX6vb9/:3pkxtvs5p6Mmg65LTW9GGrOf3/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693579306, "uuid": "55bc01b2-8bfa-4270-92e2-04cbca57b753", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693579306, "uuid": "066db1df-7723-48da-93ee-d01ca260b03e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693579306, "uuid": "4dab87b8-e203-4524-9e59-a7209e74adba", "value": "504f427ff87c3d99091d5264dd31d896750fa40420ce5dd7658a4422da3f57d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12353688-48a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693559719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693559719, "uuid": "87de5da6-9b7d-4705-9316-2e73abd29949", "comment": "Malware payload (RedLineStealer)", "value": "460ec4513112a3fe36c903c34fbd7909", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693559719, "uuid": "5873811d-4157-4f77-b253-7d34aa891a1b", "comment": "Malware payload (RedLineStealer)", "value": "508582e083ebe6fc9a4a59030efd708bfaad582dba4a8aabd30affc4321bf88b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693559719, "uuid": "532f28ea-e587-4645-862e-97555d2570c8", "comment": "Malware payload (RedLineStealer)", "value": "a8986133ab995f4106f21d2fca74916de528d148", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693559719, "uuid": "19154a6b-6808-4e6b-b694-ff551ecf7e79", "comment": "Malware payload (RedLineStealer)", "value": "40d79d1268ffb6c3482e59e523aed05a8dd5e639999801090ce8d94cd1a3010d5afe05acd511ea89080f4367b35a1bc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693559719, "uuid": "260230cb-ac79-4e63-b6a8-21f8dce367b1", "value": "T17E35230367E94432CAA83BF04CF606831E393C514D798B6F2BD2ED8C5972685AA75377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693559719, "uuid": "46bc8ad7-ee27-4eac-82e5-97658c16273b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693559719, "uuid": "52212fb6-6af3-414f-be0b-1effce0c9a78", "value": "24576:zyYuaWms6t3SrJnpox3bkjU95iFKCGA95r/8nUAWrh:GYrWXJpCIjwgK25rUn3Wr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693559719, "uuid": "852d03d6-d0fd-4e30-ba12-b85b77b18a77", "value": 1149440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693559719, "uuid": "e2d874ef-b229-494f-a383-bead440ad5f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693559719, "uuid": "dfe8edc8-ab9a-41f7-a795-d4d9cd65b14f", "value": "460ec4513112a3fe36c903c34fbd7909.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaaa5909-48ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693597448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597448, "uuid": "c27b98bd-552a-4b19-b7c7-06208cba3e74", "comment": "Malware payload (Mirai)", "value": "78e5c05de9c3f8a85c8cabea2779b08a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597448, "uuid": "ef61c938-05b0-406e-b6a2-54c9af8a1ad4", "comment": "Malware payload (Mirai)", "value": "5098248474a72f1d2d13b00294425f6273d0f4594f941e9720d32f9e9f5133e6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597448, "uuid": "11f97f55-39a7-4bdd-b403-bedf5c51bf18", "comment": "Malware payload (Mirai)", "value": "bd989b9bd756ebbdb815af52d28b20acd23df818", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597448, "uuid": "d9294fd8-b905-4743-8512-b707e2e07ffb", "comment": "Malware payload (Mirai)", "value": "ba90a3d5d51904c31417e8c354b622b0d4f3c64f376e5aa9cd9b919d84351331e7d575879a790a9ce3b74f255db4f855", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693597448, "uuid": "264d187c-962a-451c-a8f8-18ce5ec82b06", "value": "T171C3C63B67170E23C0CA50B101E34332AE75DF9B34B952D7AAD07D686F36A843856BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693597448, "uuid": "14a7ef8f-5617-4139-99f7-11d4abe32636", "value": "3072:wsrp9xV+GZTZepNPhj+e3fSqP/L7ymm/QMurB1nKGNb:SMQplV/amm/QMurB1nKGNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693597448, "uuid": "3fc04352-1a30-42fa-8072-86dd6e07c1bd", "value": 129856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693597448, "uuid": "15489d18-7505-4df6-87c0-d761abe732a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693597448, "uuid": "8714b129-fbbc-46e8-a3b9-c8ca3c582f6e", "value": "78e5c05de9c3f8a85c8cabea2779b08a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "378fe849-4912-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Meterpreter)", "timestamp": 1693605308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693605308, "uuid": "419cb50c-45f1-4813-bfe1-7e1fc31e17d3", "comment": "Malware payload (Meterpreter)", "value": "06f4cf8dcd268dbc5b2601eb14815205", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693605308, "uuid": "f21b32d3-7ff7-4250-a3e4-7fe4f8e245c0", "comment": "Malware payload (Meterpreter)", "value": "50ebcc89e8235f3d6508214667994718e8a9a69f7530bf404a106b75ef8ebebe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693605308, "uuid": "23623053-aeda-4c76-b1c0-702c959178d0", "comment": "Malware payload (Meterpreter)", "value": "eab200877b55d3c0c0957a4063144412fceca4c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693605308, "uuid": "2b8a8269-797d-4d4d-8b12-666d6f8ea58c", "comment": "Malware payload (Meterpreter)", "value": "ebe12e1bf2c0ac5b9cc497c4945c84759a4627bd25ef18dda7292ac3a14d0bdf2d4267a8e9b8f0afddf988de827d75e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693605308, "uuid": "ca8a60c8-c1ce-41d6-839f-3ee99b19da87", "value": "T17C630756F2D358F8C26BC17486E26732F931BC124134AF6D57A4FB312E16E60AE5E720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693605308, "uuid": "e2eaf394-2ad9-4563-af91-461f08c3b299", "value": "427d9adcbfac8be53d865e8dcb0bdd6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693605308, "uuid": "43abfb89-f5ae-4bee-adf9-bad7a9ec592d", "value": "768:VtlGfs7aFQXcffr36NfxZky2YA/qpwz2nj7sJsAzShkJN/XEKaKPlUMgOPm1Fhu7:VG6kQaf2NUm0+j78wvMlUMlP/pA2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693605308, "uuid": "e0ae8f62-61f7-4d97-9ecc-a76dceb835c3", "value": 72704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693605308, "uuid": "74d8556f-99aa-43a4-afee-362ba50846a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693605308, "uuid": "804e1cf9-2f19-4660-b46a-698835eaccc1", "value": "06f4cf8dcd268dbc5b2601eb14815205.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f9a8c09-48dd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1693582531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693582531, "uuid": "798c0704-a2bc-46b2-baaf-3d4a7c0ad799", "comment": "Malware payload (DCRat)", "value": "6043dfc0c46ef9a32c175392e5e2aaf0", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693582531, "uuid": "7d9c750f-3b3f-4975-834d-4770f8f00480", "comment": "Malware payload (DCRat)", "value": "52307f9ce784496218f2165be83c2486ad809da98026166b871dc279d40a4d1f", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693582531, "uuid": "0783c5f1-8b0c-4975-b699-dfd9a4d7a63e", "comment": "Malware payload (DCRat)", "value": "a7c1a65c6b265104c9998094f2b710ecac3c43f6", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693582531, "uuid": "dc586a5a-50c1-43b8-af62-14286fc4ab74", "comment": "Malware payload (DCRat)", "value": "ffdc0554eb0219b09bcd5685d7a43a645163550ff7198a808d20b9a500f86da17c2c1d5d4bc5c31fe038183b55616883", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693582531, "uuid": "f105ac27-a852-4635-be56-5daa7fcb32e8", "value": "T1D005124297D85277DC709B704CFB03931B3A3C631A74826A274AE90E6DF3AC5653672B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693582531, "uuid": "2fe54696-f664-417a-a822-93d608a80b7c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693582531, "uuid": "a4def91c-2da1-49a8-912e-ece3bf7587e0", "value": "12288:lMrEy90h9uKOtXcRDDmFT9f1Xof6k8W8pyhId3OWierTJLdhtt+J:Ry87vxENI6kB8pJdeWierNX+J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693582531, "uuid": "ad330f46-fabe-490e-8279-fa00f8f9ccb7", "value": 847360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693582531, "uuid": "7394e9bc-e075-4ad4-afc6-06ceef353a1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693582531, "uuid": "6d696b5e-b845-469a-a7fa-ecd0e73e74b4", "value": "52307f9ce784496218f2165be83c2486ad809da980261.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87f03d9d-48d6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693579673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693579673, "uuid": "63f4c037-c4c8-4409-8633-c67b0758c570", "comment": "Malware payload", "value": "a61c364320eb3c14b16b9fefbd7bc920", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693579673, "uuid": "3c08bb85-4a28-4417-8da2-62e31ba7fb8e", "comment": "Malware payload", "value": "5359ef37f59b5c430315bc9bd2a86862131a798385e81e058264c6493844bf2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693579673, "uuid": "2bf5770a-581d-48dc-b3a4-540bffd88640", "comment": "Malware payload", "value": "a83ff2998de220094b38071c70c71b45d030c2da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693579673, "uuid": "78342aeb-1048-4dc4-8a96-ca60fceb807d", "comment": "Malware payload", "value": "4da258dbbb1588463aa095ca5ec85054f943921c1527a3e48df46a763650e30a4cee636ca3607d647617625bb431eda4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693579673, "uuid": "d9b29794-eefe-4fe6-ac4a-8749a0880b0e", "value": "T1E3C36B47B2A531F8E17A8339C8614905E7B2B47507309BAF076413AA6F277D09E3AF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693579673, "uuid": "91e95b4b-6421-4600-81c5-ab82bad7c744", "value": "2e3e44ac6f091a23ef84e409c0ea9177", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693579673, "uuid": "1d433b8e-1ef2-4795-8e20-df63f02be93e", "value": "1536:M885p+Ylt3EbolY3nTzHUndVHqtdy9fsXdOIsWl0dP9dliNyG4R2zWIEn:n85tt3PY3TrQdVHqtdy1sZevANyBupEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693579673, "uuid": "df1892f2-5431-47c0-a981-3fade783d18e", "value": 121354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693579673, "uuid": "33200755-47d2-4872-bb22-26d4a893a4e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693579673, "uuid": "56fb0887-32a5-458c-8804-bc1ede45eb3e", "value": "game.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0824e2b6-4903-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1693598786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598786, "uuid": "15f83633-b02e-4aaa-bc22-85c7dcc52f3c", "comment": "Malware payload (Formbook)", "value": "453aecc8f61ec001e6740f4d7faf392b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598786, "uuid": "5dbf3d92-8f0b-495d-962f-09be6766cd61", "comment": "Malware payload (Formbook)", "value": "539e48b91ce31c5fa27b4466e9f9d9a4933e9bf17a4afd06c1dc826d0ba749c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598786, "uuid": "15a20127-5888-4fda-94cd-4da9e5e58a3d", "comment": "Malware payload (Formbook)", "value": "e1cd8702f4febdb259fd9fcef4fce507bfbaf989", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598786, "uuid": "3c0d2ea2-12f1-452b-b0fb-63826a2ba1be", "comment": "Malware payload (Formbook)", "value": "40879079c239faa7e3e17a39ffc5d9d2ab2233bf0ff9b7eec31fc28156f417c1fd920c865c64b7ecd8d5bd1e0a455eb5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598786, "uuid": "388961c5-b3d5-492a-8aff-3a76bfe8d938", "value": "T15CF4DF026664CB26D574B7F7D021A3F407BAEE2AD5F6D24B1D817CDA36B3B100A12E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598786, "uuid": "a9bda081-1107-4bb6-885d-af2d2779f3f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598786, "uuid": "0bf1ae04-eeed-4c8d-b9eb-f8d2d782399c", "value": "12288:iUOPypIzXfOUmJZeCSSGhHQc+O3bIpaf/MBn/DSeM+hd/AUJconjNvTIaUdr:iUOPypIzXWUgZxIhBlrIkq2UVB74", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693598786, "uuid": "7bd4154d-32d8-4e6f-bef9-8aed03134d19", "value": 794112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693598786, "uuid": "a5ecb60c-9a52-4512-84d2-49ab4d9e4f96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598786, "uuid": "11b9336a-8088-4919-bf58-3c44fccebc37", "value": "Order ID DHL_0901P55AL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f1d699f-48c3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1693571444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693571444, "uuid": "c6299300-c3bc-4126-bcd7-025ac49a0eb7", "comment": "Malware payload (RemcosRAT)", "value": "9f2ee9d2c770b085c485c887c4ac66d1", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693571444, "uuid": "c62787c5-6024-44f4-83ed-7eda9266b7b1", "comment": "Malware payload (RemcosRAT)", "value": "5450af8cdb916003b5ef00f39783067b58f165ce50417545d09934da358cc0c7", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693571444, "uuid": "64eb517d-f433-497c-94ed-9e22c6b762b8", "comment": "Malware payload (RemcosRAT)", "value": "053d74ff5309c54538bdb935f2747bc5722752cc", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693571444, "uuid": "0022da07-216e-4fa9-b515-87879b818bc7", "comment": "Malware payload (RemcosRAT)", "value": "e2e6e7a6a062728dc659a8d6caf6ffbc3e5fa7d1affbd4d733168bbbdc8e392b341401d21f76759f5e8c4f8f7c747a12", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693571444, "uuid": "f1fbd199-23af-44a7-b8e0-8ea72170037c", "value": "T1DD8423A48BC3E5A7A9932E07D4C30CEA424C08DA933A509F7F941DF2E2D46557F9B84D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693571444, "uuid": "d0c07789-fd77-4b92-8ad6-56984298f44d", "value": "6144:iWCtX/C1JMHsN4dSRY6Y2MKtoTSrYCt9nHowHgJI8UO08pPXkknxopt6B7bFR:iWCorOhdSYitgIQXhapYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693571444, "uuid": "5a903929-fa45-4e90-ad56-b5aaf6455704", "value": 382034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693571444, "uuid": "28c37c56-e6c4-40c7-9590-355c7d140eba", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693571444, "uuid": "a52e1ff9-1855-4d44-ab16-0336636210e7", "value": "HB23090003.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4adea878-488d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693548217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693548217, "uuid": "5d1ba0ba-2942-456b-926f-06a97bd8688f", "comment": "Malware payload (RedLineStealer)", "value": "230a93f918b7e542068839297f9b0695", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693548217, "uuid": "4551c43c-07e6-4e48-b0c4-b7dbf6cd5a72", "comment": "Malware payload (RedLineStealer)", "value": "5725a12018636f3e9b66e5e14f539b1c79b2f70b666120badda1a85d3cd74809", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693548217, "uuid": "5c1ca05e-9716-4ac5-a3c8-cb2649f64606", "comment": "Malware payload (RedLineStealer)", "value": "349ae3132bad81b8bd3183f0b32b03aadd29f510", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693548217, "uuid": "9f548662-c02c-49db-87a5-4fc3a7f1e338", "comment": "Malware payload (RedLineStealer)", "value": "0aa65d3db9eb82835ee8c0d0e8cbaf89373f18732984edeca78509a411b132a3e941818aabd009e865a0db0ade74f0e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693548217, "uuid": "38d3fcc3-e803-4a01-84ef-1b38aa50a399", "value": "T17AC42943C2A17D95EA258B729F1FC7F87E4DF2608E497BA93258AA1F00B1177C663710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693548217, "uuid": "583f422d-384c-4651-a8c1-ba1eb5eb6623", "value": "a0157d3b2852cca44553b58241d89d57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693548217, "uuid": "3879f931-eb27-4a4a-81d1-a7b0cf0bce4d", "value": "6144:ifbNPpRdTCAILbFf0n1KaQFYkyyC+3/NHUtms0E48CMwo1o5qTfduQ:KNPpRRC8K7Q+3/JSD0E4X7vqTB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693548217, "uuid": "8982c26d-fb8c-4cef-9b8d-0d6a4af689fc", "value": 551424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693548217, "uuid": "0fdcb968-0653-4a22-878a-ebca77cac708", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693548217, "uuid": "71f56aef-41c7-42f9-bfb3-72267e097147", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "263f3794-48ca-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693574355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574355, "uuid": "61ac43d4-4e2a-495b-a4b4-2117c0e2c727", "comment": "Malware payload (Mirai)", "value": "48b58f791fa8a28b76541cf5ca022d94", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574355, "uuid": "82e0d5c6-5ed1-4115-a36f-39b5b94e11d4", "comment": "Malware payload (Mirai)", "value": "58086f32d4863f0f1d259e44465e650e26432d08c01360b709ac6f613148c906", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574355, "uuid": "103f78c7-3ba0-4b9c-aac0-9729c8e56d1c", "comment": "Malware payload (Mirai)", "value": "fa53426048e2e9c30218024b9aa9aa78d6ec6c47", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574355, "uuid": "bceeb1d4-5e16-4ced-aa01-89209b3bdbfb", "comment": "Malware payload (Mirai)", "value": "5be7530746490754002e7189629640ed69898e62d9fd92800e8b7eb87bf3aeb4d6d30993de86591788552df592b4c049", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693574355, "uuid": "baa28269-ed60-4c90-890d-b0088f95f2e1", "value": "T130E2F197936090D2EDB82AF1E52D819666BE4F6CC53630F62B1656283E5B0439E3CC63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693574355, "uuid": "49ef7894-3ba5-441b-99a9-396e10bd58a3", "value": "768:ToiWiO031vpAPbrVWZK3XVGxm9XPi3U6MZqIf:Torm1vpALgUJPrd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693574355, "uuid": "7832cb98-f99a-4e28-bced-c9e673193688", "value": 33164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693574355, "uuid": "a56dc2a2-2c93-4325-ac1a-ef7ac07ce585", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693574355, "uuid": "ef47ea87-f2e3-46be-b44b-dc473f33db41", "value": "48b58f791fa8a28b76541cf5ca022d94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94722203-48c4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkTortilla)", "timestamp": 1693571963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693571963, "uuid": "f599db4c-1bb3-491e-bcac-788e74ed718c", "comment": "Malware payload (DarkTortilla)", "value": "5f3ddd6e12965864c05875a4ecd2aa9b", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693571963, "uuid": "d41be552-5f4f-4e9c-9f51-163aaa91feb3", "comment": "Malware payload (DarkTortilla)", "value": "58e746fc929f254f88dc0156b336e86aa8107abb69b10f0dddae4bb022271c55", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693571963, "uuid": "7d258a3f-1f6f-407f-a311-2b0cff94a034", "comment": "Malware payload (DarkTortilla)", "value": "f040f0ec0eb2d1345928ae0d159620fdf70f588b", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693571963, "uuid": "18c1bdc3-b1fc-4a89-a435-93912c161873", "comment": "Malware payload (DarkTortilla)", "value": "e294c297555cda8ae06bd7067dc133f47f753caf80edc67a2e9e3fc5ca6cad0b55c95fde774f80d16da7300f0b487982", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693571963, "uuid": "5892108c-0086-4c6b-b7c6-018ad9fb2aa6", "value": "T110C4E1327697A60DC86D4F32482591C133B6AA893B18CB6F34CD135CDEA36578F127B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693571963, "uuid": "424788df-6548-4e2c-9215-9739ce20a500", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693571963, "uuid": "ea305a77-fd66-472a-973f-003934a88a0e", "value": "6144:ZS3dCftUSmjZQe8i+xnQwZNBy8XybKwGNOXsG0UL19s18EETdO98EGWQCUwO/:NixQy+BjZXyh2Op0UHUpIPEGWQt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693571963, "uuid": "ebfd7c74-fce0-43fc-8233-bce2de5c179b", "value": 576000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693571963, "uuid": "66cb92e4-2546-432a-8f3a-4e4ea3f89234", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693571963, "uuid": "c5da320d-2933-44d5-ac0d-d450abd9787d", "value": "SecuriteInfo.com.Win32.TrojanX-gen.12445.18255", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75d63460-48a3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (KnightCrypt)", "timestamp": 1693557738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693557738, "uuid": "ca07c534-3fe1-4d42-87d0-133d5e10a08a", "comment": "Malware payload (KnightCrypt)", "value": "ab5790b15e5bc33050fde26c6dce007d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KnightCrypt", "colour": "#81A14D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693557738, "uuid": "7a61a7e9-446c-4853-90ce-59989ff88d3a", "comment": "Malware payload (KnightCrypt)", "value": "5ebc114af099dbf4ce24cd2cad3e5ab783383d2217520e162fcc21feca88d3b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KnightCrypt", "colour": "#81A14D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693557738, "uuid": "ae5a6810-2810-43b5-86a5-1453fcb2cb61", "comment": "Malware payload (KnightCrypt)", "value": "a31ad9afd6f63b4bf7f0ac7f0839afb9e0eaa798", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KnightCrypt", "colour": "#81A14D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693557738, "uuid": "5b6d664a-5ca2-4032-87b7-ee99e4f497e5", "comment": "Malware payload (KnightCrypt)", "value": "5772a9106b99ceddd89e3f357fb25e04ed4f7e1225b6f0386d65a3a25ceafda1ddb1e457a0f9a0681eb1ee1661e5bfe3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KnightCrypt", "colour": "#81A14D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693557738, "uuid": "214df714-fcce-4d41-bb2c-11c26c4f4796", "value": "T1DA459E17B69941E8D06AD1B4CB564132EA72BC510F34AADF0690B3192F7BEE46F3E710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693557738, "uuid": "6fe6df5a-2d89-4354-9228-5c04fb43a4f0", "value": "92ed8fb21c381a073a5e7ca35347f90e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693557738, "uuid": "ca83db95-b569-4e51-bb00-15d20e2c3883", "value": "12288:RBVVtkNBJOlMmXP0447OdMyogfJ7gwPueClVVRWM5YDh8xpoPKouMA+nkGGCp+D:CTcCG0447AMVgfdnTClVm4QKcGRD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693557738, "uuid": "d7147954-9bc8-4723-b906-3c65831fbc64", "value": 1165432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693557738, "uuid": "8da339d0-71a3-4203-b227-d9d53edf2781", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693557738, "uuid": "6e339615-dad5-4d83-8272-4974170023f2", "value": "3qtae89jazaachaa4wg3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "570bedb9-485d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tofsee)", "timestamp": 1693527622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693527622, "uuid": "bd8e1659-de63-4e4b-93be-4a4a72beb0d2", "comment": "Malware payload (Tofsee)", "value": "11fdf6fecb79a572d7d6d1c8251604fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693527622, "uuid": "702ed7c1-97c0-4a02-b50a-17c2acb9c5e2", "comment": "Malware payload (Tofsee)", "value": "608c1c39c6c66f67243b606a488ad9b24dcefd05f5f47fd6d523529fcf062ed3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693527622, "uuid": "3c093132-33d9-4b2b-8fb0-22545d794eed", "comment": "Malware payload (Tofsee)", "value": "b0878cf91fbd1d0e52d816fbf89c05af89f4b4be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693527622, "uuid": "70e4bb17-d77c-4b2e-ba00-465a82f50f5e", "comment": "Malware payload (Tofsee)", "value": "8549d451c1969131e35cb1b0e6da13e652c7431e782c0137026bb268536f744d1cc6f1faf6d60849aa9973d0b926b9ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693527622, "uuid": "3f75ac38-7946-40e0-a5c6-5180cfa7f072", "value": "T1B324D022F7D0C077D4620B3055B0DAA52EBEFC2166B6C64B37982A3E5E307D01A7D792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693527622, "uuid": "69a64543-1bc6-4560-997f-638073237fb3", "value": "60202b26a1548f32d077efa3514a2fd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693527622, "uuid": "e57fca2d-f525-415d-a599-0abe0a664d3d", "value": "3072:qLx7kv8RGHBw0F/nUIW3FM9/aXWjYkWktvqToqP:qdfRGHBw0FrMFoam8kWktC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693527622, "uuid": "2b76be0a-d973-45e6-a779-151c6e3ff5aa", "value": 211968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693527622, "uuid": "bbba4927-844a-4917-9811-673f58785742", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693527622, "uuid": "1998ef21-f676-469f-898d-88ae86b6d2e1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b935876-48a3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (KnightCrypt)", "timestamp": 1693557721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693557721, "uuid": "b4e1e431-34d0-409c-a2d8-4d7c83cf6acf", "comment": "Malware payload (KnightCrypt)", "value": "4d4571527cdef8e10ac9ad6eb2ee7739", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KnightCrypt", "colour": "#81A14D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693557721, "uuid": "3f2d3739-84a8-4d19-afe0-a0f8542d3560", "comment": "Malware payload (KnightCrypt)", "value": "61bb91bc554d9b849cbd670669365bc5a58a8c5f9a0f530b8ed9a4b8f0968186", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KnightCrypt", "colour": "#81A14D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693557721, "uuid": "e06a3211-9680-418e-8a3d-c12b31b37c9f", "comment": "Malware payload (KnightCrypt)", "value": "1960f32c2d62d049012f4deb64ddec341fbe3541", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KnightCrypt", "colour": "#81A14D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693557721, "uuid": "98d25323-6117-4968-a2a9-51b522861b63", "comment": "Malware payload (KnightCrypt)", "value": "e73e1c4cfbca0e1c0f73b609b298c690e27d34aab9ff63f47b0cb2c1d1db5e0638963fb1a9def2da4e210dd89e53242a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KnightCrypt", "colour": "#81A14D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693557721, "uuid": "4c7a0d40-6227-42ec-8ed4-48005620c2f7", "value": "T12A757C4BB7A441F8D0A7C27989528647E7B274150F34ABDF56E047AA2F23BE14E3E311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693557721, "uuid": "e11b132f-7138-45db-9943-9d7e045140f8", "value": "be843536fdc17a2b5e02f8f44a2ad7ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693557721, "uuid": "d86e23ae-81a6-458b-8c03-dc25c07b9e50", "value": "24576:wucUS55cDR3NgJ4zJ1H+QI84rncvGt3nE6vlTlJxBkTde/cfkr:wucUS55cHgJIzez8+n9Bn3NT5BkYokr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693557721, "uuid": "d40189d5-ed32-4155-87dd-987fb54bcf27", "value": 1636552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693557721, "uuid": "972e3ba4-221f-42e4-8cb1-44a863b21508", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693557721, "uuid": "da665c9d-1885-485c-af29-02f384502051", "value": "2wrRR6sW6XJtsXyPzuhWhDG7qwN4es.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "485ac359-490a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693601900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693601900, "uuid": "a82f38c0-d14f-4618-9e34-4d42d7ae7367", "comment": "Malware payload", "value": "014cc53b0c8099ec413479b8586904a8", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693601900, "uuid": "0ac1dfc0-a745-43cc-bbab-6538ea200c48", "comment": "Malware payload", "value": "6208a1f088ab11e60bdc607a47a4bbcdf9368f06d0d00c8e498deb612b1a55de", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693601900, "uuid": "f4dab317-4454-43f5-b4e4-fd369e0d5a3c", "comment": "Malware payload", "value": "53a2c2313c0dd5df3117b3755af39648b86417e4", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693601900, "uuid": "5896ca3f-5172-4a54-aadb-c67e42ddbb7d", "comment": "Malware payload", "value": "53cfc91d657802fd6d51bd354371f0d911826a8bed730b74b0f965c86982245ff5368c9facc0a2cc635964098f07c7c2", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693601900, "uuid": "475243bc-7bc6-46c8-ae5b-f4590ce3d5ea", "value": "T1E4A533CC0CC43EFCE15D7EB4008BDDAE815ABF60A9E5F2D595B594213ADB0E894DA06C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693601900, "uuid": "b525af1a-542e-481f-a860-c5c92fe50c3b", "value": "49152:t8sL3HYZucJ34vR7B4ezGJZBORR7ZH1FkOMb+HF6sC:7oocWvxBiSlZH1eOmwF6v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693601900, "uuid": "ab769a06-7d10-4a45-b425-7d3b713f1ef3", "value": 2205087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693601900, "uuid": "97e9c94b-a4dd-4592-aa39-ed7a7b1778ea", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693601900, "uuid": "61fa049d-db4b-40a8-b010-79f43066159c", "value": "PolerStarter.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b873fa6-486a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693533320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693533320, "uuid": "5b67ec72-5dfd-47de-9ac8-745bcb15a601", "comment": "Malware payload (Amadey)", "value": "3d8b87a6d345677ff4ccc9fbbe96b8bd", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693533320, "uuid": "a364cd20-a29c-47af-81b0-bff732c365d2", "comment": "Malware payload (Amadey)", "value": "63ae2f16c01ff43708559662e3240b46e52732f20eaefc8e64f520b914d950f1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693533320, "uuid": "4dfed4c1-e898-4713-b340-2494019710df", "comment": "Malware payload (Amadey)", "value": "7eb8d96001af75a333b550c6fb732df07b41d4b8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693533320, "uuid": "ca13658d-8ecf-456b-8536-9def2e536961", "comment": "Malware payload (Amadey)", "value": "1915f72cca93f0b38d91aa01eea5d3dff9d973910c186f7c4caf8dca590d76214614d3758f69b73c0e7fc98db694d264", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693533320, "uuid": "4e2cc4a3-6463-4d39-962e-aa8dfec3d50f", "value": "T136352302E6D4A4A2DAF51BB119F51BD31B23BDF19D64872F32A18E4A4C336C8647173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693533320, "uuid": "d8bd5718-8541-4249-a3e5-4a748d949a0e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693533320, "uuid": "491ffbe2-6ce6-4d56-8caa-d1f7349db68e", "value": "24576:WyHjs3dJE8jyXfxzL+dnznz1mMqAHdpEEtPHrW2ccaS85r3JDDQ:lH8/YFSnznB3pEGjc9NvDD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693533320, "uuid": "68b572c6-51d3-4b33-876c-f020a38ab0de", "value": 1147904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693533320, "uuid": "7a580f31-0e74-440e-83ca-d55cca86bc82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693533320, "uuid": "64c296c9-9676-4341-9661-2a644e4720a2", "value": "3d8b87a6d345677ff4ccc9fbbe96b8bd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42cc9bd1-4900-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693597596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597596, "uuid": "010a30c8-9570-46f4-b84b-c0f8737150b4", "comment": "Malware payload", "value": "fe65a5259e8838d2e5dba239981df4c3", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597596, "uuid": "43d9ba28-a331-4859-ba69-16c6c6234c8b", "comment": "Malware payload", "value": "64108b9853d5fcd8e5e334ed59995d6ee3dff9132f40eb773433100d732cc8c6", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597596, "uuid": "94d69b9f-47f2-4255-b975-cae9ca2f743e", "comment": "Malware payload", "value": "c098ad75d18bf42001bac434016e48e1e8b99610", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597596, "uuid": "f888a381-55da-449e-a12f-bf4986fccb72", "comment": "Malware payload", "value": "70396feede94e03e4713d6199e2738bbef67e449f70bd58cf451d255c65a5d5666152bee4689cbf6947a4781e08cf6db", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693597596, "uuid": "aead06b3-3aad-4d47-b81e-c29aa4097550", "value": "T137E3D792B2834E00C16EB9B996F7B10E32A37EFFCEE19557F9ED3B1B64704602485245", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693597596, "uuid": "10593320-2e72-42c3-aafd-ab7902b329e7", "value": "3072:ks1wYaTTTpPrmYPrmO96MRrXyIhbfpusVR6VX:ksszwa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693597596, "uuid": "2a696748-5613-401b-8019-a77573055c55", "value": 144384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693597596, "uuid": "d3a6187e-faf0-4ffb-92d6-539b6b0fcef8", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693597596, "uuid": "982f9ebf-a56a-479d-a686-c1a0bafd0b30", "value": "Vendor Management Form 10-12-21 (002).doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7663e850-48c3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693571483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693571483, "uuid": "fbab16cc-338c-4837-a007-af76d02f61e2", "comment": "Malware payload (AgentTesla)", "value": "fbad6ae9a778119e7fa68a4af950ea1d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693571483, "uuid": "1ba1d7c7-0954-4c9c-893a-2f686b285fbc", "comment": "Malware payload (AgentTesla)", "value": "6461077970b9463db60faad97819790772c4b8cf94cc068d6a6524f5b7fc28de", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693571483, "uuid": "1f25cca8-61b0-429e-8b7c-43e331d540ca", "comment": "Malware payload (AgentTesla)", "value": "6cac78884894a7415498c70a8e5bb0818a0535ca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693571483, "uuid": "d80eb1ef-badb-47a5-b2c9-3af4aa446d73", "comment": "Malware payload (AgentTesla)", "value": "eb6513637a4a4a13ca1a2864a48c65137406dd92351195b635d92b76b23ca6286901f8fb9dd48c4d9face624ec1301d4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693571483, "uuid": "9ca5aeae-c77f-411f-b645-5c2ffcce2f78", "value": "T1F1F4E0016254C712E674B7F3D025A7F407B6EE26E5F6E2471D827CDA36B3B104A42E2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693571483, "uuid": "6ed6bdf7-f734-4c98-8e77-eebd1c712c74", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693571483, "uuid": "aac434c0-bde0-4457-9e36-f0a00f5938b5", "value": "12288:DUOPypIzGfOUmJZeClB3/AaJzD9DhyKftDKUACZKA6Pj5wox9avEFh:DUOPypIzGWUgZxDN5D91bFKULKvPjmo6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693571483, "uuid": "e1fab5ca-d6ad-4638-a400-64f20a39fc68", "value": 746496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693571483, "uuid": "34559b6f-974a-42e1-b8c1-dbcfb2ff4f13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693571483, "uuid": "18949830-d389-478e-8413-7b3bcb826b74", "value": "overdue invoices pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2c40bd8-48b6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693566028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693566028, "uuid": "d687fd66-dede-49f5-8563-4d43eaffcf7f", "comment": "Malware payload (Amadey)", "value": "0af2f2a83581168cdd657e6f74ee2f40", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693566028, "uuid": "52416557-e474-4f49-b64e-f8b8dcb8133f", "comment": "Malware payload (Amadey)", "value": "651d233f593e6d3cffede929e116ce2b531406609230abcbc51ca0d8c35ea364", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693566028, "uuid": "fee3c90f-b81e-4334-abe9-375b9ce78bce", "comment": "Malware payload (Amadey)", "value": "3707d3d2c63029d6d51cfd95be8d5fad1e958b10", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693566028, "uuid": "9f408fde-1314-4160-87a3-e55d36856940", "comment": "Malware payload (Amadey)", "value": "e85b9fb23852287af71548c35777cf82563537150420e832225f9d183266fbd58514fabb8950aa973874d0f705d069dd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693566028, "uuid": "d754335e-6680-47d2-8bc1-a74d4cf91532", "value": "T16D35230BB7D59472C9B82BB044F722830F347E90BD7082E757818A1E5DB3689A9747B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693566028, "uuid": "cc1ea029-f32e-48d8-a41b-78935446984a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693566028, "uuid": "4db0da39-317f-4d4d-89e7-cb58b6c22f59", "value": "24576:gyH0y+ZhaEIkEr3aGfkhMUGLPDI1JhM2eU4PfCJlr5Z3ts:nH0yIg5kErKGfgaLYhMwe6Jp5Z3t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693566028, "uuid": "78f1bbeb-bae1-4465-812f-ef36ea64477e", "value": 1148928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693566028, "uuid": "1c267f97-06b8-4b9e-a455-48a42eb12c7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693566028, "uuid": "61b8d29e-fb5f-4b61-87af-bc42dcbd3cb2", "value": "0af2f2a83581168cdd657e6f74ee2f40.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35a650ad-48e5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693585977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693585977, "uuid": "a784880e-eaa1-438b-a882-aa431389dd4a", "comment": "Malware payload (Mirai)", "value": "37bdd5eeb2d15eda624bdd87ca49548d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693585977, "uuid": "e17645e3-e9e7-4a0f-ad30-f74fc4e30e51", "comment": "Malware payload (Mirai)", "value": "666ac17af53d0d21969751472f0d4147448aae52fff9fd759b319f2929a47de6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693585977, "uuid": "634265af-12cb-4088-8017-4bb1f399468e", "comment": "Malware payload (Mirai)", "value": "cd74767c0d92a9b7cbed04e78824dd6b6985c3bd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693585977, "uuid": "b2aa6c5a-905a-4154-8e4a-7233e36fe635", "comment": "Malware payload (Mirai)", "value": "019eb6becdc81358d1a5ffa6d5fcc7d1a34c86353eeafa097e0172bf3b85862e7d35c12767d41e9b60c28442af0490a9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693585977, "uuid": "293381c4-bdc7-42f0-bb70-f764a8b7994f", "value": "T171D31A56EB408B13C0D62779BADF42553323AB5493DB33069928BFB43F867AE0E23515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693585977, "uuid": "3d062b10-d8f3-42dd-81e1-24d678a7ffb4", "value": "3072:KMNfthR6SEanSX8u9tR+isLT2Q2sau23M/9bD:KMNfthRPEanSX8u9n+NosaueM/9bD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693585977, "uuid": "dfd5d457-1c79-4857-ae25-6e6fd6c6252d", "value": 135205, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693585977, "uuid": "c3abfa7d-82b3-4121-90bb-d1fed863159a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693585977, "uuid": "2bddfb28-0fab-45ac-a4f6-e8365df6eac4", "value": "37bdd5eeb2d15eda624bdd87ca49548d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1304baf8-487c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693540822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693540822, "uuid": "c5631212-6e15-4dab-9d52-665239c47d0a", "comment": "Malware payload (Amadey)", "value": "a0edb86f10a337f1835dbbb077c91844", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693540822, "uuid": "baf263cd-349c-40d8-932f-a492bd7aeadc", "comment": "Malware payload (Amadey)", "value": "6773b061f540605fc049305425ada5fe3ce650b6669ade7ff46fe7ed496d3528", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693540822, "uuid": "a2211d76-bfff-4cb1-9f87-68d6a7303b16", "comment": "Malware payload (Amadey)", "value": "5b8eb6d5037eaccc47937bae467895c3034bdcff", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693540822, "uuid": "6e03ae28-fdc9-4eec-8689-228b06e1406b", "comment": "Malware payload (Amadey)", "value": "3e4fae32d07ab7db833a09356eec73f5d4a061fa8244b5e54a2da8d100a5ae1ad552e16883d4a334d43e7c96eba99f87", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693540822, "uuid": "08e4369f-a19e-4ee2-9e09-7f87cb8a695f", "value": "T192352302B7EE03B3E9B617B0A4F786C32E327C651979835576A2581E1CF2345923633B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693540822, "uuid": "ac4918c3-b24b-4e05-99f0-4a571942dbba", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693540822, "uuid": "a1edec09-2bad-44d6-916b-b306bdb96755", "value": "24576:nyTaodQygFsmvfKVUpTHmDM3gGxt5ZnyS8ubTmwT9WbQR6Sun/WcCAnkA/:yNd+fXT7myganxlbTmw086Sun/Fnk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693540822, "uuid": "7824c464-7844-4bbe-9291-6ea1aa03ae3f", "value": 1149440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693540822, "uuid": "14280493-d759-492b-8487-85045e41cddc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693540822, "uuid": "e5d02f8c-f990-4128-a15a-dc3053c2982c", "value": "a0edb86f10a337f1835dbbb077c91844.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abe71d80-48ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693576297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693576297, "uuid": "ce5bad76-71cf-40d4-85a6-4f19149a7f1d", "comment": "Malware payload", "value": "5adeca13a4af7c23f1acdc6c70930d3b", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693576297, "uuid": "893f5a95-e419-4c72-81ac-3ad6a5746d40", "comment": "Malware payload", "value": "67b6fc930183d84b8610c5cc9d44768021d4ece0913217f79f2950575d437662", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693576297, "uuid": "f2e1c844-5a56-444e-81a1-c37946e5e01a", "comment": "Malware payload", "value": "170d800f1a57cf9b3e5ee6ce9ef3077800afeadc", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693576297, "uuid": "2e9cb32e-a6aa-4776-8dfc-0d97a50bbee0", "comment": "Malware payload", "value": "2fc2a5a9e4b7f3c865972a48431190adec51bdbafb112c93e2874c43d8b87619605e7bfb4723c32f165fa3b680018b12", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693576297, "uuid": "0fac8f01-90b8-4142-880d-bbd9d4afc716", "value": "T12766F173B0DA2471F8732A3678A26432393E489CE0472DA929B4ABD7F572D0C5F4B751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693576297, "uuid": "8ae99f33-426c-478f-8ab5-9bdac8812200", "value": "6011984d7c1f1b97a34d7517a498bff8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693576297, "uuid": "393aa7a7-9b23-483e-b809-958990c35eae", "value": "98304:SuHbL/fUWWhTt4vd8orT8TBrHJWGs2NyqeoNE/7SRYY2VymGu/m6zHAlA64TRR7:RXMhT6vPrT8TVHJack+YlGlSRR7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693576297, "uuid": "25bb7547-fc43-4ea6-b710-a9b5d3fcbf38", "value": 6926903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693576297, "uuid": "487e78d8-49b4-42f5-adf3-741a89dd9a7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693576297, "uuid": "9db2d0dd-62e0-4733-96e0-bde1432c7ab7", "value": "Extreme Injector v3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efe9273e-48f5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693593162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693593162, "uuid": "2d3cdad4-cbed-4531-b528-b8d8eaa00d55", "comment": "Malware payload", "value": "1456716faf85a3c27b8766c37d4d05ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693593162, "uuid": "1917ce52-7088-4e69-9711-5f8bce059424", "comment": "Malware payload", "value": "69ef6dcea45127b897a23324d41df8acfea240b059f96149c2d89e2ecb2a4983", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693593162, "uuid": "1dcbb5d3-cf6d-4d7d-82a9-53f342b2975e", "comment": "Malware payload", "value": "65716856525d7f675f3ebef761aab38d5d2163d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693593162, "uuid": "4e31d682-ef74-4631-8bea-2047ba8d0422", "comment": "Malware payload", "value": "b53bc6cfda9094f081827615c504bd1228aaa26e883acacae59e1d23b9af72cb5cc84323fc7d07f27cb1cb07d08202ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693593162, "uuid": "9a1cd188-6780-4b2e-bff9-28927e17a690", "value": "T1FEC45B0392E17D58EB294B768F1FCEF8772DF1608E497BAB22189A1F04B1176C263715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693593162, "uuid": "553d606b-ed09-4ac9-a247-72317fd691e7", "value": "0d5ccc78ff50fbd2fc0370addad4c1f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693593162, "uuid": "97b0f21e-7a7b-41be-97a0-70e736c0c326", "value": "12288:zA+1QSRBE1UkmdkKV/JrEBcQ6aqpn2/OM/:zDQSRBE1Ud1JAL652GM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693593162, "uuid": "022629e1-9e9b-48c3-a181-180db17943cf", "value": 559104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693593162, "uuid": "3d5249d7-8a00-4167-a9c9-134897e28934", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693593162, "uuid": "cfa5ef84-f32f-4a56-9eab-f0eb938aceb7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1d73bfa-4902-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693598641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598641, "uuid": "fdf50d6a-dada-4f4a-b619-806276aaf2f8", "comment": "Malware payload", "value": "1a368aa24093f7c4fc1e500a23fe5a83", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598641, "uuid": "40c64a60-c488-4476-910c-de1031c59863", "comment": "Malware payload", "value": "6bece943eae00945b984f604c131be96792a1158c8b9177e48033db1a9f103a0", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598641, "uuid": "8f93d5c6-54d1-4439-9af8-269a9b618dc8", "comment": "Malware payload", "value": "b040144da900e8fff8b0c10d0f73657de557ea17", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598641, "uuid": "02f70834-e685-4f81-a01b-331a698daa26", "comment": "Malware payload", "value": "b9cbfc163b5a55d8c41baf43c881f9eb769a414a14398d92649bfdf583a682a308e464cb3111219017a28e3c44da4aec", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598641, "uuid": "b355ad39-cc22-4fc7-bd4a-7b365db00fcd", "value": "T162E4234CDEC88310756B8DAAB9E56C817DFE224006390A3510CD6D75ADE3E9B868CE5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598641, "uuid": "a10ce9f3-fa9a-434c-b39c-5b35ae47a225", "value": "12288:wfiW4jrf+Mcu6nYuFIDWhsgqbCg0lto0TMegSiKOz:wwrf+M/6LIDWhebub/iKOz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693598641, "uuid": "35ee079e-d04e-49ef-911f-d33152fd0709", "value": 685164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693598641, "uuid": "68e30cf3-5d22-4d2d-9a59-2a067e0294e6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598641, "uuid": "d44c0606-c6f1-4e82-bb82-4b98274bb054", "value": "fedex00983000768797.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0149789-489c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1693554910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693554910, "uuid": "d400dd80-a446-4abe-a3fc-a01788d5dc22", "comment": "Malware payload (Gafgyt)", "value": "a7d4810c8cf59e3354d3afd7088a89d3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693554910, "uuid": "add77545-af9b-4ebc-9ea6-91a9926e07d2", "comment": "Malware payload (Gafgyt)", "value": "6c3c4aaf7428d2926fb7d6cab4c061a11f060dadb2d96fb744996588393970a3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693554910, "uuid": "f9da2168-af05-4339-8eb8-9563a7f7b9b3", "comment": "Malware payload (Gafgyt)", "value": "f6b96e0ea6075c7673af3e9af0042a51bb49fa96", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693554910, "uuid": "3b757116-fea4-401a-b3b5-6396d19bbcbc", "comment": "Malware payload (Gafgyt)", "value": "223c1f87ecb8a9f52e0c1a6b84c481e8d2dec05ef932a536a0e2bb14446e4d9a305a13fb14ee7a83e9490825efebe30c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693554910, "uuid": "9453f749-f19b-4d3b-a886-f5fa36cbb8be", "value": "T1CB047436A91BE627D49AEDF9BDD2BE979119F6834E82830272C1204E0DF59D4341FDC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693554910, "uuid": "d5fe8588-cf30-45b7-8ea5-44c49b8812d4", "value": "3072:4/vy0BMv9g77QEye7xnJH4TnSMXZm/tVlwAGHowa:4jMv9WxyedJYTnZm/tVlwAGHowa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693554910, "uuid": "8ee80a94-eb24-4b2a-9533-ce9b206621ab", "value": 180190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693554910, "uuid": "37647650-a7b7-471f-a3c4-865898e2b985", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693554910, "uuid": "9ca2f4e0-59f8-44a5-b856-0936949913ab", "value": "a7d4810c8cf59e3354d3afd7088a89d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c57c4c3f-48c7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693573334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693573334, "uuid": "c3db8f1d-35ef-4420-81cc-c3b8ecd95240", "comment": "Malware payload (AgentTesla)", "value": "2948c06ead3f0348fcf37ef00020a8f0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693573334, "uuid": "100078ed-4dac-460f-a5c2-cd9ed85c30d3", "comment": "Malware payload (AgentTesla)", "value": "6dbccb15517b791648d8c1aed44a95820f51bba3acf881a833a333e56bb3f4ba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693573334, "uuid": "523777d7-fa0d-4d0c-b99e-f3fb0a1f7ff2", "comment": "Malware payload (AgentTesla)", "value": "c31e61aa6dbf0e0c7c5221bbf6f7323e8dc3247d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693573334, "uuid": "d0feccbe-fbe1-420a-a76a-c7989755a9e7", "comment": "Malware payload (AgentTesla)", "value": "ac7cf862ccc2dec5ba44c4e5f4f5914e24654bbceb7fcf7c5d6141378dfa7dcd807e3fd99187cf5d2081abb08281a0ae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693573334, "uuid": "a04bf851-1f0a-4f01-aa00-73793d7b1b2d", "value": "T1F0E42319E55A12CEBDC9553600F8F71E81860A993AC717EB9D24BC0B88374DA0D7EE7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693573334, "uuid": "fe83cf67-c00e-40b1-87b9-e61b586ab614", "value": "12288:mTZqY2O1eNH9/ochzOSdrqmpO3w4N7aeofLvRJNqHJKbYm8GQX:7seNd/bjdTpcN7forRz1bYV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693573334, "uuid": "0d525108-a840-4193-b3a5-f1c9ae0cdb1a", "value": 703302, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693573334, "uuid": "0cb2590d-f3f2-4d6b-9b80-7b0e399609f9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693573334, "uuid": "b83bf27b-6352-4771-9995-343bf91f7156", "value": "Factura_670967.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb8a9b10-4902-11ee-a6f9-42010a9c0055", "comment": "Malware payload (XWorm)", "timestamp": 1693598684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598684, "uuid": "4e7bfd67-41a4-4937-a106-42855a23245d", "comment": "Malware payload (XWorm)", "value": "f560a83be353d47d556ad3da2b9e788c", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598684, "uuid": "911c40a0-f1d2-48d9-874a-5cfa3462e824", "comment": "Malware payload (XWorm)", "value": "6e0df2a748927a28875f76eb917f71fe8ee2a9b2004c9b7d2742a654aae0238e", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598684, "uuid": "0e97d800-4e8a-4464-b6d9-db5af872d3c1", "comment": "Malware payload (XWorm)", "value": "be11a8dc5e78a8f17040eee4c342ce6617eb7b7c", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598684, "uuid": "c7aba8f0-f7aa-4235-9a4d-189db0eaa5a3", "comment": "Malware payload (XWorm)", "value": "bf0a5699af739640cf68c657aa80fc6bb24e6f3d0d6d37d39495bfd23c924184f7a77db9b3d1ffe7294be3d0169b1046", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598684, "uuid": "4ab1223e-5023-449d-bce5-6432072dea63", "value": "T15DA2E1B33E123B1FCE6E2131574E0CFAA834E4FAAD8DCA4B3A4174A48D475E375A5446", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598684, "uuid": "f835f306-b513-4664-bf23-49db4eefeb21", "value": "384:dXPsKtK4CQ3kKvFwPh2OM3QfD5samGyT44vKer1PfiYgFF/QBzzOse2Ewr1rlet8:VPsO7N3kKvFE2z++Gys4gZFeBPqwr1i4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693598684, "uuid": "0f8e780c-373f-4ce3-a59c-9c86e71ee6d3", "value": 23106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693598684, "uuid": "5c4004aa-802d-4556-a77b-b9966746216f", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598684, "uuid": "e3a678e5-9b85-4037-98f2-c3483d65bba8", "value": "00026391087.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eec1f9f2-48ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693597455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597455, "uuid": "0086251a-43d5-486e-ba23-7ef08834bcb4", "comment": "Malware payload (Mirai)", "value": "8fbcfb5a4c0337481973210501328409", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597455, "uuid": "d4330ab0-3e3f-410e-bd90-12aa0cc57dea", "comment": "Malware payload (Mirai)", "value": "6ea01391f5410321a26cd46b8a1ad55510f35ba7bb0e2198a5a25e2b1466800f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597455, "uuid": "04c54e25-33e3-47a1-83aa-89d628f5e68e", "comment": "Malware payload (Mirai)", "value": "32e5f98b4e988ea3bbea0776f32dec151cca67ea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597455, "uuid": "9aa00d02-1870-40f6-b26c-14af5d50b6d8", "comment": "Malware payload (Mirai)", "value": "8dc859a5e4534a008fa4dee9385024dcc817997876e4337010f960dfcbd968843cac6d10199ea677df5abe9d1cd4fb4b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693597455, "uuid": "c2d78692-f224-44f3-8a48-e38ee7d10f6d", "value": "T1C9C3F731E8044B1BC2D223F6E75A469E3F351E9793E733115A3879B06FF27992E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693597455, "uuid": "5185931b-373e-4fd7-9398-27ee117e2c8d", "value": "3072:6jVlyaL5JCrIpv04sUbttiEiTmP46aQyfPlfKsNb:yoCJCN4sUbHemP46aQyfPlfKsNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693597455, "uuid": "08d39863-6a5c-442b-b266-f0a1c8070c4c", "value": 129898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693597455, "uuid": "0c1a5024-4cdd-4a60-a4c6-8e9f423cac37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693597455, "uuid": "2f451b98-141d-4ae5-abcc-9678e6e7fadb", "value": "8fbcfb5a4c0337481973210501328409", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94a65d2c-48a0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693556502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693556502, "uuid": "c51b645c-84ed-4b34-8de1-97a684e93a23", "comment": "Malware payload (AgentTesla)", "value": "dfb5dea55b4747aa769b1bafa01ac15f", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693556502, "uuid": "32ade685-c2a5-42e7-a116-2d79fc81f910", "comment": "Malware payload (AgentTesla)", "value": "6ecb0d1dd85e578cc52fef1f76bcd28c0c82102d02f6daf596bf26f31f52f479", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693556502, "uuid": "ec3dfb68-285d-4002-a542-d3f446650f4b", "comment": "Malware payload (AgentTesla)", "value": "62e625f988e05e4f9c02d322e4b5b3a15d56d6eb", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693556502, "uuid": "9fb9acee-9aa8-4649-bdba-f2fe89b06c14", "comment": "Malware payload (AgentTesla)", "value": "98ed6322a6ca73428ac546ae74878bace2e46c89171fe5550769e42ad6a4692d9dfc53c0820fb8dcbe9c3e2554d024c0", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693556502, "uuid": "5fd68093-fc7d-427f-acc2-182bd24b3c65", "value": "T1B4D4235939D5DB55F4E60EDA1C86B1CA093FD287A6D1AF20234160CD3D89ECF28C4E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693556502, "uuid": "3ba05944-05a6-482d-bbbc-fa643d5f2215", "value": "12288:R2uMDH03q0xdlXsrkIbD7VClCpEwhjl79iLizWicUe20gP6cUzmGFHAMP:R5MkFxdlXsrkkD4oEwhjh9ZWiLt0CbUf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693556502, "uuid": "9b1db435-92ab-464a-9afc-20065d1e2d59", "value": 652821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693556502, "uuid": "d5a02803-c51d-4680-82a5-28fc759e1076", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693556502, "uuid": "94ab18a8-405e-4d2f-b91f-0a34ac5e12a8", "value": "62867266.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2af33626-48b1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693563626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693563626, "uuid": "77203a3d-3d06-465a-9724-f2e40e7fe5a3", "comment": "Malware payload (RedLineStealer)", "value": "7e3005caaed26f595035e62caf056ebf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693563626, "uuid": "32e0a1fc-4503-41f4-95ee-23401b62722a", "comment": "Malware payload (RedLineStealer)", "value": "6f95c5c4cb688e2d12f32a1907b15b4a2e1fca040fea934fb41afcade2e07b35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693563626, "uuid": "1c27fc08-d0ba-46e6-a3da-1b762e0f0950", "comment": "Malware payload (RedLineStealer)", "value": "e6fb089055fc46573eaf1ee5c6b8621e826dfdf2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693563626, "uuid": "aaf2ac98-b37c-409a-95d3-09360e4aff2b", "comment": "Malware payload (RedLineStealer)", "value": "1e9a6720e7e45df11171ed79a8b83507e1a77cd483ad0ca35eb1a141696a58ff92739b772fd96f8b3353f6d69b391158", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693563626, "uuid": "b9436b68-5789-49e8-b1d9-babfe12532bb", "value": "T155352242A2E14573DDA417752CF607C70F35BFE22A784A2F236D6A1A08B30D4A17677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693563626, "uuid": "cc660271-4336-431e-95aa-cd53308ca4ad", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693563626, "uuid": "b1e43d20-e9d8-459c-9274-cca214202785", "value": "24576:DyajKYevU4li8DV4mB0P7QO2WgeeecyUvZ:WyKbvU4lfxBeEDecy0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693563626, "uuid": "1a034143-66d6-441e-a3be-b29008dffa72", "value": 1147392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693563626, "uuid": "77708a7c-36f5-453e-8c82-6e7f7b78ed08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693563626, "uuid": "72994b3c-113a-422b-9f45-56b688b17497", "value": "6f95c5c4cb688e2d12f32a1907b15b4a2e1fca040fea9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc6883b4-486d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (PrivateLoader)", "timestamp": 1693534718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693534718, "uuid": "3d9dadf1-0ab4-48a1-9910-c7a297690519", "comment": "Malware payload (PrivateLoader)", "value": "90c9d4742bdf0531988902651a792dc2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693534718, "uuid": "7df9964f-594d-4856-ad86-53c77837d819", "comment": "Malware payload (PrivateLoader)", "value": "6f9c91ea89943314e55188a58a0c8e96d6bde70916cc1ea29e121545e945d515", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693534718, "uuid": "bd8f8f3e-a656-46d2-be2d-e9d940027c01", "comment": "Malware payload (PrivateLoader)", "value": "a52a5991148f17399c9a1176b005b1b5754afb8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693534718, "uuid": "c0ed0ace-e6b9-4dfa-ba57-2473a48b9c3a", "comment": "Malware payload (PrivateLoader)", "value": "b4ce93671ccfadef840f6d0a56aa52abfa4f617de703cd725ffaf48c1caa9739ef9894e4c78a2d2c04a0c10b31ae58d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693534718, "uuid": "e0d56a55-c3dd-4982-883c-af0436ddd7e8", "value": "T1F0654B10F602D13AF9E304F6CABE866D5568AAA1071520C7F3CC1DBA9F75AE27D31217", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693534718, "uuid": "62e4a0b1-284d-4300-b8b2-451e424a811f", "value": "c06acc2a3a092a7fc8d4970114b7230e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693534718, "uuid": "f072ca77-2dfa-4c61-90b9-1e2c3e79b4ce", "value": "24576:7yQ3G3eNNXUcWmt5WJd4myQ0lQIfQolLzQBaIyTH1ga8zJ3y9e:n0eNNXBsdGooliadTHJOJ3f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693534718, "uuid": "43486e41-038f-4f77-a430-f03d87d7cc99", "value": 1433544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693534718, "uuid": "ec97ca98-34c0-4a14-ae2c-2d370a2748b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693534718, "uuid": "58994d50-bf4e-47c6-91f0-dfc6d9201573", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1956d452-48c6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693572616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693572616, "uuid": "90ae2da3-1947-452f-af84-f18f7da9f157", "comment": "Malware payload (Mirai)", "value": "614896105719e7f64a4268c6bd95b91d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693572616, "uuid": "5304730f-a9bb-4162-9c3a-2b9b13e39108", "comment": "Malware payload (Mirai)", "value": "6fc4f5663dce8fd7d1e5ff28b860599f29df1253f383c21e205d01c970d203f6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693572616, "uuid": "44379aa0-5633-4e95-b9c4-b812f539b22d", "comment": "Malware payload (Mirai)", "value": "3aa78dddb1cc5295767444dc40b85362b31e1aba", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693572616, "uuid": "c40b6253-17dd-4b16-a25b-1bbcddaaf502", "comment": "Malware payload (Mirai)", "value": "7e0e1115962ea1d647684105224196ed0719a7004fcdb7d914b9da9c180f3a33af0c03447627ca22de0b449dc4dd16b0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693572616, "uuid": "900c6b08-fa67-4a4d-b799-ecba7c5b8453", "value": "T1556328827880AA26CBC0577BFA5F108E331457D8E1DAB3479C191FA076CAD1F0D6B75A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693572616, "uuid": "21aa8fb4-7f7e-4046-a091-2fb02fcac82b", "value": "1536:dRqCA7shu+z506mEu82prPw+70w4Y8jkMhW65g8Yn:dRqG0pjp70zY8jLr5k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693572616, "uuid": "e1115cb9-dda2-48fd-acd7-a44af0d84972", "value": 69452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693572616, "uuid": "fff77b27-3db8-4215-9c39-a307e5999944", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693572616, "uuid": "eee2a759-c3a9-4793-92e6-354f6f0381d9", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81395b6a-486e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (JanelaRAT)", "timestamp": 1693534994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693534994, "uuid": "b6d20568-ec3a-4745-afce-0952b641c669", "comment": "Malware payload (JanelaRAT)", "value": "d2dbb6a883d58f01ab0da7d55df83da9", "object_relation": "md5", "Tag": [ { "name": "JanelaRAT", "colour": "#63718C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693534994, "uuid": "9bd25128-1541-4194-a109-d5e5eb47bb56", "comment": "Malware payload (JanelaRAT)", "value": "71072c873d3981c67ab6cfb8239152b59b1bed681ad3cedb9390b49559be5205", "object_relation": "sha256", "Tag": [ { "name": "JanelaRAT", "colour": "#63718C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693534994, "uuid": "07bc4993-caad-4893-93de-44016936ed9b", "comment": "Malware payload (JanelaRAT)", "value": "a38408273044ffaa3bf4c8257460944b8524a6cb", "object_relation": "sha1", "Tag": [ { "name": "JanelaRAT", "colour": "#63718C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693534994, "uuid": "4320d3cf-e85c-44fd-a986-def48dc411e2", "comment": "Malware payload (JanelaRAT)", "value": "40a5be293e8e9055b301697ab6f6155fd55dea063d8e258329cde2b73d2ba9ebe669617d7cc47c1066f89096beb69cc4", "object_relation": "sha3-384", "Tag": [ { "name": "JanelaRAT", "colour": "#63718C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693534994, "uuid": "41cb32d4-2254-46a8-b8de-d7505f21a234", "value": "T1035533D9A4EDE4AD2D923739F42B61AD624F9BDEF133E61049BF0A1DA35D401E036630", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693534994, "uuid": "d6ea55fc-8fec-414c-b7d3-74e56774dfbe", "value": "24576:Z47LZKZGHwkcc27LV/7VCmokGfMChQcoaBzlbbJBNUzjl/bPvU7xLYUDgmFjoyN9:iXZKcQc23VjVuf3lbbbWR/bP8GMBFjo4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693534994, "uuid": "1e70dbcf-eddc-4b91-92bc-1abf1f7da18f", "value": 1335083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693534994, "uuid": "ebb4c1c7-4d32-432a-96e4-b40a0a721061", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693534994, "uuid": "57df86ed-3130-4bbe-b04b-8b1c1b6f5afe", "value": "Reporte_Estado-Factura 1693534612.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e21fb934-48ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693597434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597434, "uuid": "8784c536-eb58-4b09-bf12-62554a1ef7b7", "comment": "Malware payload (Mirai)", "value": "10211158aad3e3513ae096068db3785a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597434, "uuid": "4aa46885-aca1-4496-bd7c-7d4e876df7a1", "comment": "Malware payload (Mirai)", "value": "71badafcdc61b2a7ace3396fc5b0440bf4fb4a152c56a4fec64766588566f6ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597434, "uuid": "fdd9cb17-b95c-4fd1-92dd-1bf161802877", "comment": "Malware payload (Mirai)", "value": "ddc2a2a2523020a42a9fe50ed48ea3f51740b930", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597434, "uuid": "06816305-98cd-4540-af2d-5ebccc54f7a8", "comment": "Malware payload (Mirai)", "value": "1847cc7266ca7aeeca857861f7069ccf283aef6e3734db7d65dd3392f8600834fc06a132e2ae4207dcd82de5cf04f484", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693597434, "uuid": "702a93e6-c004-4a82-8d9c-deaffaeb29a7", "value": "T171B31A37A61C0B43C09B55F02DB77BF24F69AEA313A611C46609FEC04B73AB22551F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693597434, "uuid": "67ecd489-7673-4303-93cc-d7830f77249e", "value": "3072:pC/4rdZHsXsZwwR9QNk5mm/QcuLmHniPNb:pCwrvHwsZwY9QOmm/QcuLmHniPNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693597434, "uuid": "f6819ece-5592-44c3-bbb8-923ec2efe650", "value": 116786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693597434, "uuid": "c45d5fb1-4374-4fe9-a684-f0de98a7deee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693597434, "uuid": "7357de1e-ae44-4911-91fd-0992362259c1", "value": "10211158aad3e3513ae096068db3785a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dc1fb75-4905-11ee-a6f9-42010a9c0055", "comment": "Malware payload (N-W0rm)", "timestamp": 1693599681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693599681, "uuid": "f792c209-b08c-4f4e-8635-77de5ede1310", "comment": "Malware payload (N-W0rm)", "value": "d3ec7e37c4d7c6d7adab1ccaa50ce27c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693599681, "uuid": "58769d1f-f1f4-40ab-aaa1-891a949c0581", "comment": "Malware payload (N-W0rm)", "value": "71cb1ea3d8e249cf83c6c0717aa292094c4fbfa99fec8ede816a27da531d57db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693599681, "uuid": "c4f72431-dbb1-40ef-b1a2-0719d3fcbc52", "comment": "Malware payload (N-W0rm)", "value": "8c13c02fcbb52cf0476aa8ed046f75d0371883dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693599681, "uuid": "97c9fa5f-2e14-4b96-b8dd-4d7324cfc741", "comment": "Malware payload (N-W0rm)", "value": "269fea835d3c1dadb7b2f80225dff33a45f26f5ebd6d984828541cd010a8f073eb69f44aa19404ed125fce9d509e364e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693599681, "uuid": "c1512317-688f-4989-85a6-dbff0fd79dfe", "value": "T13C85DF0176B9CF96D388127056DB866C9790EEB2B263770F1F1CB259F9B23724A013D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693599681, "uuid": "fc79b52c-e3af-48fb-9ce3-5be83ea01a13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693599681, "uuid": "02a08cc6-7e3f-46ac-b755-d3e7d5aea0ac", "value": "24576:0madtNLos53sku8gFkdBb8hAv4kvxxEjzB8NNS4ToNr7LtccIikW:PWPnbuDkAhARAp8NNPSr7Rccp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693599681, "uuid": "f5494daf-58b6-4441-b20f-23af088c5a6a", "value": 1788928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693599681, "uuid": "7e7f489c-e5cb-488c-8ea8-600681fa79a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693599681, "uuid": "ad673852-b5f9-483c-a9b5-42488336ca51", "value": "d3ec7e37c4d7c6d7adab1ccaa50ce27c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "363050b5-48bc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693568369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693568369, "uuid": "70ccb1e7-26de-4e2d-a938-f5e6c22b38fc", "comment": "Malware payload", "value": "d2628b3bb4d04722b3224c42b4aa5c35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693568369, "uuid": "a110dd2f-e14b-4b4d-9a56-178053cafd03", "comment": "Malware payload", "value": "732b46b578c219831da0b26b866ad7da19c37ce6cbeeeb49e43a7366baccdfb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693568369, "uuid": "709f1e04-9469-453e-b099-3101294324a6", "comment": "Malware payload", "value": "7ecf4b9653f4b306a657fc39f567dc738b3a686b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693568369, "uuid": "a7237840-fb85-4c78-a9cf-9da6f94e8e38", "comment": "Malware payload", "value": "e028d3778bc98b2db62ead8c47d3c748209c609614a2e8b0830812f1e03a21e6964c8b5a8b30d2a7cc563334a13e5409", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693568369, "uuid": "e6d86df3-55e2-47d0-8050-0e2e91550c71", "value": "T15E436B017FC48A32D082933196E4B712E760BAB7A966E25D76CCD2394F12B10D6BD7F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693568369, "uuid": "1849c592-3b7a-4239-88a8-74998b170535", "value": "1a2320d39eb91af3f0d22ba6c4750021", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693568369, "uuid": "f37ada26-f525-44a0-bb7f-2a89f62fe0e9", "value": "1536:pHV5el3oWA+l5K47lOZKQjgrW/dC7weVqI:pHV5etoW/l5KIkZZjgrCdC7dq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693568369, "uuid": "8707f429-f5fa-4031-b207-3868e9afdcb8", "value": 58368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693568369, "uuid": "29847076-1c91-4527-9626-1ece5af54c6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693568369, "uuid": "b26b270f-f712-47bb-aab8-f9d6ed8a61ea", "value": "jt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f142be66-4901-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NetSupport)", "timestamp": 1693598318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598318, "uuid": "73a3f3cf-5e54-4602-8588-920466755f01", "comment": "Malware payload (NetSupport)", "value": "a4f6e50613bdfba2c0f9445a3ad03773", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598318, "uuid": "0c18f35f-8108-4249-8240-ba0824573e74", "comment": "Malware payload (NetSupport)", "value": "73e0975c94ebcdec46fd23664ccecf8953dd70eea1f4e5813e7f8cd8d2dbc4f9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598318, "uuid": "d6b2b536-1100-415f-9d40-8f8051a942ae", "comment": "Malware payload (NetSupport)", "value": "0a6c63da49c587511e30f3e0cd3802d8ae40822a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598318, "uuid": "7dba5145-8fb2-4c06-ab2a-3c81373c5c3e", "comment": "Malware payload (NetSupport)", "value": "ada9fc93bdc8ee90e8eea2452822953da261f7c346c35a47e04d626af6385664d4b2aad60ae47355b3adada273e1aade", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598318, "uuid": "aa027ce3-83dc-4990-807c-00a5aa5e9b84", "value": "T17671DA762F5093DF029A03776F27F0C1E03BD8963A602A859384F950EA96F398F74935", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598318, "uuid": "ae3c7c4e-1720-44df-a665-0127296e231a", "value": "96:FsIh+yl2D798Bciguo0qCD7uPRZthBspq2pr:Pl2DZYIT0JuPft/0r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693598318, "uuid": "12548738-eeee-4fef-92d9-ba3b4fe04075", "value": 3611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693598318, "uuid": "683a86f2-7251-4033-979a-0c25274c0363", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598318, "uuid": "2fba9388-ebec-4770-b6d7-ade5188d354e", "value": "package_details_____________________185181.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dc919d5-4902-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1693598581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598581, "uuid": "5e6ba2ff-4f36-402c-bddd-3f44f5c60250", "comment": "Malware payload (AveMariaRAT)", "value": "b90499fe7dc57d7c5721f85c7618d1d4", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598581, "uuid": "a88f9a3a-6de4-400b-bd7d-e315f8943c34", "comment": "Malware payload (AveMariaRAT)", "value": "77e9e64dfc5d21f99ceb7936244a9486a5c0e752c0ad949b3c6f6d6a1e4f4417", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598581, "uuid": "e07498d0-3a93-413c-8b1b-90ad19401707", "comment": "Malware payload (AveMariaRAT)", "value": "435736aeacede9bd426e339cdbd33590ed7de41d", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598581, "uuid": "f26e0393-d930-4583-ba16-6ccbb4b6f551", "comment": "Malware payload (AveMariaRAT)", "value": "4cff8b15cf5bf7115bfdd1d7c9fb688c1bb0ab21e46174fb95acb22d52a4ed7edf5d3374f732bb28d5f91e89e51bccd5", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598581, "uuid": "87c8a9a7-cd89-443e-b5c0-db672bb1ecbf", "value": "T14483C517BA5AC5B2C28457BBC987545C0366DE81E2A3D70A38CE37DE27233F6894174B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598581, "uuid": "c84cfc45-1303-43f4-a2ac-0aee0f4ab842", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598581, "uuid": "d21f90bf-6532-405c-994b-f998cb1b380f", "value": "1536:nrUmlP4Wmx0XXf0M3JZPjBAGCLLTxtlu3oKY6kcwdyJ6yiiDxc607vDTi:hPmaXXf0bzs3oKY6kc+yXdxkfi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693598581, "uuid": "055892ec-0f16-4eca-a71d-a8b62cfa2c57", "value": 86528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693598581, "uuid": "e3af156f-e94d-40e0-9459-9a0d8ffd4ae4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598581, "uuid": "466981f5-b649-4044-ba8b-ae84d7d64f77", "value": "VIET NGUYEN TECHNOLOGY - PRODUCTS LIST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85585bfb-487f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1693542303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693542303, "uuid": "2d45335a-ea36-4633-a528-27038091af2c", "comment": "Malware payload (Formbook)", "value": "b0d09c916638e2e1a505cb0d33b82991", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693542303, "uuid": "0f474935-6092-4b3d-9884-bfea1a7518a5", "comment": "Malware payload (Formbook)", "value": "77f6f216b078f447330384e369bdf9bc167be984ef86aaacc5b2ab5292c177c2", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693542303, "uuid": "decd5ab6-4d14-476a-a894-b4bc9c451348", "comment": "Malware payload (Formbook)", "value": "aa53a2f463368af8f215817093fd9d29128f251d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693542303, "uuid": "38a8f7ea-f5e1-4928-863b-3036c7da5d2c", "comment": "Malware payload (Formbook)", "value": "318cc2da9a027ce7772b5395e372aa18b3ace0b4e24c2bace32de5d872b781553d058f074981a82b6378f9f988103771", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693542303, "uuid": "b489eb95-daf5-4757-a2f2-e129283d5842", "value": "T104D42310F10F7DB8AE33DFC28714748EA9309D54C8EDA9321259562832BB5ED671A3DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693542303, "uuid": "8fd91a98-5e91-4fa6-967c-057b0f2fbf10", "value": "12288:cArXd8skrh6+bggUvj9khrOJDohdcZaOsmiL8vHBo98cnmlEIN2UlA06FQeEV:prN8skrwj9jDG+smiwhQ8cnmlpoQeEV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693542303, "uuid": "c56aabf0-6b30-4881-8cc4-d18432354e81", "value": 633848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693542303, "uuid": "6708bfaa-2384-4c23-bf0e-65b2b42b47db", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693542303, "uuid": "af252f54-4d5b-4546-9d42-df93bbaab7c0", "value": "Confirm pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9506c331-4902-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1693598593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598593, "uuid": "106056b5-3d85-438e-b7c4-e9a96ea86ba8", "comment": "Malware payload (Loki)", "value": "154d2392a316fe32338cb4a537ee7a23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598593, "uuid": "7f2c7021-df9e-4212-bb0f-22e4640c7495", "comment": "Malware payload (Loki)", "value": "7876c0f4dba9df60cb6a5d7d954e823399f096cc3afb96ecc0a20170cfd9ed2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598593, "uuid": "39e96de9-5ea5-444b-8330-6c5652fd37be", "comment": "Malware payload (Loki)", "value": "88b00ec88ca72dfdd35ac1d589692cbcf9153aae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598593, "uuid": "c24ffdcc-775a-457d-b211-8b112c0d4810", "comment": "Malware payload (Loki)", "value": "6361a01db148e02f16349df1bc8401da4a0690ad50ca2e0a8fd31939befd9105adddc45b34ae58a8f10e0e5d654d21b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598593, "uuid": "4afe6cbd-9f3e-4fdc-8598-4bab1c02170e", "value": "T156350212BEC247B2D5F3CA325938A644F17EBC343F269A0A739CF61C4736051927DA66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598593, "uuid": "c7f2aac3-b692-40e7-8a1c-3c6d184272c5", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598593, "uuid": "a7be6054-736a-4ad4-9906-48591eb4e5d0", "value": "24576:wNA3R5drXmDy1/ebyBvrdWqZdTsToC5I+hqR6jZ8kQwqv83+Qg+XA44p:p5UI/eyFrvdAToC5IY8kkv83Wp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693598593, "uuid": "c9992b96-1140-4cd0-bc74-c27a0ee54d55", "value": 1099790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693598593, "uuid": "e6a40cea-1f57-42d0-99de-39390263b32b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598593, "uuid": "2e95af40-17de-4520-9509-36e0a2cf62fa", "value": "Odeme.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6d1870a-48bf-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693569927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693569927, "uuid": "75c368dc-cdda-4e71-88e8-49011f658de3", "comment": "Malware payload", "value": "8472040cdd619eb2b57ea60bdae11d47", "object_relation": "md5", "Tag": [ { "name": "6000 virus", "colour": "#C1FF84", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693569927, "uuid": "cc67c672-39ac-4550-865f-deb4f7874480", "comment": "Malware payload", "value": "790b2cf307cd28769d823a76479923c34c51da6e77b2e7abe4b0fde47faa27ed", "object_relation": "sha256", "Tag": [ { "name": "6000 virus", "colour": "#C1FF84", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693569927, "uuid": "6a408893-d097-457b-b4f9-63b8279a39a6", "comment": "Malware payload", "value": "4d820a4280652dad3883483a78a44f4b2a8e00ad", "object_relation": "sha1", "Tag": [ { "name": "6000 virus", "colour": "#C1FF84", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693569927, "uuid": "a9cf0578-dcd9-49ee-87bb-228b1a4c8468", "comment": "Malware payload", "value": "380319db6be79dfccd9b4c8d49d125651d4330e50976d1fb70988131dec20112335f3d3bb02f1b62f059abb53d687585", "object_relation": "sha3-384", "Tag": [ { "name": "6000 virus", "colour": "#C1FF84", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693569927, "uuid": "b12d232a-e5a0-44ca-b6e1-69614f999659", "value": "T125B5192E9724543ECE1E73F45397B623EBB9F7277750329E0EA8198008D11C87A93979", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693569927, "uuid": "5fd8f3b6-f684-49ae-9113-ddd124d97bb5", "value": "49152:Mv61ApWvM5sFQYmmGtcWi7FHPGYM1ai8ZN:MIApWvM5sDkvi7FHPGtZ8ZN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693569927, "uuid": "02e236d0-8d7e-411c-8b63-adcc6dbed2e0", "value": 2352494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693569927, "uuid": "49c4604e-5842-4af4-be31-6c9144e73be5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693569927, "uuid": "26e49396-d00f-4286-b461-dd0418096e9c", "value": "6000 Virus.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "634b4465-487a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693540098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693540098, "uuid": "fb842bdc-1097-42df-89b8-e878c70a243c", "comment": "Malware payload", "value": "0b83d6e9346525200c882de0a3cc9c76", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693540098, "uuid": "5f7b5503-8f40-46d7-b523-e46c72215aaa", "comment": "Malware payload", "value": "7c520c771f878a8b683048684b4b71d0e8128ac1060e50a84d24355263155490", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693540098, "uuid": "368e0d32-02c3-4b04-a9cb-9f235ca82c16", "comment": "Malware payload", "value": "2af67c2e9f42e938fecc3cbb245c7c13ced4ef69", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693540098, "uuid": "5b3f6acd-86e3-4fe1-8774-c762184d1cb4", "comment": "Malware payload", "value": "e0e7cb9a6baa2895009bd6ec718592b3afb9ae2ef013dfcc4c9d22af2643e955ccf64f354491733db6c959ec2d4bd62d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693540098, "uuid": "2f5082b4-1bbe-460d-8cfb-1b5516bdc55c", "value": "T1DBA18DA0768A6D9DCE1704FC9CAF4DA1AED0C143A4106BD26A0BBCE807C66C802D9EC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693540098, "uuid": "30ec8148-5275-4b3d-91a0-0e0d2614e6b2", "value": "48:9K0YxRVi1U4GELcGDTTn8X4Nht5J6/NpqsVPyQ2UsrB4Gz8MAP2wONbCjQpodzV6:LnBpPjNn+/Npqw5OCOGHScA3xRhAAuJA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693540098, "uuid": "5c9dbc14-1916-4658-aed5-2426484fa186", "value": 4980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693540098, "uuid": "af682ca4-e6ba-420d-a2ec-02779bcd0ef2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693540098, "uuid": "d2ed7ec6-e40d-4b01-a351-cb1a3b30f150", "value": "19657WhatsLogs.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5757bd9e-4882-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693543514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693543514, "uuid": "9bb5d38c-fd9d-4f8a-a5ed-f14a9ffbf428", "comment": "Malware payload", "value": "2bae98c0f00d194f92eb26c04b2969e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693543514, "uuid": "74b7ee60-d02d-4cdc-ac3e-089e84dc5c5d", "comment": "Malware payload", "value": "7d5362474a02e3cda5f6982ac84984edfa7ebb3bc42837e86bde1d86dcf1fb1c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693543514, "uuid": "47bb16f8-8105-4ffd-8911-7176c3e2f600", "comment": "Malware payload", "value": "1814e86c33b600c996e649eb3a515ef0953d12d9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693543514, "uuid": "86928344-0f2c-4a83-be41-f47864d8e2d1", "comment": "Malware payload", "value": "ced733f942d1920bcdbabd411f429781e1af8981f6e64f9d9a162e40a83019c1f2286b6c17783c4e603be1dfa52f24ec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693543514, "uuid": "3bfe4bac-e99d-4894-b92e-de4d30b10ee6", "value": "T17FA2E1F8CE49828ACCED657DCA492B8DF69D29E8F5C59B24F0E0484ADC580F4C455DDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693543514, "uuid": "cb288f3d-f2ab-46cd-98d5-3475f93fa5c7", "value": "384:i3Z9PmoK7yfMeqXpEX655Yq81a6DBVrSt81cwYNRMSGwCxIzoZAF:iChmmXcm5x81a6/rxYNRMSGFmzsw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693543514, "uuid": "bc78367c-a93e-465c-aa1d-9cd7a37ae827", "value": 22904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693543514, "uuid": "7371ee82-5f2f-465b-96cd-4e8c98005036", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693543514, "uuid": "2e307fa1-854d-4841-910f-b513280132a1", "value": "2bae98c0f00d194f92eb26c04b2969e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1dbc4a3-485b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693526996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693526996, "uuid": "0e519c56-0bd1-4d53-a4ae-856848eb9134", "comment": "Malware payload (Amadey)", "value": "3cd75029c97847f86b88e7216ffd873c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693526996, "uuid": "fc75b69e-e694-47e5-8130-4712ceee9165", "comment": "Malware payload (Amadey)", "value": "7d77d1e2bff3541903ce4d55acb5a7ca96c9164513fdf1a7a9d2ed063f2e6fd9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693526996, "uuid": "98013b75-2695-4386-b5e7-f0bd086a7171", "comment": "Malware payload (Amadey)", "value": "e3b4ad9c04ea9e3bb77af642892105874f74df2c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693526996, "uuid": "0e4401f9-36d6-4791-b087-ca24740e3657", "comment": "Malware payload (Amadey)", "value": "fed817e114544a37cc8677f19544e95af8607e52b6197ffd58b56a2e25ee5c868d074204a73f3e5fe817b5f4c9ed0f89", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693526996, "uuid": "8b933e16-2060-4e7e-86b2-2e5db5105bdc", "value": "T1A9051212DFEC1176E8F05B7524F602C30F36BC9268A996AF234199250CB36C5AC75B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693526996, "uuid": "d59eb7d8-d2c6-4f99-8c9a-019dcc1fb05b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693526996, "uuid": "1b3eb76f-49e0-4423-8603-e041998c6a6f", "value": "12288:EMrhy90OoMw0x9CAeeb9FUinGhaqeey7r0hlU5PW498S5rV1sWLwXXjSN6kSg5O/:Vydo+2s7nMY0Ud//pkXmILg5I/LEQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693526996, "uuid": "94575504-17cb-442d-8ee6-a40316a58c43", "value": 847872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693526996, "uuid": "803a2fcf-ecbf-415e-bd0f-3e71844da1c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693526996, "uuid": "72ff90a2-1905-445c-b5ed-e4d94c1380a6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82ce39d4-4911-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693605005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693605005, "uuid": "5e42bfe2-d56f-48ea-98c0-a3efb9bd119d", "comment": "Malware payload (Mirai)", "value": "54c3d2fe4d5bc29fcb22c6f6fb82cae7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693605005, "uuid": "5b18bd5b-08fa-42fd-b900-e9dd7b5b2a39", "comment": "Malware payload (Mirai)", "value": "7d801172353d1517b20bb6751b0663765a181e725c3130e92a34fa368250bd35", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693605005, "uuid": "58f1e8e6-8562-41fe-9beb-79b6580af5c5", "comment": "Malware payload (Mirai)", "value": "af3662fcdef65e3740f56072fa040d9edccc48f0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693605005, "uuid": "23beebc5-1367-4bfa-8332-79a950b3e0d6", "comment": "Malware payload (Mirai)", "value": "de08e3992bd23384aa7fb8d5db5ffd90ecdc2763737eff0d608d0582776eb5b38ca20b01b4643912cc325953b8473144", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693605005, "uuid": "956d93fe-b490-4e34-8fe4-f34c3bc99c80", "value": "T11733F211B2321F72ACB98877F5A501466AC9877C61C6F2B34258CADC4562F8BF05E4D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693605005, "uuid": "dad53216-a274-489d-a58b-433200a19982", "value": "1536:DOIlMtSFSIhqUXKpdhi41Hf/ZV2iLv8WHx:DOmMoBlapbief/Z5LFx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693605005, "uuid": "f5d34337-63d0-4931-b188-a8d493b2bb56", "value": 53636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693605005, "uuid": "07a15833-6b76-4c1c-aa25-8b58fc29081e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693605005, "uuid": "77fd4a24-94f0-487a-8e51-e1d386233538", "value": "z3hir.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "331fdedb-48a2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693557197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693557197, "uuid": "58851687-5465-4d12-b6a4-4eddc965ed7d", "comment": "Malware payload (Amadey)", "value": "7d1b70fdde8d02db098c718ec83b2d37", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693557197, "uuid": "2e07cd10-0f62-4ca2-a567-e58f0e47c8b7", "comment": "Malware payload (Amadey)", "value": "7e0b315f66989a4bab22132d5b185f24e40c82d9a843a04d2d512b373fb970b5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693557197, "uuid": "8077e886-fa99-48fe-add2-96997dc027bd", "comment": "Malware payload (Amadey)", "value": "08e9748972fcd15acd40bdc8a0c349875b8ab7ee", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693557197, "uuid": "cb186908-fd26-4276-b913-b802a143f658", "comment": "Malware payload (Amadey)", "value": "2fa49f1202cae3876500d4c68c12172939ccabbe41e855bb2e4ca785d0bce7e55716b850c9a5df680185b5dfc33f6a9c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693557197, "uuid": "894abeba-51d4-48dc-8ce6-6900fabff185", "value": "T193051202E7D48632E9B6277189FB0B831F31BC914CB8531F6388DA5B1D7259991B237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693557197, "uuid": "a8b0d16a-df4c-4fc5-8522-e5e3e64c9707", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693557197, "uuid": "b17472c3-b691-4f91-8c37-08c69bc68909", "value": "12288:zMrFy90w9+7qpUC3UZPC1c4RRbfWyhE1Ojnk+IKwsnL4B9BNbbh/hrJgEGX5v0r:+ybQ0VOyW1+kdsK9BNbJhrU5vU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693557197, "uuid": "09ee7383-813c-4e7e-84e8-000d6aa8764e", "value": 847360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693557197, "uuid": "728b5b13-afd9-47c8-b4e2-61347195bd97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693557197, "uuid": "1bda2b72-e117-493b-b46e-2ca2e0244bd4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0256f319-488e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tofsee)", "timestamp": 1693548525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693548525, "uuid": "7e84a76f-9812-421a-a64c-61136390cab8", "comment": "Malware payload (Tofsee)", "value": "2d773ac7f3d9be821b9840505dccd9a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693548525, "uuid": "d90befb7-3537-49ac-8513-472a93a5ada3", "comment": "Malware payload (Tofsee)", "value": "7ea06044a8fb6a5754735db9ea04cf4d0e67f3caa00ac2750b187a4e9a4295a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693548525, "uuid": "d3ea1cce-04ec-4902-b164-fc832cdea578", "comment": "Malware payload (Tofsee)", "value": "18299d075d9edc5df97234796d09b3dba677acd1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693548525, "uuid": "6accc09e-6857-4e02-aa15-0900409fb1e1", "comment": "Malware payload (Tofsee)", "value": "06a0ee0f9791c6ecea2d3b2b7ebeb878521ab927c1cecdfb14281e3a96409dd875fec0962badc9aaa2840287701ea9cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693548525, "uuid": "8de5c51f-baf7-45ba-8150-25b930ac2d51", "value": "T19784C64382E17D95E92ECB729F1FC6F8766DF6608E497B753228AA1B00B1177C1A3710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693548525, "uuid": "6c86d2d2-0d54-4f0c-98b8-74ccb47eaf91", "value": "a0157d3b2852cca44553b58241d89d57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693548525, "uuid": "44f8aa5d-cb12-4059-8869-b51dd5096ec9", "value": "6144:i/Q2PS+G8L+TVVJh7+XeSRjOJWYXqTfdu5:i/Q2PS98L+Td4CqTg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693548525, "uuid": "315698be-1876-47bd-811c-d5ff329d5814", "value": 394752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693548525, "uuid": "3b08a223-7527-4c41-a907-d7fe4929269a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693548525, "uuid": "53e5d1de-8766-4b3d-a438-a7c2e0a136b9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd62ce48-4902-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693598661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598661, "uuid": "f884981a-cb83-4ce3-aac7-5deae9c2f9fe", "comment": "Malware payload (AgentTesla)", "value": "d1f09ebacc4975c1c063a937aff5cb9f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598661, "uuid": "2a86d251-05e4-4ec8-9bd1-c4e5ae296e83", "comment": "Malware payload (AgentTesla)", "value": "7efc8926572801f21a109e743d788ee801aaaf4f206cae0b0c028761b9673a59", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598661, "uuid": "3a82635a-716d-487c-ab9d-84a2301b420c", "comment": "Malware payload (AgentTesla)", "value": "65bb2528b029605f8bdb4cf2bb7dfb4b21fff560", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598661, "uuid": "94cf7e03-3274-4bd5-b81b-032c14da5d9a", "comment": "Malware payload (AgentTesla)", "value": "3b0daa26907c178c96d91d33a9858da315fe85c5158ed4773cfe122548e86c4c89833870514cc73bd09667c06fe7f736", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598661, "uuid": "98d72986-adc5-48e4-8677-280a32d5df56", "value": "T1C5F4334E274F0B4CBE686B7640E2D9EC86837AA261F17159405CA3F15E83C1E59CCBDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598661, "uuid": "d053dcf5-0464-41a0-b004-d9575472e766", "value": "12288:VHnW3vWGb9l9E7ICkOkXijGwLuYysYH2Q4edv16EiK2x5Yl4:9c/9E7JXjPqmsKxKO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693598661, "uuid": "03e7cddf-86be-4f52-9f4f-ca954dc424b8", "value": 737614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693598661, "uuid": "8abaf6da-ef73-4187-9cad-cb8034e65b53", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598661, "uuid": "a19999c4-e2ce-41eb-afab-2869b17ac964", "value": "31082023_Nuovo Ordine.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "774de83c-48a9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693560318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693560318, "uuid": "892da572-7ee5-49ac-a755-e4359bd41d69", "comment": "Malware payload (Amadey)", "value": "ada0b7fe2f652cd3f6d405dc12325a77", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693560318, "uuid": "6f581f26-1258-480b-9e0c-39a9eb7b852b", "comment": "Malware payload (Amadey)", "value": "7f2333e43adffc31206040171db15f1679e8b0ff0cc6eb05bdc4c1487915906b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693560318, "uuid": "c615f4e3-2545-477f-8a91-1ebeef4a9b62", "comment": "Malware payload (Amadey)", "value": "825b9c835129a86716df94ff6ababa8196228ecd", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693560318, "uuid": "b452ef29-c838-47bf-abe2-5dfda8610746", "comment": "Malware payload (Amadey)", "value": "43b8c1cc022abff54992d2fa141f360abb551e800e85812f93e819479792520a6164b0e551931b2b2fa9235c3db97142", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693560318, "uuid": "b28683ba-5752-489f-821c-2811293f1a85", "value": "T12F33F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693560318, "uuid": "68dedd43-fd9a-460a-bd42-d35aec7fd143", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693560318, "uuid": "e8616376-49f9-482d-bcde-ca0a2aeec94f", "value": 50271, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693560318, "uuid": "21930741-6b5e-4bfb-b8cd-edecd73deed4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693560318, "uuid": "f299ce2e-a51a-44d4-8ae7-b3c4afce5392", "value": "ada0b7fe2f652cd3f6d405dc12325a77.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a52a5354-48cb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693574998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574998, "uuid": "28f0f07a-5c31-4d0f-803b-1aaf5862fca6", "comment": "Malware payload (AgentTesla)", "value": "a28d9488a198174f4b916bf2787c3fd4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574998, "uuid": "b5525e82-a652-4ac2-b30c-012841e6e8cf", "comment": "Malware payload (AgentTesla)", "value": "8021b5add7bba0b31d11847366b187821dee6c3194eae4eb340cffcdecc32ff2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574998, "uuid": "b27e8e4c-6257-4d78-830c-d485d7f0207e", "comment": "Malware payload (AgentTesla)", "value": "af5845f94e830c2df13a465af017a3c144007d05", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574998, "uuid": "29e93bc9-a85a-4ae5-9acd-110f84261ad3", "comment": "Malware payload (AgentTesla)", "value": "64464c0ae846f4b6008a2b6c0f6eff11b8b24b3ad9499f357fd138b6624ced7e8feed0f087e703d0697282afe3934fc0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693574998, "uuid": "76a2221c-a00d-4347-ac6b-65bb2250858c", "value": "T12283E817BB6B85F1C6485B3AC99751080365E6C9F393E70A788F1B5B250B3FACD4124B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693574998, "uuid": "5f70f7d8-bed0-48f4-805d-053b4d635f85", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693574998, "uuid": "7c2fca54-2949-4cdd-8e2e-35183f1d8ddd", "value": "1536:NXvdz2C9b3TalM7RMehirMyWc3Tf4oI3Ucgzz/pbpkBzADyr/Qn8:OC9alwDQnr3IdgP2zADyr/J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693574998, "uuid": "f30073ec-f5f2-4420-82d5-5bac0fdd6fbf", "value": 82432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693574998, "uuid": "2bd78588-5cf4-4ad2-9895-29d1c154fa46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693574998, "uuid": "9802431d-e915-4017-827f-8cd4b4c5bc84", "value": "SecuriteInfo.com.Win32.MalwareX-gen.14688.13385", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1627de71-48a1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693556719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693556719, "uuid": "805b18c4-fafc-4395-b975-d79dcc0bd923", "comment": "Malware payload (Amadey)", "value": "1171bd44f8a16de90939993410a8cf29", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693556719, "uuid": "ec3da929-6c9f-4530-847c-26b7769781d5", "comment": "Malware payload (Amadey)", "value": "8075cb75aaef27d9f5430b4952fe7eb1f153d43b0b85fb6f16893093b4dc4fce", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693556719, "uuid": "30cc59ef-39b6-4261-b5c3-d90583ab67b1", "comment": "Malware payload (Amadey)", "value": "d520a780d949a8b69c85d8c6a933c0e6bfe2c98a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693556719, "uuid": "9c8071b9-4267-4cc0-bcf3-7310d39ae79a", "comment": "Malware payload (Amadey)", "value": "9d3f3e950f3b27affa8cad1b976eafc6a1e231f64470e878074e55d439be1e614687fd00a70f4147c7d8aa198dc5496c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693556719, "uuid": "ced738a7-48a1-49d5-95c5-517421de4259", "value": "T1D33523539DDD94B3E8BA177418FB079B0A35BCE19C74972A1742994B0D73AC0A032B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693556719, "uuid": "f4549bbf-f4c4-4dc8-8766-0bc6937e0754", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693556719, "uuid": "85dd0e51-52d2-436d-8649-e087bfc38924", "value": "12288:dMr+y90kBy7JkJd8m4hTMV+r/0fRgEmJUNEY0ptP2n/YopiCZNaW1VQQ0/AqGv6w:3ycdkJdar/0Zbn0KJ0bGinNbUo+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693556719, "uuid": "d2d28639-7bcf-4f8c-b5cc-36cfd2654b6e", "value": 1149952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693556719, "uuid": "170ecf12-e886-4029-9124-6e2a0f1377d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693556719, "uuid": "0b24fc04-3428-4c1f-8238-ed62703d34ed", "value": "1171bd44f8a16de90939993410a8cf29.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af45abe5-4902-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693598637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598637, "uuid": "747047ef-7482-4415-8194-6863a6b3810a", "comment": "Malware payload (AgentTesla)", "value": "cf62adf11f54a15f00b8df0ab4c2df37", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598637, "uuid": "8a56d448-486d-41b6-a805-7f28bbae293b", "comment": "Malware payload (AgentTesla)", "value": "82058c68625b02b73d387ae3cedd7bd1648243fc3143570942d7e9b92e83ba7f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598637, "uuid": "d31d6509-3fe8-4d63-8ea2-20b5dd7d7356", "comment": "Malware payload (AgentTesla)", "value": "30dd5d85ec0480a8c5882700b38cc056edc3a6dc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598637, "uuid": "e2400fe5-7cff-4b6e-b2d7-3cb89663e281", "comment": "Malware payload (AgentTesla)", "value": "3c4877cd2bea8ce6a39ec787742ef6bc38d3860b11eb2c6d34bb8a406a17c4cdc43cf3d1029ab450ca410aec8ff6db4a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598637, "uuid": "4dec7176-2e46-4cbc-aa2b-04ced1f25855", "value": "T1C283D617B55E85B2E2894BFAC69B510403B5EF81B343D35B788E23765A337FA880158F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598637, "uuid": "48a11de4-2ba5-4c21-bc9e-995ab7d4fe6f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598637, "uuid": "54a2e7a7-08e2-4eea-89e6-d9683a1dc66a", "value": "1536:RGiwRuxbfRWGv7woBBtwsgflVSC1rIfjJvicBa:LwoVfRWGv7wkBCfvXt0FG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693598637, "uuid": "e19aa648-257f-45b5-bbca-69c3b02d0cbb", "value": 80896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693598637, "uuid": "7658a3f5-8425-4601-963e-d3d58f5e335f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598637, "uuid": "d4555cda-c4fb-471d-91e5-a60d1577d5c9", "value": "Factura Modificada Ebill Recibo de Pago Hsbc___pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26a1f83a-485e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1693527970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693527970, "uuid": "d98ff1a7-b14e-4f78-bf06-8dcb6ade20b1", "comment": "Malware payload (Smoke Loader)", "value": "c44e70f5543625ca259753e5c0919591", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693527970, "uuid": "34beda98-5b05-4f68-bb73-2bdc30f6a1d2", "comment": "Malware payload (Smoke Loader)", "value": "82ce4a02da068fd7f69b255e60055fbed0fbfaa9dfa15d7aab7185f8dc19f75c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693527970, "uuid": "af9dddf7-3c83-40a0-9ba7-1ea87dc40550", "comment": "Malware payload (Smoke Loader)", "value": "ac628e27747a79f4b6e74cc2a68740f99d3f69ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693527970, "uuid": "2325780e-519e-43fc-aac1-79228da6093f", "comment": "Malware payload (Smoke Loader)", "value": "fdaaa54280f3966aeb943e7eb64eaec70e49e955f065ef17fee786f324475f1adee36198c83c6b565828f73d4509c001", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693527970, "uuid": "f3a75283-d7e6-416c-95ed-41e508ea391c", "value": "T12A24E011FBE1C0B2D0631670A5B0CBED5EBA7C71263155AB27541E3E4E70BC05ABE792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693527970, "uuid": "a5a44876-1fa3-4fc4-8859-d8455ce20acf", "value": "60202b26a1548f32d077efa3514a2fd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693527970, "uuid": "69592052-81fc-45cc-ba1d-0862e5cf4497", "value": "3072:HLx7kv8RGHBw0FRfyRUNjNWNAcy4LgOmG:rdfRGHBw0FASTIy0VmG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693527970, "uuid": "0baee414-e99e-409d-ba09-d9a0dcfab9ab", "value": 211968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693527970, "uuid": "c950671d-c6db-429e-9f6a-49bb7fe4bd42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693527970, "uuid": "659a20b6-e3a9-4bea-97ec-9be53dd3c718", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72866aea-48c3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693571477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693571477, "uuid": "9cc028bc-267f-4738-895f-77c6702abded", "comment": "Malware payload (AgentTesla)", "value": "ed4a464e8bf79ecf805cf7e1c2dcc77a", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693571477, "uuid": "8bbc5c6a-3c05-4893-980a-a707d791ecee", "comment": "Malware payload (AgentTesla)", "value": "82d825c6842693921ff9436f2c09d7c755dc2489e4711321914f1020dce08bcf", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693571477, "uuid": "1deeab18-8799-4280-a17f-85a205ed7d79", "comment": "Malware payload (AgentTesla)", "value": "99a562c3e8ad3f40c64b2b5fba0d8f52eed8e312", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693571477, "uuid": "c4349382-29e4-4ab4-8d2c-01a5ec32ed08", "comment": "Malware payload (AgentTesla)", "value": "ea137eb690851772e9c585f25c8a409bf9cc8d1ba26152f0f1204d25f1e780c5aa491f1bd03966c4d03559d6b41900a2", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693571477, "uuid": "9189b8ac-62ae-468f-b8fc-dd808d6633ff", "value": "T1ECC423B1245EDF00239FA9868BEB81B14FD1D61AAA73E1345D3016CB652BCD3E0916B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693571477, "uuid": "4fc13ea1-d570-4d78-94e1-d0923426c5e8", "value": "12288:iczMwV2AJKwVpXg+BNpupsFzGE4SBaMfBHCv7Hc6T3Lt/zoeNVn:iYMo2wxhBNMp8iSEhZ0eNV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693571477, "uuid": "8a486c6c-bc0d-49a4-9230-604599d90871", "value": 595802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693571477, "uuid": "6979b864-44ef-4371-b5a6-a387a65bbf92", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693571477, "uuid": "7162843c-e0eb-4918-9eae-3d9f885c3696", "value": "overdue invoices pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "500ef869-48de-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693583015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693583015, "uuid": "9f564c63-39a8-4dbf-8863-24744d0dedd4", "comment": "Malware payload (Amadey)", "value": "98628dba1be12d83b13f1b2bd25d85b6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693583015, "uuid": "c13faff8-d3c3-4039-83d1-67e04a2da971", "comment": "Malware payload (Amadey)", "value": "82ecd2b864229b43116466944478c474ac7ff2e8a0dd4f24df59d325953c2b30", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693583015, "uuid": "cb2c7d7d-3919-4036-bbec-d61688505f47", "comment": "Malware payload (Amadey)", "value": "e5ade0031e4f6b4a67189010dcb1fc015a7ad5ef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693583015, "uuid": "7eb6a5bc-42b1-4955-919a-605ea8391375", "comment": "Malware payload (Amadey)", "value": "30d5e03509fcb5f559929fa8468c11f9f0205d07479eac5c4e8c5b4835a9e674f70c95ec8001132814265a385e1d21df", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693583015, "uuid": "6669518e-a066-42af-b4ee-c62d11111902", "value": "T1AE156DA488B30B669517C71AF5EB0CA5ECBC5BD469C26AB7D030D9DB19E2D09BFC1013", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693583015, "uuid": "2eef0ac5-48ba-4b52-924b-edc1dafcd31b", "value": "a9c887a4f18a3fede2cc29ceea138ed3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693583015, "uuid": "f04eb6a3-c693-4ab0-8034-e56d8684c64f", "value": "24576:TdO/YtNyqi2tAlwYZAVBHPXvkUNF3PEjVwaxG:gkNA2aW8ADP/1fiVwaxG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693583015, "uuid": "63a29ad6-79c7-4b61-b124-220ea311d2cb", "value": 940544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693583015, "uuid": "6c3f2098-c792-4ba8-8738-061904d5e886", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693583015, "uuid": "5a35267b-5081-447d-80b8-c6bca3f7866b", "value": "98628dba1be12d83b13f1b2bd25d85b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e4920f3-48ca-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693574369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574369, "uuid": "ce854e06-60b2-4734-9d9f-be97d7143dcb", "comment": "Malware payload (Mirai)", "value": "4f84b15885b38f019a14b270979182bb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574369, "uuid": "a7c2bd29-7e67-4246-a1b6-2d6efe4af4d2", "comment": "Malware payload (Mirai)", "value": "8451c15c8e386cc928df12537defcaf549c25cb2e160d148917a6918ee9358eb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574369, "uuid": "769688e7-c494-4b09-a1c6-4fa4892100fc", "comment": "Malware payload (Mirai)", "value": "fd94d3c687338389b594106485bd7a26c7e8f10a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574369, "uuid": "477c7653-2df1-4b02-9708-d6a41591b8e5", "comment": "Malware payload (Mirai)", "value": "97cdb73ac82c9d5469c1e15785771d8def438065648f21eb50c68e19ef7a89d26ff7faf8befca4c9ea77d97fc28ac828", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693574369, "uuid": "374a9e16-7b87-48bf-bcca-e109829de250", "value": "T153535CC6B8119E7DF5CBE6BE84224D0EB821722150931B27BB6FFC837D731648956E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693574369, "uuid": "0d96401e-bea2-4f47-8ef4-20a87294422d", "value": "1536:AXyRgQFTTbSX5dhLepSGYacFuxYhON2PPB+qG76E8b:N1GjR8EVGOR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693574369, "uuid": "13d86777-0e12-468f-850f-9181889a5a38", "value": 66504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693574369, "uuid": "349706e1-63be-4e6e-beb7-640ff97685df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693574369, "uuid": "e1b140a7-fd5a-40a6-adfa-858fe5a1828b", "value": "4f84b15885b38f019a14b270979182bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f245dd2-48f5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693592839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693592839, "uuid": "7d8ab40f-c998-4e18-9b54-06ffcafa04f5", "comment": "Malware payload", "value": "ba96aeaa69a29e3eddfdb91c1c16b97b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693592839, "uuid": "685ac887-9986-4bdc-9d2a-13030dd5af64", "comment": "Malware payload", "value": "866aa1851340dcd5a75a980d930fa3ad1997c8315077fd393ff1ff8702285b12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693592839, "uuid": "71cd42b7-1ca5-4b71-981c-bfe88e8243d0", "comment": "Malware payload", "value": "b2bab740272039740065fec23f61b836fb6ed226", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693592839, "uuid": "91d2bc02-feb3-4bc6-ae40-ce74bc4eb07e", "comment": "Malware payload", "value": "dfd40f301391426f266cfbdac35d6b75a7474631d0e5374d02976485858b90ccdc43d909f089d5660a98a1ce89382c57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693592839, "uuid": "b5367872-f409-4de9-94d7-4ef3bd17c7d1", "value": "T116052209BBDA9272DDBA177029F703930B31BCE55DB492572607990A0EB379078327B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693592839, "uuid": "e74e3330-e70a-4389-a930-79d6ee34f6fe", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693592839, "uuid": "7584e7ce-d41f-4f65-ad6d-f066f464f531", "value": "12288:RMrJy90N9exa0XioHOyJTBYLNMJJ7EiafSN9FOP4XGcPwXFv5juuyJA2oiu4cJB:0yXRHOwTBecEWTw391vRhyJMiu4cP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693592839, "uuid": "016cd632-296e-457a-9fdc-ef7f09100697", "value": 849408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693592839, "uuid": "d6664b6a-d1ef-468b-8a09-45313e47df06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693592839, "uuid": "01d1e46a-c353-4a86-a8e8-51b69101e313", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f90abd6-4862-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693529730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693529730, "uuid": "73e39c64-3837-4179-883c-25ed671adf52", "comment": "Malware payload (Amadey)", "value": "42b9cbd4e424e9a474c954191a985106", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693529730, "uuid": "3caafa28-064c-4b86-8fb3-316b9c93da3a", "comment": "Malware payload (Amadey)", "value": "868fbf11e2814e28b14a070f05ac354cf11506a31233cd8b38609735033ddf45", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693529730, "uuid": "46a619a2-6191-441e-baab-cd50e5a72e60", "comment": "Malware payload (Amadey)", "value": "6795a7aad3890619de95889005b9a84ebed4bdf3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693529730, "uuid": "4a15624c-4d12-47f5-bccc-bc9b2581b736", "comment": "Malware payload (Amadey)", "value": "938b4cd624bb80e36d967796682a7a6752b61c71015e2f5cd6f7367594184cac19752070e61dd457750c594bfdc4dc91", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693529730, "uuid": "46a63225-2faa-409b-b484-3b37f098a386", "value": "T10E352353E6FD4536D8B4673008FF02832A3B7CE64D3D476A2356A90849B3681F9B477A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693529730, "uuid": "4875e3be-bbf0-453d-adc3-8f5dbce0b4ff", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693529730, "uuid": "4e374772-dfbd-4624-853c-8e2eab19383c", "value": "24576:gyVlEwQ/7MAQAlb9VKjOddyOGWBqfYy4XNZERj2m9:nV6w6rQgxTyOdqgy4XNZ2j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693529730, "uuid": "db9988ee-441a-4f55-8006-95a487c589f5", "value": 1141760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693529730, "uuid": "d1f46592-c0ce-4096-808d-04d6ba537dcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693529730, "uuid": "c001acf7-3c72-4d65-a569-4f332dbdd0f4", "value": "42b9cbd4e424e9a474c954191a985106.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c737602a-4888-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693546279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693546279, "uuid": "9e6dde21-8e7f-406b-a748-ca8fe7279f06", "comment": "Malware payload", "value": "5325030e1e278f7a39ffff9e3f0250c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693546279, "uuid": "57e99936-d71b-4058-92c9-cea3ae9b3943", "comment": "Malware payload", "value": "87be219490ca61fdf06f15cd9b09526de224055352c37d567df2259fc334f795", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693546279, "uuid": "52a76f39-6ba1-41a8-aa0e-b6025a684b83", "comment": "Malware payload", "value": "5e07be8994e95b0a92c6b2e0d4d5f2c2f9946642", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693546279, "uuid": "6d582ef5-beef-4d69-b972-115783cbd6df", "comment": "Malware payload", "value": "5e7ad56a2118f201ae7a79bd0683e724bb7b285057d2aec98f4043976662a12c4341f40ff16ee0610048b09204220f9e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693546279, "uuid": "86263fcd-e47d-4e04-bf4f-350161138766", "value": "T1E3032A136480D0BEC8AAC27447A6F539D633747E13B5B21D27E8A937BF9EE116F59100", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693546279, "uuid": "01388cde-ea90-4753-aef6-17b5258ddb61", "value": "768:k0PWS74bqI8jcVzf1qgXB4x0a3uk4sQgGIB:xPL4uFIzf3R4x/4sQ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693546279, "uuid": "fee3de7f-9bab-4f7f-893c-ba71fddb3bdf", "value": 38688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693546279, "uuid": "643e24e8-a772-410d-8328-eaa23fb45f71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693546279, "uuid": "67963e98-212e-4b7c-af2c-e3c05c2c0a78", "value": "SecuriteInfo.com.ELF.Gafgyt-NI.18950.9069", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1090c4e1-4903-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693598800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598800, "uuid": "ea1a8f42-ee39-47eb-a29d-2a788f147951", "comment": "Malware payload (AgentTesla)", "value": "9718853c421d5e323f7c851d6e6d3477", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598800, "uuid": "b728a029-5659-4cbe-b1bc-d5696edd553c", "comment": "Malware payload (AgentTesla)", "value": "8a7d7ead016896373547cc431e014a9d6a6af581d2c78c5d6c54029d67ae1a82", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598800, "uuid": "5269db4f-3afe-4254-b44a-8e98fb9a98a9", "comment": "Malware payload (AgentTesla)", "value": "e816b528e32cc59ae4ffe38f17bd7501bec2a86b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598800, "uuid": "1e104f51-d5a4-420c-a977-1da06e49701c", "comment": "Malware payload (AgentTesla)", "value": "e2fd8279b4252f957fbbc43050a2a133374781987cf439f071c9e911ac5d478e2f4efaa0370e5ff5fc9882a5524767dc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598800, "uuid": "dd579a6f-aa44-46f6-8865-b6c45d707201", "value": "T102E4130820FC6723D6FAD3BC5164275413FEF6096261F31C4EF462E65A62F134A6A32B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598800, "uuid": "1d24a2c4-f396-4469-bd33-795a164c472f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598800, "uuid": "138a0e75-4ec5-49c1-a080-d19331bca000", "value": "12288:JEfOZ1LKMYrQsO5ymyunNiZzPzHF7jlnnBoMSc0n89XlSGv:mWZMMYrQsO5zyu+TnBoMn0yV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693598800, "uuid": "904a59a0-3075-45e7-ab28-2cef6c7eb343", "value": 678912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693598800, "uuid": "9d8475ec-d076-47bc-aae1-b8018ef7b6fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598800, "uuid": "be2506a4-cce5-484f-a446-5a88c0dbc64d", "value": "DHL Receipt_95521152018.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "752da1f1-4905-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Vidar)", "timestamp": 1693599828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693599828, "uuid": "d8947708-5600-4087-8bdd-3430330e2962", "comment": "Malware payload (Vidar)", "value": "1167c9b88f89b35291f110a7b473fe8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693599828, "uuid": "1be78426-bff2-4bf6-a417-50fd8c308f5d", "comment": "Malware payload (Vidar)", "value": "8b55d0033ff36b6d83ebe4e4942c06552182f7674c7f9338c2cbed01ca8f64fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693599828, "uuid": "5c29e4f1-0508-477a-837d-fa90723b7e76", "comment": "Malware payload (Vidar)", "value": "fc546f1b50863c983f927ddfc3dd6d555a981b5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693599828, "uuid": "45e949fb-df82-4a33-bb70-e2464d475b72", "comment": "Malware payload (Vidar)", "value": "f6724910cc6a5a8698ed5838c8cfb1bd080647d4d87732dfa47d437036e4c4615f6648d88a4700cead55a7ad3d242a4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693599828, "uuid": "6bb72b82-619f-423e-83de-73c652d3e649", "value": "T133A408838AE17D58EA258B728F1FCAFC770DF6608E497B692218DE1F04B1176C263715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693599828, "uuid": "eb3ed5fe-f69d-40d4-9f0d-a8fd6f807e1a", "value": "8ee8156b23aa2d1eebdc53a2bd0ca781", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693599828, "uuid": "2b819017-dca9-49b1-8b59-db15e4855d66", "value": "6144:PXzgzO8mzO6Ft3K0mryyE1OdSLUPSAgLUebH/:PXzgzfSh8YLUPBgLUeL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693599828, "uuid": "e4502a55-def7-49d1-a5bb-4033f1736dd8", "value": 457216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693599828, "uuid": "d6db9c96-416b-4ae4-b2dc-57350c9de763", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693599828, "uuid": "7891974f-37e4-456e-a7fa-f2579eb8439f", "value": "1167c9b88f89b35291f110a7b473fe8d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "910dcb41-48e5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693586131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693586131, "uuid": "00b7052a-2245-4612-9036-0683cca16e2f", "comment": "Malware payload (RedLineStealer)", "value": "865c99ae19817cac9d40b35202f6f453", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693586131, "uuid": "a15cf071-55ed-4066-8459-1c9b106e46ff", "comment": "Malware payload (RedLineStealer)", "value": "8d83b744ad7ae7be2bbe9b1b0a9b857b8606944a166194f5b80250c1e066016b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693586131, "uuid": "de0b2548-6ed1-40fc-9b20-ae1cdabed478", "comment": "Malware payload (RedLineStealer)", "value": "980d4e8229c3d7a6bf02596047a015c32d9210e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693586131, "uuid": "261c013d-5fcd-45fd-8b7e-0257f389862d", "comment": "Malware payload (RedLineStealer)", "value": "acfbc58c12e74124e84e321258c4516c2083e530c84f6f8e3a63c9b6709d254e08e740cc1749158b1382de3428e8a4f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693586131, "uuid": "dd7e87d1-c1f5-426f-bc12-47b14b435c43", "value": "T1A9051253E5EC6037D879273458F606930F3ABD51AAB8835B7A826D5E0CB3B80907573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693586131, "uuid": "8b113cfe-63bd-4d6d-b8f1-92c464420c3b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693586131, "uuid": "6c6f9af3-34aa-4292-b383-8c114f419d45", "value": "12288:KMrWy90uxp7VpGrXpmKepnfpz4Ahwpkb7cCUOE1RZyYrB8MB1xZhxH0:Qyhp2pm9FBz4AhwpksCHGYYdd7U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693586131, "uuid": "11ccb46a-fe41-432c-a557-0236fc87344d", "value": 839680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693586131, "uuid": "149069f7-400e-405e-9af9-5128b7888c46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693586131, "uuid": "4e412e89-7d1d-4bed-b377-2f9cd89d2585", "value": "8d83b744ad7ae7be2bbe9b1b0a9b857b8606944a16619.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb6e8c6b-4898-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693553211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693553211, "uuid": "15bcdf57-98de-4524-a53d-8ec63e0014fa", "comment": "Malware payload", "value": "4562a03dd62b77ec5c2abefa45114fbf", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693553211, "uuid": "397c8443-b104-4429-b448-8502c9c2cbbb", "comment": "Malware payload", "value": "8f9148e5a05dbc1449a8f6acfcc2f1e67b7a35552ebe98ad54649834ee2442a7", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693553211, "uuid": "81be9316-c75b-420c-9aeb-200974bccd2b", "comment": "Malware payload", "value": "16c69cc6db9f3451ebb247d65cef8d042d5442b4", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693553211, "uuid": "c1c9562e-f8af-48a0-a2db-667e6a3b427c", "comment": "Malware payload", "value": "1d78aaec7a908eae1e0f1e0f57a683ada544fef14f6aea3d31edc154b1d8e29ae346845e49cb04541a9f57ed5cd70310", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693553211, "uuid": "23ae0632-3fe8-4b12-b962-4ab7c2f4bdfb", "value": "T118E5339EB89040E8CD072D347F76815B710C54866074E76FE6ED94209FEBA246FB09EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693553211, "uuid": "c81ed8ca-b142-49d0-be9e-d1f8fac64d81", "value": "98304:hVwAE6X/gtgapgtywsTe/ibOZfI3CbBYaJCO:hCAEa4t7hO2kQ3ClYaJR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693553211, "uuid": "c6c0185c-db03-47db-9555-9513d4eadfa7", "value": 3297634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693553211, "uuid": "29919c96-67c4-4710-9cba-d68fb3b58759", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693553211, "uuid": "eaeaf537-61d6-4e88-a6df-60f4e8e51378", "value": "FactYNFP3315rvjd7201.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4b4e9a7-4862-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693530007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693530007, "uuid": "c113a179-1fe8-4e00-b0db-208e5f88cf55", "comment": "Malware payload (Mirai)", "value": "0a8b8c613963d9879fecdf6c66dbaddf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693530007, "uuid": "f418ae67-1a36-41dd-bf64-7c37a724e0d2", "comment": "Malware payload (Mirai)", "value": "8fc8b8630e9c90556f731c4b829807f1c8c2f59c238e336e522541edbb234cf9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693530007, "uuid": "f92b4fdf-569d-42d4-b2c3-ac2bc28f1412", "comment": "Malware payload (Mirai)", "value": "2e4547a717abba6e72fbfcebab940ec8d408e8b0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693530007, "uuid": "dffa1f29-1ee1-4435-b297-74b05c364fb6", "comment": "Malware payload (Mirai)", "value": "34ffb6ff73a803239439f51e4464cd3b4664ac840e9ae803cc818e392159ddfb3182c7f68063e52e94e3c6de4e440c6d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693530007, "uuid": "32d41a62-351b-46d3-9e2d-5d9ccc6b2ee7", "value": "T101C2E0A42566FF59C4344C728EF099822E7ACAB563A031B13EC807D7D67468AC9B474B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693530007, "uuid": "bcd23643-7e35-4c42-a3e6-c0ea1d2fc0c3", "value": "768:9ZqbD9poewFRgjRm6O7NxKnSXQnovGs3Uozf:9s/9KgV+jDXQOzf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693530007, "uuid": "8f8535e5-5a8a-4cc1-9eb8-5fdc407ecd1f", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693530007, "uuid": "1fbd3d50-a51c-47d7-8bec-e76220658046", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693530007, "uuid": "deb9f6a6-e6b4-4a7f-ab17-8ab176ffd606", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2e8e340-4902-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693598643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598643, "uuid": "f6194cd0-f949-4a2f-bfdb-43e4c107146b", "comment": "Malware payload (AgentTesla)", "value": "f6d8f5a4b35004316a5e8c1d60d40ea5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598643, "uuid": "1fd5891b-16dd-434d-bd7d-2cb7ae54e589", "comment": "Malware payload (AgentTesla)", "value": "9027f7fe38d5b0cc25551291e60c56ba13bc7592874345d7a76cb60aaf697d50", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598643, "uuid": "d7a5ebe4-9d08-4877-ad4a-3ad8800ffa96", "comment": "Malware payload (AgentTesla)", "value": "24bedd01c1dee9bfb109668e0259436daa3faaf7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598643, "uuid": "34c89039-85b5-4443-b2be-d62a560da7bb", "comment": "Malware payload (AgentTesla)", "value": "78a4a05b82eb767592fad9289eef9a5c9f8825591b5d90468174ff22dc2584fe63a6fd0785c63ad2e402fb11d1bd3709", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598643, "uuid": "e840e009-5042-4f1b-b6f9-fd44f4dee2a8", "value": "T1A1D423ACECB0017EC9C61550302E177F28399E52A380447D8BE09BE4D9B3DA56FD6E6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598643, "uuid": "f0a469d3-9c73-4fe9-8073-4fc578c1ac42", "value": "12288:NukgWrRm7VZFOVIrQmOLMr9SD6V5lWvaPvLjpNS2zWKQ4ulOH:QHWtYZeAELsSugkvlzWNH8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693598643, "uuid": "f3cb8edc-9674-403b-9804-d6279a858e60", "value": 617560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693598643, "uuid": "5c958bd5-a631-4ec0-aced-da6ed882464f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598643, "uuid": "2a3f7671-9d0e-4e91-b92e-dd936fa8a6e7", "value": "New PO 17201.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "febae28c-4872-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1693536923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693536923, "uuid": "1600374d-97d1-45d6-b6bc-2b493293ddc8", "comment": "Malware payload (DCRat)", "value": "94feea912adeb82c416af2ed8986c88e", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693536923, "uuid": "50bb8ad2-bc79-4a2f-bf3a-0861bec989b8", "comment": "Malware payload (DCRat)", "value": "9035299da560b2c59651aa910a0ca4fcdcf8c97c225784ac16846f61f4d5022d", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693536923, "uuid": "4d8a5438-5b38-43c0-ae9b-9f5eff75114b", "comment": "Malware payload (DCRat)", "value": "c197cf09d27c7f891ec59b50ee6bb29350c40985", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693536923, "uuid": "65afe71d-9b68-4f55-842d-519716b50be7", "comment": "Malware payload (DCRat)", "value": "5ca88ab6e472785afc6c677b1d90226a1a14f601513543de72ccd354fa9abb334b712ca14d0e5deb5cf7ee43ac28a21e", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693536923, "uuid": "9c7049a0-926a-4e6c-879e-139fc8d373c7", "value": "T1CB05124376D598B1DAF9077098FE0283193ABC916D34999B32D5AC0F5CF26D0A87237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693536923, "uuid": "a1caa128-88da-4606-9b86-619e5b6ca3cd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693536923, "uuid": "a9517c09-3616-4473-8efb-06dc97dfb722", "value": "12288:uMr6y90NJM6XmdCrA+Izk46ZvXeXxv+avKsE+7cD7yFo2Dxf42o9Mm4h1:gyGJvmQrLIZ65wv/dEKmWo2Deim41", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693536923, "uuid": "b72904cf-a232-4e47-9889-32f0ffe1e34b", "value": 847872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693536923, "uuid": "ea7248ab-3e52-4ef8-96c0-ce557a6e95ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693536923, "uuid": "981741aa-e466-4deb-bb59-b547f45beb92", "value": "9035299da560b2c59651aa910a0ca4fcdcf8c97c22578.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96ffd4dc-48f9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1693594731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693594731, "uuid": "7a0bdb54-c4b2-4345-82fe-7ac15954c72f", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "06d7002fc21e217c22dac8771318c488", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693594731, "uuid": "1b35a0c9-d3ad-44b2-884a-62df3f9f7260", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "9053d2ad5fc31e78eec56fd8ac9f5a5330b568ab7880b54941ed0c9d6172c3e2", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693594731, "uuid": "47fcc50a-2b6b-46e5-af20-21674f1e92ff", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "db60058f3d5ed995f0213a8b78eaa382a13af7ab", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693594731, "uuid": "bbcc5c12-ccdb-4bd3-aada-9dbe7941164b", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "8c149df235b0a6c94aececadfaa93e357f6f6b261450cf47d45acab7a2bb1cb13f0a300fec8a9a0fcf8df63ceb82f178", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693594731, "uuid": "8238f4a1-42f4-4375-aeed-9122e4376f65", "value": "T18445230AD6C22438E356E8B93CB8CA480567B512067D7CD177EE4C8C8F677A19E4A74F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693594731, "uuid": "acb26415-bf2c-4959-b470-3776937bc1da", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693594731, "uuid": "3566ff83-c040-4e5e-a770-b59f7a9aaa66", "value": "24576:MI39d0YfD++j5deTV/xcEh/PuohiFocrccrHmoTrdNdyFV/uN4vxt:M6d0YfDz1UBxv/Vw1cyGoTrdNEuCt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693594731, "uuid": "a021a5d3-b0e0-44da-a423-25d3d50379f8", "value": 1210364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693594731, "uuid": "4b136231-6469-4c3a-9d24-eed24127ddb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693594731, "uuid": "dfd96501-52e6-4aa2-8c01-3d9d1af853c2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43e580a6-490a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693601893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693601893, "uuid": "46cc835a-05e2-4971-9c23-60e8f6b5ca58", "comment": "Malware payload", "value": "77642b1a837500d33140f823d248a6d2", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693601893, "uuid": "b13753dc-9ddc-4503-bc39-1f8dc71f204d", "comment": "Malware payload", "value": "90c53f1197f8526902135766cb3d31c28a9265cc2eb826d9f5117048c0afac98", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693601893, "uuid": "acf26c5e-4972-4298-b1dd-4f5727c66cff", "comment": "Malware payload", "value": "d3a30bde44f6d649d06a63f0189f3fc2a5d0ffda", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693601893, "uuid": "3a6218a4-bc22-456d-9bf2-6f667240912f", "comment": "Malware payload", "value": "ecea981d9835f1044a55771649c53173a2aa88f683137c8b74ecc9cc070940fea2d2fefa659fe3fdfdf53f8de7a316e7", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693601893, "uuid": "f671970b-b562-4d20-ba4f-6f558cdd4431", "value": "T158C08C60822DC42588AF480D88098E6DAC565000221FCE31C2A25A88F9460AA4E8809A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693601893, "uuid": "c8036dfc-1ae5-463e-8485-192a22545f90", "value": "3:HRAbABGQYmjVLOBLXAdVCEKEgNFUVo2OovUo1YSo/QJ5GKbyYesbBSn:HRYFVmpgAd4EfUlGvISoIJ5xyYesbBSn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693601893, "uuid": "12f8e717-c29d-4fff-8d5b-1d726c48a201", "value": 152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693601893, "uuid": "605bc5aa-3d18-4b3f-8d92-254a49482f35", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693601893, "uuid": "40515dd6-9cb0-4a11-a00f-3880bc5065ca", "value": "fast(U)(local-EN)win.url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f03bfc48-4901-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NetSupport)", "timestamp": 1693598316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598316, "uuid": "278b8039-8236-4658-927b-4be8a222bbe7", "comment": "Malware payload (NetSupport)", "value": "bf6b4c0fc43b5aa0c9bb21b94d795240", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598316, "uuid": "617118a9-bcfe-4474-a04f-6d3b78f15b23", "comment": "Malware payload (NetSupport)", "value": "9101403bb729cabebd79206aad130293890154cd7a6fba3417471a645ea3ef25", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598316, "uuid": "1aed3403-c04e-461b-829b-9be9db260c14", "comment": "Malware payload (NetSupport)", "value": "c6826cb6d10ef41842348522571cf28a25720f04", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598316, "uuid": "d0965ba2-8c49-4c14-b0aa-0f445a95a5af", "comment": "Malware payload (NetSupport)", "value": "6940177ca68b81d52844c8afabff9b8cf99e6f409dcd11bd71bbb535aed6683c236eca454b87e69ee1d7c0f0214f146b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598316, "uuid": "d1791a17-b87d-4d83-9847-84505bdb6077", "value": "T11871DC053FB0E94D13534323D63BB4AFE2A5AEDB396C854AD067EC923B02621E565533", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598316, "uuid": "b0c5834f-f183-4ff7-acda-9090b1c00ec4", "value": "96:pHldTsm4RB4+BYHZPTnceJcbF/13QiXD7y3I:pHlGNPDQZrceJYpXDGY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693598316, "uuid": "d026827b-2014-4109-8a1f-2d5780ecc9a5", "value": 3731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693598316, "uuid": "b5f66193-ecd2-456a-a331-2684227add1d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598316, "uuid": "537df2dd-25db-42e7-918f-1b94b3450bdb", "value": "package_details_____________________972968.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5753dc52-48ed-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693589470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693589470, "uuid": "013745f4-14fe-4b05-a8a9-396fbba7518f", "comment": "Malware payload", "value": "d4896ccdf2f95ecd9106e42b0a3489ec", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693589470, "uuid": "eb5eab39-d529-455c-81ea-e680a45d713b", "comment": "Malware payload", "value": "93a67234b556a9e5d47a4d7187db3e3fd93ae1a6c9d8b1932a247c111df6fcc2", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693589470, "uuid": "a03e8aca-d6ed-4e96-ba65-791262b8b890", "comment": "Malware payload", "value": "a7aec7c432e19b80c93e69dff005b2a19ada79ce", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693589470, "uuid": "ddc84127-ae9c-4a84-b3a0-8b13fa56085d", "comment": "Malware payload", "value": "bad423a217a93cd6c607388d02ffce2655fee1230df3ebbc37817ac18b2a51de85d208898485705256b28deb512cad12", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693589470, "uuid": "0f867170-db49-4c8a-a179-68f203597681", "value": "T109D1CC1216F80111E1B65F78E8BC02A6197AFE459C38891DE850494EAF62F03DF75BB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693589470, "uuid": "c4828fb0-7335-48c4-9559-6627e2b0b001", "value": "48:8Bbd1qKJqTJqf4J6JqFSJqyIJqhJq1JqMMJqpJqbJq10JqX7JqaJqVo4JqzsJqhp:8Dp7AnveIQ05iFOHhxyZSFMsvYR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693589470, "uuid": "94226a60-b337-4cd1-a5fd-f1031f48b8fc", "value": 6285, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693589470, "uuid": "8e3779a4-21c1-48ef-8466-2c8144a52a9a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693589470, "uuid": "228850e8-e5da-4ec5-8c19-d9ae279c1ba0", "value": "Financial Advisor.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44e3e910-4900-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693597599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597599, "uuid": "010662ee-47ec-45f3-9470-e6b11599948e", "comment": "Malware payload", "value": "64c8e12382ee4951e00aa9125a34fe46", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597599, "uuid": "bec712b9-01cf-43b9-b485-138e438a0246", "comment": "Malware payload", "value": "94d68e51086fac438c3ab4a1c6996560580b035689d5a9fa6c364e8e290581d9", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597599, "uuid": "cd5e3fac-ac90-4025-9e53-c8a2c919c6e9", "comment": "Malware payload", "value": "afb7adfbf95164eb4836bda84e624dd1a6240170", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597599, "uuid": "7ecde89a-99f4-4fe9-b4ee-d9c889f3c463", "comment": "Malware payload", "value": "526313b4609f7335a8d2767648302336346ca26069dad5872b3aecd530e91444a01a86969a81a7fa5e0030f8ea0bdb4c", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693597599, "uuid": "c3d9e161-b935-40ef-89c2-dbaddf3dd75d", "value": "T1A9F59D51F102C63BC7DC1131198AA3FA23B82D0A8A844A67764E732D3EF7E54EB5B715", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693597599, "uuid": "8144f4aa-547d-4593-b246-af0ae2d5030f", "value": "49152:ZyFyg5MbVtAtRlEwxBf90y2+7tvXGcmYRuJC4L01onE6pGmFV/n3PIuD:ZydMwvxBF92+xv9mSuJpL9nTGE4u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693597599, "uuid": "f55b6926-4c05-4f0b-99df-44b901bd2f0b", "value": 3332096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693597599, "uuid": "3cc73c18-44b0-40de-bf82-a6a4de227721", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693597599, "uuid": "ed5e16ee-da83-4df4-a761-1262a8bb4123", "value": "IT1_Individual_Resident_Return_XLS-Ann Mugure.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbb62292-4902-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693598658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598658, "uuid": "f63d4a22-0554-46ff-8bb1-25d2071c6cb7", "comment": "Malware payload (AgentTesla)", "value": "ac31a8be80a6276c5be84c4ebc48bd50", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598658, "uuid": "a7bc54d2-ffaa-4614-907b-e68b7a3a9559", "comment": "Malware payload (AgentTesla)", "value": "94f7176d477a4d33a4a2b5a842ac2035776df88ff2d73175e95422cc3c6d2f29", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598658, "uuid": "12132af6-2ebd-4719-8a96-f1c277ebc426", "comment": "Malware payload (AgentTesla)", "value": "e2aae640d36a0c829055c0a79990f91400efa351", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598658, "uuid": "269aa658-f11c-4c7c-a7f7-038afa1738c2", "comment": "Malware payload (AgentTesla)", "value": "6d220218f575f4ae034567f1776c4cf92c548e3bfdd5e018c796fef34e9305731cb4797a242b5c81a5a46b1b9bb9500b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598658, "uuid": "749b8be8-3b64-4bc6-ab8e-4334f587747f", "value": "T11AE423A7FE63B299F24F10D38D55CC960710C228805762725D1E87FE6FAB55039AE8EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598658, "uuid": "cf732e89-3553-44d1-88e8-f77a9962dd91", "value": "12288:sCnWPyzzlskjjAQPyK6vnBiZ1U3wwPjkSIl0kp+VbLtfwt84Xippe:XBzlRjjAQPyKyYZirPoSK69wt8/be", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693598658, "uuid": "da39ff0f-3284-4a05-b64f-c75826218992", "value": 670807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693598658, "uuid": "6d5be6e4-b699-4976-838d-84250947d2b6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598658, "uuid": "38831865-ddb0-4d16-892d-ad9d28d640bf", "value": "PO3182023.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd5eef8f-48d8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1693580729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693580729, "uuid": "3f858ae6-8e67-47a1-9b0b-aeda187be1b4", "comment": "Malware payload (DCRat)", "value": "487c69f2ea223dbaf5160dd3148f5e79", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693580729, "uuid": "8f0fcc90-540a-49f2-a69d-6701855501a8", "comment": "Malware payload (DCRat)", "value": "95d3dc42b78f3366fdc674898cfbd74936782282122abad67248d6711428385f", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693580729, "uuid": "0775bc3b-3fb5-478c-a168-28d1a89a5df8", "comment": "Malware payload (DCRat)", "value": "36c8b7a38e66ea8bff2c83c4bba7d606302ab862", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693580729, "uuid": "39bf089d-069c-4fda-9f77-d6881818fb17", "comment": "Malware payload (DCRat)", "value": "d2fd02030dcc835b06ac583ef2a929490c3ad1d14e960e2c6eb090a728792e9f5d602a319e96ff064ef39a8c41e526e9", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693580729, "uuid": "8e15be7a-f7e2-42b0-88e4-abe4e115632f", "value": "T148352357A7F85076E5A4177228F30BC30B36BDA18DB8965F26C0A45A4C32BC5A63137F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693580729, "uuid": "11905db9-be5e-45b8-b7c1-ca8ace02d77e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693580729, "uuid": "214dd12d-8c4d-4b50-9fb2-5ba8c8fb680b", "value": "24576:MywjFb6sQbtkgurmsrMe7nx6SuXgD+3VX9t8IpKILS1Vt6h:7w/QxsKsrznx+Rx9zPAVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693580729, "uuid": "4b18886e-7d8c-4218-ad24-c6353affd158", "value": 1149440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693580729, "uuid": "a3765645-9f36-4932-9683-87031652b6a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693580729, "uuid": "f029a4b8-a73e-4753-b454-389c6c9fc285", "value": "95d3dc42b78f3366fdc674898cfbd74936782282122ab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e19b456-4902-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1693598608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598608, "uuid": "abdfca27-eb9d-4261-a2c7-7de2a2f6da41", "comment": "Malware payload (AveMariaRAT)", "value": "1afac30d0748bd539783d4346facbcb3", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598608, "uuid": "a51fa6d8-5809-498e-b9f8-78668eec6ba3", "comment": "Malware payload (AveMariaRAT)", "value": "966794e8fc1be091307b4aaeee721920734278ddae04eda17f205ffada16422c", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598608, "uuid": "cd870faa-a72b-43e6-851d-25e8da854a07", "comment": "Malware payload (AveMariaRAT)", "value": "5c4492047f046ee05f8f8d105f3e757180f0ff10", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598608, "uuid": "dddd6da6-932a-4138-85c6-d3fd78d4b3e6", "comment": "Malware payload (AveMariaRAT)", "value": "66d0107ffa48f2d4ff93cdb4521997842105d934a7c97e6b282ceb744a109e28b53e82658b11e7ca95bba7adcf26644f", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598608, "uuid": "235edb52-5076-4501-b9d8-f07ff63406d5", "value": "T111652251B6E684F2E6B32D355D28B720587C7E742E38DA1EA3C87D2D9B711806134BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598608, "uuid": "717a2ac7-5421-4098-93ca-33f419e1cbdd", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598608, "uuid": "becb71dc-7d2b-4c0b-a17d-50512d1abf10", "value": "24576:wNA3R5drXmDgFJ1awm2KcREhI2gdFtyxSKBXk9ZDJFABAWbDT1F4RjpTSsAgb/L+:p5UVwlihHkeC9ZfqrbDn4i6L+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693598608, "uuid": "bc47e67a-fbc1-456c-9c77-85b9aaf97a90", "value": 1451960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693598608, "uuid": "ca7a2d63-e1f2-4612-98a8-297b7e428ba0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598608, "uuid": "f58326da-e861-4415-93d5-b0f91a727fec", "value": "ODEME.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b3a3df8-48d8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1693580430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693580430, "uuid": "d747a5dc-b9d6-4b9f-918b-a5207c6b6373", "comment": "Malware payload (DCRat)", "value": "39b8455332764ea0ece814c833d3acba", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693580430, "uuid": "8a7ad05f-c6f9-4c9d-afd8-f8fdfb1e4507", "comment": "Malware payload (DCRat)", "value": "97560f53e4bcae868ab3cc563a2a6ad493bd0d377135b8003ce6022714627e6e", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693580430, "uuid": "00002ff3-c2b5-4e8b-8b37-e5c7f425e025", "comment": "Malware payload (DCRat)", "value": "6fb3249ebaa49954bae8a902c517db9f20862877", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693580430, "uuid": "e0010fb9-4c46-453e-a4ed-b8c7e681b560", "comment": "Malware payload (DCRat)", "value": "52b2fba797acd10e8a7f279ee087ee99a4579e305413667761e801e8531f6ad5c0d40a06146d26f52bed9c5e65e4ec67", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693580430, "uuid": "6e9482a0-98f9-4357-ae98-d0c6b14faa5b", "value": "T12C052207F6EA4473D9B61BF158F223C307363DA659748B572B52FD0928B25D0993232B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693580430, "uuid": "bd7bb752-1306-476d-b656-5f31bd891392", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693580430, "uuid": "a0baf1a9-7fcb-48da-9de6-2f86ecfcb88f", "value": "24576:cyr+pBZje6ADXS28DAWyNcU2oF83hgxQnZRG4:Lr+paTXd8qNcULKxHLG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693580430, "uuid": "14f7f09f-74b3-4a86-9800-e7061df7731a", "value": 848896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693580430, "uuid": "607e928a-2495-4aa2-bc54-02cdd8cba7e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693580430, "uuid": "3dd2f7a0-018a-4776-aea4-48cd07cadea9", "value": "97560f53e4bcae868ab3cc563a2a6ad493bd0d377135b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e5cd3c2-48c3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1693571523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693571523, "uuid": "6e34cf35-a777-4574-850e-f218b3d0c51e", "comment": "Malware payload (RemcosRAT)", "value": "05492ba0dd021b81e573bcaf60a78faa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693571523, "uuid": "05407297-623c-435a-ad68-c93a21c06499", "comment": "Malware payload (RemcosRAT)", "value": "9bf55d8f3b892e6b8706ec526eaa51cc8a1a727b45759494e2e388979a5708b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693571523, "uuid": "b193f146-eb6a-4815-bea6-07e8da8b613b", "comment": "Malware payload (RemcosRAT)", "value": "967ed28f6fe35de046b678bda593efd1fefb92e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693571523, "uuid": "14781078-e59d-44cc-b5aa-d52104c4ea26", "comment": "Malware payload (RemcosRAT)", "value": "547e470f44f45817c0f8d2df77f080cfffec68bf8513295f444be8f216b06ceb2e63f21f72162713ba314d59c55bc69d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693571523, "uuid": "5b1eccd5-91eb-4c80-b85a-d63f248e60e0", "value": "T1CE83F83BBA1A85B2C644177ACB97600403E7D781B293D70E398ED35E58033FA99CD52B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693571523, "uuid": "0813151c-46b3-4c82-960d-0608f25ca622", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693571523, "uuid": "23de9554-0792-45c6-a457-ffd2e1b78a91", "value": "1536:oNqFIZsnSJ/y3VbGBv4jMZ5LGKqn3LvMM/vnwhxgY3H6K+i3:2sSJ/cCuwqTnwbgYX6Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693571523, "uuid": "2ae15a99-f5a2-48c3-8020-fe76a336a9ef", "value": 81408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693571523, "uuid": "35954b49-67cc-478c-8d32-483245a9d624", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693571523, "uuid": "873b45ba-316e-4f5b-a1a2-9a602f1be86e", "value": "HB23090003.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6e5c09f-48d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693578947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693578947, "uuid": "b33c0ed3-3e5d-41cc-b76d-19ef04e48fe7", "comment": "Malware payload (Amadey)", "value": "1e0d54828a7bcd048ddad99487ac85c4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693578947, "uuid": "38bdc572-332f-4c8d-9c4c-628deb7cc5bb", "comment": "Malware payload (Amadey)", "value": "9c1c4ec44e5f897eaa2499a0008c896edc60fd0dfe0ec59e4086c1c798da3b4e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693578947, "uuid": "2fb71167-4dc4-4cb2-93ea-2f490431b87a", "comment": "Malware payload (Amadey)", "value": "8d27912abf305687e701e6611599c611e6283231", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693578947, "uuid": "7ab097de-f3ff-4610-960d-c11d6f310899", "comment": "Malware payload (Amadey)", "value": "f7d66ce3c428ef5c23e0f071744e289b9795a2467d10f41f7cdb5805dff2ea6f8f74cdd1746474358d3cfbb2cc5c23db", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693578947, "uuid": "572976a4-eb45-4647-b6b6-0ad1c4d0d342", "value": "T13F052353FAE94177E8B12B30A4F606D316357CB259B0533B1B94AC1E4D732E46A31B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693578947, "uuid": "61e3f739-c443-4419-88b6-da74a208184f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693578947, "uuid": "36743028-51ca-4dc0-a03e-492d3d243267", "value": "24576:yylf86NZ5zRF9/g0vzWoOay4FBbKFC+cEhZA2jT+r:ZpNzzRFu0LWo15FBsC+lAW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693578947, "uuid": "4e812aab-ca3d-4897-9348-c03809e617b8", "value": 848896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693578947, "uuid": "8d62bfeb-2447-472b-870e-c596091d464b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693578947, "uuid": "c9b1f67f-f7b3-40d6-acee-e5cf0bb130b4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d68ed3fd-48eb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693588824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693588824, "uuid": "4c379328-4c42-4a09-b308-055d650b6a6f", "comment": "Malware payload (Amadey)", "value": "5ee66ba74186920be0a7da6568eb8715", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693588824, "uuid": "26f8943e-1e93-4dd4-9c20-26ba2f7080b2", "comment": "Malware payload (Amadey)", "value": "9c4efdcc794f3607c6e1b604075f5eb82061b4e437a609677eecc2a9834f0ae6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693588824, "uuid": "f3257434-63ac-45e1-a394-deb77f812f0c", "comment": "Malware payload (Amadey)", "value": "333e879797f9b3870fa0f63a61cd621f6a0f2bd2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693588824, "uuid": "083e457a-99b5-49d4-9335-d6060d20695b", "comment": "Malware payload (Amadey)", "value": "d1d9759967ca0383a40bdbf6e8bc87b1c85470b455a83bc4de17b760f38a033d1af7bb04c06eff17ad72ee8aac0f5e61", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693588824, "uuid": "4025adc0-c80c-44ed-8d9a-097eb3d7d967", "value": "T1C9652353A79C7062D9A62B30ECF703872E30B4E90CBC416E3B59AC565EB1CD4697231A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693588824, "uuid": "9df45ac5-9fe1-4f45-a88d-908ab512cb19", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693588824, "uuid": "841c3516-e606-4152-9d94-d8b26bc393aa", "value": "24576:LyjlSrVLHFOE7LFK4vZ/5RgJ3tPznX9hNgth8KE33JqNTvEpCB85Kg0iw40E83:+IrhHFOEPFK4vZ7gJ9rntHg77UJuEpeR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693588824, "uuid": "7b16b41b-0102-4305-981e-a0ba8fd7f532", "value": 1499648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693588824, "uuid": "41b457d8-625e-4e7c-b956-92a95dd65eca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693588824, "uuid": "a12091d3-8ac7-412b-9679-8fbfe8a34cc4", "value": "5ee66ba74186920be0a7da6568eb8715", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bfed1e7-4877-11ee-a6f9-42010a9c0055", "comment": "Malware payload (JanelaRAT)", "timestamp": 1693538851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693538851, "uuid": "39dbd214-1170-4102-8bd5-c0c43b142202", "comment": "Malware payload (JanelaRAT)", "value": "6dbc5d86e0f9086034a4c8f55724cd39", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "JanelaRAT", "colour": "#63718C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693538851, "uuid": "c8cdb20b-f771-408a-88b9-7439e2f46529", "comment": "Malware payload (JanelaRAT)", "value": "9c5d2ec3e6a2a6a1b98adc0d6a6e022d0ad815cd9ff52a423ed6f91916b0b48e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "JanelaRAT", "colour": "#63718C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693538851, "uuid": "edc11abf-302a-4dd7-96ad-09f06d909ce0", "comment": "Malware payload (JanelaRAT)", "value": "6bc970a01665603fed7804440bf24aa884252a59", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "JanelaRAT", "colour": "#63718C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693538851, "uuid": "af160b9b-6ff4-455e-9084-1ed74050893c", "comment": "Malware payload (JanelaRAT)", "value": "804fff0c762c5b47e36b90f550e615d554a0e4400e438742fb06e8b4b19ee1eda7425aee23d3802163c3e485e439bd50", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "JanelaRAT", "colour": "#63718C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693538851, "uuid": "46c07694-d8cc-480f-a18b-635bd41d972e", "value": "T12935509C766072EFC857D472DEA82D68FA6074BB931F4203902715AE9E4D89BDF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693538851, "uuid": "bfe9beee-d9cb-4f7a-a8fb-b53bf094c073", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693538851, "uuid": "df7afd59-7f15-4958-ae13-b7d68befa7d3", "value": "12288:DdnogY84dTKNfrR2vwjQmZ2MNj2a/D1DF7okoWAtSesQluSa8Bfbezi4fzOJWzmG:dogY8smt2vwjLZ2Ejh7okD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693538851, "uuid": "c360a3e7-9790-4d35-acbe-b5ca9b5759f9", "value": 1099776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693538851, "uuid": "64738e02-6db6-4cd5-b8cc-4dadbc0b3b92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693538851, "uuid": "2da61bc9-381d-48bc-a825-c56553112518", "value": "4ozfksjeyu.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bb0e42b-48aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693560620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693560620, "uuid": "c0cee882-e1ed-41e5-a302-ed940d52c02f", "comment": "Malware payload (Amadey)", "value": "e30850799de2023bc4fc4ebbcabce689", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693560620, "uuid": "556141e8-f5b1-42e8-9c81-2ae437673821", "comment": "Malware payload (Amadey)", "value": "9d09c912c5c9549f1815c6252ba7311832d103f4bfa41cc249fd02d87b08d5de", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693560620, "uuid": "84a11326-e76d-4de2-89c9-a690710a1b00", "comment": "Malware payload (Amadey)", "value": "9531aa2e1540feb79b0db1d3d8e4f098c1c95b4a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693560620, "uuid": "4f6cb840-f628-46b3-95ae-6be02396fc24", "comment": "Malware payload (Amadey)", "value": "ec12d3397ff30dc08a6b4ae59e2fc04d0303ecd7c6876095965d1a1797ccb6457a8e832c41b572c04b961a3e8b196c9f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693560620, "uuid": "3bf85548-e6aa-4beb-a054-be5edb891d76", "value": "T1E5352397EACCC172C8B16BB415F212934A3B3D681E79436F32819E0D4CB3985A53676F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693560620, "uuid": "36cc5dae-3684-4273-9d2a-6e704a48f2c2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693560620, "uuid": "4594eb65-51cf-4850-bf80-3760cbb7e481", "value": "24576:RycrXNcSBSErdpekVwR2jcQE2vygTQkgnvu:EcLN7B36kJhE2vyJkgv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693560620, "uuid": "42301409-109c-4830-aa83-55e852ba2cd3", "value": 1146880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693560620, "uuid": "93480fa3-85ab-438d-9716-8a8eaeb06134", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693560620, "uuid": "54504352-2330-4036-88be-1ba8353d827c", "value": "e30850799de2023bc4fc4ebbcabce689.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6a351a5-4888-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693546278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693546278, "uuid": "50aa797f-05f1-4595-82f0-24713f8e991d", "comment": "Malware payload", "value": "83d4fd8c6282b42f2b905610bab3a1e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693546278, "uuid": "545eb16a-4f61-4a93-97a0-77042ce83405", "comment": "Malware payload", "value": "9d12a046ec6f8d2bc73aaab60a7d87f3500e07eb41ebb34641382938843587d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693546278, "uuid": "ba363caa-f314-41f1-86b0-8e14e4d8f458", "comment": "Malware payload", "value": "8a8598a4af32aecca88b89033e74768e97f248d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693546278, "uuid": "cde27864-4757-4c0c-9eb6-6c941570de09", "comment": "Malware payload", "value": "ee5aace58520cf38dcd6c3ed1f38ddb9290b5476fa1fd306caf7c02ea34d95ac16c947a898a00f4a903e42a6b8f32ecf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693546278, "uuid": "cfd48d25-b046-4420-9281-6b30c2f68701", "value": "T10933B706EF944EABDC6FDD3346A90B4235CCA55712A43B353578D838F61E5074AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693546278, "uuid": "e991d923-cfcb-4faf-bb2c-5c69fbe64e8e", "value": "768:TrMfyPUhNSd8re6lbtEFSw5seYazZ2S0Xi+KeasSlNeZc1Zp16jiI:Xmy8hNSd8r/lbaK3KZ2Sl/lN+c1ZqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693546278, "uuid": "67c476c0-8db5-4453-8ecf-aaf60b928a6d", "value": 51704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693546278, "uuid": "c55ad0c8-3f60-4812-ba98-8c80f432ea5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693546278, "uuid": "696e6179-d12d-4a42-858c-ebae114c0ab9", "value": "SecuriteInfo.com.Trojan.Linux.Gafgyt.13301.8895", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6db16aae-4905-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693599815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693599815, "uuid": "a399cf78-0dbd-4721-bcf6-0c04180612d9", "comment": "Malware payload", "value": "855bbd368c56cab24be6bf86219d36b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693599815, "uuid": "add6dc3d-7190-4973-83aa-1a134ba6ceb7", "comment": "Malware payload", "value": "a29cc91ce58a0f90b627584126f2f5ca6501222aeb3b893e9456be321b5e7afd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693599815, "uuid": "f069cb5d-34d4-4e87-a904-be747dd24a9b", "comment": "Malware payload", "value": "b84d4f725eb9d28da30a3c1834ce4059a0ecaf08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693599815, "uuid": "97e11e63-9935-41bc-8262-78cd93fa484e", "comment": "Malware payload", "value": "60fd6b3587376fa1090f66e3135a0e2ffa04256c9ec6150551a939ffe626cc57160a8fa0eb034630eeeab486189c9993", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693599815, "uuid": "a56dbb1a-d3c6-4eed-a929-db311c238476", "value": "T1DFC4294392E27D58EA25CB729F1FCAF8770DF6608E497B6922189F1B04B11B7C263705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693599815, "uuid": "cf205a56-0984-4942-8fef-0d171b9bdaec", "value": "8ee8156b23aa2d1eebdc53a2bd0ca781", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693599815, "uuid": "4ff6ff74-9739-4c6c-a669-e5032f55dd00", "value": "12288:jjU7RPxzs91NMBFB1yez8aEJxK1gLUeL/:jWZzL1y68JPGgLHL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693599815, "uuid": "f9f5d0d6-560e-4a55-bb8b-2b87cc149860", "value": 551424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693599815, "uuid": "e9c7141d-3ab1-4d95-8676-e0ba50379fb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693599815, "uuid": "9f5b8253-571e-4feb-b57c-08afa7e3251c", "value": "855bbd368c56cab24be6bf86219d36b6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed852b90-486f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (KnightCrypt)", "timestamp": 1693535605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693535605, "uuid": "f9a2a4c9-23a2-4d6d-b3ad-32cc639c2c1f", "comment": "Malware payload (KnightCrypt)", "value": "20c77f8501333cadbe729b577b9dab88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KnightCrypt", "colour": "#81A14D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693535605, "uuid": "2cd9e74d-aa0b-4773-b1b1-ef49cb9f924a", "comment": "Malware payload (KnightCrypt)", "value": "a2c654357d790d7c4cec619de951649db31ecdb63935f38b11bb37f983ff58de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KnightCrypt", "colour": "#81A14D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693535605, "uuid": "c13c5c0b-06ed-46c6-87f7-858731dd9d2f", "comment": "Malware payload (KnightCrypt)", "value": "b64a53ae9dd3f8b8ab5752c3588c934ea63225c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KnightCrypt", "colour": "#81A14D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693535605, "uuid": "9c79a934-98eb-4098-938f-860b600dbfc5", "comment": "Malware payload (KnightCrypt)", "value": "8471b4ad0cf9a5f8d19ed194583a57f5c423ef04743c64cebcedeefdcd746f45bdc1e519d454de374e111bedad6b0f6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KnightCrypt", "colour": "#81A14D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693535605, "uuid": "c1cd02a9-0f9f-4162-88d4-e5628842b230", "value": "T150857C4BB6A441F8D0BBC27989528647EBB178150F30ABDF16A4539A1F33BE15E3E311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693535605, "uuid": "9caaffff-feab-427a-9414-07cd2f474206", "value": "be843536fdc17a2b5e02f8f44a2ad7ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693535605, "uuid": "59f11da6-2173-4a86-91eb-c4b91def3877", "value": "24576:YucUS55cDR3NgJ4zJ1H+QI84rncvGt3nE6vlTlTxBkTde/cfkgg:YucUS55cHgJIzez8+n9Bn3NTfBkYokgg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693535605, "uuid": "d83c4cab-cbbd-4d4a-a0dc-df347f2d5e97", "value": 1863880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693535605, "uuid": "0200b9f4-d466-4579-b083-a623b802feec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693535605, "uuid": "e8e6f0b1-0549-4126-818c-510a0d68d8c8", "value": "SecuriteInfo.com.Trojan.Siggen21.24091.13960.2509", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dde8177-48cc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1693575254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693575254, "uuid": "e6eb9b29-3604-4128-bf99-55af7e640724", "comment": "Malware payload (Smoke Loader)", "value": "059aa5219c81ccec4d257337c885c9e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693575254, "uuid": "b01daaca-8206-4a29-a954-ab5221a9f9c9", "comment": "Malware payload (Smoke Loader)", "value": "a3e06d811446215d4ccf92e136c20795d346f94c23f94caeab63d5727f35b866", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693575254, "uuid": "85c6b9d5-6f89-4d74-89b7-ea27f8b77f76", "comment": "Malware payload (Smoke Loader)", "value": "1075024d4a988eddfdf2b4042078640c65d4b603", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693575254, "uuid": "37c02459-7e04-47fa-a8f8-37971db581cf", "comment": "Malware payload (Smoke Loader)", "value": "6d90ffde77cda34b1aaf30b3e26e27de17974d3e451c3ab6bb20891902c02ce75ce3a352c45426e4204968d03586dbaa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693575254, "uuid": "61367753-f66a-448b-a253-599fa7f843d5", "value": "T12384D64392E13D59EA268B739F1FCAF8770DF5608E497B6922189F2F04B1076C263B15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693575254, "uuid": "49d29c3e-c11d-427f-acb3-f11ca1d30441", "value": "eb568a174db8395072c750a957035097", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693575254, "uuid": "e741c96f-56a9-4fec-a587-b94ff1722596", "value": "3072:BdeUSdFCGEnpS9zSahHnboPV3dFpyQc16Z+tYuxrm4KNKLPcOJdxH/WRXWh:7exSGqpSJSP/yILtgLUebH/i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693575254, "uuid": "a322146e-ca43-45e9-a2e1-8eeac9cd5a22", "value": 395776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693575254, "uuid": "5c3eaa3a-b537-4e7b-b909-8823624af715", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693575254, "uuid": "6494df23-4d51-4b73-bdd0-195a0ebd0ea7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daa1b4b3-4911-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693605152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693605152, "uuid": "065d52f3-1a83-4368-9adb-a1af1ca3303d", "comment": "Malware payload", "value": "8f66a9149d62c7a6c8a5e1256c9343eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693605152, "uuid": "3d83ae9a-af9c-4315-97cd-818228986b99", "comment": "Malware payload", "value": "a49bd1b74a7a8a570032ba6aaf34044e260fefb2d4012a15f2a2b06abef21fe1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693605152, "uuid": "3e7f3706-e12e-4d47-bd69-e221bfaa29e7", "comment": "Malware payload", "value": "de0b7cfeff7381d36ac129c4ff3b5684da7c9ba3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693605152, "uuid": "cbb376bf-859c-451a-bc50-f6c27df3585f", "comment": "Malware payload", "value": "027fb3f1608150313d1a7f120c9224fd4fe945b10153ea3bd023b7697d10213a73991cfec21194316bcc0143ffd1fddc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693605152, "uuid": "332233f0-d3e0-4f0d-8f26-731e2473bc0c", "value": "T161963393B26B18E6F746F2342D2A0516EBF4784A0381C27703E0997AEFA77739E15711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693605152, "uuid": "d1b8a1d5-3b1d-4f41-b70e-e2efdbeaa3b5", "value": "d7baf81e124df171306667f9b54df97c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693605152, "uuid": "e170efcc-7586-499b-949f-0e4f44f2f2b4", "value": "196608:3ueZVVizoTMt/XGusECmLeprgLB+S4DGdi5RqtcY3A6U3HlZGQZ4oPp:llizqMxCm6Gtdur5oSx3XGQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693605152, "uuid": "4daec19a-fc0b-41a6-bb17-c051f05fd0b2", "value": 9075632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693605152, "uuid": "9d0567e6-6af5-4be2-a669-3e2627f6f779", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693605152, "uuid": "702bb319-0f43-447f-b37d-e485e99db648", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba272d30-4902-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693598655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598655, "uuid": "122baa75-ac8e-4e33-a39f-e737e940ae65", "comment": "Malware payload (AgentTesla)", "value": "0c9693ecfc93b68789c31f01731f644f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598655, "uuid": "9fd6f40d-1bda-4650-9f81-3a33533a5f2d", "comment": "Malware payload (AgentTesla)", "value": "a4c2ca9ee20f94c50048e447224d5513f7efa9f1d5a1d800c61bc1df245869e3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598655, "uuid": "88dd89d0-7d4a-426a-8f58-19f4b2cc7908", "comment": "Malware payload (AgentTesla)", "value": "b409faf19ad6e0518e56a08542f0ce2e09aaaee1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598655, "uuid": "9503a6f6-0f67-4e5b-9fc6-a7b7974c7bb3", "comment": "Malware payload (AgentTesla)", "value": "d440c80e4eb66d85c408095117ff740dd1e6ee4f906afe941d9df868850ea9137f1ddc56090665b83201f534a689d366", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598655, "uuid": "745be017-7d40-460a-8999-08c3a0dbbf8e", "value": "T168F4239B804DD7FDF3A3D260BF329A616A5A3C77412E96AF30C5386A4D111CDE850F29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598655, "uuid": "25244e08-3f23-4f55-a940-f41ad1acf113", "value": "12288:lOnWmACgXpAI4Ami8jVHfnM3meigkSaT0cUT5nl7HnbJ2AjXT+OuC9jyPd8YIS3S:kK1mPFPgOYvT5nl7HvjXiOuCdovVm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693598655, "uuid": "f0863c8d-0486-497f-b402-059c3dd02886", "value": 732471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693598655, "uuid": "26649ccd-cf38-4943-a097-b605ed4ebd05", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598655, "uuid": "addd7494-4d82-4a00-ada5-5ead87546c6e", "value": "1231082023_Nuovo Ordine.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "625e3232-48d0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Vjw0rm)", "timestamp": 1693577033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693577033, "uuid": "0a86afef-0c70-402e-b63a-20eeacab4a32", "comment": "Malware payload (Vjw0rm)", "value": "4bd43de1ae996231fc4bdad4e31acc18", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693577033, "uuid": "c3549e26-a0f6-4b63-badc-a42efeec688d", "comment": "Malware payload (Vjw0rm)", "value": "a4ef0bc3f82a7a6537974caa2a3c8cbcc1611aca0c80303591bcd401f05b3a2f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693577033, "uuid": "f3803fd7-ec88-4d64-803c-b1c9fc3b28a5", "comment": "Malware payload (Vjw0rm)", "value": "40867d1931e30eea677eceb397e29bece3bbc348", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693577033, "uuid": "19fec33d-698b-490c-9374-cb3280992b88", "comment": "Malware payload (Vjw0rm)", "value": "aa430eb1fc99b64e97186554ed14b549f1fcfb2f9b7467863d73afaac8a2c296a268dfa8f5f88415f68017c945c09cc4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693577033, "uuid": "3d31a317-aa15-4eed-815b-1182fe344d10", "value": "T13AB2C0F99CC579F173BB5391831ADBE1FC06332CF2C2F9521A69C6A01B07A058D0AC22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693577033, "uuid": "6f7470c7-1b5d-4979-8677-5034fdc96862", "value": "768:xjbJzKjG920H6q7DLW4pewkrEHIYz9E3HgR:BNeG9T6qzHqrEoYhigR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693577033, "uuid": "c31d5dd2-7925-4889-8ac1-2e1bc7370f11", "value": 24712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693577033, "uuid": "1841e313-63ac-47fd-a825-9644218b01f9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693577033, "uuid": "4fa26056-2941-4384-8398-79502fadaad8", "value": "DOC290823-29082023144405.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49989ce0-48c9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1693573985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693573985, "uuid": "ec017e35-ca81-4e80-9f90-3ebe17b77928", "comment": "Malware payload (Fabookie)", "value": "ff0ca5d8a61da8a0b725bcd6e36412db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693573985, "uuid": "edb69652-4eb9-4c4b-8b6d-f307204a8313", "comment": "Malware payload (Fabookie)", "value": "a7d81592138286fb7cce06bfd0798ea2930def6ff399f652644887ad9587c2d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693573985, "uuid": "1e500d8e-3de5-469d-b914-34fd34438d5c", "comment": "Malware payload (Fabookie)", "value": "c19d0f61db4137ff04210f9c959af6f2f314854c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693573985, "uuid": "3d8b7d05-5002-40d8-a23a-59d51666dba2", "comment": "Malware payload (Fabookie)", "value": "8e3b51147793124dc0aa164cdbb706754e8567cf7a4378701deae1634713d7a486fc5e39dbe830402a7196a79094ff9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693573985, "uuid": "96fe0a07-648f-40ac-8f8d-a8eb2318d691", "value": "T185F42B56FBBD4272E051C135C9A6E7B5E6B27C865D30970B2345EB2E2F335118E3AB20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693573985, "uuid": "0e1c043e-8e42-44ac-8b5e-e5d0d3236ffc", "value": "f2fcd0efb031ebebeaa83cd4cd21090b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693573985, "uuid": "6d5f1807-66ef-41c5-a0ed-a7cc8d05fd22", "value": "6144:XA01NdMuvxQWQSzoYaE5kiLNdRxQ7cUBmCUiJbc77ZvfuYuEdGxTC28Wf7xLUnwa:Xdz5QWJzNLNIShtdGxTC2M5JL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693573985, "uuid": "ef0fb55e-7de8-4e9f-9f17-4dcdf12fb544", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693573985, "uuid": "22753793-10ce-42f9-bbb8-b5bdb5e7b8c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693573985, "uuid": "6c165c48-da41-4b85-8539-bcbc426bdbdb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "386d4bed-48ec-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LockBit)", "timestamp": 1693588989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693588989, "uuid": "4c4fe2fd-27fe-4f07-b6e4-03aeddc62fb6", "comment": "Malware payload (LockBit)", "value": "6d94d664f9ba75013dddf5cefbc9a4f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693588989, "uuid": "60186d01-d731-46c7-a813-db1e50db1465", "comment": "Malware payload (LockBit)", "value": "a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693588989, "uuid": "3d8ea36e-278b-4c15-a7a7-59f01c3c377e", "comment": "Malware payload (LockBit)", "value": "a9c58e2be33854f91cb6eb19701b71b2ad0c8db0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693588989, "uuid": "837b79a8-d79c-411c-ac0b-86752ed9c317", "comment": "Malware payload (LockBit)", "value": "a90d7ee7b567db33402aa9b06cdaa019ed89da361d0babf41155c11ea45b47e7afb7d50579ebdd666a8344b63aa3539e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693588989, "uuid": "9b6bb9cd-1897-43aa-b271-102790f8d949", "value": "T1FE745B4392E1BD65E9264B328F1FC6F8B60DF6708E893B7532189A6F14B11B2D273741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693588989, "uuid": "9d92f288-68dc-4da2-a828-05ece0beb4c3", "value": "d8507a8b152f56267b5250a792ccaa4c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693588989, "uuid": "4ef44995-cb40-49cc-9855-a74a763ef4fc", "value": "3072:m/1uwdeUo9srEwzwl6XH4qopEhNJJHpTazxQQ9X4V0vIrFCZezRothGwUy8hv857:8eLLXl6VoyhNbSxQQpHQrqRfqv8+N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693588989, "uuid": "41f5bbe8-6d7e-4e15-8c27-1969d90acf0b", "value": 346112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693588989, "uuid": "655d0fc1-32df-4ed3-bb4b-3cac81b0768a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693588989, "uuid": "518529d0-cec7-48bd-ba37-2027c5fba7f6", "value": "(((\uc785\uc0ac\uc9c0\uc6d0\uc11c 230830))) \ud56d\uc0c1 \uc5f4\uc2ec\ud788 \ucd5c\uc120\uc744 \ub2e4\ud558\uaca0\uc2b5\ub2c8\ub2e4 \uc798\ubd80\ud0c1\ub4dc\ub9bd\ub2c8\ub2e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce7d5403-48ca-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693574637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574637, "uuid": "792a7f4f-2510-4415-b490-04f0043081cb", "comment": "Malware payload (Mirai)", "value": "efea48a979dd698b8118f48b986660ec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574637, "uuid": "0ccc5803-e04f-4bc4-8314-00844bd3ca8a", "comment": "Malware payload (Mirai)", "value": "a910c7af374737f1fca18056f85ec37d44fde9f770c0c912f3431816739cebf9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574637, "uuid": "1a6df387-ba5a-4022-8747-22f6dea8a7bc", "comment": "Malware payload (Mirai)", "value": "e5483ef92531d0a072e81e0f7ce23480fb6f801f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574637, "uuid": "aaa1b77b-af58-4138-8604-5feaed10dcf9", "comment": "Malware payload (Mirai)", "value": "ef04fc28345d47b6686d0da77446d441c2c3a1e3cd98b7fec0b84dbbf288f378aa3342e8f8087f342f59e569caa05c1c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693574637, "uuid": "4ff3591b-63eb-4456-a653-54977498e506", "value": "T12B33F16326AC2AD251B097B7FC32E825A2EC16F95C6330EA3CF4A61977D14034EF6641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693574637, "uuid": "6b17cc52-8d08-4638-a251-75623e50d417", "value": "1536:T9O/ZMAXIxNUk0YkdPqF1aBexo4opKZbd:T9O/ZNKyE4qFUF8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693574637, "uuid": "b52520f2-da6b-4613-bc09-dd60d0785e0e", "value": 52656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693574637, "uuid": "d90ccebe-b1d5-4581-8085-651d8fad6f3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693574637, "uuid": "1d73011e-dcf1-4118-b573-9429c3d74ea4", "value": "efea48a979dd698b8118f48b986660ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93172cdd-4902-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1693598590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598590, "uuid": "2d962640-deb9-41ad-8d91-21f07439d6bd", "comment": "Malware payload (Loki)", "value": "8b36e207c53c0e34fce64a468d9f617b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598590, "uuid": "8d5c5ab4-e754-4ba9-a3ad-96ffe73b9432", "comment": "Malware payload (Loki)", "value": "ace4774810376e5dd8bf3131c3dad03ae2c7d1d95a2edea39de42fec95a1cb19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598590, "uuid": "30913be6-bb38-4305-af55-539a91b753ea", "comment": "Malware payload (Loki)", "value": "fdbc6d03a334dcee2886fc42bc9280d9f7b590fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598590, "uuid": "37134189-5685-47e7-8fd7-4d3abc6dd9f6", "comment": "Malware payload (Loki)", "value": "dcd33449639fc9aa43e5e03270c3fd7d1d369be0f77a9bffe84812e6951336093aa27972e9cd616c2fd6cbfd555a1145", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598590, "uuid": "4592ba94-8510-4f0c-b751-e23d76f0ee51", "value": "T12B350202BFC147B2D5B2CA351939BA81F17DBC253E269E0D73A8F21C5736050D17EAA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598590, "uuid": "c4711922-4325-4df6-9a7b-b92d2c1d85ba", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598590, "uuid": "89c5039c-9838-4fe8-9d4f-8e373fc7b648", "value": "24576:wNA3R5drXmDG6/e+vv+YG28w0LCLt6Oo4KLzsKT9+hUxAPO/:p5UB/BsFR+h6O/KfsKTgm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693598590, "uuid": "3b5139f7-3cdc-46b9-a814-181b3618855a", "value": 1087961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693598590, "uuid": "e4135378-e207-406c-916d-b05edb34183a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598590, "uuid": "f672b623-c5fb-47cb-a3d0-4f6d8cc8967c", "value": "\u00d6deme_Ge\u00e7en.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3d9b5a2-489c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1693554916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693554916, "uuid": "b03702ba-61e2-4976-998c-9a33c9c2fc8d", "comment": "Malware payload (Gafgyt)", "value": "a4025d3338e0b525929a83522db8b5ef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693554916, "uuid": "c9b3523e-5819-4dd5-818c-d183baca47ad", "comment": "Malware payload (Gafgyt)", "value": "ace97a4240a776ef047a46e0761b789e8361ff11c736efece62038b7d6b20484", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693554916, "uuid": "646d626a-93ca-4594-bcc2-2b0b74244e4c", "comment": "Malware payload (Gafgyt)", "value": "979f0a077235c52748115f90eeff6582f874838d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693554916, "uuid": "40fb5f08-6c0e-4be7-aa0d-2812328c0706", "comment": "Malware payload (Gafgyt)", "value": "3c8f73b150ff7e62be0e98d736cd62f3df543a86b50c87e0ddd5f89178cc592eb0137d385e6ed018d057d9bd1ebacfb7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693554916, "uuid": "62460ae5-e57d-49fa-b738-0f5420bbf78c", "value": "T172F320215A1AE123C496ECF9BED2BAD78519F2974E8A8702B3D420AD0DF5D85701FDCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693554916, "uuid": "641addd6-7f61-4cbd-9e8d-d4604fd7de39", "value": "3072:eBk4oGMteNnEVGF9QHD9OxiT7cCO9ccjHS+m1QVd51GHvCY:eMGCeNnEUIDUoT+BPm1QVd51GHvCY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693554916, "uuid": "907f88d3-0f37-4062-89d9-72ebfbd4c8bf", "value": 161555, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693554916, "uuid": "f8484f8a-d3ef-436d-8987-1588e8677cf6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693554916, "uuid": "b61f2ff7-d89e-4e3e-a538-ec135993c738", "value": "a4025d3338e0b525929a83522db8b5ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b81d1645-4902-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693598652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598652, "uuid": "8c4b4eec-48c8-45a5-9183-602a5a61bddf", "comment": "Malware payload", "value": "7f456152801da84b6e7227a0d009bdcc", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598652, "uuid": "05ab0a3d-cbd7-4a68-917a-08d58816e6fc", "comment": "Malware payload", "value": "ad4816c08b7307f8e295ab6e15287871aad26bc6dab7e8dfb50d404acd1e4511", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598652, "uuid": "b449eb3e-63fb-4bbd-a8d7-6d352fbd6c70", "comment": "Malware payload", "value": "e36ea9aa2f560aa1166d034110d9d6343bd92e54", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598652, "uuid": "0f7d5a91-0784-4890-bc13-549dacbb06b8", "comment": "Malware payload", "value": "2f2df556c8049d9662d5a0d4ba64368f9fe500f80a3ad5e087c2fa139bac2a693b9a837993de0bf5061cb5388bf7f26c", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598652, "uuid": "9ae3c6f5-70a8-4fb6-b9a6-d54883f44864", "value": "T137E43390321436A67AE6B33FF38B22821E917E40DA611C66FB154F7F243371E9497D91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598652, "uuid": "c5cf919d-ca5b-459e-b747-847bf7d480a7", "value": "12288:wF20M1nx3qSVrTV6DMRvhRU/1HVViT+HsfqxnCMUCbcJrd9:xj1x6SaDM/C/1W+Mf0nCMBbcF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693598652, "uuid": "49ec80aa-8ba2-4be5-bef6-f89ceaa56b8c", "value": 659010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693598652, "uuid": "3ad9610b-b5cb-4e32-a2fe-abd45c9fd991", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598652, "uuid": "ca1bb7fc-827c-4cf6-9999-ee5e72c7a167", "value": "AUTO PARTS ORDER LIST.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cd52ac1-4905-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1693599733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693599733, "uuid": "a0ea6037-3bb9-4c4d-ba1b-a7a3af0ce0a1", "comment": "Malware payload (Smoke Loader)", "value": "92af305d2f27bad7c4d1b85f7a70c763", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693599733, "uuid": "52e4ed51-b496-499b-89ac-5ee9c0d9a8e9", "comment": "Malware payload (Smoke Loader)", "value": "aebd064ece93784e0720d3094ddac5c23ed866f84946c11e23435676458c2f6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693599733, "uuid": "b72c2292-118f-49b9-9438-af07e842c39c", "comment": "Malware payload (Smoke Loader)", "value": "0da4ec8b493edb33ab506b67d24a4b7f124b6024", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693599733, "uuid": "2adf5281-2d2d-4847-a755-cfc914948a22", "comment": "Malware payload (Smoke Loader)", "value": "cb03cacb3280457e8af51cd72a73853405d63ba446ad39c2356021ffc465f11b0672e7b67cf0796b575d8413879021ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693599733, "uuid": "fb1f13a5-b3e6-4bc8-ad3b-08a2f5b49563", "value": "T15E840A0392E13D94EA258B73DF1FCAF8770DF1608E497B6922989E2F04B5172E263715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693599733, "uuid": "97b4b7f9-e4e1-46b0-b3e6-fb3a8ade7cf6", "value": "0d5ccc78ff50fbd2fc0370addad4c1f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693599733, "uuid": "2301044d-17e6-4881-a190-7bb341a82837", "value": "6144:LLgI93EOrwX6wMHXjRKn0uuZWf2/Obw/:YI93EO26wIdfa2/OM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693599733, "uuid": "73f25c6b-9e08-4cd6-8f61-675654051f3c", "value": 404480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693599733, "uuid": "9fa11b02-cfe2-4eec-87f3-a881b9646539", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693599733, "uuid": "a4865360-5a65-47c7-b160-12de9d99f4e1", "value": "92af305d2f27bad7c4d1b85f7a70c763.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de603774-48ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693597427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597427, "uuid": "4cf1becb-ea20-4a6f-af86-b9fafd1f7018", "comment": "Malware payload (Mirai)", "value": "cedfd421bc2aa33a098c35988e800365", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597427, "uuid": "7117623b-0957-4f07-a8ae-e61f54230f49", "comment": "Malware payload (Mirai)", "value": "aee91e920b6725909b7e99ab69af967ada22a11a03b55cb596b47f670bc76981", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597427, "uuid": "b5a616f9-57f3-4243-b772-f026579e5101", "comment": "Malware payload (Mirai)", "value": "e0163902c68be41f3f624c318298d78fa1395d99", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597427, "uuid": "c05fb76f-5c3d-4f95-8f67-359eb1d92182", "comment": "Malware payload (Mirai)", "value": "d86f26fd7d8a5b2d5d0c96c27a38910806fa5e1e69450dde2d824d615bbe8f2175f141de3014359c2520441a70b2849c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693597427, "uuid": "166c0978-5a07-410a-9e6e-20a1fa734c99", "value": "T11FB31877A4654F73C045A5F125BA9A310F12AD931B1F1A88763CB6B04A3B4CEB84EF58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693597427, "uuid": "d03d5f17-ca82-48ac-b303-3c8f797d6b8c", "value": "3072:MDVLSItJP+Xsp4JlN3H4jmH1cuEgvniuN/:MDV+ItJH2l3H4jmH1cuEgvniuN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693597427, "uuid": "31e7cbdf-327d-4e05-a91c-48606b8cda57", "value": 112633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693597427, "uuid": "42197257-f824-47c2-af63-7bada6fd8395", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693597427, "uuid": "0936d5b7-9afc-4e46-9707-02c9e4a6f7ad", "value": "cedfd421bc2aa33a098c35988e800365", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17211fdc-4905-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693599670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693599670, "uuid": "056ead41-562e-4372-80a1-0b4b36d89af5", "comment": "Malware payload (RedLineStealer)", "value": "da7c28b0e3d4ef03c1f64ad963b046e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693599670, "uuid": "22f9a45b-0ec2-4221-ab16-993ff4b144d4", "comment": "Malware payload (RedLineStealer)", "value": "b000f98d21337e9f89ec1634a387ceefe992aa746bcad46ea33854d48dd0d15d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693599670, "uuid": "9369ebdd-cf4f-45ab-95ba-1bdf585fb6cd", "comment": "Malware payload (RedLineStealer)", "value": "fe68fbcfe47433c6c135fa23e34c9b2093b91627", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693599670, "uuid": "7c4acf25-6498-47d8-ac91-ed9fdf29496c", "comment": "Malware payload (RedLineStealer)", "value": "a5111f0277af8f812495eee8802f6e87bd71fe6a4850dd9b46fdab819175d57a2da55e05b04de72d6787ac6d21257387", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693599670, "uuid": "3f4455d0-57cc-4d58-a9f9-4ec6427a3e42", "value": "T127051217B6D84133C9B427745CF302630736BDA14CB94A2B7B5798AE2DB3288647636F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693599670, "uuid": "4d826aaa-9d01-4888-913b-9e120057c99a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693599670, "uuid": "2ff4b237-c04e-40e7-b82b-22ff0085c244", "value": "12288:NMrTy90ifzJEWrS3zlQQ/KIV5aAuU3sK7fKX5L+ldq3NVq4Kcn4n6A7FYgup5Tge:Gyh1EWOhDSJ6jCJ+DqdoPc4np7luVvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693599670, "uuid": "6f94b2ef-57b6-4cb3-84bb-e3f62789dfd7", "value": 847872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693599670, "uuid": "884be43f-dc31-4c25-b439-12a48c50cf17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693599670, "uuid": "3893e78a-f6e4-4b6c-889a-ec1f640903e0", "value": "da7c28b0e3d4ef03c1f64ad963b046e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eccaca8-4882-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1693543500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693543500, "uuid": "1a8bd22e-8258-4e9d-8ffe-8e4416a40c07", "comment": "Malware payload (Gafgyt)", "value": "cdf62d4527ed339d38f1f6d8130e6a36", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693543500, "uuid": "f6ddb25b-497b-4efe-bad4-28a5ada2f494", "comment": "Malware payload (Gafgyt)", "value": "b043468a9f0a116e4bbc74cd848a115d2d3f0fbf33083b506caaaa34d7f0dfe9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693543500, "uuid": "43f01cfd-d32a-4d05-b891-bab00df98c19", "comment": "Malware payload (Gafgyt)", "value": "65fd448169059ce776aee0f39f9648e412a07e6a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693543500, "uuid": "f7a92b6d-8b62-46ce-98b8-3f5e5a6c9317", "comment": "Malware payload (Gafgyt)", "value": "888c48d2ad0b10a1e4f30d3772c16eaab580bef644fc75a20e96829e82f9aa098d099bff668a52f318d0a5cadc780600", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693543500, "uuid": "9d317401-6d54-428c-a380-c666a77993c3", "value": "T1FBE25CA3CE252E18D28881B674218F7A1B63D955924B5FEB113AC3798043DDCF65B3F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693543500, "uuid": "b2d28f3c-3815-4559-a779-80c872d2ab29", "value": "768:SnS7YL1N5BKE6bYaPo7YBXSDCVkaRufwvJ2VjIe:B+zKE6bDg7qCDCV1vkRT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693543500, "uuid": "8ed02ee5-770c-4037-b542-62b9e26fb0cb", "value": 34080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693543500, "uuid": "36957b92-0a14-47fd-8ce4-c6b97af3fa1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693543500, "uuid": "20c2403a-ce26-4f61-8804-a6cb0625572f", "value": "cdf62d4527ed339d38f1f6d8130e6a36", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a99afcea-48a3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tofsee)", "timestamp": 1693557825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693557825, "uuid": "d21e417e-6b82-42a2-adc8-0e1a6e2739df", "comment": "Malware payload (Tofsee)", "value": "a9d7c46cfd548faf84061e36e63f07da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693557825, "uuid": "5acbf320-dcd2-4777-b18c-004ca467f4e6", "comment": "Malware payload (Tofsee)", "value": "b05cb10bb35fa751db1e6b16eceb7156e4fcafc9d9baff0354e095424c3562d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693557825, "uuid": "78e99e2f-fee6-4427-9f22-4cffad56b660", "comment": "Malware payload (Tofsee)", "value": "76fb3da13b140bcf953785247f84eb4bb33d79c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693557825, "uuid": "db95aafc-94e6-4f59-8bc4-1e46334031b3", "comment": "Malware payload (Tofsee)", "value": "97105036e1d0f661a145238bc8501fac26f4e4eb404523b135069b538e0365a502913eb2510c2efb2f8f8138a9bd5644", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693557825, "uuid": "36b40ab4-1088-4eef-a2c0-78a3b88f2568", "value": "T10F84B54392E17D58FA268B729F1FC6F8770DF5608E497BAB32189E1B04B1076C263725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693557825, "uuid": "bb1abacb-d5a2-4478-ad20-83946ab227ae", "value": "a0157d3b2852cca44553b58241d89d57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693557825, "uuid": "b3076a0c-189e-4ec2-9218-01a2d73ba9d9", "value": "3072:bivWcO4GUoPzSSxd+fd15HLL/VVcARq4klBmUsPprEOngKNKLPcOJdxH/WN:qyUyzSAdCXL7HRKB2pFgLUebH/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693557825, "uuid": "b8eeecf1-4d13-4c49-80f5-362ab34c9beb", "value": 395776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693557825, "uuid": "0fc40969-f4d2-4064-8a35-a35ad314e316", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693557825, "uuid": "79f2c9c3-cf2d-433e-afbe-10f759b4acde", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64c0f476-48c3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1693571454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693571454, "uuid": "e6923401-bd58-4709-a288-102f5c3aa363", "comment": "Malware payload (RemcosRAT)", "value": "1becaa0726bae1f669da8d39ac13509b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693571454, "uuid": "a6c3b3ef-43a9-45f8-9158-45b6f26bb0af", "comment": "Malware payload (RemcosRAT)", "value": "b2d5e15268cb130c995118e17afa1198ca19604a20b91f1907a7ef18210db30f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693571454, "uuid": "df686542-8026-4da6-8d29-c8fa928ced1f", "comment": "Malware payload (RemcosRAT)", "value": "43df013242f0172059e8df21e29215b14c1837c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693571454, "uuid": "c0d99a85-79b0-4540-b821-9994853946c2", "comment": "Malware payload (RemcosRAT)", "value": "46c642cb6624df5c080c06ce4bdeb87dd4ae5af02bbd883965dbbce85dfb0bc403832d437fcce7054ac9f7a652260cd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693571454, "uuid": "9b613ea1-c1f9-46f4-bc8f-3b0f1b6dc58a", "value": "T196D45B4392E17D58EA258B729F1FCAFC770DF5B08E097BA932189E2B04B1176C263715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693571454, "uuid": "64480dfa-7665-482d-8e3d-395858e9add6", "value": "a0157d3b2852cca44553b58241d89d57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693571454, "uuid": "25ff0129-a541-495a-b82e-b72239d8bf07", "value": "12288:kBkhRxDIusx/JyqVMdFYiUgam+XodmA+Ae+cgLUeL/:OkhbZsRJy8Md6iUNnX1RZgLHL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693571454, "uuid": "f0005961-b4a2-43cb-ae3e-03a6a3ad80ac", "value": 601600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693571454, "uuid": "7456262e-e89a-4109-8f1e-f92b8aff5829", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693571454, "uuid": "67487158-273b-4b3e-94c7-a7d6567bd502", "value": "HB23090003.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8397544c-4911-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693605006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693605006, "uuid": "fe6c8173-0004-473f-890d-867016e202e6", "comment": "Malware payload (Mirai)", "value": "befeef546414fd90161ed8fcdb796e43", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693605006, "uuid": "b9ea2b04-009c-491d-8047-b6656a430e5d", "comment": "Malware payload (Mirai)", "value": "b437ad2800566adf5964766c0eb1e5f97340c04fbd0ad12421ad51bde7416738", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693605006, "uuid": "3505e840-f0f6-4f1e-8242-7ed575036ae8", "comment": "Malware payload (Mirai)", "value": "04e42bed981b17ab683b5ad4f9addd16e1c624b9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693605006, "uuid": "8b127efd-eee4-4896-a29d-f24c27f64d85", "comment": "Malware payload (Mirai)", "value": "e5af10dc921ff4646d7def27b7ed2b43dbbe4b8362da2d48d7b4080f81b8e4b86c04ca95ff6e7a9105e122d2d31bd221", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693605006, "uuid": "2e9b2cff-1863-4c0b-bf27-ed3af3ea303a", "value": "T102D2E16466A1E8B0EFB4533FFE3C4002225713FBF4E8B5DB55948D48B64C607E636285", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693605006, "uuid": "274bdfb2-d34b-493a-ac7a-24b742cf8a49", "value": "768:tFoxdX+IoMKVUfzaP1urxIGyYUzpzAhDxZFRvms3UozA:tF2+IoXVeNIlzpzA9vLzA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693605006, "uuid": "efcfafad-860e-44fe-84f4-747431b7d035", "value": 29960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693605006, "uuid": "59dd2499-346b-416c-bb07-6fc713ae02d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693605006, "uuid": "c769144c-28a0-45a9-990c-6c291dfb79ba", "value": "z3hir.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b44a2c24-4866-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693531644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693531644, "uuid": "5de76524-46e0-4c78-8475-f05d0fcfe4e5", "comment": "Malware payload (Mirai)", "value": "713bfed514d94f78ed7f0b8e7fc9d7c3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693531644, "uuid": "7ecba092-8214-4926-b7f1-c6f386c6fd85", "comment": "Malware payload (Mirai)", "value": "b51b42b4eab85395dac35e861ec652a603f5f8372c8467c1d25b5123c06c1f0b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693531644, "uuid": "7f8bda0e-f691-499d-ad6d-18c98ebe4086", "comment": "Malware payload (Mirai)", "value": "202c015c4fd3e5fccc5371c1120e762d8795bb3e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693531644, "uuid": "bff795b8-f87c-454f-a777-999292d422b6", "comment": "Malware payload (Mirai)", "value": "50e580b80a2fc1a8fe6e5b0f5195fafe5e811b5f010dd5afb0804e786915c5d27bbb62425471c22488a28557f30d1453", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693531644, "uuid": "4e795051-7123-4f8e-a524-ecb31758444a", "value": "T1CED2E1ACE5567FA9CA4D587C05EE02766EC434C37AAC46CA072344483B7EA8BFC1D634", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693531644, "uuid": "85f8cc74-e184-4236-a62b-d9e8f70a7c0e", "value": "768:11uUtLrVDsAp6tLkFqok//xDMfl4icJbiWUr:1bDs06t4fYpwWicmr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693531644, "uuid": "aec91f2a-6dbd-444b-89e9-b00ea2646a62", "value": 30324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693531644, "uuid": "c674aec2-4048-476f-b2ab-7af75996aaa8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693531644, "uuid": "8e3af50f-458b-4fa3-bc1d-534e0b207b54", "value": "713bfed514d94f78ed7f0b8e7fc9d7c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7de25fe5-48a3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (KnightCrypt)", "timestamp": 1693557752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693557752, "uuid": "0d6eb3ae-bf20-404b-9b13-1b16a5f928c6", "comment": "Malware payload (KnightCrypt)", "value": "7d71c897223fbc3c0b0ec324e27804e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KnightCrypt", "colour": "#81A14D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693557752, "uuid": "7f86e221-868a-4c5d-9809-da94efddf8a8", "comment": "Malware payload (KnightCrypt)", "value": "b6064f6936f72d1312f40f86f0cb889c6d0477c20f59c6c96c385c6287f701f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KnightCrypt", "colour": "#81A14D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693557752, "uuid": "d375f4c3-f641-43f8-8f3e-b2fb5f3cac18", "comment": "Malware payload (KnightCrypt)", "value": "0ee04f020d4f36ac6c5c2fa7667de7ac897dc41e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KnightCrypt", "colour": "#81A14D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693557752, "uuid": "b5cb8116-3652-4e87-8670-817e3d8b2af4", "comment": "Malware payload (KnightCrypt)", "value": "d8b8d72b6a9ea3cf6d6411189d1ce33ca5148ed9c9cca1b5d880903b4ecf6785221e9841b078624993802d29f8eb3aa3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KnightCrypt", "colour": "#81A14D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693557752, "uuid": "6976b15c-1103-43bd-bbe3-6efb06d8853a", "value": "T18C459E17B69941E8D06AD1B4CB564132EA72BC510F34AADF0690B3192F7BEE46F3E710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693557752, "uuid": "a3fb1493-d20e-44fc-858b-980e43461218", "value": "92ed8fb21c381a073a5e7ca35347f90e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693557752, "uuid": "f252edba-9558-4598-bf0b-3dfb27eb627d", "value": "12288:RBVVtkNBJOlMmXP0447OdMyogfJ7gwPueClVVRWM5YDh8xpoPKouMA+nkGGCp+D:CTcCG0447AMVgfdnTClVm4QKcGRD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693557752, "uuid": "3a8cd070-6781-4120-9a26-4342ef5a0f21", "value": 1165432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693557752, "uuid": "8be499cb-90ea-40bd-8c94-318cc3f4c837", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693557752, "uuid": "1bdc5a0d-a2b1-41b6-8e3f-c8b77a57f31d", "value": "TmsLA6kdcU8jxKzpMvbUVweTeF5YcR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d039233b-489c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1693554884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693554884, "uuid": "22a9b364-b12f-4222-925f-32cfd63fae52", "comment": "Malware payload (Gafgyt)", "value": "91e6c8ca40311d86cb7db6fa4e44ec23", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693554884, "uuid": "17394a16-eed6-4bca-8f05-172ebfb68f81", "comment": "Malware payload (Gafgyt)", "value": "b734aa31a06a8632276529f73b4de0a124e8f2c55a8b277b6fd39f83b94a0fe1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693554884, "uuid": "8c69ffa3-41fe-4c2b-91cf-02c7ec9cf8b8", "comment": "Malware payload (Gafgyt)", "value": "7de1e0afe7023f6729a2135b80c5849c3e7570f5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693554884, "uuid": "e4564a6b-8ebf-4899-a9da-92072b9c5ad3", "comment": "Malware payload (Gafgyt)", "value": "e6c023d27ceef1378729a9f742f3e816ec9b36ee0b3c32bf32b45e98e273e0ffcc49e660d648c00991e27c5e1d89eac0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693554884, "uuid": "bcd6b73d-ee09-44f0-9523-c6886ff00973", "value": "T170146125991AD217C4D2EEFDFFC5BACA562DF2838BC6A30275A4105D0FE5E94242F8C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693554884, "uuid": "deb97983-2a67-4afe-a9cf-d8e8b9d4350e", "value": "3072:BiD7ta6sFSnBMTBcC/G39RUr8YsmMqqD6sFhfuLa:AwFSnBMTRG3jmMqqD6sFhfuLa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693554884, "uuid": "1c4c4879-1fab-4cd8-a22f-91eedee53c1a", "value": 190614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693554884, "uuid": "ef49185c-d69f-46d5-b8f9-ea2b88c49211", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693554884, "uuid": "881ea5c6-9a04-4a59-bdc8-4e59251bfc4f", "value": "91e6c8ca40311d86cb7db6fa4e44ec23", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce06070b-488e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1693548867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693548867, "uuid": "932ff7cd-ed72-4327-a31e-b757ac189f0f", "comment": "Malware payload (Smoke Loader)", "value": "61e9fd4f6148816616d01a054c3bcd01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693548867, "uuid": "6589341d-c11a-46c8-9988-deeca23fa585", "comment": "Malware payload (Smoke Loader)", "value": "b911c2c7924e997f1349395a95bd57bb211e7b4a67e9c98b01fb3a176b0f27a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693548867, "uuid": "5a2299cd-c28b-474d-ba00-b98cd554cf7a", "comment": "Malware payload (Smoke Loader)", "value": "63c65d30b2469e202817c9690f50910326baacea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693548867, "uuid": "4c2e5c67-7835-43e7-9489-24317e85ec78", "comment": "Malware payload (Smoke Loader)", "value": "97e0c1147f42a87d688b328e8312f78833451f908e5d697fac7a22dd207c39f81553d88abf79b6337f5207d8c3f2d8cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693548867, "uuid": "131419d5-394b-41c1-a285-9685862de0e7", "value": "T1F384B543C2A17D95F9268B769F1FC7F87E4DF6608E893BA53218AA2F00B1077C563650", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693548867, "uuid": "1573e6e5-4361-43ba-bf5d-17cf30260459", "value": "a0157d3b2852cca44553b58241d89d57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693548867, "uuid": "f30b7fdd-fc60-4c9b-9734-2337bc2f7c6e", "value": "3072:8hYeQu1IGLopjS7ZiLPNBh1kstnU8Ktej5cJ6iEOnbAFwdwTfdubIw:WVPL4jSFiLPnn5vEbASqTfduh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693548867, "uuid": "1f6f1a41-e7ea-4e70-a10c-bcbfb28a29cd", "value": 395776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693548867, "uuid": "1a047fac-5172-4dc1-8825-cdd5a7fae6b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693548867, "uuid": "880c39e8-e54a-44a3-8b7d-0ef189e9d53c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc2d00e7-4902-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693598712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598712, "uuid": "7331b530-326d-4d5f-bd15-ad7b7d8f20e4", "comment": "Malware payload", "value": "d89b79207a86482d94f6d72a77687e1f", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598712, "uuid": "e4415f02-143f-4380-9ce4-52edf0bfd1bb", "comment": "Malware payload", "value": "b93da9c62f0c9c4dafc30fb725f9b096d3cade8e91c5d84bf98d1b552242746c", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598712, "uuid": "b82faffa-bafa-4bd4-8aaa-d781147c03f6", "comment": "Malware payload", "value": "611710d51a566d46c174f935e29a7bd51390a7d2", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598712, "uuid": "17ee703a-162a-4eb8-ac53-caa12118e91b", "comment": "Malware payload", "value": "b774777fbb125f61ddf45f6d9e446b87aa7978f8d951f106b6a5074c1b1bb0bb840c5985589533f207e60d020de3de96", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598712, "uuid": "0b7f8f89-fe46-46b6-86e2-feb3d1dfbc18", "value": "T178A3E8FA2C4BA40291AD9324497BCC1E9C52D54232647A90F71AA439DF6FCA7203F7C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598712, "uuid": "90a24dbc-97f6-422c-a3bb-da642bb19474", "value": "384:pIquxhpyUyBWCd3Y6V2XYiUEkdkFz41cuUqu5VE8Q+6UH2HuVmuapg1E/4uEDyua:pl+9I0WT4xDyVhPocH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693598712, "uuid": "710dc321-3cd4-4928-9b49-8ac264558b5a", "value": 107087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693598712, "uuid": "4e82612e-98ca-4975-b5aa-c415015dd731", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598712, "uuid": "929d59de-9691-4048-afb1-1166dba2e7fb", "value": "WhatsLogs19657.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4daf220a-4903-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693598903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598903, "uuid": "06e10431-45e4-4143-9e7c-89ab8f897113", "comment": "Malware payload (AgentTesla)", "value": "9cbabab7bf38b7c105487ddaecfa5311", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598903, "uuid": "ff015be8-1c2d-4380-ae9f-ca55a3f5ebc7", "comment": "Malware payload (AgentTesla)", "value": "b9a1bf1c5e947aae9944c292b03f3424ef45a0058a96b9fbd8c454f5ae1d9d99", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598903, "uuid": "4121dc8f-a4d7-45e0-b97e-9ea93cb3bc22", "comment": "Malware payload (AgentTesla)", "value": "a1bb8e7538407de65a41bc4086fa8c6185c8507c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598903, "uuid": "3cfc30a7-c697-4a84-9b97-b403fbbdd4f4", "comment": "Malware payload (AgentTesla)", "value": "36d01a03f7e7b3228d509f793ba26acd140cbe4046b144d37011b29f17a6e703080d1858df9c4179601f526c9da1350a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598903, "uuid": "8187a55b-43f2-425c-868e-143d62a8e5d6", "value": "T10645F0177630A472CD44C779D5E35D2482E3EE99A7E2D61964C9B36D0B323BE8F03286", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598903, "uuid": "cdd7086e-8345-49a8-ac88-f8796cbfca51", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598903, "uuid": "cb74fdd3-7300-4251-b314-f835c2af54df", "value": "12288:Wo0wHBf3WdMofLvWBmSkuz41QgQGtP6jttisTwFRIoB1vCCaqwYnhKWeQxDWhyUk:CwleDvwmhu8RP6jttrwFenHMgIdv7e1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693598903, "uuid": "518948a9-5e72-4c71-9f43-70e6ca706a92", "value": 1218560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693598903, "uuid": "fc6791fc-69e5-48aa-9b14-7e6460bcf778", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598903, "uuid": "880079fa-0828-45c7-8090-b6f9d2458982", "value": "QUOTATION_AUG7FIBA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0baaf130-4903-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693598792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598792, "uuid": "f3314160-3a84-430d-a861-b859d94330f9", "comment": "Malware payload (AgentTesla)", "value": "dcff0fe386a45b55296cb896f6939991", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598792, "uuid": "421a266b-5004-4c1c-9890-07ff03241618", "comment": "Malware payload (AgentTesla)", "value": "bb345b80cdf6adf22b29c8885aa0eaa4dabff5fd66cc766c322777ac85b246c7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598792, "uuid": "e39ee41d-b0c1-482f-a9d0-9033e59f6b62", "comment": "Malware payload (AgentTesla)", "value": "0ec9ba2752e6701673995ea3742569c0603ec49a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598792, "uuid": "7e72d01e-b815-4b42-9e0d-57d6314b4583", "comment": "Malware payload (AgentTesla)", "value": "08f3b08e355a6d6d340e003b6da2dce9b6402d3035e6f3b154a65175084263e9f4d667eeb23cce66dcd94f7b345f69df", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598792, "uuid": "4274e50a-73dd-4f9d-a772-d2666f6bb80c", "value": "T1C6E42201B2E01A13D276E3BA5395336403F0B769B737D56EBDB022C4A766F254C813AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598792, "uuid": "e14a9d5d-8e3e-4853-ac0d-b7170d6cf9a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598792, "uuid": "8b51b5b2-18c7-44b6-a76f-884d9cca91c2", "value": "12288:tefOZ1T6ceVOlgkMY5qF8WTZE37wQMMicufTYyu+OJWwFsxnYjH4QN5:kWZccY3YVoMkQscufcyu+vwCxnOHJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693598792, "uuid": "b508401c-1f26-4030-a6f5-07af53afd270", "value": 680448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693598792, "uuid": "f2962554-91a8-4900-ab63-4c466f404870", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598792, "uuid": "82de2447-9a31-4c02-a0e3-02478b0965ff", "value": "DHL Express Receiptss.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79a5dea0-48a3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (KnightCrypt)", "timestamp": 1693557745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693557745, "uuid": "af3f803f-7815-435f-abfe-bad658286554", "comment": "Malware payload (KnightCrypt)", "value": "219e1bd62a715ebbe536ea581e0c1578", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KnightCrypt", "colour": "#81A14D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693557745, "uuid": "9b8ec239-9e03-4253-9e96-195e16d8fabe", "comment": "Malware payload (KnightCrypt)", "value": "bb65532e8a52e282d98938031c0d75155082933524924d01de4246e12690cf9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KnightCrypt", "colour": "#81A14D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693557745, "uuid": "a363dbf2-56a4-47a4-86b1-4366442bb38d", "comment": "Malware payload (KnightCrypt)", "value": "2c4c0d875a2432d5590f32c64bdcfebddd9ccdd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KnightCrypt", "colour": "#81A14D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693557745, "uuid": "dae618af-057f-4d2d-915f-3c746819a7af", "comment": "Malware payload (KnightCrypt)", "value": "34bfa7648cae7dcdacd4e056dc2fa9ebaf6ef95c7e568415b5ce80d04a1739285a2f9afd851de7012d4b79539e0eae12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KnightCrypt", "colour": "#81A14D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693557745, "uuid": "266fb588-10df-4403-b325-d5ba6d41cb2d", "value": "T16F459E17B69941E8D06AD1B4CB564132EA72BC510F34AADF0690B3192F7BEE46F3E710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693557745, "uuid": "4b1c0d30-81a5-4490-8329-7f94cd80d881", "value": "92ed8fb21c381a073a5e7ca35347f90e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693557745, "uuid": "6341afde-084d-4464-9404-f6ec96a8ea74", "value": "12288:RBVVtkNBJOlMmXP0447OdMyogfJ7gwPueClVVRWM5YDh8xpoPPouMA+nkGGCp+D:CTcCG0447AMVgfdnTClVm4QPcGRD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693557745, "uuid": "dcb584cc-a4b6-4916-9de1-f644b433eca1", "value": 1165432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693557745, "uuid": "7f2e1f1e-935e-4400-aef8-23749b3380c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693557745, "uuid": "4e2b001b-1b19-4d7a-8e3b-425940aa8650", "value": "bj3n3ma8q7yc2tsbyv7s.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c241c4d6-4902-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693598669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598669, "uuid": "03637fff-2924-4f2d-a710-572e8c361824", "comment": "Malware payload", "value": "2ca2bd9a61fd24e942c736910a4348fe", "object_relation": "md5", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598669, "uuid": "e3c98dce-4eaf-49fc-a77e-b40d17142cc8", "comment": "Malware payload", "value": "bc5695525cf74a690f304b0dc28a0ae699499c63d1879bbea0a5a8bd2d6f5389", "object_relation": "sha256", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598669, "uuid": "e21ab0e0-9881-4810-ab88-f2e8ab454e68", "comment": "Malware payload", "value": "27ef200c50c37508c9f88311755c22063ba166d8", "object_relation": "sha1", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598669, "uuid": "e63219a4-c331-4bfb-b1a4-03f010319981", "comment": "Malware payload", "value": "072efb61191174cb8f97937e33ba9f5733104f98842f8338ccf9d43ee2df34ac99a86b3c140b75c6f0475fbb5d5a0d1c", "object_relation": "sha3-384", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598669, "uuid": "d3ba2841-8175-4850-a37c-33a9a511e763", "value": "T158E12B9E6D320D18F37E243B907993A153AE7593067F160A7DB0965C19BFFD20B18271", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598669, "uuid": "9e39b44f-d9de-4b89-9875-8eb95bbef2d4", "value": "192:LlFTELyOV8vdQjm0jlRD6Yu35urGdYZ/XQ8:rTqz8qmMlRPu35MGKtXJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693598669, "uuid": "c3e3f6a0-6b8d-4979-9e13-d6d7b5c06da2", "value": 7181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693598669, "uuid": "c89661e6-434c-4f4b-a0cb-379c86941018", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598669, "uuid": "b23a62e1-9c9d-473b-9eac-ae4cfb1cf45d", "value": "SWIFT COPY.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b57e0702-48cb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693575025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693575025, "uuid": "80c4916f-0cd1-4c6a-89f9-bb63869da299", "comment": "Malware payload (RedLineStealer)", "value": "e3e67aabe468b06821a1f111d4aa40aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693575025, "uuid": "01349cca-c980-45bc-b5d4-9db5343f0eab", "comment": "Malware payload (RedLineStealer)", "value": "bc6675a70c4621d32c600ed5f2aeedd09d72b0787a74ec24219f2853a2bc2123", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693575025, "uuid": "0b4123cf-9d9a-4bca-a7c6-6cfb7a79af63", "comment": "Malware payload (RedLineStealer)", "value": "a0da275e82ce62b29026894984c138a6718f6d7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693575025, "uuid": "ef9e83eb-aef9-4fd4-9623-202d970e76ef", "comment": "Malware payload (RedLineStealer)", "value": "e56a2c06c36bd1177666206cf929a6217dee764851ab90f198078b4eecdda73c37564eee679493a8c96d293ed7ac426b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693575025, "uuid": "7bb112cb-c440-4265-8aca-d119356d155e", "value": "T162352347EBE89176E5F127705CF703C30B35BCAA8A784363275AA88B08736946935737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693575025, "uuid": "c2503160-56e3-4974-9727-6d04b953fc8b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693575025, "uuid": "fc557323-9abe-4663-9e81-35637dd77ed1", "value": "24576:myBD9zSOhEqzaGGWla5I+vIPatEOmN77+SP:1jS2/zaqaxvUHOO7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693575025, "uuid": "a682fa06-c38a-494f-8ab8-321d41ef1465", "value": 1149952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693575025, "uuid": "e1dbdab0-2fda-4057-baff-7d39be65a85e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693575025, "uuid": "bd6bd332-9893-45e6-bd64-14470ee9c1e9", "value": "bc6675a70c4621d32c600ed5f2aeedd09d72b0787a74e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93f407d8-48a4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1693558218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693558218, "uuid": "a7b74a01-f3ea-4104-9baa-31e57c7509b7", "comment": "Malware payload (DCRat)", "value": "ae1bce358f2891606a9a045fe50c7f37", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693558218, "uuid": "896a47e9-bf68-480b-ace7-bcb491ecf8c6", "comment": "Malware payload (DCRat)", "value": "bcf3602797e5867d0510de83cebe263882703c6281c5a55cdc9ee8eed2d6c436", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693558218, "uuid": "dee7b5f1-f98e-4786-b5ca-942259fa1e2c", "comment": "Malware payload (DCRat)", "value": "33c9ff9b33b1df59d593d3befcb519f32ab330cb", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693558218, "uuid": "3c51529f-129d-4793-b178-056ff9a6a47a", "comment": "Malware payload (DCRat)", "value": "60a30f87003fe4741ec01aa779621cef4f58a12b03260bdc51a8248ab5694cd0a7dacf33fd53cd24276dfcc34fe1f09b", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693558218, "uuid": "261f1386-70bb-4ed8-9d76-f7eeb865f6c6", "value": "T14B455A027E08DE91F408127BC3EF45484BB4E9516AA6E31B7DBA376D16163A33C0D9DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693558218, "uuid": "9fec3a9d-6d84-448b-a198-c7e18b922253", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693558218, "uuid": "5163ad14-44a1-4bd6-937e-1f6677738830", "value": "24576:/iHaqwmgl5WHZfkb2xL3FVgHg6qiJFTKI1w8A5ox7bO0qKegzLW:/jdmDZxoAl0eew5C7bRqDgv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693558218, "uuid": "44fe2dec-5184-48e6-8544-64574f3c1caf", "value": 1171968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693558218, "uuid": "671f8396-f2f7-4a0c-af0a-2bfbf33c2a36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693558218, "uuid": "ea350d10-f4d3-474f-a070-059fbd061488", "value": "ae1bce358f2891606a9a045fe50c7f37.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e43fcae6-48b2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693564366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693564366, "uuid": "52c307d9-3f3d-4659-b20c-763399de9598", "comment": "Malware payload (AgentTesla)", "value": "b693c7f213193791fb66ba7277764bbb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693564366, "uuid": "1b653393-6be8-4281-962a-52f37048651c", "comment": "Malware payload (AgentTesla)", "value": "bd0b7ee993da6e96723b57cef78778f681b3682e00aa44c8916c91fbf7b9d058", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693564366, "uuid": "efcac3d5-e222-432b-ac8c-cb80896f0736", "comment": "Malware payload (AgentTesla)", "value": "9d5b678976ac5c6c4bad4065f4849cfd3791c36b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693564366, "uuid": "0fcff55c-9331-4407-9bce-bea4ac5f4857", "comment": "Malware payload (AgentTesla)", "value": "5bac0715ef6b7b7dd4b59334f7f2a4284c2c6c75f2c665149d1d9006a552728d7e12c4c9b70a22e2f884051033f0086c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693564366, "uuid": "66f5ce33-f4fb-4a5e-88d4-60709ef5843b", "value": "T1A8C412A69D186972CDED0BFA3818F7DD110105A8E853EE4F3D9678C76C31B4CA2D3A61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693564366, "uuid": "0aab8c01-6957-4289-9496-6b8f51b6774a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693564366, "uuid": "3945d55b-be9d-4fd7-93f9-c762e655be7b", "value": "12288:x3p7ySSnttM4OBJ+GxRwiZqOh2+hmFzYjJioz5n1+h:xZenttMl7Xeikuh3jTz5n1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693564366, "uuid": "55c1437d-9ba7-4024-981f-c1fd2e8cc27f", "value": 549376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693564366, "uuid": "d967dd17-d736-4b41-8448-0ff649583e65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693564366, "uuid": "a28cb097-6095-44da-b238-d79e9f709c26", "value": "SecuriteInfo.com.Win32.PWSX-gen.31866.32148", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85f82584-486e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (JanelaRAT)", "timestamp": 1693535002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693535002, "uuid": "2b91ba0b-d040-483c-acec-656db4fd5520", "comment": "Malware payload (JanelaRAT)", "value": "cec8473e2fa4225a94f3b4bc9ada1070", "object_relation": "md5", "Tag": [ { "name": "JanelaRAT", "colour": "#63718C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693535002, "uuid": "3d745dc8-abc5-450b-ac33-329dc26b8669", "comment": "Malware payload (JanelaRAT)", "value": "bd352cda38b22bc6d25ffe9e34609667cf0343c9e2a4875403bbf7bb20101a7f", "object_relation": "sha256", "Tag": [ { "name": "JanelaRAT", "colour": "#63718C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693535002, "uuid": "2a50005c-40af-420a-aaea-261b3e01b7a3", "comment": "Malware payload (JanelaRAT)", "value": "b43964c566c363fd525ac42b65680a7dc1d17e27", "object_relation": "sha1", "Tag": [ { "name": "JanelaRAT", "colour": "#63718C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693535002, "uuid": "06344a32-d831-4c65-9038-336f82217ce7", "comment": "Malware payload (JanelaRAT)", "value": "eb44789795a95f22ab0ada0605343e9da1b1236ba632b64e83b3f00e77b7e93c21f72269b0a7be298c2e947332554727", "object_relation": "sha3-384", "Tag": [ { "name": "JanelaRAT", "colour": "#63718C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693535002, "uuid": "fc4b9e9d-efc4-43f7-9c4d-e8da9eb10c0b", "value": "T1CE5533D9A4EDE4AD2D923739F42B61AD624F9BDEF133E61049BF0A1DA35D401E036630", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693535002, "uuid": "a9969c4b-1ea3-40fc-ad63-834c86955b55", "value": "24576:l47LZKZGHwkcc27LV/7VCmokGfMChQcoaBzlbbJBNUzjl/bPvU7xLYUDgmFjoyNV:mXZKcQc23VjVuf3lbbbWR/bP8GMBFjoQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693535002, "uuid": "388e42df-4c79-489f-bf5f-dc1981c14330", "value": 1335083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693535002, "uuid": "b6c48f66-4f5c-4c8c-a412-b302a34d2124", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693535002, "uuid": "a353291d-3d32-4dd0-9172-e09b90fba2a2", "value": "Reporte_Estado-Factura 1693534165.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2fb1134-48dd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693582832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693582832, "uuid": "557056c6-7284-4cbf-b2b1-0a70fac1a2f6", "comment": "Malware payload (RedLineStealer)", "value": "646b96c7dd3018b879a6d6150b2526bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693582832, "uuid": "39a41994-1fde-419f-ac7b-cfcd458b95b6", "comment": "Malware payload (RedLineStealer)", "value": "bdbd1d22f5ebe7fb28271cc873a94b321aa148681c3ec20f1455dea3e735400f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693582832, "uuid": "e01dad9a-f2ff-421e-b45c-f2afb5a2d2bf", "comment": "Malware payload (RedLineStealer)", "value": "195f5f005ed7805061590200de2672f0dfd71af5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693582832, "uuid": "27fa509a-6ebc-419c-b7c8-f2a841caa13a", "comment": "Malware payload (RedLineStealer)", "value": "16a0f0ae0cbd23f9e5550785fe988ad73975527d9e50726b595ec8bef37ec5a0b0d140a08c45e4e065d1ed218a6da60b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693582832, "uuid": "5d9e9847-d2d0-482f-a30e-bd1a7e7d925a", "value": "T16B051243A7DC487ADDB5277054FB03631A36BCA28D348BAB6744888E1D637C8693177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693582832, "uuid": "1b78498b-09dd-4a24-913f-76b50f1d5873", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693582832, "uuid": "072599b8-aa7c-404f-9bb0-d4fc64a2d1e4", "value": "12288:nMrny90xkGbQQlpeSn+SiasgtZ4HptBknt9OPK9C8Jg5wx+3OGvFjl8Fre8o3tt2:QymkBQlQS+S68tcK9C89p4FSFrOd7U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693582832, "uuid": "221a9b3f-6105-4be5-b7bc-9758ab92e6ee", "value": 848896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693582832, "uuid": "5ca6db24-c862-485b-9fa0-054103dcabdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693582832, "uuid": "26079352-43ea-4f38-b4cc-a7193bfa65d5", "value": "bdbd1d22f5ebe7fb28271cc873a94b321aa148681c3ec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1144e34-48ca-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693574642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574642, "uuid": "e75d3485-c991-4f9f-ae29-eeb87eeba735", "comment": "Malware payload (Mirai)", "value": "b7c4faed4e4fcdccaeed938ce74b8b0c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574642, "uuid": "e3f51afd-7a54-4558-8145-adf572345c78", "comment": "Malware payload (Mirai)", "value": "bddb8f26a9a0f80119fa9ccab3499d3dca107856d57f832b8efbee15f700708f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574642, "uuid": "3868d0f4-d71c-4ad3-b1a3-0cd06d3741d7", "comment": "Malware payload (Mirai)", "value": "c8ee55d4fdfeef561d1f101e5f546248b0cd99a4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574642, "uuid": "e2e88b61-2b05-439b-b049-c3a80913c4c5", "comment": "Malware payload (Mirai)", "value": "8a706a1d1c7b28608580ba0253047a675db230715ad45ac52e0df02d2b452d6396d2397e1a14531d20452b10db07e352", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693574642, "uuid": "53877b76-986d-469e-8048-d2a64760a1a0", "value": "T1AAD2D142D48B968EC5FE123104EDBAC91D04DA0CA764C0B79DB03977CC97E552B7C8AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693574642, "uuid": "078e3442-ae7f-4f5d-9bcb-96bbd2bc2b83", "value": "768:vh/f7b26ozNqAhsiL8ZcWTs9iM7ckSncI/9nbcuyD7UlUhT:vhX7i6ozNqAWfKbIMIkYnouy8C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693574642, "uuid": "ea712c8f-8de3-48c1-a69f-74d9a47ec242", "value": 29800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693574642, "uuid": "3bb51c68-5c7c-40d2-a333-833c06d69003", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693574642, "uuid": "dd344ee2-b003-4b38-9189-1532d42fe66d", "value": "b7c4faed4e4fcdccaeed938ce74b8b0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36f93112-4906-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693600153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693600153, "uuid": "1260d5e3-ee16-4cca-87fd-3a342986795b", "comment": "Malware payload", "value": "7fc12805bd6af1082f3689b424eb3f4c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693600153, "uuid": "99d754bf-5554-412c-b119-60548145510d", "comment": "Malware payload", "value": "bef28d599ab34506504a92f84c6bdeb2c0cadb3d8aae2ccfe2636c34f2052a2b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693600153, "uuid": "78007c2b-5c91-4b9c-8143-b990569d1d9d", "comment": "Malware payload", "value": "0c73883df2e3b131ff6952c2e6088df69e4876db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693600153, "uuid": "b326c51e-42b5-46f9-8c94-be5204e42ce7", "comment": "Malware payload", "value": "b3d04ab27a4b1d76ce13ab962acc668c4def7369f2ce6b3ae84d6cee578410cd1e33782cca9babe1026d62fa31ae2b52", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693600153, "uuid": "bd10dbf0-e7ea-4836-96e4-c683d12d9004", "value": "T1E68412443881D72BC16316750AB98B4A9FB1AC2A0DE05D473BE85F7A7A79252DD0E333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693600153, "uuid": "7484ceb2-6604-472e-9650-7d4125359c38", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693600153, "uuid": "c8048822-798d-465c-a073-c8518a1e61ba", "value": "6144:2Ya6yXMMW+gPDDpn3gkvaSJOcXIG88SJbu5wNrb0fPr17sIhExLExN1x:2YkrWzDDxQMvgbRJqCRg7ElExJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693600153, "uuid": "7abea0aa-dce2-4579-8a31-bd04a5b422d2", "value": 402397, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693600153, "uuid": "0a6ab999-946c-46fa-af14-774f91f69e89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693600153, "uuid": "4ad392ea-e2da-4ed4-bfe5-697adf01460a", "value": "7fc12805bd6af1082f3689b424eb3f4c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c28c0574-48af-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693563021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693563021, "uuid": "89f48d73-c7bb-4b28-9025-efa74541e0f0", "comment": "Malware payload (RedLineStealer)", "value": "10fc361eb11f556649fd0deb9815a235", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693563021, "uuid": "a8c18908-43e9-4242-91ae-c1c393c80d42", "comment": "Malware payload (RedLineStealer)", "value": "bf9ed5b65b551cdde0625d0f698f4e9c101e8b7ff989fbb633f5516cafe56be4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693563021, "uuid": "3e7ce476-54c7-4504-a4ce-d679ca57059e", "comment": "Malware payload (RedLineStealer)", "value": "5b4e5861665b22fbf64fdd639a8c7442e2678dfe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693563021, "uuid": "058bf174-ef5b-4487-9962-ff2d6f656e7e", "comment": "Malware payload (RedLineStealer)", "value": "37b77d15b09e833ae212b953e664bcaf6bee0046759d4a72e3bb29ae1446fe5efdd571312fd8f1e891f4026cc1e34880", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693563021, "uuid": "2ab607a1-5d3b-4383-b9a2-43c2c77267b7", "value": "T1EC352386BBE44473CCA517B048FA27931B31BE429C38932F5396AC1B6833298947577F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693563021, "uuid": "df36b840-d61a-4358-a808-d3dbef081f48", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693563021, "uuid": "fc6da98a-3caa-469b-982f-3698bf6ff737", "value": "24576:9ykh/1F2RN1bjigvp87ahWe0BrsfbZ9vMAGOxKn5nbgBrWzje:Ykh1F2RfbjHvhx0O/M3OknZgFWzj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693563021, "uuid": "d04ef18f-8cc5-450d-ac78-9566f0f9aa2a", "value": 1148416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693563021, "uuid": "722394de-c606-432f-b13d-80ea29d73444", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693563021, "uuid": "c4bcfe49-5c75-4a7a-84b4-2261a8f31b16", "value": "10fc361eb11f556649fd0deb9815a235.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "407287d6-4900-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1693597592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597592, "uuid": "9cb52c79-3050-41d7-a7a7-333e35146793", "comment": "Malware payload (SnakeKeylogger)", "value": "b73abed9b409c447ec26e0c516b20871", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597592, "uuid": "cfeabd8b-c416-4536-bd50-cf9d6ce8259a", "comment": "Malware payload (SnakeKeylogger)", "value": "bfd49aeac1dd1018e1cf01633f2567399f728efe9e39dd122702a5a12c43d5ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597592, "uuid": "e37ae079-6e16-4353-8a4b-8526330a9ca8", "comment": "Malware payload (SnakeKeylogger)", "value": "2117fbf2e70f032b896ee50c36be46d139b25c37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597592, "uuid": "813b3087-4ebc-47b0-aeda-e12dad08d79a", "comment": "Malware payload (SnakeKeylogger)", "value": "7775e767d3c199b016583342640515e70d9561d73af8d1f7a01fec8ea813d107892ee6e5e22a9c1084acf6c53df9d730", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693597592, "uuid": "5bc96c03-ad93-4f13-84f6-2e8680f4e669", "value": "T1CA620A217384E93ADC6106325877C7641738FE42590AEB2B74C47E5FEC3632768B66B4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693597592, "uuid": "58eaf264-d8e1-455c-9cf4-021597c92ab7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693597592, "uuid": "1cae2fb7-6870-445f-870b-ea9d1791d02c", "value": "192:vE+9mcgfXFc4ZffCF6Ate1ozTqpKGaOFwCwBeuF6:kfXlZioAteaKpuOFwNIy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693597592, "uuid": "765b60fd-d8c4-4281-87c2-40144d235aaa", "value": 15360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693597592, "uuid": "6cce17da-109b-4cd3-8c67-9d26e411a85d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693597592, "uuid": "3a3dbd30-7e0e-4bb4-bfb4-eb31c6cb2d5a", "value": "0376H00021-61714-2500,00-EUR pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd95baa9-4902-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693598715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598715, "uuid": "5d28b028-7475-4592-b254-fa74856062f4", "comment": "Malware payload", "value": "c3a3b49e430c6d6bcf2183985cbd5bcd", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598715, "uuid": "40118dba-07c1-4d16-9c0b-36053ee3be27", "comment": "Malware payload", "value": "c0b6994721e9926bdf56585ea130dea8b7a67cfb9e1a0d0ea2e4737e3990194e", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598715, "uuid": "177bb73f-7902-47c1-9fb6-efd71e68d7aa", "comment": "Malware payload", "value": "246e92dc10438b53f035ed012d90b8a54cb7f8c1", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598715, "uuid": "1ead8f65-9771-4c21-930c-633d9f571b27", "comment": "Malware payload", "value": "d03571850e06b7dacb8c5a5d19169e9c2565e8f1da563d9a32bb6fc23d375d4d9a95af473299664208efcf98b729018c", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598715, "uuid": "f8573343-0f8d-485d-b693-126869bd28cb", "value": "T16102D89AA8228DE6D8B65AA4863B5D4CD92CC0B61AD1F45C74A3DCCF0F3883618C1C5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598715, "uuid": "30111d58-b8f9-44d0-870b-e170c936df2e", "value": "96:xA/1A315OEorriaJ4WDoyQgiaguCDIYby5o6Zk6Mfsc7vSdsVdsVB:xA9AF8EoPvnD12GoDfscosVdsVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693598715, "uuid": "9e131aa1-68a0-4883-a66d-c04a6a995f72", "value": 8866, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693598715, "uuid": "dd70f6db-ab08-417d-9c1c-92cbf06ae015", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598715, "uuid": "6ca91598-426c-4b44-92ab-c4a17b2581b9", "value": "Reporte_Estado-Factura 64f147d52f3a8.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc774c3d-486b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693533912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693533912, "uuid": "b322e1df-c093-499f-aac6-4945629909e6", "comment": "Malware payload", "value": "5aa48baea787481e8ef110eef76930a7", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693533912, "uuid": "8602f781-bbc1-4ad5-ae1f-53b320ca0b03", "comment": "Malware payload", "value": "c2833508b73244a5c6be1d0f047037951edf3f50719bbdcc9e3fa593211061b7", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693533912, "uuid": "86f05550-ede6-4204-a0eb-21651608d2d0", "comment": "Malware payload", "value": "172058d7637b5b967246231ca07fca776dcac6d2", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693533912, "uuid": "5983d9f5-a282-4104-b047-5ba69484c303", "comment": "Malware payload", "value": "7bc0309b9c41cae8774f1dbaf400589cec1ba91007e4858e92a5b08deaa6c7ad65ea3b3dde3b029297d59f770537d0dd", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693533912, "uuid": "0cf5ce34-3c9b-4a4f-aff5-c554f6443686", "value": "T1F42733631C07ADDAC032A476057E13496875CA1E3EE277722054EEBBD4F38A5C9DDE88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693533912, "uuid": "92ac9f09-9858-47ed-b3f5-9779d23b4fe7", "value": "393216:j98eVsJA35z7A79L+w8X1mbgafiubcnZLbhT9i/zVN2I+TX7d+KpPbNiRSKcs+Jw:j9nWJA35z7c5almbBffcZLbi/zVN2Ike", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693533912, "uuid": "c15d66c8-e1cb-4d8f-80ae-b48f4666414a", "value": 21497583, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693533912, "uuid": "7315b5ff-de34-4196-871f-dbe83f884018", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693533912, "uuid": "9d0955ea-04da-4542-b21b-ab95ba90a5b7", "value": "prog.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c358d3f3-486c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693534246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693534246, "uuid": "324a66af-1908-477e-82bd-75c652c02fc0", "comment": "Malware payload (RedLineStealer)", "value": "91deae4211c478675cc3d5de23bba12a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693534246, "uuid": "1fcb5238-d829-4bd4-a947-b28e0731ecb2", "comment": "Malware payload (RedLineStealer)", "value": "c32942e638646854d0d3a9373b3e592be13459c8533dc6662c65f2f2555f50e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693534246, "uuid": "eb3c560f-92ba-4ab7-b875-b023b378b478", "comment": "Malware payload (RedLineStealer)", "value": "dba18ace0166a8a6b6edb2849fc8527149753710", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693534246, "uuid": "407391ee-4859-42ee-bf16-e01b7230c929", "comment": "Malware payload (RedLineStealer)", "value": "5e8af742f95bf346d3b1100cbe8337ed42fe6460eb46185e478f40ed792efde9ec45a3a5453147f2e26b7869d1c520e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693534246, "uuid": "cd27bf2e-2149-4744-bfa5-a5ffa4019e08", "value": "T176052247AFCA8172EC78273068FA07D303757CD72579C6661B5AE11A1C72A80E5B273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693534246, "uuid": "2f7bd3ed-5be3-4798-a201-81593a89021b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693534246, "uuid": "a0652d2e-4377-4e76-a3f6-1c9ee87a706b", "value": "12288:KMrOy90VympjymDi3R5uluUMmaAPawHADdwwE4NWTKbTa4ZM5DJgI00:syDI+mDi5ul7MZiAdBEPTIal9vZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693534246, "uuid": "e8d174f9-2655-417a-9de2-03ac3adfb033", "value": 848384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693534246, "uuid": "34e777a9-99d8-4973-9cd9-255f46ced069", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693534246, "uuid": "e16c6f41-4975-4a25-b6f3-740aa931e77e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "986648f9-4902-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693598599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598599, "uuid": "b96244d4-cde9-424f-b197-dd7215b9d0c3", "comment": "Malware payload (AgentTesla)", "value": "f2fa6fe38c2159e968d1d308ec584982", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598599, "uuid": "aa4a5cba-b9d1-4a9e-9d4a-971017ba5c0c", "comment": "Malware payload (AgentTesla)", "value": "c3d7784b55f0d1d5bc37f3d850039ccac92dfd94257ccd4b8fe04307ad46d617", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598599, "uuid": "3061f22b-432f-424a-83b7-033539f2f336", "comment": "Malware payload (AgentTesla)", "value": "da88f6a058d6f12b7a6e409e58a3d78557b6f48c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598599, "uuid": "c3637b8d-2bde-44cf-a055-95b611e9598f", "comment": "Malware payload (AgentTesla)", "value": "2844bd2df131ba5782c6b915e2f6e729cb03efe77a74d72cd5cb609919e14323b7cb52f354236351280c1f44a3201143", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598599, "uuid": "a67b4cba-fd03-43d9-a15d-30483cfd7cab", "value": "T14CC1B51163FC9233E6714B759CB38780A338A7599C17DF6F79C863071C263644A62B7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598599, "uuid": "9a632fdb-baa0-4825-a21d-1fb80fefa580", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598599, "uuid": "28bdbad6-ad61-427e-8bfa-a586040ccb7b", "value": "96:qeVo9yq4jcgfoq8E4SQ8gN141S7l8rUCzNt:qeO9acgfoq8E4Zfr41MGT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693598599, "uuid": "c794d780-9a03-476c-99eb-1881e7c86651", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693598599, "uuid": "305c57c3-6d97-4207-a2d7-6b8fbdc83869", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598599, "uuid": "5081231e-fff2-4d4d-a8e6-01c1b923aaff", "value": "\u00d6deme faturas\u0131.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82fa9690-48a3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (KnightCrypt)", "timestamp": 1693557760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693557760, "uuid": "b2bc283b-0efa-45c4-8120-6f39241fddb2", "comment": "Malware payload (KnightCrypt)", "value": "66e35561f12773e19afb08eff919588d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "KnightCrypt", "colour": "#81A14D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693557760, "uuid": "9fe81dab-f3a0-4939-97c7-32832927d46d", "comment": "Malware payload (KnightCrypt)", "value": "c42ad519510936f14ab46fbad53606db8132ea52a11e3fc8d111fbccc7d9ab5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "KnightCrypt", "colour": "#81A14D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693557760, "uuid": "edd8b104-ce53-458d-8d84-67039c214d2b", "comment": "Malware payload (KnightCrypt)", "value": "66a943dea2cd1c3f440cbebf63f5dad3f04a4aa4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "KnightCrypt", "colour": "#81A14D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693557760, "uuid": "9e593acf-a75c-4b24-9694-833a7d3be042", "comment": "Malware payload (KnightCrypt)", "value": "8f5074ff7bedaf2288117fac7713064967c6c3e9fec475cfc7525b8629aae96ad92f09a31620f1debce2eb0cf8452e05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "KnightCrypt", "colour": "#81A14D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693557760, "uuid": "cbdeff97-5032-4813-9f5f-da233c620598", "value": "T10A757C4BB7A441F8D0A7C27989528647E7B274150F34ABDF56E047AA2F23BE14E3E311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693557760, "uuid": "6d09fa13-ef0a-4efd-a055-957e2eb044fd", "value": "be843536fdc17a2b5e02f8f44a2ad7ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693557760, "uuid": "bec6cf5e-7d34-4386-b168-5e2744ded345", "value": "24576:wucUS55cDR3NgJ4zJ1H+QI84rncvGt3nE6vlTluxBkTde/cfkr:wucUS55cHgJIzez8+n9Bn3NTgBkYokr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693557760, "uuid": "246aaa32-6e02-48ef-b4d9-1d4c0a458a9a", "value": 1636552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693557760, "uuid": "664b077b-f3c2-424a-80b2-b2fff5c1c904", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693557760, "uuid": "47f122b7-e685-41b3-af93-8258cdfa236f", "value": "xwenxub285p83ecrzvft.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e24c4f7-490f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693604111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693604111, "uuid": "486c1fac-1d34-4d0b-9202-6c266e5de6b5", "comment": "Malware payload", "value": "fdb1670b89546b3cfa975db098107544", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693604111, "uuid": "6f433634-44a4-4f64-844d-740eaea67f79", "comment": "Malware payload", "value": "c4594c091d25b24860cdee132fce80d16258d7adcbed515f12a62722756f765c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693604111, "uuid": "eaf708f6-44c4-4293-9bb1-9cc9611a907d", "comment": "Malware payload", "value": "bb97d246153a9a9543e4cc4e76fd8cb6c61a96cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693604111, "uuid": "0f85a10f-1c2e-4b1e-a0ad-1e95d30d8fa4", "comment": "Malware payload", "value": "fe5216e07a9679c984b0bc57af47ce081ed613f75c6799c7dc0efc1fa25881b9291adb2cf826c3bed86b57a18007f37f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693604111, "uuid": "f197e14d-7669-4f2d-90f4-0297d9cd899c", "value": "T143C43903D2E17D58EA258B729F1FCAFC770DF5A08E497BA922189E2F04B1176C263715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693604111, "uuid": "11a69626-9a94-42bb-a5c6-58374bb2b6b8", "value": "05ee59df2bbc43c078e8ef99811a7d49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693604111, "uuid": "1387fe4d-cadb-4926-82be-649e4abb6f59", "value": "12288:nIs/hm+Hi9NOZxSENHur/zpTkC9xp0gLUeL/:nB/U+HijOzHqTb9EgLHL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693604111, "uuid": "7944be5b-8153-4bab-923a-31c47b03b697", "value": 554496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693604111, "uuid": "bf3bcd21-baea-4c49-8e7e-06dec47f50ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693604111, "uuid": "a378aeff-7cfe-4ca6-b7aa-14cc5a586f5c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83929718-48a0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693556473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693556473, "uuid": "471c907b-eb17-45ad-a6c1-3dfad7bad9a7", "comment": "Malware payload (AgentTesla)", "value": "53a1a2fd7f39b13a4a21a69ebe02d10c", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693556473, "uuid": "3eb68013-d9aa-4fa6-a9fc-e3edcd6a8906", "comment": "Malware payload (AgentTesla)", "value": "c46c8953e8339a5ffd20bea44024f7e18248abaed5d7d513e54b1869b8ff7e39", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693556473, "uuid": "c0f28b47-bf60-495e-8cca-f2acab0d8f4f", "comment": "Malware payload (AgentTesla)", "value": "2411624cf35c9e14ebd1fd083e61f7c6d5bbe7d6", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693556473, "uuid": "971d5cd2-0cd4-4b88-9264-c87253778f0e", "comment": "Malware payload (AgentTesla)", "value": "da5b91275146b2457da143592dd47440b7a36a3885d0237430a23fdfa8f55ab26f93424a5a53fedc59005583261875df", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693556473, "uuid": "0d62d670-ffe5-4cf5-9a5e-cbc78d81b530", "value": "T1DFD4235939D5DB55F4E60EDA1C86B1CA093FD287A6D1AF20234160CD3D89ECF28C4EAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693556473, "uuid": "1deac83e-d901-4abc-a4c3-c94e27dd7e5e", "value": "12288:e2uMDH03q0xdlXsrkIbD7VClCpEwhjl79iLizWicUe20gP6cUzmGFHAMq:e5MkFxdlXsrkkD4oEwhjh9ZWiLt0CbU6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693556473, "uuid": "05e360bc-823b-445f-88c5-dc62e627d15c", "value": 652821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693556473, "uuid": "b8baa4d9-6f11-47e7-b1a3-930e940c0675", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693556473, "uuid": "be1d6bb4-1f14-4464-82ff-1664c38cc075", "value": "62867252.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1386e5a8-48c6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693572606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693572606, "uuid": "20473c38-6785-4333-9ea2-9a88a806de49", "comment": "Malware payload (Mirai)", "value": "0dee71c60365e85150540394b3af330e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693572606, "uuid": "7b270922-1edd-4383-985c-5ba90f7b6edf", "comment": "Malware payload (Mirai)", "value": "c4cb626f80baa288773610fdcd03c935c52de314490ca5a3d8787ed5c5e83047", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693572606, "uuid": "b0d88309-89aa-492f-82b3-fa87bff0652c", "comment": "Malware payload (Mirai)", "value": "fce133fc5d2a32b27b59b395c0ddc9012df60fe9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693572606, "uuid": "120ea9e0-6d6e-48f2-8c8e-cae6991ea62b", "comment": "Malware payload (Mirai)", "value": "215800a021e5d064b7bf57756a066866dcae36d53bbded13d8ef3da2328e62c27dc34d23ee22695aef4f62a3896d4d38", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693572606, "uuid": "f5966c40-074c-44be-aec9-b9487828a0e5", "value": "T12B5338C4E2D3E8FADC10087D316AAF629E73F13AB135D99BD3D959639901A02E10625D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693572606, "uuid": "adc560b5-d2f4-4828-a906-0c7477ba5b34", "value": "1536:0UEMAWwPQk161TTWKRmyaSkDu4eFOVdr:0UEMAWwr161TTWKRmyaSmu4aOdr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693572606, "uuid": "f34ee753-2ce8-402a-a926-66cd99411d84", "value": 62224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693572606, "uuid": "ead47e4b-7129-4176-92df-95f08bc186b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693572606, "uuid": "319ee5e3-3584-459d-a404-cd2e37afdde9", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dd88665-4900-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1693597588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597588, "uuid": "af60381e-3a35-4afb-b6e2-599a43353293", "comment": "Malware payload (SnakeKeylogger)", "value": "296fc5b6ed5bdc1c37db6364dec12736", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597588, "uuid": "63e8f845-669e-4bc9-9497-fbf8f81d16c8", "comment": "Malware payload (SnakeKeylogger)", "value": "c6562037d0c1bec2df17d10632540f5d0b859559048493913b80291f60161d9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597588, "uuid": "02c7e535-5608-46be-935d-ddbbd65bd116", "comment": "Malware payload (SnakeKeylogger)", "value": "2806603e9ceb5add72d4150108ecb973b962bfc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693597588, "uuid": "ed7d642f-861c-4904-9c7d-55623fb8d222", "comment": "Malware payload (SnakeKeylogger)", "value": "44fef8b566f85b4fd17b6f90535743eb798070a92473ecb3d170b1485ae56aa65fc22297a5342c9194cc38e5f102981a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693597588, "uuid": "9ac2b011-bdc8-4f06-9075-475edb9a8173", "value": "T18883E647BA4B89F2C284D776CB8F550403A5EA82F793D70A798E135A1843FFACD4164B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693597588, "uuid": "3a60f958-5a0d-434a-96ef-f5dedde4e0c2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693597588, "uuid": "68ad0e75-b951-4a0d-b881-e95787d2e9d8", "value": "1536:L29a7bE2a3rqUtuUuZi8y3LnHYvoy8PFEd8/uJlncHIo/xZ7:Lim9mXLuZi8qRdEd8GJlnUIov7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693597588, "uuid": "8cfc41b4-31f3-4180-bf32-e14d95d547f0", "value": 82432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693597588, "uuid": "b17117cc-fc97-43fb-afb6-d62c45c886c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693597588, "uuid": "bc293467-f33c-4141-8d73-607216e78549", "value": "853F1D97-5DBB-4A87-A566-33D9012B05E2 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c25d2f8-4903-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693598900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598900, "uuid": "fb53b2df-47b6-4f10-8ef1-4529e0a6e271", "comment": "Malware payload (AgentTesla)", "value": "d659e6e8589b5a7f91fa7b0f7c291b61", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598900, "uuid": "06668d81-9e11-4b0a-aac2-5de6a634dc83", "comment": "Malware payload (AgentTesla)", "value": "c8498a4cc14c406e6c74881a35a2452394585bd24abda5bdbe13fff811969362", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598900, "uuid": "f07811a7-9250-4be6-839b-ba3853e03e3e", "comment": "Malware payload (AgentTesla)", "value": "eb1a02c435b6450f64595a1737c6558c6ad0affc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598900, "uuid": "e350c9d0-7ed5-49fd-9d7b-0c370fd7eb93", "comment": "Malware payload (AgentTesla)", "value": "00e5372c53936cdacbe3f310e1fc1ba1ff197ab295a1aabc37de540e18f60192f8cca4782f0005de83d7803d4b09493c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598900, "uuid": "e7e58923-90b4-49f2-abe4-8763d66188e6", "value": "T16435BFB876047DE6267F576BDE96ADDD03B626239ACBA4CC806477C305A3335FE02805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598900, "uuid": "eebd314f-fdb5-4ce5-8ecf-c6bbafa3db67", "value": "24576:oC6mgE9eexaQ99OlcxGwaTIyO3u59cpVI47IQ5tjshV1pVCQS7LTyK76LcN:F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693598900, "uuid": "1d46512d-8552-4fb9-8169-8986984c865a", "value": 1070159, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693598900, "uuid": "8bee823c-dc7f-4214-a6d9-a2604eeae707", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598900, "uuid": "6ab6d08a-0bb8-411f-9d32-2a20afe34f90", "value": "invoice copy.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12086437-48f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1693592360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693592360, "uuid": "8bcb489f-412d-4a95-9177-211226b2ad72", "comment": "Malware payload (njrat)", "value": "4ab14da1b79e8976db74791160b1dd76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693592360, "uuid": "f61a6aba-f36d-4a26-9685-44e04c020d08", "comment": "Malware payload (njrat)", "value": "c88d284ef2d9cce8072988329905947de8dd6d99e5116652b857a55286606754", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693592360, "uuid": "fb18314c-e9d2-48d8-a2eb-3bbe4a073f93", "comment": "Malware payload (njrat)", "value": "6b5a9ade3809769c9e2e946f2f14e1d30297afca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693592360, "uuid": "e0954000-42a0-4d39-b549-005c3c1abf08", "comment": "Malware payload (njrat)", "value": "b70fbabaa6b2a9d6e4a2c9db4158dcfe035792a718709ac7b23afaa04affb987c29142d550d3e669fd7cee550af68639", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693592360, "uuid": "d7703a27-888c-452a-8e06-39c36f33cf17", "value": "T1D6E2F74677A58229C6BC5AFC8CB313110772E3438432EB6F5CDC98CA5B67AD04245EEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693592360, "uuid": "0572f43c-ac38-4785-b6c7-a54e39ff0b5b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693592360, "uuid": "fa8e94a8-ae14-48fb-88ed-52bef585bdd4", "value": "384:Q0bUe5XB4e0XuOhWiaXLilpknDIWTMtTUFQqz95ObbO:VT9ButDaXWlxvbO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693592360, "uuid": "38e51d5a-f6b3-4b1f-a37e-bd2704d4e01c", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693592360, "uuid": "0bbf9f7f-b894-44d6-b4fb-4a245fd88292", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693592360, "uuid": "15222e61-67eb-4c3f-aea9-391c1446aa47", "value": "xlHNLak23LLt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca71c15e-4907-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693600830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693600830, "uuid": "e33f8021-e808-4da1-920d-a35baaf33180", "comment": "Malware payload (Amadey)", "value": "00e70a8273284e240f43b1ccd68db425", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693600830, "uuid": "3cf3dd38-59d1-44b0-a60f-cd3d7106269f", "comment": "Malware payload (Amadey)", "value": "cb98f5aeec9579d48bb8fbf7a8a7ec1ff7eb80ea2059b5d7d96c3f5a0c4b81c1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693600830, "uuid": "fcf4b27a-9b21-44f1-8725-303cd08032ad", "comment": "Malware payload (Amadey)", "value": "9eea5eec53c49d3aec9b6bbd9e0d6bfed6ce266f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693600830, "uuid": "ead20490-cb2d-4746-99a4-47a226710c6c", "comment": "Malware payload (Amadey)", "value": "56d2b5059505fc6cf49f493a73ad86ca4ef685f3c7c978febfc7f5afa1800ecb64f6dd175f11328a591362050c8153ac", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693600830, "uuid": "37ac39d2-06a9-45a0-8bc0-37b4352e8b64", "value": "T147352307F3DCD432E871277098F902871B3B7DD08A78536B2309EA5D5AB2691E4357AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693600830, "uuid": "fb09f628-5cdc-4a4b-8207-58771f4fb2ce", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693600830, "uuid": "8d1ba7bf-ae2b-499f-be14-89ac077ad3f4", "value": "24576:XyL1nMNidQjuVsLYqN9eVLpCDSu34KguMTPpuBUNHVX:iL1n2ivVQQCWuZX4R48HV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693600830, "uuid": "1d040242-518d-4ad7-878a-b1877216a4d4", "value": 1149952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693600830, "uuid": "cf07936d-6138-48da-8822-74b27318fef5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693600830, "uuid": "2c7e00df-73db-4630-b952-908d245311e8", "value": "cb98f5aeec9579d48bb8fbf7a8a7ec1ff7eb80ea2059b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79648512-48cb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tofsee)", "timestamp": 1693574924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574924, "uuid": "fa687324-24e6-46f8-bff0-2bfe07766b2b", "comment": "Malware payload (Tofsee)", "value": "9e1c8f396a3d81e6626cd61012280679", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574924, "uuid": "87d9d6f8-3189-4b19-8bf2-d1efcb483b26", "comment": "Malware payload (Tofsee)", "value": "cd361fa5836d2a093f1e0c4060350c4d21a0ccdf083f47ef6cea1502e3d20363", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574924, "uuid": "57de357b-2615-4a7e-a292-be57393761a1", "comment": "Malware payload (Tofsee)", "value": "68bc52b2ee42166e54592274461a39f53979bf65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574924, "uuid": "a0ac5db2-fe75-473b-a491-cc1ce941d4b2", "comment": "Malware payload (Tofsee)", "value": "b4fed3e1c8e29c388f822c5bc8193dcc74edc43e9507a77679fc520ef33af07096db0975f85b604e71c60f1c3e6d93a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693574924, "uuid": "0548aabd-be12-4bff-b521-d3b3a66a2057", "value": "T15684B54392E13D7CEA258B729F1FD6F8770DF5608E097BA922189E2B04B1176C2E3715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693574924, "uuid": "52f5da3b-1c36-4cb9-9e78-9f9d08423afa", "value": "eb568a174db8395072c750a957035097", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693574924, "uuid": "b89742ec-5134-4c68-9050-9a1101a455e1", "value": "3072:qpYUQVFChEGJS91yjEbG9/EkNLKlNbOKviUKE43VXdbKCA4S4rmOKNKLPcOJdxH9:0YbqhnJSPyfBVaW3FXQBTgLUebH/i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693574924, "uuid": "e6113704-218d-447b-b80e-d00aef540ecd", "value": 395776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693574924, "uuid": "d2922499-93b2-4f8d-b6fd-c19488949995", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693574924, "uuid": "f1c93663-5d77-4453-acdf-ac34c9361a06", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "239ad771-487b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693540421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693540421, "uuid": "99693e59-dbe6-4204-a349-dda7636876bb", "comment": "Malware payload", "value": "f38b7140ba1503754d0a7b329ef6a316", "object_relation": "md5", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693540421, "uuid": "d851eff2-1347-4338-a81b-6ada6a60f73a", "comment": "Malware payload", "value": "ce544f3a9258ef55ec9808737016e614d088363898ffbd3b33b5554ba185357c", "object_relation": "sha256", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693540421, "uuid": "8b5d1a1a-a0f8-4f29-b457-890d1ec1b89f", "comment": "Malware payload", "value": "3dd94ab6a0bedbfd71bc7dfb172c3317059f00d6", "object_relation": "sha1", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693540421, "uuid": "a70fbdfb-2282-40bf-92c8-904ce5b982c7", "comment": "Malware payload", "value": "72c09f546e1b85835ec016a3964e885d1de4b4cae2e976adc94a29c5f667a20aaeb175e9e7fc5e69adaba974a582b9a4", "object_relation": "sha3-384", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693540421, "uuid": "0dce1672-fec0-49d1-8061-6fc42f01b0bb", "value": "T11136230175C68636C0AD4670595AFFAE34B57E28477240DB23C86BDF28F36D076B2A87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693540421, "uuid": "2911aedb-ae88-46d6-a038-9308a33af8ba", "value": "98304:LYrpoMOfIOf/C7YZZ7n91vL4wwjjUgD5ccaWz/xtY9q4Ft0tMEA:+yMOw8ykTj8DuclbD54v0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693540421, "uuid": "11af0c04-7111-4523-af9d-0e90d0d38aef", "value": 4931072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693540421, "uuid": "d3aee75d-9914-4f1f-8a46-5c29178cf6fa", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693540421, "uuid": "400ba06b-a083-452d-9be8-0843ba6df052", "value": "factmarzosiinopagadasii.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a11a9d10-485c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693527317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693527317, "uuid": "b1f69dd4-d1c4-4817-a5cc-2778abd09699", "comment": "Malware payload (RedLineStealer)", "value": "7be8293e2066924a8db462781bc0aecc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693527317, "uuid": "b6b44c63-2c2c-4736-b521-c002336dc9bc", "comment": "Malware payload (RedLineStealer)", "value": "d054ccbf5652bac06dfb662b5a85ddd602bc0d59a2226253f2f5aa46dff9757f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693527317, "uuid": "6361eaff-b8f5-42f0-8e9b-92d63b3e4168", "comment": "Malware payload (RedLineStealer)", "value": "7679ef839afc27546ab5405735234565a1e5f6c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693527317, "uuid": "08fc1a1e-61b0-4e63-8f8c-b4235bb5d380", "comment": "Malware payload (RedLineStealer)", "value": "454c98b8f0003514665d558f983963560ecd2d89a4049d0f3afb8d8b817f859b1c0ee0f70e66b02a23db68985e9487cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693527317, "uuid": "47f55cbb-d0f6-437d-b901-b8f5d66717ad", "value": "T1FC840222BBD2D072D4525A3061B485E16F76FC305F75524B5B9C1E3E2EF0BC12A693E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693527317, "uuid": "a9596b72-8b68-4ec5-9785-d63dd497f16f", "value": "60202b26a1548f32d077efa3514a2fd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693527317, "uuid": "d3b7c1f3-9073-41d0-ba3d-166afe9ab6ff", "value": "6144:35rRDLsG6fvGgosSRRHu2suLkQax88t2VhVD/4NOjL8N6U25O:plfsG6mgosS/u2suI822rVQNOjLr7g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693527317, "uuid": "8778b354-ecbe-4b90-ae55-97282125674b", "value": 378368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693527317, "uuid": "2d60c279-bb79-4b77-98bd-7a3047b9a701", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693527317, "uuid": "04d938e6-9488-440e-96ea-c852c5eac6c1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64ef6358-48fd-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693596365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693596365, "uuid": "8fe427cc-b611-45c2-b902-1eb7f5c58ff4", "comment": "Malware payload", "value": "17a5fdaefa1d0df5a111d41c1e823610", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693596365, "uuid": "b1fff256-750a-4f61-a4bd-821c25d29d18", "comment": "Malware payload", "value": "d11ac1d42c198de4a5be1c8b3f15d9fdc166dbf6e821a540760f768a391be5de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693596365, "uuid": "38121e02-33c7-4808-baaf-09dd539f55d8", "comment": "Malware payload", "value": "f7c29d536799f16e83c3a4792a1d735fc8f194af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693596365, "uuid": "2a4d760b-1767-4b79-b1f5-bd7a40f6ddc3", "comment": "Malware payload", "value": "8014feddde438c6621c26c098bba532e54bf8a647be18ebb7c7ed12c1d42034c5dc5b38bb8c15e4bcd775c3055c23578", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693596365, "uuid": "831a242a-f236-45c6-8697-dde5d8c059e7", "value": "T1DE852222B6C58871F5A75D7655E593243B7ABC312B310FEB8B183E2E9F341C09935B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693596365, "uuid": "9cfd5a83-4c77-476b-8563-b795c963a474", "value": "fa8d20faea9ef7b4e2b7fbfe93442593", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693596365, "uuid": "ca4027ed-3cc2-46f2-b4c5-8702ec7fd3a2", "value": "24576:acbD/31EB0QpUs+0jjAxvJspsd6ZNhY6A5al3bGhumKmSOWHT+eyBo3Dy85fLMex:acbz60uLqJ2sdypv3bGzMHpLzyMjAWkK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693596365, "uuid": "83f652e2-c74a-4bb1-bb08-e82e5857d77f", "value": 1820464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693596365, "uuid": "cdd16e43-8abf-406b-acf7-603c5121db58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693596365, "uuid": "6c9500c4-85f7-4dc9-8cf2-ef80401784b4", "value": "17a5fdaefa1d0df5a111d41c1e823610.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c95e25e4-48a3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1693557879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693557879, "uuid": "a1388a22-9259-4cca-b09e-0d7cf658bf03", "comment": "Malware payload (RemcosRAT)", "value": "e0e59db623cddccb1e6422e850dd0221", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693557879, "uuid": "e5c6f126-3bec-41ad-8626-9135a04c1aba", "comment": "Malware payload (RemcosRAT)", "value": "d187cd925739faaf36ec184a13d707b638fa50f8ce4d76869fdb5b715eca5192", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693557879, "uuid": "5f3d731f-4c29-4a3c-b625-c3a347dee0af", "comment": "Malware payload (RemcosRAT)", "value": "812ef6fc7fc47ed9a50641811634484e3ef85048", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693557879, "uuid": "3770396d-94ba-4c8f-ac72-4257ffbec458", "comment": "Malware payload (RemcosRAT)", "value": "f8adbffe880b03b2df269c8325e115a35f120f805f541fc737d7e6ce3223f2d7f88d0d1c1afb02105a99da7bff54a9bb", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693557879, "uuid": "09202c38-25e7-44a1-9173-246501094a32", "value": "T15F63B71197E40236E96107729CB3B7C1923BF64458F6EBAF38CC610B2F577A40A51B75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693557879, "uuid": "6864f07b-663e-42cd-9e7b-fcd535d08ffa", "value": "96:5s38HpGs9ycajcgfud1KPU4SQ8gN8KpDHEAx6zNt:G38HpGs9wcgfy1J4ZfvpD18", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693557879, "uuid": "9d7f8815-cab4-4906-a933-0538f2aeb32b", "value": 67584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693557879, "uuid": "215a513f-1e3d-4d5e-a563-cc245e2f5a39", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693557879, "uuid": "06efa7d0-d9f0-4583-b34d-1a3db114f0eb", "value": "Potwierdzenie.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbd8b2b3-489c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1693554903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693554903, "uuid": "eb0db3fc-9db4-4102-932c-f0ea6dd6249b", "comment": "Malware payload (Gafgyt)", "value": "da2819e878f43f2335ed9888757a3b6b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693554903, "uuid": "f4f0236f-ceb6-4749-b828-c18ee00978a6", "comment": "Malware payload (Gafgyt)", "value": "d2fa4189c49bd58d5f17f59264d168f5a1020f664db4b534c899f4bff51eab53", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693554903, "uuid": "245a028b-0840-4615-9e11-304e912b5f39", "comment": "Malware payload (Gafgyt)", "value": "4064ebffc9ce6419cf1afd253158556f03f67767", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693554903, "uuid": "48ad9251-3a64-4909-97b7-41b2819f67b3", "comment": "Malware payload (Gafgyt)", "value": "f64bcfa838d627563eab66cd9635104786a41438c5449ea83564f1199d4f72cce4416b5a26f60cda53fd9040896213d7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693554903, "uuid": "f828031a-fcd4-4971-82a6-afe7ce6e4c4c", "value": "T114148425891AD217C4D2EEFDFFC5BACE6219F6838BC6A3027590516D0FE1E95242FC84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693554903, "uuid": "c96e42d3-06ba-424c-8423-0f5c6b182454", "value": "3072:loQTIQXaukntc2zanxUTpcCtw/JsWUHXmlD4ZK+Jab:qvQ9k3zaxUT/w/uW8XmlD4ZzJab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693554903, "uuid": "317eeff7-a6b3-4549-84aa-ab443b44d27d", "value": 208529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693554903, "uuid": "243151a7-4461-4640-9189-35adc481dfbb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693554903, "uuid": "b5ed77eb-6f5c-48ab-88f2-642ff378ed65", "value": "da2819e878f43f2335ed9888757a3b6b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46a44ed7-490a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693601897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693601897, "uuid": "db10ec46-da18-477a-ad85-8c1a0c919267", "comment": "Malware payload", "value": "63cdb37e2bf2928a36eafe3705d30284", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693601897, "uuid": "a1c4a824-9135-4548-b4d7-616277517b64", "comment": "Malware payload", "value": "d4f6598a76b92b919bccac6394429a94e7e28da1a86d53e3cd5b204e9c9dc8a8", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693601897, "uuid": "f899a81e-1e24-4929-980c-4a4b84d1019b", "comment": "Malware payload", "value": "235f23fafaa45b5b41fc95e567f098e179c43e0c", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693601897, "uuid": "cc736c82-280e-4393-8bd9-c44b101fe926", "comment": "Malware payload", "value": "0824fd2c3b783a5f20da07d7985a0fb3c5890a496b2565aac839a7bd8118149abdeea2dd0084a2563d6c262baeab16f5", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693601897, "uuid": "e49fabf0-d1da-468e-83af-7ce7e97155df", "value": "T13655A9342979BC2847E7EE6335F04A150DE505AFE630393B198ED6678A362C125B12FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693601897, "uuid": "196c2808-4c28-4a33-bbdc-13fbcb9fd329", "value": "3072:TO1dnIpk90I3oQ504RqikgNkZdPR5YvP0fwlakvzIo9:TO1dnI+28j0zcOjE0fwlhvzZ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693601897, "uuid": "eb3f4870-37b2-46a6-8bd0-fc86df447c31", "value": 1370040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693601897, "uuid": "5dce1ce5-38b4-4582-b96b-22d01fa4a580", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693601897, "uuid": "90618929-77ca-4826-a188-75d293264c03", "value": "lolcaljefosijfoesnofiegoiesgnos.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17f9489a-48c6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693572613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693572613, "uuid": "2f929070-c0fe-432e-9f03-ef2393f2e7bb", "comment": "Malware payload (Mirai)", "value": "57e30c6abdc6d5d52eff81a285082b94", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693572613, "uuid": "5f76e88c-b3ed-41a3-8c44-766137004f69", "comment": "Malware payload (Mirai)", "value": "d685bd43bcbaffd3af4fc8aaaeda455056804b765c89c6fa1605baca47f24113", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693572613, "uuid": "07f7bfdf-a1b0-449d-98d3-f648b06cdc87", "comment": "Malware payload (Mirai)", "value": "b87c91e98e56d43bac8a8821ee0f5cb3e11a3433", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693572613, "uuid": "976788c9-a518-4c22-9669-113280f9f07c", "comment": "Malware payload (Mirai)", "value": "4b6a5f7051b2403e6978a315953c875c4d4612d7fb4abcf2f4cb51153d2ca7a19393aee6fa3b7679e1a89f29acc644e0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693572613, "uuid": "9facef66-f257-46d4-8d87-7bd96ff90f0e", "value": "T1A3E34B85EA408A13C0D61776FAAF41493322DB55E3DB73079D189FF43FC6A9E0E26606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693572613, "uuid": "6715c2e2-32a1-4340-80bc-4b70e9520cd7", "value": "3072:sqlhEFZBB9qPoLmpMguHcUlVUHalw7WguH0vsfC0XxmjX5Xa/NOL9eXgIncdVT2J:sqlhEFZBTqPoLmpMguHcUlVUHalw7WgC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693572613, "uuid": "0ac8a604-3fcc-4d35-af24-66c0a8380bb3", "value": 143882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693572613, "uuid": "32992330-cf60-4dba-b126-e29dba9c2871", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693572613, "uuid": "b8f183c9-b528-492a-adff-79e877be52ec", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1fda899-4866-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693531640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693531640, "uuid": "d029de86-422b-4b85-9896-96510e3b00a4", "comment": "Malware payload (Mirai)", "value": "e652ccc2f6777f4d365f7f94e94a1b37", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693531640, "uuid": "819855fc-aa7a-4496-ab63-6496dac345ad", "comment": "Malware payload (Mirai)", "value": "da2953b64a5406705827a80c89f1ce1810fa275e9f44d9c72e509b8821a0a76b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693531640, "uuid": "a3748ad8-d8f6-41bf-b105-0bcbb8c0cf92", "comment": "Malware payload (Mirai)", "value": "2243c016be0fd1519e17ee7bb275c1532df3c392", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693531640, "uuid": "957ba5d3-060f-4e93-a7e7-69625e32853a", "comment": "Malware payload (Mirai)", "value": "8b32c77cc69a8c2650624052011b715ed0c2629eed03af0cb80862f4b94e3da968ee87022d8cdcbd0f1eb83eed83793d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693531640, "uuid": "14c864ae-f4bb-4072-9521-b2ca977a6f2a", "value": "T16BB2D02602C9AE97CD148570FBF9C208335206B5E1BFA05A3B814F79D7913DAA3355AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693531640, "uuid": "6682c74c-da40-48bf-90f4-1246b2d9a38b", "value": "384:t9dWyZ1lp0E/Z6uy1AEZZBTCU9HT5SExCDtEFL88lKOsl0dKboJ8hymdGUop5ht5:t9dWCp0E/oZ1zZBT31TYsCcL8zXCK8as", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693531640, "uuid": "2558f73a-fa6c-465f-8b5b-2ff93c1992d6", "value": 24516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693531640, "uuid": "8d36ad90-7404-4adc-88d2-ad9143a8310f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693531640, "uuid": "32d26957-dee1-45d6-9e80-5f49e44a3581", "value": "e652ccc2f6777f4d365f7f94e94a1b37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc3db4fc-48d8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1693580727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693580727, "uuid": "22558939-2e26-4f5d-86e5-bb2e6d3f5dae", "comment": "Malware payload (DCRat)", "value": "bce073e802ebcb8a0db1e1cdcaf4edfd", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693580727, "uuid": "1b28d645-37ba-4ecf-b824-3dd457e0de80", "comment": "Malware payload (DCRat)", "value": "da3a85da56707d388a682f5455418bfd57bc8e3a8e6734fcf98d08326d76b5c0", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693580727, "uuid": "4d078906-c3ed-4e9f-83a9-b40369f2bc81", "comment": "Malware payload (DCRat)", "value": "e3bf14eea5f0ab61b6c99c23a71c0dca0ca9df1c", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693580727, "uuid": "78379dfe-3440-479a-97f2-5d13b773f4fe", "comment": "Malware payload (DCRat)", "value": "fee2370a138d84ce2ae4b139e90162af2a24cd633bde0e3be9adc5e5a4d22b1034207e70949c3e6c3961d5046474c785", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693580727, "uuid": "a46846b6-83e4-459c-88c8-fc7675b9ebad", "value": "T10B352302A9DA1433C9B5277948FB03C30A7F7D774A3D994F2365AE1A28B395460B1377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693580727, "uuid": "50b01135-4483-411d-963a-727f76fb2bce", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693580727, "uuid": "a56a1988-7215-4bd9-ac7c-928459e814b2", "value": "24576:MynD3NOFVbh1yQJZHaPYmSIwsfU6kjlVX+/aYJ:7nGn1yQTHaPO6HMH0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693580727, "uuid": "6c30c265-676f-40a2-ae25-2a46fcec6158", "value": 1148928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693580727, "uuid": "6dfd75cd-fe22-4681-988f-2be830a88002", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693580727, "uuid": "868bb6d8-71f1-453c-b6d8-f687945743f6", "value": "da3a85da56707d388a682f5455418bfd57bc8e3a8e673.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a3b023d-48f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1693593797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693593797, "uuid": "e21cd50b-91ca-4db4-937d-b00ab5c90c13", "comment": "Malware payload (Smoke Loader)", "value": "5c152786b02df0d925456bb71a1953c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693593797, "uuid": "5b14f83a-cda9-4261-9a92-7ecde43001cd", "comment": "Malware payload (Smoke Loader)", "value": "dcca1131914f6c8a480e8e0ad87eabb4b85383f804815496cb4f2c2e1a111f39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693593797, "uuid": "0fb3e11c-6b68-4d2e-b9f5-c9b7a8905cef", "comment": "Malware payload (Smoke Loader)", "value": "568baecb920e8b460a0fa568de1bcc652b3e6b1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693593797, "uuid": "bac85f8f-54d2-405d-8176-fb45e62a59d7", "comment": "Malware payload (Smoke Loader)", "value": "d4a8e69a8fec63d5ff4b0e91b651b20323676a9c2c8d8a01971a4ac228d7fb450a01c1829b4b5a58d8cd20e5beacee59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693593797, "uuid": "fe8fc931-f9d5-4892-b0f1-f5adf57296e0", "value": "T14984E80392E17D5CEA358B72CF1FEAF8760DF5618E497BA922189E2F04B1172C263715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693593797, "uuid": "a06e4f37-efff-48a7-8469-343689c39a0e", "value": "0d5ccc78ff50fbd2fc0370addad4c1f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693593797, "uuid": "5aeb3a9c-52d8-4750-aaa6-257ca7e3584e", "value": "3072:ST/P1x4AuaM3xepbYkT3MSwttv0OPZxi01QcF9WCnkCu8aQcK2P3OBdxw/P:ol1A3Z65k2OjrQYg62/Obw/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693593797, "uuid": "7914bf83-35a5-47cf-b4a4-6fce76833a71", "value": 403456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693593797, "uuid": "45029d3a-eaac-4fdf-a13f-634d9cf7b5a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693593797, "uuid": "9b9e8bb3-be15-4c15-8c9d-49594754a50a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18d9c69c-4903-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693598814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598814, "uuid": "c36bf539-e136-4098-b6a4-2f9ca01aa0c6", "comment": "Malware payload (AgentTesla)", "value": "a84bd33991026b6cbf0dd3c35f3d2f08", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598814, "uuid": "eda41db6-d0d9-42af-b6c2-365ee4701b4c", "comment": "Malware payload (AgentTesla)", "value": "dd19e3ba36af53243a448f8734283300f7e49f07f2e460781a5ae12de5b18b50", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598814, "uuid": "5be761d1-d9d9-4de8-8805-fdb53f8d9b4c", "comment": "Malware payload (AgentTesla)", "value": "94fc581780bf9d0136eb5befd236c665152cb43d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598814, "uuid": "543d09fc-76ef-4be5-bc80-66cbee758b5e", "comment": "Malware payload (AgentTesla)", "value": "fec914b59553fa3ddd860c94f395bbcb648839b096c671c9e908ccb5d76b2c4b1cfc5e01dfa8f57998bd72f45ae575c1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598814, "uuid": "2570648e-aaee-4649-988f-f1448a05f506", "value": "T124E4231562A86317E636D3FCA58027000BF257146B32C7AD2EF461DB6E76FA485B831F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598814, "uuid": "d8e6afe6-707c-4da1-a694-43a71a2c2f7a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598814, "uuid": "32a5dc10-4719-4e43-b940-1d858c11f993", "value": "12288:34cfOZ1Hfw9N0y2mHXtSNd0cNac/GEHFVw/Yc6o+3HVMU/OQb:3dWZ9oNf2SXTZW/vc6o6TG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693598814, "uuid": "ba34a0c1-02b3-40a4-832e-3f337f6c4cca", "value": 679424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693598814, "uuid": "7ed6aec0-a04c-48e6-9f77-eb042fc0a014", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598814, "uuid": "56e92eab-fbef-45a9-b18c-a63d47509801", "value": "FedEx_AWB#5091919274.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3897ac3a-4905-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693599726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693599726, "uuid": "1462f700-7511-49ec-b83f-d57a05ddabfb", "comment": "Malware payload (RedLineStealer)", "value": "d8bf1d2bf6a70a9d20616ae017d2f119", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693599726, "uuid": "b2a99c8c-25a7-4059-ac32-7f79def2c0ce", "comment": "Malware payload (RedLineStealer)", "value": "de03afc5413ad7272b93c8eb6146a7aa26b492627933e87a64995d50a52f5ec6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693599726, "uuid": "393b5669-61bb-4908-8ac6-44a223b53855", "comment": "Malware payload (RedLineStealer)", "value": "d96cd1ec09067491f0324a602d49540dbdb42470", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693599726, "uuid": "4edc5479-2d4f-4ab8-b2d0-26b537a8f1e7", "comment": "Malware payload (RedLineStealer)", "value": "e087043bd831d05dcbad53beae06308310c15fb4e3ea3c78d60b509a93a63046ae69e455458e18b0d3614a27bee5ccc9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693599726, "uuid": "19f45c60-97ab-4775-8ffc-390ad9f77a05", "value": "T1F2E41212E6C89573E8B62B7025F757830B37BCA28A78C2975346AC5D08B36D4747633B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693599726, "uuid": "e912668e-bee5-4e0c-83c6-64f4027d6b56", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693599726, "uuid": "35ddc32f-30a6-47d9-8a4e-7064f45e724a", "value": "12288:AMrJy9061QrPf2It2jrXcXyxc9r21uCBRy4ABMBxc:Zyret2HMib11Bk47nc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693599726, "uuid": "3bc20212-69d2-4faa-84cd-765df0bb65d0", "value": 721920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693599726, "uuid": "217f67a5-83ed-4530-b99e-4935526e8ecf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693599726, "uuid": "134e952e-5d1b-4f61-ab40-5785784f25a4", "value": "d8bf1d2bf6a70a9d20616ae017d2f119.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36a84cca-48ca-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693574383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574383, "uuid": "839726b0-7e13-4def-858e-a4d291fcb530", "comment": "Malware payload (Mirai)", "value": "610586be03e93ae7a385c81bab25f1b1", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574383, "uuid": "712eb4e9-9fa1-4f31-86d0-4695acde2d95", "comment": "Malware payload (Mirai)", "value": "dfbc8183731c8d40ec29b9c566af9cd086c77db537403d2fcb3521a8e7e40f6c", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574383, "uuid": "350362f3-988e-468b-8195-4882eea34aa2", "comment": "Malware payload (Mirai)", "value": "b6d057391c2d809d1b3f6f097a55c82d4ea71a50", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574383, "uuid": "2f687f18-5815-4c9d-b5b7-26110d736cb6", "comment": "Malware payload (Mirai)", "value": "f49c8cc36d163d952f965bf30291b3c7539eb2454b1f080e8a35831222c2e654684bd9b6059da96fb662687590b5a8f1", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693574383, "uuid": "78a11183-c0cd-4802-ad84-4a2144584ae4", "value": "T187D2D0AA40E7F1BCC1AEB6F6013D4785FD76B012D2291AB708E83566EE431D55E20DA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693574383, "uuid": "0ca1acde-c90f-4574-90f1-b148073fc209", "value": "768:EYSoXdJZETc51aBfdNRQkHy3xWEMcw6qBcJ8zf:EYJdJZiy1aBnQfTqBcWf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693574383, "uuid": "ed61dcde-ca76-4ad7-9e65-65d56db2885a", "value": 30124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693574383, "uuid": "5dd1fd56-1b73-40e1-9800-0c8c68bc2ed5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693574383, "uuid": "fce00b7d-0aff-4348-a9ba-cf485bff52d1", "value": "610586be03e93ae7a385c81bab25f1b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3f59e4a-489c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1693554890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693554890, "uuid": "895c07cd-4792-4827-a459-831ddf469a80", "comment": "Malware payload (Gafgyt)", "value": "2a1ee12628167176e64f07a43fe9c316", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693554890, "uuid": "1f445356-3b19-42c7-8cb9-d4eca79045af", "comment": "Malware payload (Gafgyt)", "value": "dff861aa25468da060e00d5a0cd10799b1aa36d0e833653485c3d6635aaf9e0f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693554890, "uuid": "6faea117-4401-49da-988d-2508b39925ca", "comment": "Malware payload (Gafgyt)", "value": "fec4fe387c12c9b44cb9e01e9219327bc7bbf9b7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693554890, "uuid": "a0422fd1-664a-4f1f-8d09-6b46c8ad18c3", "comment": "Malware payload (Gafgyt)", "value": "3b3e78156e931f462a5323274d384b1d3ed724f1c4eb11042a2c3606175a2915ef64f7a4974e603f3775a69838f60619", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693554890, "uuid": "c2adc9d5-8e6e-4919-b6fd-093cf43b8999", "value": "T140F33E259A1BD273C896DDF9BED2BAD78509F1834E8A8702B2C4249D0EF5D94701FDC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693554890, "uuid": "dfbd2c9e-d2cc-41c2-b8f9-50c67cac01a1", "value": "3072:6nip2gkAMcjLGoh6aaT7cCtfSGmtQVd51GHvCY:6LIaohuTdfdmtQVd51GHvCY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693554890, "uuid": "a6a95216-9601-4ba6-a139-74350dadaf57", "value": 161875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693554890, "uuid": "a04cb5b2-2863-4e00-9f09-d451c5257918", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693554890, "uuid": "85ff95ef-28ec-4cd5-9511-e26b975998b6", "value": "2a1ee12628167176e64f07a43fe9c316", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65be0904-48f2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1693591642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693591642, "uuid": "772bdb7d-cb97-4b71-9e23-a28c0cfe17da", "comment": "Malware payload (njrat)", "value": "ca200c4dfa94e84a23cd210cdc907fc0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693591642, "uuid": "cb64a1a9-d2a5-4b18-b8b3-685b62772d40", "comment": "Malware payload (njrat)", "value": "e07b114dc126e3c9b27cabb8077931d1c3805457eee0d83db6b9717f185874c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693591642, "uuid": "3dfb9d68-ad06-4b42-bc2a-55a65cea55ff", "comment": "Malware payload (njrat)", "value": "58cc98e227b5aa117b49fb60f8a5b31a7eb897ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693591642, "uuid": "f37a3a8a-7b66-443e-8f1a-6ba59af9ed0a", "comment": "Malware payload (njrat)", "value": "98f30144ca6b53f9d3f60c87aa8097c4eb279c5978016bb573d76b0ac8775dc8f14e8f2a0bdb2dfaa69d0533980ed1c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693591642, "uuid": "08249499-25d0-408a-ad70-fe385a91013b", "value": "T1E9E208067BE94215D6BC1AFC8CB313214772E3438532EB6F5CDC88CA4B676D00655EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693591642, "uuid": "d0aa6086-4759-4ded-ab85-2644a4824e7c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693591642, "uuid": "a3bd8a75-e2b3-423b-a21e-fc1910feb2d0", "value": "384:d0bUe5XB4e0XXOhbw0Q0mS03AWTxtTUFQqzFOObb9:OT9BueC55d0b9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693591642, "uuid": "f55db984-1031-45c4-846e-ae4572c9bd16", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693591642, "uuid": "ee85e475-a5b7-4fc3-ac6e-9a199bcb57f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693591642, "uuid": "4c663146-0efe-4794-a345-3ae5de1ae18d", "value": "bPuC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abcff7ba-4866-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693531630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693531630, "uuid": "6b46e859-fcc0-4a56-ac74-b25a5c56764f", "comment": "Malware payload (Mirai)", "value": "2dac91f2012a1cfe01d1954634c2c2b5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693531630, "uuid": "f94a9bee-cee9-4acc-b60f-ee4328498cbe", "comment": "Malware payload (Mirai)", "value": "e3704d504d9f73033c2ee57f2005f103d4b8015fa6586f94871fac83d8776742", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693531630, "uuid": "633f26de-2b2e-4e5a-8ced-2d242dfd8556", "comment": "Malware payload (Mirai)", "value": "e8ff7951cfa17b4be8a9eb57160365f47b031ac9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693531630, "uuid": "47c07ae4-19a3-43e0-aa81-ffcf0d2c1d25", "comment": "Malware payload (Mirai)", "value": "0e2f1392646dd7b517406d9616ccf594702426563e8304bbd7d760263727e258b5b16580e8f478325c24f8aa44df0be1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693531630, "uuid": "29130a28-981d-48e5-a4e9-abbbba75138a", "value": "T13B539FA5C5ACAD58CB1445B8B614CD388723F408A5E72EFBD646C796800BEECF1587F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693531630, "uuid": "7755cd6d-04e2-41a5-ac43-e0028420bd1f", "value": "1536:XaoJRnrB/mUU5XtiYmG6u1KUDYofs3Qb9jQrNUxb9CH:XHJRrBeUUfw9MXBf+QJjWNUxb9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693531630, "uuid": "b2d84bb9-c6f2-48a2-9b05-fb8da933b160", "value": 63768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693531630, "uuid": "2ec919e8-8eb1-4267-93bf-19a1c208cc23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693531630, "uuid": "aafce965-d7fb-4db5-9cd8-cb533b6f236c", "value": "2dac91f2012a1cfe01d1954634c2c2b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3537d16-487c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IcedID)", "timestamp": 1693541064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693541064, "uuid": "7892036f-812f-47a4-ada5-2f0c1da18ffa", "comment": "Malware payload (IcedID)", "value": "69d9cb9416217e4c5ad33e41f8c1ccd4", "object_relation": "md5", "Tag": [ { "name": "4240553492", "colour": "#63DFF5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693541064, "uuid": "0d1c8391-9fe4-4e3e-8b2f-593d01a4e039", "comment": "Malware payload (IcedID)", "value": "e403c3a17925b09fd8aede97a97a8b5a716c16690dd544ef8646dcd3f1b1e26c", "object_relation": "sha256", "Tag": [ { "name": "4240553492", "colour": "#63DFF5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693541064, "uuid": "aa7eae57-28d4-44f5-ab6a-693228c515ae", "comment": "Malware payload (IcedID)", "value": "74e6ac725ecdef6f1289136601248fa65c73947f", "object_relation": "sha1", "Tag": [ { "name": "4240553492", "colour": "#63DFF5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693541064, "uuid": "300de85f-2c95-406c-ac22-e4f1b87a84d5", "comment": "Malware payload (IcedID)", "value": "0681dd6ffc22312c14d31a20ce4ea34b3747985b8f57995794a5d644091c1d5315bbfc95dfb111e374d07477f54e14db", "object_relation": "sha3-384", "Tag": [ { "name": "4240553492", "colour": "#63DFF5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693541064, "uuid": "6e465387-fd05-42c9-80df-48a33038c46c", "value": "T156D4E407AC9F00C8C965A03CDA79619EE365371523E05DDF95815606AACFAE0DC3BE3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693541064, "uuid": "26fbc0e9-c0cc-47fd-96ed-e6ad25760a97", "value": "e5e63fcb065def1635ff4d5f87c69b37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693541064, "uuid": "8769cb33-6fd7-4b12-b599-6793da860708", "value": "12288:BqlI8nyOrk/09drnix9Lo/k9crJmEcUKx12UAXXWRfI:BmyOrkM9lk9Lo/k9crJmEcUKx1252JI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693541064, "uuid": "c0b0639f-f82d-41ef-8a47-0a59a4cfcb19", "value": 653831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693541064, "uuid": "c1d64d0f-f61d-402d-ba86-deba8252da8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693541064, "uuid": "40d3f066-e37d-466b-be6e-7d9f1ab1093f", "value": "icedid.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1c11443-4902-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693598614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598614, "uuid": "1b4747d1-6703-46a8-8d51-798a0070af3c", "comment": "Malware payload (AgentTesla)", "value": "4710a4d5b372395c5b92582d54a86c81", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598614, "uuid": "78c221b6-0a26-451f-91f2-6a56c6d00df0", "comment": "Malware payload (AgentTesla)", "value": "e468da4729ae66592316d232181d04d1e87207953754c94025929fba8539dd71", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598614, "uuid": "1fc51a03-8a82-4ec6-9bb7-e3db57ac1d62", "comment": "Malware payload (AgentTesla)", "value": "c278a7417f1ef8f77567ed8c028d74e0e53390f0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598614, "uuid": "a8035256-f7c8-4627-94f6-01c13286e555", "comment": "Malware payload (AgentTesla)", "value": "8a9934568d7c0cb9d149dd1cdf6075fd6bea8dfb0ac0de58c94a1f01c1419237da0acaaf5a759cdcad35bc8bfe4fe269", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598614, "uuid": "9ce92a7f-d5a1-467c-8a1a-de84f749a2f4", "value": "T1E5349974A1F13ACDE896CDB28E64AD59FFE31C558A46420FD03239F6553BB85CA040FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598614, "uuid": "a0e92254-5d10-493d-b120-f9bad53a1f89", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598614, "uuid": "84c41d6c-4f8b-46ce-aab5-86c539b96729", "value": "3072:tAtqF1u/oDcSUUhCT71hEbaFSkjiRrP3:tYlQDcJUhCSa+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693598614, "uuid": "45798200-fee8-4fef-9fdd-5ef73113da42", "value": 252928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693598614, "uuid": "496dc3ab-56a6-4b96-8ea6-1b6b65f9db86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598614, "uuid": "de26f6bf-e4d4-431c-9c1b-6d88b873064e", "value": "E-DEKONT01092023,DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5f94526-4902-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693598729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598729, "uuid": "c8082ff4-66d9-4b12-83d9-40c70fdf975a", "comment": "Malware payload", "value": "504301649835eb61c3fb272522aff4c3", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598729, "uuid": "1ce5b74e-81f9-4e0c-9492-1d36946c4e5c", "comment": "Malware payload", "value": "e4f14c2476e892021df5c87e6291ef9ba1e6763ba90bb95000d347815270a2fd", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598729, "uuid": "5cb62bd4-828d-42a0-a5e9-06ddb0d700cf", "comment": "Malware payload", "value": "da1498b1698d5c3ad425618b262ff54cbf06b5cc", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598729, "uuid": "db1b21e1-9638-4c9a-be71-5969df7ba87e", "comment": "Malware payload", "value": "f8b6ca0e2b27e031791e90e959b34affd49fe8db00fb4ad09c4eed5df1526694128ba13f126d8406c169aa9c3595ca78", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598729, "uuid": "898df7a3-c23c-433d-8232-3c138d7f4a9e", "value": "T135A423CCE03F551BC5A7597AFBD38793220C0C5386836E3DC266266B9F99506AC8BD30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598729, "uuid": "0628568f-9d6c-48f8-9cf5-bf63050e882b", "value": "12288:yc5tHCoOJealLjb72KjmSNDax5siBe28pmUT44gg0fIb9YUUPbkLJV:nHCzJTn2Kjm0DI55Be28px44H73U+V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693598729, "uuid": "6378f1ab-2917-405a-bc12-9351c23b2a22", "value": 452622, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693598729, "uuid": "db675724-bc0f-4349-ab17-ca35f753ab02", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598729, "uuid": "14ff68cf-483d-4e5f-b971-8e540dc1e6b7", "value": "DHL COURIER DETAILS.docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffdb5ddc-48d1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693577727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693577727, "uuid": "c74318f0-4c19-4d22-b6c6-d1c05aa52baa", "comment": "Malware payload (RedLineStealer)", "value": "51eabf0c85dba4d0a7f01efec40e60d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693577727, "uuid": "f7bfca72-5a2b-415c-ba5d-0de7aa35b3a8", "comment": "Malware payload (RedLineStealer)", "value": "e6e4dc91cd7f34e3f961f2ed7ec6ba134833470632c1f6af74f165d819e6afb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693577727, "uuid": "716665e5-a5e0-4a26-92e7-152aef585f84", "comment": "Malware payload (RedLineStealer)", "value": "54644f0567c344a5fa08a1e827c823f1388bff4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693577727, "uuid": "6bde524b-0c24-4255-aeeb-9eada76aabfa", "comment": "Malware payload (RedLineStealer)", "value": "eed21be73e92e137120f56e62edf0dbff9cf0e1d74ab1f4f66d26f38227acaff9fa92efe20977d38842cbbe5982078af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693577727, "uuid": "586c72e5-c4ec-41eb-a0b3-8aef8361b584", "value": "T139352302E5E99073D8F6677048F163A32A3FBC508C7093A76685994B89B2189F53737F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693577727, "uuid": "2ed266fc-e405-4727-ba14-1011419d6281", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693577727, "uuid": "2f6feb1a-d22f-4f0c-bde5-c984ae19c58d", "value": "24576:wyz8JgGQx3g3OGNjP8cs54ZjRzZ9jzcUbG8d+Qrbukk:3lmeYj8csm19jzcUbG8g0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693577727, "uuid": "6ecda248-87b5-4c85-acd9-9b2c36ee50c5", "value": 1147392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693577727, "uuid": "45b3ff15-4dfe-4cc5-b565-90927181a22e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693577727, "uuid": "51ada4eb-cfe7-444e-8cbf-8f3d44166403", "value": "51eabf0c85dba4d0a7f01efec40e60d5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d81fa3d4-489c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1693554897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693554897, "uuid": "fffa9268-7652-4d7b-be93-faf93ec2bbfb", "comment": "Malware payload (Gafgyt)", "value": "21f9a24bb8ecfa6008a006a083ba1cd1", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693554897, "uuid": "25c86af8-f9d3-4e03-95c5-39256838149e", "comment": "Malware payload (Gafgyt)", "value": "e72d20ab9c068345e8cbe0b8fa0ac0049dbd59a9100c71ecd325105ea8fb42b0", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693554897, "uuid": "b503248c-383e-4d14-9fd4-a3aeb62802ae", "comment": "Malware payload (Gafgyt)", "value": "8f6b7bea1aa94c459f267e0d1f41617aba915906", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693554897, "uuid": "3092cf28-9254-44b8-aad4-dddddcd263c3", "comment": "Malware payload (Gafgyt)", "value": "351f7a1f40f6a95c872995f88f5c9d17cf1dbbe5d38c033a94384d01cec868ab1de06def406e1b5e33f080cb6deb7bdf", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693554897, "uuid": "a64e3a0d-8cc6-4654-9552-246ba860cce8", "value": "T1A10461364A1AD127C4D6EDF8FED6BAE38509F1A74E96920273C0244E0EF5D85681FDC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693554897, "uuid": "6f32c885-76e5-4dd0-96fe-a9faab9dee52", "value": "3072:VUpCKcT124NWgbrH8eUvlpT7MyUsDgmMCWd8A4pZYJ:8Zo24NpvH6TUfmMCWd8A4pZYJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693554897, "uuid": "bcdcb213-9676-471d-808a-1eb5156f47b1", "value": 176791, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693554897, "uuid": "4421561e-67ca-4b4e-acc6-8131b5e63e7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693554897, "uuid": "01b55c60-49f0-4be6-bc56-bfe38631c2c9", "value": "21f9a24bb8ecfa6008a006a083ba1cd1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b4d9334-4905-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1693599785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693599785, "uuid": "799f885c-49bd-4fb4-b239-1625e1599ba0", "comment": "Malware payload (Smoke Loader)", "value": "3758d79e248b71ec40d6c526df09b0cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693599785, "uuid": "ad9c9ab0-83ae-4fe0-bb65-e54377521e51", "comment": "Malware payload (Smoke Loader)", "value": "e87a49c8c893c7d984fd1f7b1256f0e377f1ade1327795d917d399ce7b7ed634", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693599785, "uuid": "937b3fd0-db67-4d8c-81ee-5f9a0eb8eb9a", "comment": "Malware payload (Smoke Loader)", "value": "b9d7465ee49a01a348bcb76fb111fdc00fe7d9fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693599785, "uuid": "df7802fa-d84d-4820-9f24-fa7bbf7bd6e9", "comment": "Malware payload (Smoke Loader)", "value": "dc0d39f5332bc2bde7440463e714770bad10892f93823d76c9f3da9a5c6bf0a17985d99b09e95048d742d872517e172e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693599785, "uuid": "51171ac4-03f0-4220-8b58-b0d2a2c69fda", "value": "T1D784C74392E17D58EA258B7B8F1FC6FC770DF6608E497BA922189E1F08B1076C263715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693599785, "uuid": "618324fe-3e92-4e5b-8082-73012c4d81ca", "value": "eb568a174db8395072c750a957035097", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693599785, "uuid": "7d06a2df-ce68-4311-9936-dab15c2ccd7b", "value": "6144:B0QaG8BYStPT5joS4KAhlVijGgzV9gLUebH/:B0QaG8BYSVTR4KxjfzV9gLUeL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693599785, "uuid": "57af2a71-8beb-4b7b-b1e7-dbb90b75a6a2", "value": 396288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693599785, "uuid": "1f35fa74-706d-4d8c-86c7-fc8b22bd7c89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693599785, "uuid": "d2486b68-3f65-4d29-a761-1bc2c4cb1cc1", "value": "3758d79e248b71ec40d6c526df09b0cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2545016-48a2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693557518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693557518, "uuid": "852a699d-a234-42da-af52-72b58c4e07e9", "comment": "Malware payload (RedLineStealer)", "value": "dae3997523fb2ff22f7ac6f3312098f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693557518, "uuid": "f03cdddf-4718-4b3f-9b78-457191dc319a", "comment": "Malware payload (RedLineStealer)", "value": "eaf0b83166fa34e9c7aeb111f1a0aac02cd227c1506a0df15ed8e6b8302b44b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693557518, "uuid": "9dd64e58-cf1e-404f-8bea-190131082b8b", "comment": "Malware payload (RedLineStealer)", "value": "b3747a50de49c25707146913200f3e1f915daaf4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693557518, "uuid": "b0acfe97-d8a7-441d-a348-5f32530078d9", "comment": "Malware payload (RedLineStealer)", "value": "00f66e5043c22a401e2c977ecc29c9844f618084fd593330afe0bac59899dd96690f9b75396c6b39c9216cdcbd5caccc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693557518, "uuid": "868cc86a-88d0-4254-9ff2-65c3ed45e555", "value": "T1DEC44A43D2E17D58EA258B739F1FCAF8770DF2608E497BA922189E5F04B10B6C263715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693557518, "uuid": "c77144bf-5ab2-497c-9984-59139fe2d3c4", "value": "a0157d3b2852cca44553b58241d89d57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693557518, "uuid": "47a0f953-c5e5-4879-a7fa-226ebfcc6af1", "value": "6144:VAMrRancWbSOj38epOCUBpEIfQ7J6OsIjD+1pdWBoRCtZH9IU/gLUebH/:VAMrRmbqepHmWQQl654TBJdjgLUeL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693557518, "uuid": "61d482fa-bd80-49d5-b53a-0256d2b2ad5a", "value": 551424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693557518, "uuid": "b0937cb5-f9ab-42af-94cc-71e493c16a24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693557518, "uuid": "107d4279-a7fb-4a1c-ab21-8381dd8480da", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5ce530a-48fd-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693596527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693596527, "uuid": "75b21e1b-7287-4982-a108-7cedd123b562", "comment": "Malware payload", "value": "7c6838f528a66506eef6b18902ec8e44", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693596527, "uuid": "8751d2ba-fd12-4466-a67a-213ddd61efe3", "comment": "Malware payload", "value": "ebe36b9fe3b792e0b0dab43fb4d2d0c540d7ab810c52e037fcf3dbb1f138163c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693596527, "uuid": "e7646485-dfa1-4d23-bcdd-dcfb03f4982f", "comment": "Malware payload", "value": "bae6e20c8a25a1d6153f9393c5b0cae3daf8056f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693596527, "uuid": "cde86589-b723-43f2-b820-a9abda31661a", "comment": "Malware payload", "value": "77c53744b5935c1a1cbbdef68a92d587839bb627e06d4a100287325040a5fcd03ecfb6227fef4bf6a5e797531b052411", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693596527, "uuid": "187c7198-6d51-459b-8a76-959664290e80", "value": "T1EB33F85AF9819B15D5C1017AFE1E124E73130B7CE3DE7312AE246B2177879AB0E3B815", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693596527, "uuid": "f4c43ea7-751f-49e1-b22e-ca5bbf8e6696", "value": "1536:wKnl1KJAWhn3PYasExQYM2iexf4ZPVXt5FYpv:n1KJAU3gatxf4ZPVXt3a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693596527, "uuid": "ad407c9d-68ca-4fc9-9a2d-22b72cae2637", "value": 51856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693596527, "uuid": "27707c91-8164-40f6-872c-b2d670dbd6ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693596527, "uuid": "535b295e-fe03-4c43-8099-6c2cb51f6ae2", "value": "SecuriteInfo.com.ELF.Mirai-CJG.28990.24838", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6bbeb8e-4866-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693531648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693531648, "uuid": "82973151-1e91-4bee-9d76-b62f16358b96", "comment": "Malware payload (Mirai)", "value": "ac967e5ef20405fbd42dd8d525603c83", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693531648, "uuid": "d597f405-bfa6-40de-ad23-309db5df726a", "comment": "Malware payload (Mirai)", "value": "ec148923ec38d248fa958a0459753766ff10f125c2d31750981345e2e881c57d", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693531648, "uuid": "89052ea9-695f-4200-a5c3-f6ee331b9678", "comment": "Malware payload (Mirai)", "value": "cd3e3e8c9dad57006f5247ab202e464263f46a43", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693531648, "uuid": "3efce8df-fded-498c-a125-c93d68fc6a60", "comment": "Malware payload (Mirai)", "value": "71b0c7246c0aafd3c90c35e1fbd6330171869416d4c717dc449c50b31a19893d740dbf17283873cc383e3677ced9c4d2", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693531648, "uuid": "f77b8b6c-8605-4029-b314-7a37c3f4d596", "value": "T110D2E14585F7F4B1C475997265BABAC4FAB4A461A32C5B7B48CCF6BF6D9B24C0220700", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693531648, "uuid": "9179e716-c45d-4905-9fe5-c6b5eea8321b", "value": "768:TYSoXdJZUtqz0hVGTa/V7t4zY/R04O/GLSx0sU:TYJdJZmY03GU504GtU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693531648, "uuid": "c7f797c2-603c-41fb-b3cf-880e4a795bf0", "value": 29440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693531648, "uuid": "074829be-7085-443b-a5ad-5ebb4eaa527f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693531648, "uuid": "029369f7-6e3a-40a8-bddf-788922718e59", "value": "ac967e5ef20405fbd42dd8d525603c83", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37c86092-48e5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693585981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693585981, "uuid": "16977cd1-53d5-4bbd-b0b3-22c5f706102d", "comment": "Malware payload (RedLineStealer)", "value": "579d040434b6ad4c43f95c9cabc30256", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693585981, "uuid": "8cbe18a3-02c9-4c82-bf7f-d9a113876335", "comment": "Malware payload (RedLineStealer)", "value": "ec71f8b1de9ab853a519c2984cd086f1c85600dd38b77e6491e406597c7254db", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693585981, "uuid": "41f50ef3-c7e5-4765-8660-a9aba5a44eb4", "comment": "Malware payload (RedLineStealer)", "value": "30fd931aba95e018ef5434e7871bf1a85c5c5f3c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693585981, "uuid": "13fd925e-b59d-4dd3-b476-f4c81d64232e", "comment": "Malware payload (RedLineStealer)", "value": "29930674d02a141dbc48efdf96a9c1755c3b868ed20eabff783dc1854c6c1d894f2b166564ab65a504653d47dbdadd17", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693585981, "uuid": "d268acf9-9cba-4b24-aefd-086e91219d22", "value": "T142652302FBE56467FD6953B084FB03830B317D1B88BC8276278598951EB3A88D77139B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693585981, "uuid": "eb410127-0b6f-48b9-8775-17240c07d643", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693585981, "uuid": "88e13bfc-3a06-45c5-a096-08c9468e0d40", "value": "24576:NyHPRNCCukzpETHZimCdVSKtCi1BrU2bYEevUponDFf9k+6SNSyaCt3F2igE:oHD8kg5NCHSKtCi1BrU2ecinDFfPhNSp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693585981, "uuid": "87802fca-3fba-47f8-9e3c-cfadf8f3655a", "value": 1503232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693585981, "uuid": "8e2313b3-b2be-44f2-ae11-c580d652d8ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693585981, "uuid": "a173e103-208e-4b68-bdbd-0dd32cd5040e", "value": "579d040434b6ad4c43f95c9cabc30256", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3248f896-491a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693608735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693608735, "uuid": "4ac090fa-fb16-470f-b77e-e2f8237b251e", "comment": "Malware payload", "value": "99b64fb5afa891594926f40154df1cf5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693608735, "uuid": "6dad86df-c0f8-4a08-bcbe-42d0401fac90", "comment": "Malware payload", "value": "ecb9d6e6bd48f11c73f03c7fa605449eb2828dac1605069b1abc94f6e915dcde", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693608735, "uuid": "89756027-98ce-4381-b182-787a83a179eb", "comment": "Malware payload", "value": "8f0361a9a69d166e36a58cfbc30ac237107b95a9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693608735, "uuid": "7217d72d-c3c9-416d-bbb8-82cdf87c1268", "comment": "Malware payload", "value": "36eacb43ceec1151e512c639a5c86aab00f875525e919cc41c263297f708ebd35fc62fa3c4916e51c454ed8ca8464edf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693608735, "uuid": "e2cbf8b9-32bf-42a5-ba9c-b8139f80e32c", "value": "T147B5231476C080B1D8A31D761BE1A732A77EBD301B758BEB87942A6F9E301D0DB26747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693608735, "uuid": "6c49b851-8fa5-4ec6-9a6c-86c40eabcf38", "value": "fa8d20faea9ef7b4e2b7fbfe93442593", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693608735, "uuid": "fce52a3e-c0cb-4076-bc52-6ee8fadc9c6c", "value": "49152:acbz6i3uwY1/PHXL0yx8TRv5c/Y8kHlsTg+Y7zKSLpCdLWL1:acbVuw0/ws89Rc/Y8oCg+OzNLpWLQ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693608735, "uuid": "1d1a1c6d-2fb8-4a1b-ac9d-79d0af861a46", "value": 2366614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693608735, "uuid": "7a9aca60-8a69-47f2-b624-67707f90e035", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693608735, "uuid": "24b96769-4bc2-4893-815a-da224bbd205b", "value": "99b64fb5afa891594926f40154df1cf5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab27c30c-48ad-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693562123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693562123, "uuid": "0369d24e-b647-4aa5-8a02-e6d322ccdb69", "comment": "Malware payload (RedLineStealer)", "value": "3609cc088be291aa988db591d01bb3e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693562123, "uuid": "2b9982e5-9907-48a9-97c4-b7dde9cd62d1", "comment": "Malware payload (RedLineStealer)", "value": "ed12a7c69d2d40a7d2dab74a9ad88ea4d1383216f62bbdb27c1cc6867146420b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693562123, "uuid": "784b0265-645b-4f1a-a9ca-6c5ad513917d", "comment": "Malware payload (RedLineStealer)", "value": "f29748033ea6079796ad49479c2231c22d3fd9f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693562123, "uuid": "d7b3c699-8c07-4367-82ba-71edd518d8b1", "comment": "Malware payload (RedLineStealer)", "value": "25787ae8f2473f9ac549ef42256c33cc48c05ee2b45bfa5005511f5292a5ecb96fdf8b1d93a9342263e1e8cb04c5c084", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693562123, "uuid": "2bda58fd-69ad-42cf-bc29-c64a6671027e", "value": "T15C352327FEE89031D4B213B018FD05532A767D90C9A9C2AF37986D4A0DB36857A79337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693562123, "uuid": "9429d534-20ff-4adb-b11d-0629d1fe380a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693562123, "uuid": "6158111b-cb67-40e8-80eb-58c4255ceb5e", "value": "24576:kyhrR85/TGOXx4FtuLDbbdhM0PigCZAFca4HYPByTuOu:zhrRwBh4325/AHYJtO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693562123, "uuid": "3a450186-ee1a-46a5-8bf0-c0874bc0847d", "value": 1147904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693562123, "uuid": "3a0837be-220d-4ccb-8792-ba18f794aa64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693562123, "uuid": "a7a63e2b-3179-48b8-bc3b-a38c0732a2c5", "value": "3609cc088be291aa988db591d01bb3e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "197bd46f-4905-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693599674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693599674, "uuid": "36aafb76-5148-4150-aeb1-352e74339edf", "comment": "Malware payload", "value": "c6664fa3239eeb78300dcd61b03e88d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693599674, "uuid": "c11ac495-3364-4f0a-8b7b-b2dce7cd7028", "comment": "Malware payload", "value": "ed8c742d1b4bcee625de4199c1392004568abc7bf677c9657e462756bce95c77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693599674, "uuid": "d32b49c2-87e0-4296-bf25-878246d93412", "comment": "Malware payload", "value": "9eab5dfaee92816e7480f281f34b85539f3666fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693599674, "uuid": "0516067e-0de5-4f3b-aa9a-27415eb160ba", "comment": "Malware payload", "value": "5789bb7a55d64478cbdae448182792d56dcd237e4425ed0ae91d54011b13b5607ce7d85d19745cd503577368bc430276", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693599674, "uuid": "1db18f6e-d12d-465c-8b61-bd71320e933f", "value": "T1CCD523217AC189B6D0325C3025E4A7B16F7DBD311B328BC79744AE3EAE704C16936B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693599674, "uuid": "9e01e12d-085c-4fa0-86b5-45f2eea4f171", "value": "fa8d20faea9ef7b4e2b7fbfe93442593", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693599674, "uuid": "e0277fb2-6802-43f1-9f01-705eb7c5231a", "value": "49152:mDkUrjENlk6WYGX+v7J/JQYe4KRKO31s+U/sLXuzo:m4UkNlnDPc4KRKOlsvqX3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693599674, "uuid": "202882ff-a876-4635-92a1-da07fc13fe44", "value": 2839390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693599674, "uuid": "c514e3c2-bad6-4279-bdd9-8a6a3e60b319", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693599674, "uuid": "a99e308b-044f-483c-ab54-b7e376b0676c", "value": "c6664fa3239eeb78300dcd61b03e88d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c572dd6-48d8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693580432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693580432, "uuid": "3c17a835-d207-4e69-b8f2-24aafc53803a", "comment": "Malware payload (RedLineStealer)", "value": "221b188cd8088ae5c9b01594be8c2801", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693580432, "uuid": "e5bf8598-0ce8-4caf-a0c4-4b73a66249ba", "comment": "Malware payload (RedLineStealer)", "value": "ef0f222217f4b83988df688f49728aef5c126e35411909180a395050a04f8dde", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693580432, "uuid": "af40b238-a759-4c76-b6ec-bd0a41d7c0a5", "comment": "Malware payload (RedLineStealer)", "value": "c05e9dc7f5e1e74e0b34fa07de759b018d64a985", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693580432, "uuid": "ec88a5ec-a9ed-45ea-94d7-fbf1e809bd5e", "comment": "Malware payload (RedLineStealer)", "value": "5c84e818042354ccdd0893cc726f674628d412cc0aafaba43cf142089a4c59c9f6da0723a7819b3b2a9f2813d81e9912", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693580432, "uuid": "db64aeae-3e9f-494f-ba58-2edf2e8f6878", "value": "T11F051247ABE58177DDB61BB099FA02931B36BC925930825B2342A94F1CB31C4F53277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693580432, "uuid": "16c7d203-a8c4-4b42-90cf-1299e91b8012", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693580432, "uuid": "6dc3886f-840f-46a7-a51f-46dc2534b224", "value": "24576:JyiUcIk57J5/bBZzJVP12SM2gxzcDPOzI:8i39xbBZHPxMwDPOz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693580432, "uuid": "03aef8ad-0b95-4f58-a170-f003ae6fb6d2", "value": 847360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693580432, "uuid": "06581ed3-cb28-471f-817f-eb81478b73e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693580432, "uuid": "85df9c72-07d9-4e01-b70e-65bd642738e7", "value": "ef0f222217f4b83988df688f49728aef5c126e3541190.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5643ef0-4902-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693598674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598674, "uuid": "004e5a56-2ea3-4735-9256-07f3dd93a157", "comment": "Malware payload", "value": "76a7d4c43cbe51e7cac8e6eb88d1a9b7", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598674, "uuid": "193acb6b-dccb-4b0c-a59e-601be9ccf42b", "comment": "Malware payload", "value": "ef74d2b8d1767667fb6817916f7d2d2c998358e07422a6af246151e0299f26aa", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598674, "uuid": "e10bceb5-7aa4-4543-a95c-dd93566ddc89", "comment": "Malware payload", "value": "3186fceaea15217c4345cab35fc71087feeba204", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598674, "uuid": "99c3e1ee-852e-4a1e-8da7-18b151b76f17", "comment": "Malware payload", "value": "ad04b1085eba99ce2959265a3f72d92a3b7c0b66c9ee147c404e7f05019b99c9904958a403fc58804f36bf4345e5b7bf", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598674, "uuid": "b0b4c4e7-8148-4161-abed-ef36fbbbe141", "value": "T190C48D57F7C7FAB0E6BE827A86B1891C527774520260A78F674072896D23392493DF0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598674, "uuid": "d6fef7ca-2da7-4a19-9ccb-7aa3618a06e0", "value": "a31761b5a590c4c499d5f4a347d75c12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598674, "uuid": "09ec3212-ce50-47fb-83fe-8d927525a4e2", "value": "12288:an/zDvGHAykHSzLW/4+8bzbBSreMd5LFgFK/UqW:IzbGHAzHAjX1EcL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693598674, "uuid": "febbbab1-f956-422a-874f-a8bf0491539e", "value": 587264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693598674, "uuid": "88b8d822-f76f-4be0-a7c4-b9f2fa5efecf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598674, "uuid": "c790317a-0433-40e4-a851-30036ae24dab", "value": "Unconfirmed Invoices - total amount.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dba132cf-4879-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693539870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693539870, "uuid": "c3a6a17c-df56-4dc7-9f29-10c18438aada", "comment": "Malware payload", "value": "1bd861c3721a8b0db53e5c0e5b0bdccd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693539870, "uuid": "f3dca73f-cede-4159-a4c5-e0102babbd64", "comment": "Malware payload", "value": "f014c1c46fab3e95a455896bfb5d8dbcbbe4d7999f713a860658afa274b63cf8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693539870, "uuid": "0a278ce0-3354-4d2e-8268-ea23d959cb30", "comment": "Malware payload", "value": "c9186d6237334f4b03d5d1eadbfc75733adb2aab", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693539870, "uuid": "fe7eef5c-49f5-483d-bd13-220472af149b", "comment": "Malware payload", "value": "db8bd1095c11896727e97def9dae9571330d47dadb99384e000e6b8651a6145604879897d18027f7a49a7381b76c40fb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693539870, "uuid": "d2d8aca3-519e-4891-a6e2-c0f78f339a00", "value": "T1C2942211A3FD5208FAF73F846DB5A2A40E26BCA6ED79D2AD1250105E4AB2F40DD71733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693539870, "uuid": "81102c33-113c-486f-8552-979e6d3a6a48", "value": "3072:hxufEXOZvkRYBArQfAjFDgBDRygzQqn3ArT/NpnF4:Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693539870, "uuid": "3025c4e8-d1ed-4139-bd8f-d7a25e949c96", "value": 444806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693539870, "uuid": "ddd3f974-9ec2-436f-a793-011cf3c194f8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693539870, "uuid": "18122344-5f0e-4b4b-9884-c8f41ae63c80", "value": "Notice_4335426.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30348e0e-48ec-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693588975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693588975, "uuid": "0d7229cc-adf3-4487-8451-3d28cb9522c6", "comment": "Malware payload", "value": "ab703f6f90f79049264fab7af3c1175a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693588975, "uuid": "8fadbcb0-82d1-436f-96d4-aa47b50538aa", "comment": "Malware payload", "value": "f07b32bb491b3fbec3c07c9ba9d42ccd57757238cc72e0f84214f853037904a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693588975, "uuid": "7709a0d1-0fb8-425f-8413-7f148537a2eb", "comment": "Malware payload", "value": "af405249cd0266d72d56e626b2b2c67af9eb1fc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693588975, "uuid": "c9f16d63-b7c7-4339-9319-777908dde592", "comment": "Malware payload", "value": "6bff6c0b36ec363eb078fb056db9be0c3f4be290f6c72532054c8ba273f67db709db95f89c2783a259583c041a379dcc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693588975, "uuid": "c0cdb35c-8037-4e3a-a9b0-e7ad209fa33f", "value": "T150948D539290BD61EA258B72DF2FC6F8B61EF6308E893B7532189A5F05B01B2D573701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693588975, "uuid": "e1dfbc65-88e2-4af8-b2d2-614d657e9037", "value": "d8507a8b152f56267b5250a792ccaa4c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693588975, "uuid": "b552d8e3-ac66-42c5-b019-8f119ced2e5b", "value": "12288:D5BVAKGq3mjdNvJmpn8qrYY8bYqWyry8kE65:fVAKGSUZywYTUkF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693588975, "uuid": "7fc6ce39-4a53-4728-87fc-d1521a2f16a5", "value": 432128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693588975, "uuid": "60aefe4b-1f5d-4938-99c2-605354780069", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693588975, "uuid": "43dbf036-0c24-487c-8337-d01c39fd1e78", "value": "(((\ud3ec\ud2b8\ud3f4\ub9ac\uc624 230830))) \ud56d\uc0c1 \uc5f4\uc2ec\ud788 \ucd5c\uc120\uc744 \ub2e4\ud558\uaca0\uc2b5\ub2c8\ub2e4 \uc798\ubd80\ud0c1\ub4dc\ub9bd\ub2c8\ub2e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a12ac50-4877-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693538821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693538821, "uuid": "b7f8e765-3508-454c-9e3f-9c8372727de3", "comment": "Malware payload (AgentTesla)", "value": "e2b8a473aedb792e418e2cd6621d0f2a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693538821, "uuid": "f0a40320-772a-4c9f-b07c-4927cc4dbff6", "comment": "Malware payload (AgentTesla)", "value": "f085fce543d06180ff004aea70a30d312c2d727918f6e3f100aefdec45f071f3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693538821, "uuid": "80da4abd-0ea4-4fd7-b3f0-a078f35b07be", "comment": "Malware payload (AgentTesla)", "value": "8d487e2136e4fa598767f18ca6aae54c53976aba", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693538821, "uuid": "85c551f6-6a53-4958-9fc1-5af689217bfd", "comment": "Malware payload (AgentTesla)", "value": "dad5081422447ae072280effe190eab4b0ba80388db070e3960cf34dfe60a1d5a0cb957065df897a5883ef32cdc97be6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693538821, "uuid": "9446326b-f81d-4c4c-abf3-04789cd80d8b", "value": "T1AAA4238AC8BC86EA0BB97EF909F0E5C4BB070C02DDFAB1DD3D9DD6C661969109503197", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693538821, "uuid": "3c0048f3-6134-4525-b1ee-ba395d0529dc", "value": "12288:VtaygnN1U25pdRIMIZmM5GOOC/ehnRkNoF6AZpvUZkJAou9r:VAv5pdEbMEe4oUAvoJr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693538821, "uuid": "b39a6918-7f0a-4085-8083-27da6cf6f1fc", "value": 484528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693538821, "uuid": "90c348f1-da2d-4e05-850c-5b32871395a1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693538821, "uuid": "4358fdbf-47f6-4250-acf3-03c8b4d6a391", "value": "708e198608b5b463224c3fb77fcf708b845d0c7b5dbc6e9cab9e185c489be089 (1).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce5f165a-4902-11ee-a6f9-42010a9c0055", "comment": "Malware payload (XWorm)", "timestamp": 1693598689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598689, "uuid": "3463d8c1-9e06-42b0-bf3e-cbbc1fc33cf2", "comment": "Malware payload (XWorm)", "value": "98b971fed4427555f7a679d713036b65", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598689, "uuid": "8a17fb35-e9c1-4a6d-bafe-a7cfceec6539", "comment": "Malware payload (XWorm)", "value": "f1bd55921cea4cf6af8be2564435df0c8c2ac621f171cdb03a0cdcfcf5c14762", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598689, "uuid": "2a5e14fa-8f39-473d-a575-d07e42ca85d3", "comment": "Malware payload (XWorm)", "value": "ce3c0ff84774a80a8debf655fd5c3c643ad39ba5", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598689, "uuid": "99bc5142-cde9-4bc8-901b-d1adf43e2de7", "comment": "Malware payload (XWorm)", "value": "36a17ca4ec63a20ab5b9d08a3c05a9f7860b629377397082893ec1939baf258e6983f6ad7d1e48ecebd9de75cb977f49", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598689, "uuid": "ad5e609c-75e3-47c4-8952-862116ca9e19", "value": "T18182C03297C215B1DFC2C239E62C05DD7D68F1B70DAA6A065FC42204636A1EE27BB51B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598689, "uuid": "959d63d9-bc85-43d2-ac55-60dc1fbd589e", "value": "384:dXPxtcsgbM79vh52/WQdkpFHOI85B8b708dkFI:VPxK+1GkvHOI85B89dkS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693598689, "uuid": "fbeef3a4-5742-4573-bfff-33eb784006b6", "value": 19104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693598689, "uuid": "8c3cfa79-7d2c-4c2a-996e-ce3ba25c9807", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598689, "uuid": "b682248d-50a2-452d-9810-f85b73ebaf2c", "value": "LinhasSumarizadas_2020006499.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "842858b6-4902-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693598565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598565, "uuid": "6ef74df4-aa6a-4dba-87dd-d0195efea964", "comment": "Malware payload", "value": "e95493c4629392869ba6225c2faa75b3", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598565, "uuid": "e9bf247f-087a-4836-95a3-cb4b51b5937e", "comment": "Malware payload", "value": "f2e2427107648e8d7be5f4e42341c702ceddb442191434128cbbf15c0325d8e9", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598565, "uuid": "576c022a-1f22-4caa-9aa0-3fb53883319b", "comment": "Malware payload", "value": "769eba29b217624e626d9e3afb03f3dd6171f754", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598565, "uuid": "4466a882-82cc-478c-bb39-7e913aabf9ac", "comment": "Malware payload", "value": "50e478ea60185d56439ff3451b9fe03264efe64ec37ba261b78fa2117c2355215f0fae4bd51e350ef25be3028527fae9", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598565, "uuid": "31c915ab-a209-43c0-934e-153c35b6a311", "value": "T1F44141200BF20718E7F68E3658F363609776B402EA368F9F21C059860875E24EC65F6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598565, "uuid": "2273d914-580c-4303-b4b7-193f43aaa6fb", "value": "24:8WLtGmYNa89KuPgIWJAAzW5+/CWJAM/9iUoIakWbx/ndN6CZXDyJC6CZ4ywyfm:8WB4ydJXuMFiBIaTx/ndN5ZXGJC5ZDb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693598565, "uuid": "b68ca2e6-e4f9-4624-ab20-69e898422233", "value": 2269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693598565, "uuid": "bfb7953f-e42e-4ded-80ff-6709f7382b37", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598565, "uuid": "198483dc-39c6-4c6a-9758-a393ba683977", "value": "MANDATORY-Invoice-28-August.docx.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5f44956-4887-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Vidar)", "timestamp": 1693545820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693545820, "uuid": "8bbaeba0-b460-4c97-bb8a-7d199c12210c", "comment": "Malware payload (Vidar)", "value": "ed4cc1bda9c5671fd5c137b46e11e88a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693545820, "uuid": "519d8f39-8641-41f8-a909-d69318ad4547", "comment": "Malware payload (Vidar)", "value": "f30c8773a897d45c5798d6d3c1768148af13101536a2d5f6ae3dc26f25471215", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693545820, "uuid": "1ce15a47-fa51-4ab1-9bdd-ccd18f9f0829", "comment": "Malware payload (Vidar)", "value": "00e79ce4fdd7f3b54cd755012f457e61ecf0a95d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693545820, "uuid": "688ec8d9-2434-4b2e-b1cd-02bfcf19aa1c", "comment": "Malware payload (Vidar)", "value": "8dbe87fd6e142aa245457e69e8383d835a1c11f3eb76c8b895fd4394bb06eeea8a8ec2a8a2825e2b27931ba9c509060b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693545820, "uuid": "cf247b4c-193d-4b3a-9d3f-98fa1365dafa", "value": "T1E5A4E60382B17D95FA258B729F1FC6F8B64DF660AE897B653318AA1F00B1477C663710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693545820, "uuid": "c996cc6b-d54a-493d-99c4-05348f10ebb9", "value": "a0157d3b2852cca44553b58241d89d57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693545820, "uuid": "dc4e360d-da00-4218-84ff-4712bcb48412", "value": "6144:5345zEsMrzvFISRy7KSNq7EzWxhyh5EoDmdwqTfduQ:5345zZMrOCy7fyMELwqTB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693545820, "uuid": "43555424-d37c-4f1c-9743-6e150353a1c5", "value": 457216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693545820, "uuid": "7e57cc75-6f6d-45f9-9552-8a99a5d8960b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693545820, "uuid": "91bf20d5-262e-4dc0-baf1-5fe806b468cc", "value": "ed4cc1bda9c5671fd5c137b46e11e88a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "760452ff-48a4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1693558168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693558168, "uuid": "267da69d-91ac-4838-9742-a84cf5663ec7", "comment": "Malware payload (Smoke Loader)", "value": "e6f347743fcfbfd54fddcdd1d1835ca4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693558168, "uuid": "d95e2c2f-cd98-485e-8d4b-e8cbcec6fe46", "comment": "Malware payload (Smoke Loader)", "value": "f3fad225386f7222566703f13a3df005b36736afe33c6b324cd18f0df70f973f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693558168, "uuid": "e73a1e9b-fb4d-475c-b02f-666dfb0c4f4a", "comment": "Malware payload (Smoke Loader)", "value": "91bfdee2209f460336a348590a5bad34adae1979", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693558168, "uuid": "e153bd72-81d6-4d32-9019-d89b21dace26", "comment": "Malware payload (Smoke Loader)", "value": "9329f37bb4ee0e0ffa0d989c7b942b0dfa5d45d4bc7a832d00f2301f10b494fdddb82bf8cb412f2aefd967f82c7b4290", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693558168, "uuid": "49715dce-fb40-45e7-87a6-129ae348096a", "value": "T1C084C74382E13D58EB258B729F1FDAF8778DF5608E09BB6B22189E1F00B1176C263755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693558168, "uuid": "eaeb1d43-ba07-4b2a-802f-4d4c6c7338b7", "value": "a0157d3b2852cca44553b58241d89d57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693558168, "uuid": "d559dd9c-55bc-4cab-a144-5db2c4272777", "value": "3072:pYUOO4GtogRSWo7nsojoIjm43NieoC+4Dw0ToGR5QEOn6KNKLPcOJdxH/WN:myt5RSx7sosIp9Hof0oGR5IvgLUebH/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693558168, "uuid": "761a886c-e13b-4345-89f6-da3f8a0e9279", "value": 395264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693558168, "uuid": "f6ef0c97-6539-499a-be5e-593b6f2db4ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693558168, "uuid": "105c9bf0-4f16-4d2c-911f-7923897f8281", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a725f88c-4902-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693598623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598623, "uuid": "e3ef9060-e667-41d6-b751-fd78420ec8f7", "comment": "Malware payload (AgentTesla)", "value": "1c84232fb49dd8a33d51c98ca54d8ec9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598623, "uuid": "f0ab8caa-cc41-47d3-b1c5-4a84d8cb08be", "comment": "Malware payload (AgentTesla)", "value": "f4b418c7c9b2c453a3507deea027ba20c6c81bfcf842d03150c2a8462655d7cc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598623, "uuid": "dfe90e85-7313-4a55-b6eb-4a544b29339e", "comment": "Malware payload (AgentTesla)", "value": "aa6f58da6c0ffcde8536bbac03da10ac95237eaf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598623, "uuid": "e3a530fb-3d40-4e44-a5b4-355b030a13dd", "comment": "Malware payload (AgentTesla)", "value": "f243c7c6d96156882315e6c3baa3a350120050303cd7c4c1c8c6ec2edaf8ba71a85f76cf3816e22176e9125ad9112f8d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598623, "uuid": "57fca8fc-d7ce-467b-961a-d8aa17f59f82", "value": "T17F43AD9C722076DFC86BC6B5DA591C64ABA134BB531BD207985325EEA90CB83CF150F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598623, "uuid": "a077cfd4-5665-457f-9377-e5081d7877e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598623, "uuid": "41a0c2b7-79fa-4923-9fcb-bf261d6443eb", "value": "768:QWS3eRd0L4WPFuz0RaRC2PxzeZ1GSlwhYyeYeX4olg7eSyLugybrdrS46kgW6aba:QWSsd0sWmPP1Ts1D55yje", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693598623, "uuid": "76fd954a-a986-4ba4-827f-be7298c13565", "value": 60416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693598623, "uuid": "6abf7e45-6b81-4bbf-a47a-0ed534dadb30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598623, "uuid": "72b6b09d-2f26-4e7b-92b8-a08c62e129af", "value": "E-DEKONT1,DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25ac3770-4910-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693604419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693604419, "uuid": "024f1fb3-400c-4c1b-9d34-cad0567944ec", "comment": "Malware payload", "value": "04172925394691c755c3c6e95dcac708", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693604419, "uuid": "38d9af3a-01f4-49a5-89ee-7c2de9caca8c", "comment": "Malware payload", "value": "f52010b1bacbab1cf11cb8c18de051e160613a1e5877ea20ad4920d9f1f8dbd9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693604419, "uuid": "d27ff27b-bdf2-4790-a748-7c0761fceda7", "comment": "Malware payload", "value": "48125547ee74db72b1e9071aaa453d606fb17dc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693604419, "uuid": "595d286d-7780-476d-96d1-d8970a97d9ac", "comment": "Malware payload", "value": "5d3a0dbb435e88764e6a0a2a16aaeef838726b9054f6d788a74d6255924184a707532a3ff36007debb2f4019b50b7c38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693604419, "uuid": "35c8f642-1e54-44be-8f54-7a5957c6332e", "value": "T18584C54392E13D58EA258B739F1FCAF8F70DF660EE097B6922189E5B04B1076C263715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693604419, "uuid": "8af4ddf9-fb5b-4bb7-9e66-54d6d19f74df", "value": "05ee59df2bbc43c078e8ef99811a7d49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693604419, "uuid": "0deec837-bbc3-47c6-9bb4-8a3ea291de24", "value": "3072:RCukSS9S4NVc4mYNGx424jHdpvp6/z8OUtbBMqdnBsMZhwTPKNKLPcOJdxH/WlE:Nu44NVcZMGUn4/z8OsdBvFgLUebH/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693604419, "uuid": "6131ba3c-da7e-4d5e-81c6-f42e23200807", "value": 398336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693604419, "uuid": "d0631888-1304-42cf-b79c-6e64840481cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693604419, "uuid": "670c5022-41a2-4cf0-b179-073bb03a9af1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d2d9264-4905-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1693599707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693599707, "uuid": "5f9a0ffc-308c-4cc0-b94b-b3e8f5e4ebe8", "comment": "Malware payload (Fabookie)", "value": "20f4484c3c45ab6b7ea688926eac9a41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693599707, "uuid": "748bfbb9-5e17-4899-806e-764c82a4988c", "comment": "Malware payload (Fabookie)", "value": "f74fa3cddd816dadce025ca6183481138cfe17fd59827d16e34f2255dcfc18e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693599707, "uuid": "78f04eb4-0709-4d10-bdca-ef9dadf2b5f7", "comment": "Malware payload (Fabookie)", "value": "69e88e8fdca83d05e7daeb94ea36da3ce10a497c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693599707, "uuid": "a32565e1-d10f-48f3-8bfb-b2321f229557", "comment": "Malware payload (Fabookie)", "value": "468b7d885a581df7f5cbd05d9f7b540c4c06e43b591ebc7ab0f20bb33e5e034951f37cda6b732d333f683bb3c1837014", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693599707, "uuid": "ae3059a0-91cf-4130-ad79-797998384ee1", "value": "T126F42B56FBBD4272E051C135C9A6E7B5E6B27C865D30970B2345EB2E2F335118E3AB20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693599707, "uuid": "fe37e969-e62c-41d6-b790-785d41cbca07", "value": "f2fcd0efb031ebebeaa83cd4cd21090b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693599707, "uuid": "746f969f-273b-43cf-9742-353032cbffcd", "value": "6144:XA01NdMuvxQWQSzoYaE5kiLNdRxQ7cUBmCUiJbc77ZvfuYuEdGxTC2UWf7xLUnwa:Xdz5QWJzNLNIShtdGxTC2U5JL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693599707, "uuid": "fb52fcb8-19b2-43dc-87bd-7bcfdbdf52ad", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693599707, "uuid": "8fc467b5-3fd2-4944-8b5a-ef304d7f9d5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693599707, "uuid": "e7afec04-cefe-47c8-b917-d551c92f89e2", "value": "20f4484c3c45ab6b7ea688926eac9a41.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3de37ea-48ca-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693574647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574647, "uuid": "7834704c-8ecf-437e-8092-85c86ad96b72", "comment": "Malware payload (Mirai)", "value": "f522d480281be98c9184871902d98346", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574647, "uuid": "043fa34e-11e4-45a5-9819-76f38bae5d63", "comment": "Malware payload (Mirai)", "value": "f7e128f6d3d835d0eb75e8c3ad4ee8dea133155e1eebb60b70d1769db8186397", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574647, "uuid": "3feed506-8038-449e-aa59-20c4523a57f9", "comment": "Malware payload (Mirai)", "value": "9f88df3a00d9fe099bdcbdf212654bccae2eacee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693574647, "uuid": "5478c785-2626-4eed-a08c-2072a21523e5", "comment": "Malware payload (Mirai)", "value": "39fba5b3a4a145a4bbca196d5960042d70ecfd17ddcecb46b24dd7463f408fbb38fbee738bdb7f8daa586a07b207d3a4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693574647, "uuid": "844ddcd5-f7c9-4ffc-a7be-d2201ca5be6d", "value": "T176D2E12C895DB905CAAD3EBD80DE5AF5398CB4C0A35DE68E17668414FB17E47FC070A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693574647, "uuid": "15834173-88ed-4778-82b0-6a94bc2e07ee", "value": "768:D1uUtLrVDsAp6tLkF4FuetwEub4sU/M9g36KNH6MsJbmW2:DbDs06t4BEub4sU/MbUaf8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693574647, "uuid": "09adb871-1d8a-4af7-82f3-204129f73135", "value": 30564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693574647, "uuid": "094ac3e2-6a6b-49e9-a4c4-3a71543822ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693574647, "uuid": "f64e202a-465e-477a-94e3-860b2011a127", "value": "f522d480281be98c9184871902d98346", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6c647e7-4902-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693598650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598650, "uuid": "8fdd55ec-d708-425f-b5b4-db8128f23715", "comment": "Malware payload (AgentTesla)", "value": "9397f64eeace43eb2554036ba41657a1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598650, "uuid": "9221112f-f4d8-4cbf-bb16-4d459e87700f", "comment": "Malware payload (AgentTesla)", "value": "fc2bdb118068cfdd4ca52b23bb40d53c596383ca3c182eb4a66c10f95722562a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598650, "uuid": "ddec350d-33ea-4833-b05a-5e13cfbfc6eb", "comment": "Malware payload (AgentTesla)", "value": "de2b2932329438b3c48cfa0a5611477cc34ecc56", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693598650, "uuid": "a1dfae25-0389-4959-bf40-e253bafd4990", "comment": "Malware payload (AgentTesla)", "value": "bdc9c44179219b40cdf5572d28f813abdb46d3984332d11788246ad59b8837b275e92bd0c824ce4d9c45089026859492", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598650, "uuid": "6cc2ab8e-8f12-418b-8e6a-006f72601265", "value": "T1ADE42381C98DE1E5CA1C56BB6A08F8DCE16910400BDB078E8DFC86B58DFD6BB455D27C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598650, "uuid": "03e771d5-40e5-4deb-8e1f-61eee1d13ca5", "value": "12288:g0nWzG0E1otTjWNmQ6QM+/ag5fnrSvVPtjEAV+Wb/SWgnM6+fX2RYHnGiT1ITlr5:TpnotTyNmvJWP2vVTMF1MFyYHTWjy/K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693598650, "uuid": "75ed96f8-7422-4601-b527-036820f45798", "value": 711579, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693598650, "uuid": "2c23a7d5-a2ca-4d7c-8084-af83101b1e3b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693598650, "uuid": "8b47b947-7b3c-4258-a307-cc9b08fdd9c6", "value": "SulerDExw00953.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ae3b04c-488c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693547895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693547895, "uuid": "317340c1-194f-473d-8413-e346519d5bc0", "comment": "Malware payload (RedLineStealer)", "value": "fd9bc3308e0bc8cb74950961ba7998a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693547895, "uuid": "b0d289ca-e8f9-4210-b43a-4e5995dd2482", "comment": "Malware payload (RedLineStealer)", "value": "fc5d73a95abb848576fbde8604dfde6145277131dc9be39cdbaf84644d174029", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693547895, "uuid": "4778ab46-91f7-4e29-9e52-a39772e7c665", "comment": "Malware payload (RedLineStealer)", "value": "cd4c1262df956f0a7dc9d98b96aa5367b8f9003d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693547895, "uuid": "97ababe3-1ebd-400b-a636-9fdd2e952fa3", "comment": "Malware payload (RedLineStealer)", "value": "b87f9dddfb86b9b0e7587bf6105fd49f217d097030b3b74839518ab3d8a5d9388542c26b59cf89b2902164c9741e2067", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693547895, "uuid": "67b2c5ff-4297-4690-b146-8d6c4d703c33", "value": "T14F051256F7F58422E8B25B7059F717CB0B39BCA54870836B2746A92F0CF2645A43237A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693547895, "uuid": "2631475c-6e34-44de-aca1-d7cd8ac48d43", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693547895, "uuid": "90b0c558-80af-4126-8a95-37afc6724d85", "value": "12288:ZMrly90hMOBS+UCCPcrM0JNCL20ThdSVVFbXtdWwNbSezqnnCM6LJw:MySlS+UAM0JExTOZDtdhtzaClw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693547895, "uuid": "bb1fb43e-7d3e-4980-8623-c0bd7656e8d4", "value": 849408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693547895, "uuid": "af7a58c4-1ff2-436e-80da-63de6936308e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693547895, "uuid": "faee85a6-f8af-4de8-8c74-45d526d2a6ed", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "635ee0ad-48da-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693581330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693581330, "uuid": "cb1dbb8b-6eac-46a1-804f-db30107b2aa5", "comment": "Malware payload (Amadey)", "value": "2444731660e17b60c198a17d19e14266", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693581330, "uuid": "4e043ce3-e7f2-4416-9b29-a54a3dfdbb02", "comment": "Malware payload (Amadey)", "value": "fdb5bc623237c13a42ffe675d4ef194d2da48da92a897f74bf8adc2108525e17", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693581330, "uuid": "f912263c-9ddc-4002-bafc-85eb24d44652", "comment": "Malware payload (Amadey)", "value": "884085a78905b50035ac22ac37b9c17f6278654b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693581330, "uuid": "40d8bac1-d12c-4419-9b35-ba1e7c2813e9", "comment": "Malware payload (Amadey)", "value": "ae9789c008fe29b20cf22f1ba906a7613ac93cee31b49394b85236f09139481f980bff97f1eceeea3aa13d2b68eaa112", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693581330, "uuid": "529b50eb-ce10-4d0a-ae4d-9000239f0dba", "value": "T1F53523149BEC9032D8BA677008F71253A6357CB25D78C6EB734A5E470CB26C2393673A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693581330, "uuid": "f0209fde-9b74-4584-948b-227caa6bee17", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693581330, "uuid": "49c35e13-4f42-4161-86fb-a9cfc3ee78ed", "value": "24576:ZyeTeLw+o7+Itcq6X6ey5w4J/vv3GJOJ1XJAmh7xncG4kj:MeTeLwp7RSXhy5eJoJXh7xncG4k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693581330, "uuid": "50527187-7423-4ba8-9706-81b4aef5074b", "value": 1149440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693581330, "uuid": "ccd969c6-4055-477a-97f9-721067ed836a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693581330, "uuid": "11095d54-e2c5-4b6f-a62b-3b16c078de50", "value": "fdb5bc623237c13a42ffe675d4ef194d2da48da92a897.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0c68a69-48a0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693556522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693556522, "uuid": "55507f00-8c2d-4f26-b1bc-e9c7454e38fc", "comment": "Malware payload (AgentTesla)", "value": "fde99a622d06401b34fa136850f09141", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693556522, "uuid": "9113ddc7-7164-4a09-9a0e-889d0b78535a", "comment": "Malware payload (AgentTesla)", "value": "ffe373cf9e34085791fb7316ce35f7bc1dd03f1fddd51060b7e3bf6f4f791319", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693556522, "uuid": "5d744565-1d27-41ce-926a-5bf730528948", "comment": "Malware payload (AgentTesla)", "value": "7e24c0531195b5a663f9981e278bd2592c51dc54", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693556522, "uuid": "3ef5fce7-6dd0-462c-af0c-86dc211c505d", "comment": "Malware payload (AgentTesla)", "value": "598aa996b5db45445de11c860f3f13083ad6139897afd114bc2e5a09f3b3931880d13df9ee07f34aca8650a9319078cc", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693556522, "uuid": "96728bb5-4e35-4706-b0ab-7a03c57c5567", "value": "T1F7D4235939D5DB55F4E60EDA1C86B1CA093FD287A6D1AF60230160CD3D89ECF28C4EAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693556522, "uuid": "9d105604-5beb-4657-a864-9b3e0574eb8d", "value": "12288:O2uMDH03q0xdlXsrkIbD7VClCpEwhjl79iLizWicUe20gP6cUzmGFHAML:O5MkFxdlXsrkkD4oEwhjh9ZWiLt0CbUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693556522, "uuid": "631f44d3-ca49-45c8-9b5b-e4c426c72397", "value": 652845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693556522, "uuid": "6f1a2e5e-1bab-406b-9e07-dbc498af0bfa", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693556522, "uuid": "36c5e2a6-7269-4c4e-ae85-10d3cdbec09d", "value": "Bankdaten_Deutsche.xlsx.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }