{ "Event": { "published": true, "date": "2024-02-04", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2024-02-04", "timestamp": 1707091381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "be528ff4-db2c-4b9c-81bd-4fde1b434c79", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56d95592-c316-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707021120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707021120, "uuid": "4c491d48-a338-464b-a034-0ded07b81dbc", "comment": "Malware payload", "value": "deff93081ccb3fda7a12f6e9e3ad15ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Rusty", "colour": "#F10BFE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707021120, "uuid": "f5cda26c-1f23-4f61-a8c0-45728ee427cc", "comment": "Malware payload", "value": "030eb56e155fb01d7b190866aaa8b3128f935afd0b7a7b2178dc8e2eb84228b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Rusty", "colour": "#F10BFE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707021120, "uuid": "e4746842-3a43-47c0-9c9e-2409c558e756", "comment": "Malware payload", "value": "40b88819594091111c93bd9578b82dedd0823362", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Rusty", "colour": "#F10BFE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707021120, "uuid": "c24996c6-a08c-491f-a83a-5626b1a34d30", "comment": "Malware payload", "value": "03e7d33a67b349d420147b466083f74db68d22b4e058abacbde4165ce588cc70969990ab0ca5247ee65a124aaaf77252", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Rusty", "colour": "#F10BFE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707021120, "uuid": "05b3eab2-f21e-46e9-ae3a-2d1fa1b9449e", "value": "T147154B07FDA204BDD9B9C834861EA273F639B85C421176377BD85B302E25A20DF2DB95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707021120, "uuid": "620b164f-325e-4e67-8f1b-e765d46a47e5", "value": "24576:aR4f424TMgHBwOmA8vzHhyKDnPAzRDLZUaWX:aR4xzgHVmAIHhnDnIR+aWX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707021120, "uuid": "eefc6951-84f8-46f0-bc57-5ef6a38d5298", "value": 878824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707021120, "uuid": "4bfc1b25-0866-48c8-8dca-d78fd538b469", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707021120, "uuid": "d82ffae8-fca7-4fbe-915b-79ffeb49a6d1", "value": "gEsD2heW4crIT", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5505bc08-c34f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1707045599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707045599, "uuid": "f6747d8d-0254-4914-89e8-2f5d64b3a90a", "comment": "Malware payload (RiseProStealer)", "value": "7f39f45301caa3945806324282dec7f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707045599, "uuid": "6e468b37-2d3a-4f8a-9f40-38e4b282e190", "comment": "Malware payload (RiseProStealer)", "value": "03f12ab1faa19de44091129611bae311b5e73c054747fda67491d7c6fcaaa58a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707045599, "uuid": "69597b17-4143-4e24-b6dc-6e5515c31d1a", "comment": "Malware payload (RiseProStealer)", "value": "84794be765a212c8fc06f369b62d6988333b8be3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707045599, "uuid": "0e2e8e02-152a-4647-8867-95235f6d6c90", "comment": "Malware payload (RiseProStealer)", "value": "1a9038ff228b74be66a74a4a74fc772a06bbd933eb7386cfdb574713e67efc9b2c73e54babddb0e17ec02dc9587e310c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707045599, "uuid": "62f131aa-c6d0-46d7-94c7-1500460e4887", "value": "T14A45336593359E02DF20A4F935EE29B8A7B179DB3014A3A9664704CD4FA04FF2F6118B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707045599, "uuid": "094a4634-c5db-4bc6-a7aa-845a74c46dd2", "value": "5ab723dc8d5af21b79dc301ed6a56a64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707045599, "uuid": "5fa270fe-ca21-4ddf-9e2d-0d273a67553d", "value": "24576:tu3QB+Eu0vu4KLJd5oPExpMsuc28Rj8oFmwQN6icoEClJFymLpmMEF:tu3xE/m4Kdug9FmlMoEaJQmLEZF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707045599, "uuid": "549c447f-0b5d-437b-a586-7fc10404c87c", "value": 1197568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707045599, "uuid": "3f025725-ee7f-4c8d-bb2c-4d2dcab8ed0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707045599, "uuid": "4e69bfb9-3c2f-4595-ab4f-9fcc440399de", "value": "7f39f45301caa3945806324282dec7f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4f29f18-c32d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1707031237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707031237, "uuid": "fba18b69-7e08-4ac2-89d0-876bc0306ad4", "comment": "Malware payload (Stealc)", "value": "627ffd31a7c7b86d813cb8b853c45374", "object_relation": "md5", "Tag": [ { "name": "cre8ure", "colour": "#7B880E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707031237, "uuid": "1e7e1292-f180-4f27-8aa2-e586f94549cd", "comment": "Malware payload (Stealc)", "value": "04934437e59c31551119638b9d181bad27c3a5092fe409d0cdcc1769edafb825", "object_relation": "sha256", "Tag": [ { "name": "cre8ure", "colour": "#7B880E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707031237, "uuid": "27945427-085a-4c5b-8eb4-d459236c25b3", "comment": "Malware payload (Stealc)", "value": "e961a97c49e318960ea073998629f9ccec0ac8e1", "object_relation": "sha1", "Tag": [ { "name": "cre8ure", "colour": "#7B880E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707031237, "uuid": "bbe6c2da-cf07-4ac7-bd2a-03ccc2be579c", "comment": "Malware payload (Stealc)", "value": "29e11039d1d6a00a430d30f60c263d63924e9061a3a436f94bb456edf4f452583d9e61517c0a0ca05b1a24d8c157b48d", "object_relation": "sha3-384", "Tag": [ { "name": "cre8ure", "colour": "#7B880E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707031237, "uuid": "33d5ef7a-70c5-48ac-bdfc-e37fe26d9da5", "value": "T110546C1033E5D035E2B7963589B4F3F14A3BF8622673DABE7A91272B2E343918915707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707031237, "uuid": "7f6bcb00-482c-435f-ada8-66fe862f21b9", "value": "bf14849f4ab78a7abfe404cb860b648b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707031237, "uuid": "fa2326dd-49bb-4c52-8f80-ddfc86ea7816", "value": "6144:hWAxztUVn2x4R3RqLGA8b1OZq61U42UQL1kDc:hVOVn2xIBqS1b1ON1U4QeY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707031237, "uuid": "20210ddf-f32c-4701-84e9-00d0fbbc21d3", "value": 301056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707031237, "uuid": "bfdc2d60-0540-40c6-8038-d985cf7960d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707031237, "uuid": "b07ae284-f970-485d-b32e-c0d16acf274f", "value": "syncUpd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae134d02-c367-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707056056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707056056, "uuid": "36fb6e61-7d3e-4608-803e-c6e1ab664e3a", "comment": "Malware payload", "value": "5aff712144d6d600b8d6077f64cc8367", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707056056, "uuid": "29c7de40-296b-4c90-a5ee-faf9a191a6d6", "comment": "Malware payload", "value": "049c1aa7ff166f599c44692148fc6bfd66246ce49c4dc7b77491838e037c1c1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707056056, "uuid": "cd155979-2a0c-467f-a291-fec5d3496dee", "comment": "Malware payload", "value": "14a88a4161ac233ca3d37ec42c1f85fc2a236048", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707056056, "uuid": "ffe53ece-a227-4be1-b5b4-818714bfa63e", "comment": "Malware payload", "value": "d898a891eed03856561d6ed56d233f462b6d5f2934dec9464fdf2eac4cd99aff0fc8de03770d9af8392fc6cc71033a2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707056056, "uuid": "bf2b5496-7bc3-400c-9a8b-e1546cb23917", "value": "T19AE5C61DB1D0DDF0C389503A3389CA6AE464BA752F46F962BBD2E39B15340CF965DB02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707056056, "uuid": "e78d5b57-ffce-446e-8f18-dbaacc0b2d1a", "value": "49152:XSyAhVHfUB2EwBCpTWmrvmYGJGQDjrGSLKixlTCV0qo:XSyAh9UIRcTVrv2nTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707056056, "uuid": "54e41699-85d8-4b19-b5e5-a69a95cf94de", "value": 3215008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707056056, "uuid": "a847ae4e-49ac-43c9-accd-ba7aba42d91d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707056056, "uuid": "26e83296-6d31-4f2d-b586-8ae64a3f3d6a", "value": "049c1aa7ff166f599c44692148fc6bfd66246ce49c4dc7b77491838e037c1c1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76603272-c384-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1707068418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707068418, "uuid": "afe32e26-c7a5-48d7-a983-71ba98e9df10", "comment": "Malware payload (Stealc)", "value": "afa6d712a8073358da65fb1582a11057", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707068418, "uuid": "c2d7d3e8-661d-4cc6-96da-e503174096ae", "comment": "Malware payload (Stealc)", "value": "07b7e6ad9534a1acbd3dc3fedf8b0dbb4ce8236dcadb66316af269f49e3194c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707068418, "uuid": "5cbda8d4-9f56-4408-956c-dd801fdbbe70", "comment": "Malware payload (Stealc)", "value": "d1dd40c98c22c71634e1c7d3730dcaa2e46a48f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707068418, "uuid": "41ab6f8c-38c4-4768-84e5-d17e793eaca2", "comment": "Malware payload (Stealc)", "value": "659d8f5318c56d6ccabcba8b8d62fc9b33a99cc9c7631b5371462977e8bb6beab426d584e465631a2b1a6d07e21b04b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707068418, "uuid": "67f463e2-9ee1-4b8b-9dee-5cc74a11f80e", "value": "T1A8649D1133F5E031E2F726354A74C7A54A7B786278739ABEBB911B7B2E34380891471B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707068418, "uuid": "c585158e-a757-4fc1-8925-11d589710aee", "value": "98be55e334636f2b313f62420192c2b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707068418, "uuid": "91c357c7-677b-4e88-a8ce-ea47ef5b5492", "value": "3072:X0YS185yeypVEV7PCU9UaVFcPzsIeXcLMLjP5x9cUBI28h7bTp6Pk1vjHb6P0s4g:XFS18ceDCURXgh+tfP5LSbJ6Pk11sac", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707068418, "uuid": "bb9daa62-bb01-4078-86d0-9686853d685b", "value": 308224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707068418, "uuid": "d08c8dd1-0c02-4619-8749-608fcef3a358", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707068418, "uuid": "56b42738-7212-4cb8-8b1c-36dccf5e2612", "value": "afa6d712a8073358da65fb1582a11057.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adac0e1e-c354-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PureLogStealer)", "timestamp": 1707047895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707047895, "uuid": "c5715dac-2b69-42a9-a184-415875012dca", "comment": "Malware payload (PureLogStealer)", "value": "6e365b04dd5fb443c9c29f05fc6fc3ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707047895, "uuid": "9cc4b160-8566-47e7-9e84-b2f84c0c02ed", "comment": "Malware payload (PureLogStealer)", "value": "0876db82ab833f6e84f0424e4ce8d27cacb57cbb35ebd3d2eaa5c2bbef861c42", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707047895, "uuid": "e39d0b20-39a8-4e3b-8356-90b0c45d1cd8", "comment": "Malware payload (PureLogStealer)", "value": "4fbcc7ebdda1069cbbe7cac1f4a59f1bdc06afa6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707047895, "uuid": "55135234-cc0e-4ca1-a85e-890f03cfad52", "comment": "Malware payload (PureLogStealer)", "value": "9aeef083ee557db9bffe686543646e2761f6d7dddc656ca2efc06414cefe0e2003f161fee90fe3255c34e48c7dc45e86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707047895, "uuid": "92b9b166-e44b-410c-98dc-1af3265c3f03", "value": "T1B5352314B7CDF613D62EAC3DECC24902C7FEC1E6BA42E2069D845F5D11637D66A0A8C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707047895, "uuid": "12c2efb0-4113-4efe-8a4f-608b21b3b7f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707047895, "uuid": "beef6c4e-c306-4c85-8cba-0f9c3ebdf82f", "value": "24576:ccEteje14l4zS1n1gJUP418/SY7caG/k4C9Z2N47krFIFsLe:lEKgS1nLP+8/SY7cb/mZ2N47sFIFZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707047895, "uuid": "e588e947-32db-437b-b620-539ce8f1e4d5", "value": 1080648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707047895, "uuid": "fc898dd8-494d-4a53-94fc-4e17fbb85d7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707047895, "uuid": "0da4707a-5707-4373-b5f4-f7f90f84db7e", "value": "6e365b04dd5fb443c9c29f05fc6fc3ea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4aa8e2d-c324-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1707027318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707027318, "uuid": "339a1ecd-5b7a-469e-8039-7767c53987f2", "comment": "Malware payload (DCRat)", "value": "9c82ecc2ec50d32c697a3e0dcadb8641", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707027318, "uuid": "ebd33078-d170-446c-9fdc-0f34426eb41a", "comment": "Malware payload (DCRat)", "value": "08d9d5c3b0a134a56085e058b5078dbf68de75dc98409dff52c7dd5075598c3a", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707027318, "uuid": "5a724fc2-e981-42f8-ac09-521e79794922", "comment": "Malware payload (DCRat)", "value": "b544a1c90b4bdcac3780616fad4aea98c83b2fb1", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707027318, "uuid": "34e9e039-617b-43e8-9401-2c239d45e68d", "comment": "Malware payload (DCRat)", "value": "dfa3d96c53494d7180327c545dad6275e9dfd51e026d86c6ecee8e90a9e9c65a4241c356c76da3aef2664206f72211cc", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707027318, "uuid": "7f66a1bb-9bd0-407a-81a3-6f48b8d5907f", "value": "T14064591833EC4B19F1FE6BB6D4B351559770B89AFA7EEB0E5D8190DA1822350CD00BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707027318, "uuid": "04a2efd5-60ff-453a-97d3-e4bb296e59ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707027318, "uuid": "30756c35-1c11-4193-b07c-1f0929afd64a", "value": "6144:mWLMy2oo7Ky1XO/qIqINSDrmiAeN6x2eTxWliA74jwmxcbcr9u:dZ2N7Z1+rqIgAea/vEmxRZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707027318, "uuid": "5ab28a48-f28d-467c-ae64-c52ead2bb0a6", "value": 327680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707027318, "uuid": "51b6eaf5-e2a5-4fc8-b122-c6f0d6d7b6ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707027318, "uuid": "178a5aaa-c214-4fc0-9645-8482bc8f1f3c", "value": "9C82ECC2EC50D32C697A3E0DCADB8641.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fa64c80-c32d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707031121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707031121, "uuid": "d18eab60-ac41-423b-9a0b-7a0086a9fa13", "comment": "Malware payload", "value": "9738759d7c031f42f02b84a1a5614f1f", "object_relation": "md5", "Tag": [ { "name": "AutoIT stealer", "colour": "#54EB1E", "exportable": true, "hide_tag": false }, { "name": "cre8ure", "colour": "#7B880E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707031121, "uuid": "85528e84-ac5a-458e-bd2c-1cc6270b32c6", "comment": "Malware payload", "value": "0b70a2bcddfd035871adbce755b88113eceafea5086271c64f095ec88b85b98d", "object_relation": "sha256", "Tag": [ { "name": "AutoIT stealer", "colour": "#54EB1E", "exportable": true, "hide_tag": false }, { "name": "cre8ure", "colour": "#7B880E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707031121, "uuid": "f77836ae-be99-4be7-b4d0-4323dbbcee49", "comment": "Malware payload", "value": "faf550b8f2ab59dcadbeab9f9b90f91bbb41a7fd", "object_relation": "sha1", "Tag": [ { "name": "AutoIT stealer", "colour": "#54EB1E", "exportable": true, "hide_tag": false }, { "name": "cre8ure", "colour": "#7B880E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707031121, "uuid": "7319435b-8ff1-4c62-b86a-7658870fd694", "comment": "Malware payload", "value": "30fdd7cd0b02a2886fe96adda48413ad57a030d5870fa157320993930e254db8a0ed80b08219f80e09fa39568acc60e8", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT stealer", "colour": "#54EB1E", "exportable": true, "hide_tag": false }, { "name": "cre8ure", "colour": "#7B880E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707031121, "uuid": "3b38b6d9-e0ac-4ede-beb1-1a206e3e4284", "value": "T16B159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13A81D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707031121, "uuid": "8c69138b-55aa-451e-9b55-6b9c4984fc65", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707031121, "uuid": "c943fd04-3ff5-4803-aea3-5d811593c7af", "value": "12288:DqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgarTo:DqDEvCTbMWu7rQYlBQcBiT6rprG8avo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707031121, "uuid": "ee5b1d9e-42fc-4840-8145-23f6bff7f764", "value": 918016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707031121, "uuid": "0de99521-3ca1-45f4-8346-b3e946337f1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707031121, "uuid": "d80643be-b63e-479c-a2e0-5b5680c64426", "value": "no.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8659a120-c343-11ee-b7ea-42010a9c0006", "comment": "Malware payload (NanoCore)", "timestamp": 1707040527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707040527, "uuid": "3f83bb22-a094-487e-a415-4effce143a02", "comment": "Malware payload (NanoCore)", "value": "b738c981ee80fef191c95d3d030ba5b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707040527, "uuid": "8bf5bc3d-7d91-4cf0-9dd7-dc7dc4b616c5", "comment": "Malware payload (NanoCore)", "value": "0b9ca6e1597ec89cc959fd7f59820216473675c4178cccc5a533551ab8a61099", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707040527, "uuid": "34ba02d1-2899-4aab-887d-4d00664e89c0", "comment": "Malware payload (NanoCore)", "value": "5f2835a1e94f83b38eb7dc5f1b90deb2edb0b3ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707040527, "uuid": "c5aa6dae-60dd-4463-b467-f1df863ff893", "comment": "Malware payload (NanoCore)", "value": "fc076da92e308c0317a137c9d33d83a43db9cc5c5bcee5ee1f4ddec2df649278388263b19632537dd23936e4219f205c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707040527, "uuid": "d318e5fd-8dff-4bd6-a9a7-fe86b357ba75", "value": "T1D6A4E77D81329C4CDCD4DEB5CC003D918F49EDAAD5562A2E9C94B0BF887E9780B974CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707040527, "uuid": "458296d1-2172-4169-a1f8-918decf675fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707040527, "uuid": "7a7d4681-e596-45ee-97b7-bec0d777bc80", "value": "3072:pzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HI/oRL/1eORKOfUxCvq2RhFVyFR:pLV6Bta6dtJmakIM5FvpKpp2RVyFRC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707040527, "uuid": "94da7e88-06c6-4975-ae1c-0a0f49a5f34e", "value": 478208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707040527, "uuid": "b289a88a-2c8e-44a0-a851-5205d031ecc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707040527, "uuid": "9fbe5429-b7bd-47b2-abb7-86f822ca23a3", "value": "B738C981EE80FEF191C95D3D030BA5B5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6960f36-c361-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707053601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707053601, "uuid": "21024677-ff98-429b-ac19-51bd2bb0f02f", "comment": "Malware payload", "value": "00f91c64275bcebd7ac085a4704abf72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707053601, "uuid": "2d2b46d8-a327-47b3-89f3-c868f2faa04d", "comment": "Malware payload", "value": "0d1ef6c812920ad4fe47f5d2be750861467bbcd9bb20df2705bf54fb5fa19234", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707053601, "uuid": "90ff34e6-2499-4b36-b052-3bc7e4d24af4", "comment": "Malware payload", "value": "60320931c27c0ab0158c373a29f585958d8f45aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707053601, "uuid": "2a2c33f3-2d92-4642-911a-b45b0bf8a566", "comment": "Malware payload", "value": "373902e6ec2479dce836d61b9ac68b50bc0851ccc5f96fea572936006b2ee2e145457cc2baf09a88fe4a5031ab378eaf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707053601, "uuid": "1d23dae4-83a8-4cfe-b981-904d841ea5d1", "value": "T183A51254B35008F4EAAB923DC941C52AD776FC611324DACB03E8A5A73F277929C3E791", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707053601, "uuid": "231a717e-2487-4a26-ad38-1c7156c4b857", "value": "bae3d3e8262d7ce7e9ee69cc1b630d3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707053601, "uuid": "1a5ec059-c85c-4141-82de-d2d576554ba2", "value": "49152:MQDTE8yqcY99I8OR6fJyoik9O5AU+YJzKNdPXJNF8eMgWgZ4fmlapih1:pY899fA6hFik9O5AU+YpK7JNDVr4+h1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707053601, "uuid": "612f62c1-cd42-4a27-81a5-32738fa854c1", "value": 2207790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707053601, "uuid": "a2863b0b-cf62-4189-9028-037d7d1bb071", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707053601, "uuid": "0c865c7f-e0e0-4637-8f55-36ba6710709b", "value": "SecuriteInfo.com.Win64.Malware-gen.776.5331", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "133e41ca-c2f7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707007693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707007693, "uuid": "bb77c395-0050-4bda-a169-210c83789f55", "comment": "Malware payload", "value": "0d5f686b51f86b081d0d6d1daae64e3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707007693, "uuid": "740d6e07-447d-4f5e-9a81-adbc8a4ccbcb", "comment": "Malware payload", "value": "0f333f516979734a68f706ebc0306fc5b4724e188a51937f10f012daafc956dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707007693, "uuid": "623f986c-c508-4a21-bfb9-8f391f1d58f6", "comment": "Malware payload", "value": "cd38def382c158c164ad76530550dd821f0fb5a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707007693, "uuid": "d32a196d-60ea-4bed-84bc-94c76a5bbb86", "comment": "Malware payload", "value": "84ddad7f7f1915adae44173a088b2cb1dd9ab3f9d2201c14fe94a51dc45fdd9c172a85c0f164668c9777d578bbf1a108", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707007693, "uuid": "96afcfa1-2d22-46da-abf3-c50df6a58fd3", "value": "T145C37D67671810FCE2ABE2BCD6964A52D7B1B845032093CF53B0852A0F637D47E7EB91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707007693, "uuid": "95ab1007-a6ef-4dd4-8f87-36a69b26f079", "value": "e4fb669a28ae0ba455045aa3cf04203e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707007693, "uuid": "7e75eb5c-5729-4e3e-96dd-a208a99da01a", "value": "3072:zfrpYP36FypCZ2K5a79BmJTQSaMm5/6ro:zf9YP36FyyzU8Wlqo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707007693, "uuid": "523e77cd-b11e-4c76-89e5-def6f38c7635", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707007693, "uuid": "46e1cc9a-717e-4e58-8efd-4adb00356732", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707007693, "uuid": "6bbeee72-6ce4-4a6e-8355-77350b69caf6", "value": "SecuriteInfo.com.Win64.TrojanX-gen.31797.16855", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54e5e2f4-c357-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707049034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707049034, "uuid": "1aabb42a-d9b8-4572-9c4e-7ed494d23aa3", "comment": "Malware payload", "value": "df322ecdf263412f6d0b01bff01226f1", "object_relation": "md5", "Tag": [ { "name": "BTL2 course malware", "colour": "#9D0DE2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707049034, "uuid": "65cab252-571f-43ad-8a84-27c5b010d512", "comment": "Malware payload", "value": "0f52bd7e357bbb226b2df5886da8c09868fbbb4bbc0590527b7422e032b498d0", "object_relation": "sha256", "Tag": [ { "name": "BTL2 course malware", "colour": "#9D0DE2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707049034, "uuid": "15256f20-77ba-4168-aafb-b86af934d8f5", "comment": "Malware payload", "value": "a02a63e66b937c3037517c5a822eda65cd470254", "object_relation": "sha1", "Tag": [ { "name": "BTL2 course malware", "colour": "#9D0DE2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707049034, "uuid": "244d631d-9587-4e1f-9bb1-405e0bc38fb8", "comment": "Malware payload", "value": "b6df3554eaf8613c9ad1c1d64609b591676ea5f8de728ce20e5160cc8f06beca7d7d2f440e6208062018dc60b3829650", "object_relation": "sha3-384", "Tag": [ { "name": "BTL2 course malware", "colour": "#9D0DE2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707049034, "uuid": "df147f46-6ab2-4eac-b960-3e3c101f8757", "value": "T12694239C4287BCC7E208DD27E80A81E6BDEA1CBBD1191ED58297CFDF45766D0166C08D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707049034, "uuid": "a8450751-3d74-4614-b36b-466e69cd790b", "value": "6144:ag3Qrd5IZkvlrgPOzDx2Yr0/kAt8KkUFskpz/RIe+OFv7P8/BzzhHyqiH8YlV+aK:a6uI2vuO/rcdPz/t+OZ7WBZ9wl+4f9xQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707049034, "uuid": "40b5962c-6cc2-4120-8318-f857fabe9728", "value": 421779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707049034, "uuid": "93cc3ea4-2ed4-4663-8274-075a76b284af", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707049034, "uuid": "398cc1de-fe84-4b71-90a1-9a8b34670d0a", "value": "9f3797e50c23e3fa4c23ab244e29de9f5ef843c71aebc4a59eab3ae8dd91d88e43da82d0a04899371c4a43075098.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7504f312-c384-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1707068416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707068416, "uuid": "f6f10137-9b7c-4d95-9e6e-5afc7ed8a9fc", "comment": "Malware payload (Stealc)", "value": "8631575486d7c2fa771a0878c4a43e91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707068416, "uuid": "4ef8e561-4bc8-4ac4-b5f1-5372b936b1e7", "comment": "Malware payload (Stealc)", "value": "0f929d45b2cf8bcd6a55a6fb6f8e7d61fe65b0dfbe0b27b56850644567027922", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707068416, "uuid": "6a8b021e-094f-49f2-a48b-42658f8479db", "comment": "Malware payload (Stealc)", "value": "ea4fbb4a1f2e1324815743ff75c4e2a8996a4fed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707068416, "uuid": "e03fa5a3-4023-4f08-9aa2-b0bf9e9fcd4e", "comment": "Malware payload (Stealc)", "value": "3f7b6112aeef6ae7c3da7abfd68feca816059483997b0b4eeca4eca576b85d974fee0925c8a436e5e2b7e08ba76501e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707068416, "uuid": "7cabe2a8-b88d-45d7-ab1f-ed680664b5e6", "value": "T16554BE0163D5E031D19725398961C7B28A7B783669239F7FFBD52B7B6F343809A24708", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707068416, "uuid": "a67775d3-b33b-49cd-b360-29f683c2306a", "value": "8030328de4abbcbe9ae8898cebdc9230", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707068416, "uuid": "1e987555-6135-415d-9f66-0b57ce434484", "value": "3072:g0JSlLGeCLdVEVJV/m27lnr0qz1WxXYDKcELjubUPkR79QWyo6P0s4iNT:g8SlLFCOVu0lWNYDJyWUPk/yo1s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707068416, "uuid": "a233ee28-c0f8-4f58-bb8b-8fb36f655b70", "value": 294400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707068416, "uuid": "6097233a-a739-4e85-8632-521fa0b18115", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707068416, "uuid": "40078705-374c-4f22-b9d0-781a94c58634", "value": "8631575486d7c2fa771a0878c4a43e91.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7330147-c32d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1707031268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707031268, "uuid": "fb0aeb6a-c00b-4d08-9c64-04dc738190c6", "comment": "Malware payload (Stealc)", "value": "14e98fedaf97d4f912732b6a768a29b7", "object_relation": "md5", "Tag": [ { "name": "cre8ure", "colour": "#7B880E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707031268, "uuid": "44778e96-f77a-4ef5-8d78-728e46dcf454", "comment": "Malware payload (Stealc)", "value": "102f43a0b1b7c08d017bdd8f9414616f30b5b482549d8610362a5f307dcc3b6e", "object_relation": "sha256", "Tag": [ { "name": "cre8ure", "colour": "#7B880E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707031268, "uuid": "70f651ad-0947-4fc6-bdc2-c97a88839aa6", "comment": "Malware payload (Stealc)", "value": "1c39a9e1248af0eb34812296cd5d3454dff22d6e", "object_relation": "sha1", "Tag": [ { "name": "cre8ure", "colour": "#7B880E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707031268, "uuid": "d23701e8-603f-4d1f-b887-c2f218f1df45", "comment": "Malware payload (Stealc)", "value": "04179a3bde9d99fe70ee082b34c1be177bf4cb5f72218f47de75e31738ddcaa38eeb980d84bdf65195f86c93d34d94f4", "object_relation": "sha3-384", "Tag": [ { "name": "cre8ure", "colour": "#7B880E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707031268, "uuid": "978558f0-0379-4176-a135-336327c46905", "value": "T18F548D1033E4D031E2B75635797CD3F14A7B7C62773396AE7E91262B2E342918A24B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707031268, "uuid": "d80173ab-c50a-4971-840e-d4df95ed056c", "value": "bf14849f4ab78a7abfe404cb860b648b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707031268, "uuid": "2dc903d8-c576-4961-a341-36da8d612b7a", "value": "6144:6WAxztUVn2x4R+ZI6ioekqfw8u0YUn61U42GcV1kDc:6VOVn2xIJoEfwTI61U42peY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707031268, "uuid": "b5236a9b-3fe0-4aed-b5fe-6860311b3393", "value": 301056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707031268, "uuid": "62a2a345-83ce-488d-92be-19aacf54322a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707031268, "uuid": "aaabf9c8-e290-4e07-b4c9-0f97703cd299", "value": "timeSync.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16b4b950-c34c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707044206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707044206, "uuid": "5ca3c822-edde-4c2c-8896-be14ce860d58", "comment": "Malware payload", "value": "b762bfb8df35d247db996634d9eb8931", "object_relation": "md5", "Tag": [ { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "base64-packed", "colour": "#3FC404", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707044206, "uuid": "74302086-9e02-415a-8ed7-11a20ca0d28c", "comment": "Malware payload", "value": "124a5dea8fcd1b3880f07b10316b3e24ca4b1723467e175374c4f0b130a6e337", "object_relation": "sha256", "Tag": [ { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "base64-packed", "colour": "#3FC404", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707044206, "uuid": "632a7be4-308d-43c4-a717-5402cfd710e7", "comment": "Malware payload", "value": "7ae79f30d4c5cda81b101d40e88991099a2ea81a", "object_relation": "sha1", "Tag": [ { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "base64-packed", "colour": "#3FC404", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707044206, "uuid": "9b562dc9-db6b-44a6-90c8-31f5667d6710", "comment": "Malware payload", "value": "d4897e1fbf8afcd695e4c73de0266784daa2440521cdf44630b004dd82cacb7e8ca887004a7baa563813f90bcbe41a2c", "object_relation": "sha3-384", "Tag": [ { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "base64-packed", "colour": "#3FC404", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707044206, "uuid": "60073c67-5954-493a-91dc-338c7b2e4571", "value": "T194F263BA0F672F422FE0140042A69954AA4E45F99F8DCC4E43B85F3BE76216749BD8F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707044206, "uuid": "0b93061e-6645-4336-8987-65b52bfac550", "value": "96:+NU6H5xixFK2rTzCYRIKc4FFF2aFFFVFFvjSc7EgnTLAfEicL/d:/qnIFJr6ELWChnYqL1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707044206, "uuid": "f00e1cc5-9596-4e22-a5ae-74c8ad3734d2", "value": 34870, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707044206, "uuid": "51e371eb-7bd3-4757-820f-b4e3a4083d26", "value": "image/svg+xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707044206, "uuid": "0bf5f56e-8ea0-4030-a950-a53d0d8b1778", "value": "Bill_of_Lading_32984734.pdf .SVG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1446e71f-c39f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707079850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707079850, "uuid": "a249ab43-4a73-4188-b088-04b26e251aa1", "comment": "Malware payload (Mirai)", "value": "90d35bf0d29b1165bec632c0b6a4c0f0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707079850, "uuid": "98e15523-9c02-4fff-b75a-656eff15e57a", "comment": "Malware payload (Mirai)", "value": "1379772cbf23e57a39cf0aadf71cb094f4e3368c357044c2d18f99a052bce730", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707079850, "uuid": "a2a2f25e-1083-4d77-b392-485ff3f5fcdf", "comment": "Malware payload (Mirai)", "value": "623f1895a8ae0687ed8847b5ab1b7b9894c91c47", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707079850, "uuid": "3b6ba0bd-6804-4075-b6b3-130bb8629f59", "comment": "Malware payload (Mirai)", "value": "d08f7f71fb55300740588df6d2a6e7a8fc7dba60007592f432619655ea6f79a4838c580b0898d201b2716541c2f73504", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707079850, "uuid": "54d004f9-30c7-481a-b42c-2ab95797cd6c", "value": "T148534B02721C0E47C1B35A743A3F27E083BFEA9121E4F684651F9B869675E3A5186FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707079850, "uuid": "4f92ee15-c590-4391-b17c-0bfe0c27739e", "value": "768:8txlH4RsYEqRcqERkrL6pGJIus2CH9BZdwoosUsaJBoEHNE/NF5otfKynIdA2:8MrEc6iXmBvwohU7oSS/ZolNwA2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707079850, "uuid": "a11a6816-fd5d-4bf2-abfe-133a833899ec", "value": 63112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707079850, "uuid": "739948e7-1d23-4d5a-9cf9-11321b4820e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707079850, "uuid": "219e2c54-3e80-45f5-9761-3add6a1ad26d", "value": "90d35bf0d29b1165bec632c0b6a4c0f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96b45631-c30d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707017362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707017362, "uuid": "478f7019-f896-41c4-ac05-271dfeaeea46", "comment": "Malware payload", "value": "cb506afedc0cc3254909de314c3ef3fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707017362, "uuid": "c6d4e48e-67f9-4c4c-9aaa-29cccc3c86e1", "comment": "Malware payload", "value": "142ce34310598e577c93649b4ca0271ced8f246a3dd841e2d88e40fe8bc1dde3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707017362, "uuid": "1f86a4e7-a790-43b0-874b-569d7953f14f", "comment": "Malware payload", "value": "8fe7537673e6e7316d267a23e3a030b8586cb87a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707017362, "uuid": "068a2d71-26c7-429c-bb35-21f26d3ebae1", "comment": "Malware payload", "value": "10164a7d15252035b0948607b2e12f06864e19ffff3693ff334faa24d6e2a0054ec2602a62325abb246eac9c8df84bed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707017362, "uuid": "f9f1e1c3-9c21-4178-a47d-fd9932303701", "value": "T1E295017741D8E37AE154213D828DE4E268A41DCCFBC9D9C6FAB97CCEA4FDA134124612", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707017362, "uuid": "039b8327-7fa2-4a43-8f6b-3a8c144f8984", "value": "d879a65e465b1c412670e44fbe2d8e6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707017362, "uuid": "1d88e417-da34-4c86-8cee-eaa239c877ba", "value": "49152:YbrmcFtcE6zI7bc527bgcMxArBeiWADkbmWxwMtRHm1TN3r5AK:Y/m0t7AI/c527bgclroi8mWxVtsAK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707017362, "uuid": "23e96efa-2584-4ea8-ae7a-5846af2db112", "value": 1882376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707017362, "uuid": "9a991e77-6b2d-446a-b88d-20a4284603c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707017362, "uuid": "0209555a-53c0-454f-a08f-7d14475b8e68", "value": "SecuriteInfo.com.Trojan.Siggen22.10132.30992.7049", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29131b1d-c356-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1707048531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707048531, "uuid": "9dac2fb2-2c31-42c2-9e70-3b4d153c545a", "comment": "Malware payload (RiseProStealer)", "value": "7b0e45f57d7b98f3f5c0837019e39476", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707048531, "uuid": "56af0028-855d-438f-9231-0a94636de4cb", "comment": "Malware payload (RiseProStealer)", "value": "1452c77fdb3ef05ddea321c86f3e4504dab58d7b31a12068d729daedeb457eab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707048531, "uuid": "b6231abf-7ae8-465a-b9b9-3177adc9877c", "comment": "Malware payload (RiseProStealer)", "value": "5d109330b1b5bbb53dc0c3599bd14846eae10f74", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707048531, "uuid": "2142a21f-f1b3-4fc5-a652-04fe9c1e3c6e", "comment": "Malware payload (RiseProStealer)", "value": "deedc422e95252634085da0ff4012eb913ada2ef9fb0d1cd10199c6454e742297913125b91a02cdb820cbfc4406abd7c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707048531, "uuid": "2deb8acb-1efe-4845-b01e-35ecc44d1c55", "value": "T1614533FBE32F3A52E208B570A355424C9DF89F2561A9C95221CF47A14EE90FE3F4E452", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707048531, "uuid": "5761328f-39b2-4587-bae4-3e964ade9fe3", "value": "5ab723dc8d5af21b79dc301ed6a56a64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707048531, "uuid": "0b66e79c-dbb8-4d93-9205-d14a19c63fda", "value": "24576:jIxChBjCdOGp6qi4ABUqbOVGlwQIiyIakELMRS8k46D2EW:jAChBCdOGsqQBUqyUlxL8MPkb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707048531, "uuid": "37faab78-cca2-4524-859e-fc0834602920", "value": 1197056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707048531, "uuid": "a0bcf2a0-924a-4be0-9a57-0ab958e7e601", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707048531, "uuid": "b87f9fd9-e4b8-49d8-92ff-7c225c57f141", "value": "7b0e45f57d7b98f3f5c0837019e39476", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbbc1431-c361-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707053609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707053609, "uuid": "727df432-139e-4cf5-a5ca-bc68759bdc34", "comment": "Malware payload", "value": "496f947c498ae50f85f8892262ecb782", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707053609, "uuid": "ae7a48b9-11d4-4275-9715-0df854219da1", "comment": "Malware payload", "value": "15deb483acb4ea3242c27c36e5f083348e25f7bfaa4a64eb2b0979915679ad90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707053609, "uuid": "cc888480-e687-4685-b97f-8f21a00e457d", "comment": "Malware payload", "value": "115de5b06d39f0be23c04dbdf579d271b929c902", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707053609, "uuid": "adef91e7-7b41-45cb-baa0-85b7a48a5501", "comment": "Malware payload", "value": "e9dedd2599dfe470a61526e860b2524442e8b79aff615e8957c1683b827e63025a66b5ad74f9e0a28f2b9aecfb749a9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707053609, "uuid": "2a82dd9c-86b5-4f70-9bf4-f099739333db", "value": "T16C0633BDB54EB55AE4D6D77384983176A68568C3B06982340CDC61FF7B4AFA1EA0F300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707053609, "uuid": "64b3e810-ef7d-46c1-b3ab-0bb695c979f9", "value": "9d6ac900fd9fbf4286a46ae04e4a95e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707053609, "uuid": "9fccfc7e-b0d3-4462-b0bc-1926f92c77e4", "value": "49152:x9oFQP3PMQ4PcQpU4fx7tE5H6aGxXN3khJtAhLsrwhxSJzoacwlDlDthWSTrgYK4:x9o6sQ4PcQUs7tMKkhQ8Jzoml7WS47s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707053609, "uuid": "7af08382-c847-46b6-95d0-806072f05338", "value": 3686932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707053609, "uuid": "5eba2659-3f5d-4413-a792-e0ec444b121c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707053609, "uuid": "ccf31d8d-750d-48b7-9db7-685d439eada9", "value": "SecuriteInfo.com.Win64.MalwareX-gen.31082.11906", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31089ac5-c318-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Zyklon)", "timestamp": 1707021916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707021916, "uuid": "c85b635a-7232-4f65-ad4b-93879d211044", "comment": "Malware payload (Zyklon)", "value": "70add2e399bd523776e8fcd5f86e842c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707021916, "uuid": "89cdd3d7-a34c-4f3c-a95c-95cb7b9dea56", "comment": "Malware payload (Zyklon)", "value": "1842a949efbc8881d7bbe5e6a73385800c0376bd52071ce86dfdb6df60026bbc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707021916, "uuid": "9cee79f1-43bc-4573-83e4-153f7a3b75e1", "comment": "Malware payload (Zyklon)", "value": "327355c2ef33c83c318c52b7e2ca0a8e05c03640", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707021916, "uuid": "3639967e-21a9-44e0-b8a1-0b5bc6638770", "comment": "Malware payload (Zyklon)", "value": "4971abbe91d8d2eef642e1b8fbbc82b4e6fd92472a480b435e9dfdfcacbf57e98df896aa62d0461eabc1f4009db5db95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707021916, "uuid": "1a90837a-8349-45b4-bed9-803b45448c2a", "value": "T170959E0699626E33C2997B7986D7001E43B0C6A37567FF1B3A1F30B1AD066319F562F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707021916, "uuid": "98b6f9d7-580b-4ff8-aeba-dc78bbb6e8bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707021916, "uuid": "3435c964-17ea-4a00-b8ba-d041a46e081d", "value": "49152:byUmdKMMFOQpF2w9BWfN9oMNbrks7IrnZrgz//p:byUmdTQpFlWfNaMNfkSIZrg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707021916, "uuid": "64057ef5-bcfc-4448-bb8d-f3525225b886", "value": 1936896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707021916, "uuid": "3c0da81a-4369-4f38-beb2-a59457b82465", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707021916, "uuid": "e5ad6cfb-d8c0-4e48-aab6-5d78cfab5b62", "value": "1842A949EFBC8881D7BBE5E6A73385800C0376BD52071.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c46436c-c34b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707043920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707043920, "uuid": "b7080bac-e25b-4327-876c-13106d6ab15f", "comment": "Malware payload", "value": "f78f79a9955725001e502d0946eb3d00", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707043920, "uuid": "c9802101-cd30-4a71-8c89-c3032e51a659", "comment": "Malware payload", "value": "18b8e4782b590141ff10ecde5b76bd1e35d99890a517741ac71408a478a56a81", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707043920, "uuid": "6b229dda-9361-40bc-b3cf-8334c806b551", "comment": "Malware payload", "value": "925fe336bbc98797e3efcbddc39695b7b0de5534", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707043920, "uuid": "133ac16c-ebc3-4c71-a000-9343aa5ca8dd", "comment": "Malware payload", "value": "8ae2eda872df014c336d9cc2caa199fd3b94628ac97a8eab756f238f258add84e7198ea8b28edf18e83e1b526b8de223", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707043920, "uuid": "20dc495a-edba-4bd1-86aa-1a4f2ff8e446", "value": "T1FAE2E167CA601CB9E72D893361EB3F09D24D641BD6632C8C9F72962C8C63049DE26DDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707043920, "uuid": "bd3303a5-7d8d-40d4-944c-7b563adc1d79", "value": "768:4ll1kmuFze6jSomfsRYKiAMx9Xg0mp0s2S6ke:+p+66tCYYek9Xmd+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707043920, "uuid": "539cc8ae-c702-4188-aff5-8a5f74728e89", "value": 31372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707043920, "uuid": "77966d07-0258-41b6-9b69-f609fe0735f7", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707043920, "uuid": "7b3ab76b-a077-428f-8be8-b9f84a28197d", "value": "Shipment Documents.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c60b00cc-c398-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707077142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707077142, "uuid": "7f9c64e2-3a69-4d90-88a2-d9a9789b67ed", "comment": "Malware payload", "value": "4706996406cdb58da22e899a24e4c124", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707077142, "uuid": "f1d54211-bde1-42b5-a483-16a34b9584b3", "comment": "Malware payload", "value": "203eabebbf7e7a0c5df0933d5a8ad03a703924b2dd46c9a44c563d2e9c50ec9d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707077142, "uuid": "20bcf203-da63-4333-aa76-3d43201b9f37", "comment": "Malware payload", "value": "8a9b5f7e62489b939b0afbc9e753c779f6005b09", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707077142, "uuid": "bd6995ac-91b8-40ef-8a50-60c9f599f967", "comment": "Malware payload", "value": "a862bffedcfbfc2e0ac45eacbb9349dc08b659b9b90d1e35efc7ba7c45fe8a5039dfd75a26337c2c5ce2abab8fbce0ca", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707077142, "uuid": "e7b81f14-f8e5-4fc5-9c82-90c5ccd68884", "value": "T1D1334AC4E583D8F6FD8601712137E7378B32F53A012ADA97D398DA2BFC91601E657288", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707077142, "uuid": "246057a0-eeac-4e47-b30b-1f7e04ed5c7d", "value": "1536:/DrJmiYM3MZdUqCqmVDnnI4ZNjk/K4yerDGmevSMUBX:LeM3MZdUqDQDIMFSK4yefjeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707077142, "uuid": "c4b82725-5bee-405a-9e37-42ea05162fad", "value": 54644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707077142, "uuid": "615f852d-9ae1-4872-9da2-73ef0330c1d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707077142, "uuid": "6eb15751-44a0-4fda-a9dc-d421a4121212", "value": "VRx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4983f862-c3b0-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707087241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707087241, "uuid": "398d9275-d759-42b0-88c2-34120d7e178b", "comment": "Malware payload", "value": "f0ac7a3be16d044b279b97544470eee9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707087241, "uuid": "ffe17c06-4f4b-4cca-a4c1-e0cbb01bb42f", "comment": "Malware payload", "value": "29e494163faf7290dc7f50d764d9c7af7110525810acb391b693882b034ff8ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707087241, "uuid": "0726d378-867d-43c9-a1f4-15faf9bcd1a2", "comment": "Malware payload", "value": "124f857d2a65c9a9305dd69aea17d2c8d8f79e71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707087241, "uuid": "be6836de-fd62-4603-8dcb-df80560df39f", "comment": "Malware payload", "value": "37af1c5a0fa09f60448d9c7252a3b61414d130510ae0883e925e77ebd491a426b87ae973625a882ecb09fb1199abb244", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707087241, "uuid": "7bd71084-7de3-4d7a-9da1-ce2777bc0eee", "value": "T1BAC533ABCC28276DC06384728C31A53FF87B4576257AF4E0437E5F6D672B6A0143CA96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707087241, "uuid": "bf526cc4-a6db-4aa4-9e84-39a116a1c214", "value": "0980a5bdf7b225ee6a859c0ebee6a4b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707087241, "uuid": "1a59375e-5d81-43c0-8f98-10e1ccc1b88d", "value": "49152:F7CZEGA1sKt+Rymv/peRIe3d+fFsPgJEv4RQnu/FMw6TG1Z40lPA4LTuD:wZEGA1oRuRIe3d+9sYJw4RQnmFSEZ40C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707087241, "uuid": "0840e1be-49e8-44bd-b670-c2792bd8f6f9", "value": 2668032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707087241, "uuid": "60bcac47-b7fc-4660-83eb-559d57cea16d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707087241, "uuid": "aef6e084-8e15-414b-a5ca-237712fd51d0", "value": "SecuriteInfo.com.Win32.PWSX-gen.13740.22618", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5ab8265-c393-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1707075020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707075020, "uuid": "4fc4b486-a9ef-4f72-adf1-28fb824ab350", "comment": "Malware payload (Stealc)", "value": "a4e55b134fe1f35e2c86ddefc420c840", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707075020, "uuid": "0b036538-2043-461d-b522-f40bcc56ef8b", "comment": "Malware payload (Stealc)", "value": "2b52ff31f1e3eeb17b8cc6fe5aa354fe787b97818f31fec5c60489636d62a54e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707075020, "uuid": "43ae3b5d-cf82-4ae3-8288-f66bfc2b9b00", "comment": "Malware payload (Stealc)", "value": "24f1c3f2bd6b6dc50eba24d1dec9465c135e6a63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707075020, "uuid": "a68ed50c-5161-452f-9df0-2f74113d77f7", "comment": "Malware payload (Stealc)", "value": "421da4ff4f65cfbd6932278bb69e7c1a6f490abcae4a8ff9f6b468baf03cff2c7f8495367eb04e6777594dffe5a47cac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707075020, "uuid": "51465172-925a-4949-812e-fcbac208cd00", "value": "T1FDD26C2573EC0722D8FF0B389DB725212B70B2176A05C96E2DD9848B4D77FE01A11B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707075020, "uuid": "efb89e69-104c-4262-b166-a218c8ea1781", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707075020, "uuid": "e1b9b26b-a5ad-43a9-bbb3-882690912f1f", "value": "768:plOpnqjUI/I7ss4TufgvF9YiOIz4dEFiRm:nO0s4Tufgvvlxz8ei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707075020, "uuid": "d05c2693-f817-40b5-87fd-c143b28abe34", "value": 30056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707075020, "uuid": "acbc7f37-2d30-4c8d-97a9-5442bd9f7950", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707075020, "uuid": "b67d3969-144b-404a-9d8e-b60dd1caaf16", "value": "a4e55b134fe1f35e2c86ddefc420c840.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb74ca11-c32d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Fabookie)", "timestamp": 1707031194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707031194, "uuid": "da47e6c2-c2e6-48cc-aaf9-4a1106ed95a0", "comment": "Malware payload (Fabookie)", "value": "95bcfc484ea3b87d4e0058bb15bfc206", "object_relation": "md5", "Tag": [ { "name": "cre8ure", "colour": "#7B880E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707031194, "uuid": "cb7e9b04-4e2b-40ce-85b3-ce71beb5d66f", "comment": "Malware payload (Fabookie)", "value": "2bf7fdb0b81e587a2121389cce1f0a4404ef51c59e71eeafef50ccfeb7914aa3", "object_relation": "sha256", "Tag": [ { "name": "cre8ure", "colour": "#7B880E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707031194, "uuid": "adc27cdb-0c2c-4b6f-a10c-e31c4b5c833a", "comment": "Malware payload (Fabookie)", "value": "07eee3b46dd79949e1d456d801f77d411eb480ae", "object_relation": "sha1", "Tag": [ { "name": "cre8ure", "colour": "#7B880E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707031194, "uuid": "3140d94b-4136-4f59-8f70-23a4503321fa", "comment": "Malware payload (Fabookie)", "value": "fae820d8d15a3acb44c6bc830378058638f86364fbd4ea993269c828d972ddc95d25eb81d60dad05759ac73cbf9306ad", "object_relation": "sha3-384", "Tag": [ { "name": "cre8ure", "colour": "#7B880E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707031194, "uuid": "965266be-638b-495c-9b23-d4fcecf2c121", "value": "T17DF42B56FBBD4272E061C135C9A6E7B5E6B27C855D30970B2345EB2E2F335118E3AB20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707031194, "uuid": "15ec9e33-bcd1-4cef-a89e-717a4ca5e846", "value": "f2fcd0efb031ebebeaa83cd4cd21090b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707031194, "uuid": "87161949-1155-41d2-a379-28a1d32ddb6d", "value": "6144:nA01Nd5uvxQWQSYYaE5CinBdRxQ7cUBmCUiJbc77ZvfuYuEdGxTC2wWf7xLUnw+V:ndo5QWJnnBIShtdGxTC2A5JL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707031194, "uuid": "4f278789-737b-404c-be86-b52db4a82566", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707031194, "uuid": "a7d71ba9-c39b-4279-a81e-b863afdca5ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707031194, "uuid": "7e925001-9bf0-4de2-b8ae-04738272814e", "value": "rty45.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb885f14-c30b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707016672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707016672, "uuid": "5ea7393c-4930-4704-b03d-1c0de2c01e67", "comment": "Malware payload", "value": "504d24b231072148bd3573111631ab4e", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "SMSWorm", "colour": "#2EA4A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707016672, "uuid": "96063761-6ba7-41ce-883a-f96eee72493f", "comment": "Malware payload", "value": "2d81efabf6b5aa167fed70bbe07e30fab07569b8a992b8ff9f55b4b86169b84c", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "SMSWorm", "colour": "#2EA4A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707016672, "uuid": "411d0f24-11bc-46c6-8fc7-ba0a67cf0b48", "comment": "Malware payload", "value": "0e5d11da02fcf991989ab28943f4ca96a5c5f81b", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "SMSWorm", "colour": "#2EA4A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707016672, "uuid": "d88c4d05-7ad0-4008-be93-342331e9e9ad", "comment": "Malware payload", "value": "1d2d8e6fc2796e92b5d307674b6e986ef35b29e77ba0e87e26f6d6914594ea5ec02b9f5ad267b666366949bfe8206357", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "SMSWorm", "colour": "#2EA4A2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707016672, "uuid": "90aa9200-9bbd-4b2e-ad05-fdd152c8b78c", "value": "T186D62302FF88E82FC877C1334AA5163A52864D6DCA42D76754ECB26C68F7ED44AC5EC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707016672, "uuid": "95f9b51a-1942-4525-a2eb-9b7f404709da", "value": "196608:uTzqgG5BRSzDfFyfVBlFjGMWWmjbwXiMpBdyLih7d+dyfCOO7Qdkc/cbjy6iJp:mq3PfV577m/wSMpBduyfCO3dx/aa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707016672, "uuid": "30d1c4be-1373-499a-a801-48fb3430f3be", "value": 12691755, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707016672, "uuid": "ee6354a8-72ca-4498-9232-d1e781f882d2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707016672, "uuid": "4cf516f2-97aa-4710-b224-262a4a1c1395", "value": "Onlyfans-Premium-Access-Free-v6.6.6-PREMIUM-(entireapk.com).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b30e895d-c349-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707043179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707043179, "uuid": "edcbd9d9-e119-4a89-bb92-e18b778edf0a", "comment": "Malware payload (AgentTesla)", "value": "979554a3ccae5331549ac6a3ba7b6d2b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707043179, "uuid": "398a1b76-3bb6-42bd-9655-8d015eebd4f3", "comment": "Malware payload (AgentTesla)", "value": "332c0b69f815c83e75d1501ae6080493584d7a086ab2324384f354904c9be7a1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707043179, "uuid": "05495046-108f-47fd-9a6f-8d2f3b63a85f", "comment": "Malware payload (AgentTesla)", "value": "047c2ed4fad21a8dbf1171bc6dcec59963f91ec1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707043179, "uuid": "4e33696e-92f9-4188-9a53-8ae84fb65505", "comment": "Malware payload (AgentTesla)", "value": "afe2eb0b8596d03e49c8a3a7bb6a86ccaec8bfff685aab002a11d19ef531d2e92910703afcb9ae5e31798e0b4d070eb6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707043179, "uuid": "bd03824a-8c5f-4d28-9540-466c117aa278", "value": "T1D341E2F88957D593881DC7068346BE665E7B735C613D6F687C878BCCB668300B2AC09D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707043179, "uuid": "caa605ec-8b3b-4725-a333-11e422b558f7", "value": "48:kWA5dEfOaA1uiQ4oXEb7jcHYznodUm9lr:o8OaAYLNgjc4pm9V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707043179, "uuid": "acfd97dd-7a33-4b82-a113-84392573aa3e", "value": 2130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707043179, "uuid": "c8a16739-0249-4a75-9682-9f5c16c758b4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707043179, "uuid": "582bd42b-d491-4aff-b258-547b2d875ffd", "value": "DOC20240.BAT", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bc360aa-c34c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1707044429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707044429, "uuid": "f1e41153-e72a-4022-9bfe-75baa14c5828", "comment": "Malware payload (DCRat)", "value": "bb6386e0e4366e0919696b48b1cf99b0", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707044429, "uuid": "e9cbaa01-12fa-4736-a916-e2dfa74ed29b", "comment": "Malware payload (DCRat)", "value": "3385b4eae1bd4ef9d9dd5735fb7cb7835f43921caa128221539138ed51e89469", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707044429, "uuid": "7f987529-9504-4a77-8eb1-9536bb7ee2c0", "comment": "Malware payload (DCRat)", "value": "6022554d8f31c072861f13ccff70f24c90e44885", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707044429, "uuid": "fad2e957-4780-4bd3-976c-c54686978fd7", "comment": "Malware payload (DCRat)", "value": "db82f8e159d0b240742b9ccf431db8fcadd483c38beac3f3988ca24457d02862c770a5a23096e96621443dd53e6d0822", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707044429, "uuid": "7e8904cd-56a2-42f8-9960-086358e71a36", "value": "T15A95BF46A6524F77C2A53F7184D7062E4BB0D6727513EF0F7A1F65E2A80A2318B072F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707044429, "uuid": "a6b6d609-7eb5-41a2-ab82-b01fea29099b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707044429, "uuid": "0797214d-6872-4953-a821-3380bbaef1e8", "value": "24576:h4jBgF2cl7A6I9YUIthQARH+ABgzQXHLVHZEWYfSaRjvvPxj8YGsnM1RfSOVPyJQ:mjSF/26cItdEOHBZijvHxjUyJ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707044429, "uuid": "fd9563c3-e2f3-4a7c-9f14-88103f8e46aa", "value": 1969152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707044429, "uuid": "122f5076-3f28-4b96-be09-8d759395ecf1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707044429, "uuid": "f5fb9674-d353-4d64-bb4b-cac3ff3dae22", "value": "bb6386e0e4366e0919696b48b1cf99b0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44d290c2-c397-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707076495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707076495, "uuid": "32929548-10bf-4466-9ab5-45bc5e2731e3", "comment": "Malware payload", "value": "161ba30e72d8b54b8016da412f3111a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707076495, "uuid": "7c408486-6ba0-4372-a1c8-3f82126e144d", "comment": "Malware payload", "value": "35b96f5fcf9fb2f24a7d2dc29170938d14f7d351a14d4b37340aedd7b6a85b50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707076495, "uuid": "3f28353b-3262-4bc9-a38c-ec199c1b0059", "comment": "Malware payload", "value": "243fbd7d16c2d96e73a82d81a3aea4033dbc93cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707076495, "uuid": "b33b60cf-9a53-49ef-b91e-adc9950542c6", "comment": "Malware payload", "value": "7e97cb425b07331c67962dad11fe10e9e52e4d10c86f8544ed54870e9970d773484116a2eae26b992ec4d41fd22f4f6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707076495, "uuid": "ea9a0b3e-211e-4c7d-a54c-e4bff3bfc8a8", "value": "T1E4E733E4FFECA938D409827677C08CBD1B41763AE517B4F2D6A6500E74520D3AA0AD7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707076495, "uuid": "bd1a663e-7fb6-4a0a-ba56-d0d7b928f188", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707076495, "uuid": "6e860a7d-0f1c-40c9-92a9-4cdcc643303c", "value": "1572864:IrziN4aKD8cKauEXEnREpwWGD5Pb2PKDLrM36DY7:j4aK7u+W/kHKs7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707076495, "uuid": "6099ce1c-ca83-4257-9bda-28b09d74d134", "value": 64308374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707076495, "uuid": "54068453-5520-48d1-a216-5cfdd6d34b28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707076495, "uuid": "f8bcba53-b525-49a5-b40a-4658a1a69f7e", "value": "35b96f5fcf9fb2f24a7d2dc29170938d14f7d351a14d4b37340aedd7b6a85b50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d4ed20c-c35b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707050766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707050766, "uuid": "bf865272-6257-4baa-8fc0-1b73d33b0ef7", "comment": "Malware payload", "value": "009ec72b0873b2a5044d53cdfc4da321", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707050766, "uuid": "ec92efd1-584f-4ead-b52b-c271f218e746", "comment": "Malware payload", "value": "35bd686f3b38ba85a2ff6a9d85ea5520179e8c930fe9162e68c3f099aa822725", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707050766, "uuid": "741aac1a-d52d-438e-bc64-3e3964ba523c", "comment": "Malware payload", "value": "fe83a22c9785c9fa97716b81b46d472a4a5ca94c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707050766, "uuid": "b0b4ccbf-223c-4a95-9a1d-7e716f983f11", "comment": "Malware payload", "value": "d377ccb31b5f6722159fa73629e9c141d73df6eb0dd55646eeda8faf3f88b06d21317451d5464af05148b98ff3c31bbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707050766, "uuid": "1e61b23b-b331-47a4-812e-caef858e6719", "value": "T14BE73375DE4A083BCF1D91F980803DF53EAC21609B9BA1AC947914EFF991254CB247FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707050766, "uuid": "e064e4bb-8e84-4d72-803d-12dfec2659f3", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707050766, "uuid": "d5963f69-30ca-4d98-80df-395406d432bc", "value": "1572864:OrziNx5qznYYDx9jR+iRes+bjK9YGVfY2PUVonPVvLSZqP3AV+nkTXPU/I7:Rx5qMC9jJeNm11tPkonP1LQqIVwk7U/c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707050766, "uuid": "50d555d4-4629-4a60-b3be-765d88a0048a", "value": 69102580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707050766, "uuid": "a607ff7b-01dc-4ac0-aa49-d49a19142f72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707050766, "uuid": "8b75979e-e7e1-485f-be5c-96554a09ecf3", "value": "Steup The Damned.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8114b3d-c398-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707077145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707077145, "uuid": "6c1c7bb8-8a1f-42f5-8740-825ca1bee4cc", "comment": "Malware payload", "value": "83e4c66f7863301bc6b8b9916d04aff8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707077145, "uuid": "64295af6-213e-41a4-ba21-bfd22548b953", "comment": "Malware payload", "value": "36b279b2832316522392f1a874a7f5332a7229c1674fc15173936012ea8c8b76", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707077145, "uuid": "dcf0fd5e-1024-45cd-b583-88bad4ae5373", "comment": "Malware payload", "value": "536e3154fbb78b3c09a81eaeb013c799464ef61d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707077145, "uuid": "1a5ef78f-17eb-4bd5-9b1e-463f5da1cd5d", "comment": "Malware payload", "value": "c8b436ed5a1e633c4486035d3df2238d87dc45a5e79d8dfeccf15de780a11658eb2b12e2e181a8595ad4c2e49979edc7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707077145, "uuid": "d1af23f3-6dcd-482c-b68c-77103394fbc6", "value": "T1E6731A96B8819B21C6D5127EFA2E018E3313177CE3DE73129D24AF20778796B0E7B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707077145, "uuid": "6963ce41-bfa9-413e-a733-71f9af84555c", "value": "1536:QAntx+oT1lVJBWV4jja/faHDS3IRi9e48l585YYm:62HI4jja/nell58+J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707077145, "uuid": "902f0dd8-7c9f-44ad-b4f5-0c202a6bb79a", "value": 75308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707077145, "uuid": "deed7f43-c57d-4396-af7b-bb1a41ae0176", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707077145, "uuid": "7ab71b24-2961-450b-bf94-1569324f63a4", "value": "VRarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "780bc1a4-c32d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1707031055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707031055, "uuid": "12119704-374b-4f52-8e2d-d5efcb2b53af", "comment": "Malware payload (RiseProStealer)", "value": "b02de615ea9700389bbf6cd918cc2d03", "object_relation": "md5", "Tag": [ { "name": "cre8ure", "colour": "#7B880E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707031055, "uuid": "20bdfa3e-84dd-4280-86c3-f9a1d945ac92", "comment": "Malware payload (RiseProStealer)", "value": "372520905ceeed960d315f7501d2e0e27602447c7eb622916bf33612a38ad0aa", "object_relation": "sha256", "Tag": [ { "name": "cre8ure", "colour": "#7B880E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707031055, "uuid": "6604f2b3-55c7-462e-989e-b17bec7c5fad", "comment": "Malware payload (RiseProStealer)", "value": "83be6e76f0a2a9477f5444ac14665e11dc40e2e5", "object_relation": "sha1", "Tag": [ { "name": "cre8ure", "colour": "#7B880E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707031055, "uuid": "6f8e7910-b631-4faa-8ebe-496ac151aca3", "comment": "Malware payload (RiseProStealer)", "value": "2b0f54245ab4925749017e0629811c39b700620c723e1e1e4708469a8f7e5a424f5f16d6b058d161010c5d754ef8c89c", "object_relation": "sha3-384", "Tag": [ { "name": "cre8ure", "colour": "#7B880E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707031055, "uuid": "0c5218bd-aa27-491f-9e67-168a156ef4b1", "value": "T118B533F24E3355A6C4534FB6CD239D55B8DF1D2B61AAA912142AF2202FFF2B31542CD8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707031055, "uuid": "8c7bf8b0-1550-498b-9628-e177ac6e94cf", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707031055, "uuid": "e9e20da7-a2b0-4353-a28c-df5b393210b4", "value": "49152:udNfrEYAuQVCFHod3JEzVoSPzBPZLELHSbQv:ud+YAzuzVpbfELHmi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707031055, "uuid": "b3dde2cf-89d8-4f60-9ac4-44ae4d18c589", "value": 2352640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707031055, "uuid": "511c82ac-bb3c-4fee-8736-2bfcc1ff0f63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707031055, "uuid": "d54594f8-6066-47b6-9a0e-6ca5cbfa2f0a", "value": "merso.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0d4e6b9-c328-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1707029002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707029002, "uuid": "5537a20f-5251-4451-b205-f97be68f9dee", "comment": "Malware payload (Stealc)", "value": "cfab7a2f5302b8fcdd98159c3c892404", "object_relation": "md5", "Tag": [ { "name": "194-120-116-120", "colour": "#060034", "exportable": true, "hide_tag": false }, { "name": "CVE-2023-27363", "colour": "#36119D", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707029002, "uuid": "f96e5f2b-d723-418d-9726-174460dd4a39", "comment": "Malware payload (Stealc)", "value": "3779f1b904ee4cf41f4a266505490682559d09337deb30a2cc08793c2e69385c", "object_relation": "sha256", "Tag": [ { "name": "194-120-116-120", "colour": "#060034", "exportable": true, "hide_tag": false }, { "name": "CVE-2023-27363", "colour": "#36119D", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707029002, "uuid": "a8ad1942-055c-4ef9-80d0-31214f6df1d1", "comment": "Malware payload (Stealc)", "value": "18e9e6d893bab03d9b1a47951c9d408a31c59ba4", "object_relation": "sha1", "Tag": [ { "name": "194-120-116-120", "colour": "#060034", "exportable": true, "hide_tag": false }, { "name": "CVE-2023-27363", "colour": "#36119D", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707029002, "uuid": "4e70d575-b6b8-42c7-861c-54db8484c7c0", "comment": "Malware payload (Stealc)", "value": "d2349b8be97fbb7c2c8f26f68e0df40a8291616ab475fa40713efa18ca02d7ad4d00cf709ca6113f1102711a45f371e1", "object_relation": "sha3-384", "Tag": [ { "name": "194-120-116-120", "colour": "#060034", "exportable": true, "hide_tag": false }, { "name": "CVE-2023-27363", "colour": "#36119D", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707029002, "uuid": "3edb7772-5db6-459a-8fa5-e4f64a36bad4", "value": "T1DE83026E8D270483E8DB1EBA744C69B34A6B12DB23112EE53524DB730844BDB7E50BF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707029002, "uuid": "646ee242-9997-484e-9655-f8d9ed4e8713", "value": "1536:hqICCqKqIXY1RYZpfg99xyUb1V7fbxp7kWJx362lKXH7WPsi4Dym15gF:hqLdIGYZiZbz7FpJJxUCPsiSn1GF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707029002, "uuid": "6cde5b0a-8e73-42bf-adf7-2dc70fdf13df", "value": 86773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707029002, "uuid": "7317a592-d962-48d5-a97d-b3ba359f0fa6", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707029002, "uuid": "d500932c-469d-422c-9199-6c6fbb5baaaf", "value": "Agreement_eSign.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63092977-c3a7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1707083418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707083418, "uuid": "db0a9fbe-8bc5-4c1c-b00a-ced8045aeb07", "comment": "Malware payload (Stealc)", "value": "8e3cea75d3bfc58c9d86577335e67dab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707083418, "uuid": "a8cf07a3-b056-4a73-8824-20de4fc878c1", "comment": "Malware payload (Stealc)", "value": "3a114fb72887fd2a26d3dbe460d292107416526d68e6fea8c14d7c33546348e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707083418, "uuid": "fa35a7dc-bd54-4673-a520-74ca4cdbfe7f", "comment": "Malware payload (Stealc)", "value": "5045044eefaa4a600cf7a350f4a8331278aa0c51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707083418, "uuid": "d7f412b0-47d9-4894-8822-f9d083134f9c", "comment": "Malware payload (Stealc)", "value": "0806134b25754c0b8fb70e53bb2a4cbbef37eee0e9ccf7fc33ca234dab4ec77b96ee15f62b156b4338a6a30159616916", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707083418, "uuid": "41d65125-e930-4832-a1b0-905fa27061c2", "value": "T11354BF002790E071D19725348962C7B64ABB38757923AFBFBFE51B7B6E34390DA25309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707083418, "uuid": "c0a0fe99-a51c-46ea-8984-abc73c5c5a8a", "value": "ebe35e0085e613a421d4abea9476d495", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707083418, "uuid": "eb543007-1cbb-457a-b253-b2aaf4815868", "value": "3072:e2IDrkVtFdm6KjSrGvgq/ShxxrK4Y58Ls5QllP7RE73CVfsP2tmx6P0s4iNc:e9DrstDGvgGyxxr4p6lDRPVfst1s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707083418, "uuid": "a7fc7873-0738-4463-a336-4d32278542f0", "value": 293888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707083418, "uuid": "18762371-55ed-4895-a2b2-c8c57fad39ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707083418, "uuid": "84bb7c2e-16e9-4619-8084-42f3b1640d09", "value": "8e3cea75d3bfc58c9d86577335e67dab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9263ed1c-c3a9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1707084356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707084356, "uuid": "4f2da117-8015-45e0-94bf-0c8a7edaca02", "comment": "Malware payload (RiseProStealer)", "value": "64fc74e64fce58018ce3ee49d14071e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707084356, "uuid": "3489a616-0e8e-4bfc-9c71-60750edc914d", "comment": "Malware payload (RiseProStealer)", "value": "3ce192ad0c7beb490b91094507f1a1a4d36c3ec3f3fe02d5fb76b173e955958f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707084356, "uuid": "d9a0a5a2-1557-4ccf-bceb-9c76a98acf94", "comment": "Malware payload (RiseProStealer)", "value": "4c815f8a21617315e1fdfb9b3a371d6a7674b5cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707084356, "uuid": "5ee8bc51-f38b-4c5a-bc61-6caf45e37899", "comment": "Malware payload (RiseProStealer)", "value": "01ed5a10bb4b6a0af2249a665d61920b2b38d5174f97e97fe16d6e4328e0c50c6447907fb555911312e1c8d4e920b214", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707084356, "uuid": "858ee2ca-fbcb-44d3-8643-53d1b678c38c", "value": "T1F4D53324065355B8FE1FF530186E1AFE70FB68230FBE1194F1A9507FD16206AA52CBB9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707084356, "uuid": "c949cc18-92d6-4c8c-b4f3-c15a9a8f808b", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707084356, "uuid": "42d9359f-a1c8-4113-912b-0ae7647e08bf", "value": "49152:vRmN6wsrqa04ptA7twc5/aAKi/3r4WggymAtjNcawfUTvbJ86jUdZ5WUYZ:vRmsR2a04ptwRa6/7NggylLvLDynWU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707084356, "uuid": "13a941a5-589b-4b07-a4bd-b6078f903b85", "value": 2817536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707084356, "uuid": "08bcce7c-66ab-4932-b420-7625138fc089", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707084356, "uuid": "39ab1b98-66a5-4ec0-9f91-3edb22aa3d11", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73ae70e1-c354-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1707047798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707047798, "uuid": "12ae86c8-c936-4439-a505-0ab398450469", "comment": "Malware payload (Smoke Loader)", "value": "982d0f785eb918d8410ca6723517d899", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707047798, "uuid": "3c65fab2-2c9f-4223-9c91-46d7acc4ae9f", "comment": "Malware payload (Smoke Loader)", "value": "3e36b2179d0f16855160f2a119d5343622b797b75d45b277b3b0616501f18da0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707047798, "uuid": "980dffee-9d78-4a49-b79b-bac05bf2da3f", "comment": "Malware payload (Smoke Loader)", "value": "5c50c6ea9ed6553382aed1e9ddb6688b54631e4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707047798, "uuid": "07678e1d-56ba-4156-8f9a-9d8851a67f57", "comment": "Malware payload (Smoke Loader)", "value": "57b6ba9ac269e401794e3e6925151886a1a98fe240e3044e14bbe21a607155cc36a5de489d46b0a218d26c3451cfdaf9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707047798, "uuid": "b3a71e56-e732-4669-9db5-b1152edd311d", "value": "T1D4547D1023E5D031F2B756358AB0D7B50A7B7C7226735AFFBA91163B1E746918A2033B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707047798, "uuid": "1667aac3-7566-48dc-a570-1d071f5ca543", "value": "e73d248f8b5138b09f44525633bf1f57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707047798, "uuid": "31ded1fe-1118-4c12-9814-37945b7c8923", "value": "3072:U0CR85KgNgVH293SHLRdBtKsUStUWoSKneWPJIX2PEXalv2iuY5CcPzb6P0k4iNX:Bm85jNgVH29sRRNUTeWkXalvmSH1kqc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707047798, "uuid": "e0696b71-bf7e-40cc-adf1-87f9ac650d2b", "value": 296960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707047798, "uuid": "e4c33494-4714-44cc-87c1-b45b07737a29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707047798, "uuid": "eeb489f6-dd96-4a05-9a3f-fe04b477df20", "value": "982d0f785eb918d8410ca6723517d899.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9f2009f-c32d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707031192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707031192, "uuid": "8a2c4cb7-c47e-4fce-97ba-9a63070c994f", "comment": "Malware payload", "value": "d36b77f788ac6b8a25a10634b6009058", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707031192, "uuid": "c97ba3fe-9338-499c-b28b-4b9344403cec", "comment": "Malware payload", "value": "3f5772f7ad492cae66118a54705d4885336d56ff771c90bb63d3e19e6635008e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707031192, "uuid": "1779222f-f71f-492e-a32f-6d72afdae4b7", "comment": "Malware payload", "value": "489d9760ee7f74f16e44bc2394816445174958e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707031192, "uuid": "48bf69a3-b5ff-4564-8883-4b5b31b20151", "comment": "Malware payload", "value": "54aacd9d9b5977332dfad19cb76461af517857a9b1a4e8342294d94056f0755ec59f76cb289fe1e42d3d0ad764512606", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707031192, "uuid": "aebb6cd0-7eb1-4444-bfb6-3a24bfd90b11", "value": "T17C54C0C7EBD6BD93DB5A213EC8A783091239F7D4179247032D36A0386B5B4C06E9764B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707031192, "uuid": "9b61ac3f-fffc-47e8-9f37-18f55c08b252", "value": "bd3691e1d34908ae58a58dcd43b00287", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707031192, "uuid": "fa33cbb7-f6f0-4a95-ae8d-23c9a39e7e61", "value": "3072:pAL8oMSzxf0HQU25lO6kBc9u/8oMSzxf0HQU25lO6kBc9ucvOUuMMtf+:pAoAzxMHi0679ukAzxMHi0679u0HyG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707031192, "uuid": "28a1f481-5092-4322-81b6-ad0b6b87ed50", "value": 281760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707031192, "uuid": "e8cb3dba-d1b1-4e63-9e2d-e8b6f9b8b1db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707031192, "uuid": "1465b87b-6d06-4760-86ac-8690bf200124", "value": "SecuriteInfo.com.Trojan.Win32.Rozena.6847.947", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d19a2322-c38d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707072436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707072436, "uuid": "7558c828-daaa-472f-bc5d-940ef476f9a9", "comment": "Malware payload", "value": "62e143153aad5ccb8a7178a0fce49d5b", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeGram", "colour": "#5189C2", "exportable": true, "hide_tag": false }, { "name": "FakeTelegram", "colour": "#FF4C93", "exportable": true, "hide_tag": false }, { "name": "FakeTGram", "colour": "#CA6675", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707072436, "uuid": "541d7e1b-3f6f-4d47-b158-8c3323767279", "comment": "Malware payload", "value": "42d370c1820a14d68bc1284414f231f9a5e49402aff83d2f524245fc9a2b90de", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeGram", "colour": "#5189C2", "exportable": true, "hide_tag": false }, { "name": "FakeTelegram", "colour": "#FF4C93", "exportable": true, "hide_tag": false }, { "name": "FakeTGram", "colour": "#CA6675", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707072436, "uuid": "6f75ff08-c547-48e7-a4e3-d412e6e8b508", "comment": "Malware payload", "value": "0df16d8225aaa07ba80bf6c20862add1f941d04a", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeGram", "colour": "#5189C2", "exportable": true, "hide_tag": false }, { "name": "FakeTelegram", "colour": "#FF4C93", "exportable": true, "hide_tag": false }, { "name": "FakeTGram", "colour": "#CA6675", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707072436, "uuid": "3fe8df4f-3ec3-497c-bc97-16875dd73e25", "comment": "Malware payload", "value": "82af6bc91d9054e8d8d95d304914b3e57ddec18a8063a0eae4ca3bf7230ed269c256ba42e0ddea2279d1474eac11cf8d", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeGram", "colour": "#5189C2", "exportable": true, "hide_tag": false }, { "name": "FakeTelegram", "colour": "#FF4C93", "exportable": true, "hide_tag": false }, { "name": "FakeTGram", "colour": "#CA6675", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707072436, "uuid": "25e536ab-13e1-40d8-99ba-8d93e716a076", "value": "T133F723E7F709EC64C0F2833693F16193F5254E909713E6266A05BA386EBB5D0C249FE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707072436, "uuid": "46d70ca1-1f3c-4524-b8cf-31d1152841d3", "value": "1572864:ww4iC2AJLX3iWQWDHd84yL5mXK/zvMmEybEAjSk0wTqQF8jKXiv:vzGXwKWHb/zkTGE4Sk0U8Ki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707072436, "uuid": "2950c7cb-3cc6-43b6-90da-0110855425ff", "value": 72242841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707072436, "uuid": "1b51ab7d-86f5-42d1-ba9b-ae8febec88b0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707072436, "uuid": "a5d3cbdc-1ed0-4c3e-9447-3a888cc326cb", "value": "Telegram3765816.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a23e145-c329-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PrivateLoader)", "timestamp": 1707029206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707029206, "uuid": "eba754cf-1ad5-4698-9b0a-a836af6d94ca", "comment": "Malware payload (PrivateLoader)", "value": "d73567b918afe0081de4251aec9035d3", "object_relation": "md5", "Tag": [ { "name": "cre8ure", "colour": "#7B880E", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "pw-1234", "colour": "#ADC330", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707029206, "uuid": "1c1a46c7-e9a1-4555-9ae8-0cff7cc689f5", "comment": "Malware payload (PrivateLoader)", "value": "496e1270385f82f3c85fb8eec0405ef4d85aa05aa460989a655e57d4d8553835", "object_relation": "sha256", "Tag": [ { "name": "cre8ure", "colour": "#7B880E", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "pw-1234", "colour": "#ADC330", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707029206, "uuid": "aa76615c-867a-45f0-b2fb-fcd7706b192a", "comment": "Malware payload (PrivateLoader)", "value": "0bab6ab2abbba9387c13071ee81807322b6437d7", "object_relation": "sha1", "Tag": [ { "name": "cre8ure", "colour": "#7B880E", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "pw-1234", "colour": "#ADC330", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707029206, "uuid": "5316871d-b87a-4592-a78a-2f9cb890417d", "comment": "Malware payload (PrivateLoader)", "value": "75bb573d2de3d957e3d47191fedcc1d53ee591fe7dec4d69be38896f6c57b6e9c1429926b5886e6b15f153f4ddcaf92d", "object_relation": "sha3-384", "Tag": [ { "name": "cre8ure", "colour": "#7B880E", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "pw-1234", "colour": "#ADC330", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707029206, "uuid": "9cc95a99-f432-4375-8430-e0e0db79fc6d", "value": "T184173323BA71B2141C16CE7D0E6BEF673BD9624792A79DEF0E0F218F854924064A4F74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707029206, "uuid": "6da97633-3009-48b7-ac06-0b93ffe4e4c2", "value": "393216:UOxxqxUVD3Mnrgl1Jz7Muf/OvRPwmyFo9I5DgER:UOP9F4clv782U9sD9R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707029206, "uuid": "066a9d71-62c7-4651-abfa-6499082fc6e4", "value": 19233710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707029206, "uuid": "60d5b496-df7f-45d5-9ffb-3eb4ad31cb45", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707029206, "uuid": "7e162fba-b492-42e4-a668-37e8336d3ddb", "value": "setup_v3.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f18d7bc-c354-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GCleaner)", "timestamp": 1707047790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707047790, "uuid": "69b1f03e-cfae-45e4-9671-6c37728dec99", "comment": "Malware payload (GCleaner)", "value": "b8943ecf1ba8d885924dc6c6960ac585", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707047790, "uuid": "e9feab2a-8703-4df9-9676-562d0713bba8", "comment": "Malware payload (GCleaner)", "value": "4b2f2e8cc35e90b2f48bdcd093e4d8c9fa7424e412c123657a554357fb6fe201", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707047790, "uuid": "555b268e-e63d-49b8-b065-5ef1bee6a1a0", "comment": "Malware payload (GCleaner)", "value": "2916bd9f50da5b0299e33d57b96ae83bb9fb6369", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707047790, "uuid": "d7e69111-c0fc-461e-ad0c-fe75b765911b", "comment": "Malware payload (GCleaner)", "value": "3ce0d933b54326bf2fb4c7c23e31872b84f342dd85763096828f143bf38d1baf8fe11ec818586eac36f0f1a3c0c74c04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707047790, "uuid": "511d350d-a20b-4270-a0ea-5b03be5317bb", "value": "T12E84AD1173E1E031D2A716354A74C7B14A7B7C627A33A7AFBA91267B2E343C1893570B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707047790, "uuid": "74dcd004-2d6e-4c8e-82fa-997fc4135292", "value": "e73d248f8b5138b09f44525633bf1f57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707047790, "uuid": "e30da472-e8dc-4c62-b240-8219c1a16e05", "value": "6144:KE9qRXqOi02OBRiIgQCtr2v//KSopPGBX91xJ4ImFhcyD1kDc:KpRdi02OPuD1RpPgX96ImFyeeY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707047790, "uuid": "300784d7-3d22-421a-8f71-d0717674722b", "value": 388096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707047790, "uuid": "80fecb57-17eb-40d5-9f4c-9414448ed668", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707047790, "uuid": "f72521f4-2a4e-4682-b11f-6d14dc3bd4bc", "value": "b8943ecf1ba8d885924dc6c6960ac585.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "381fc514-c389-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707070461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707070461, "uuid": "e1dfc22f-3e64-4352-bdc9-07e472145be1", "comment": "Malware payload", "value": "612872a5545bd5cc998254ac608ca215", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeGram", "colour": "#5189C2", "exportable": true, "hide_tag": false }, { "name": "FakeTelegram", "colour": "#FF4C93", "exportable": true, "hide_tag": false }, { "name": "FakeTGram", "colour": "#CA6675", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707070461, "uuid": "2101589f-6dd9-492a-8f48-cee473f2d9f8", "comment": "Malware payload", "value": "4ddb079cb8d18dfe05afc7d11d119d5f3544a75fbdbf0db01f1593e38f3f3b19", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeGram", "colour": "#5189C2", "exportable": true, "hide_tag": false }, { "name": "FakeTelegram", "colour": "#FF4C93", "exportable": true, "hide_tag": false }, { "name": "FakeTGram", "colour": "#CA6675", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707070461, "uuid": "1d0536f6-4dbc-415b-a5d1-b68518bebbd6", "comment": "Malware payload", "value": "a8cc7005e784c1acde6228857048329fd4df356f", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeGram", "colour": "#5189C2", "exportable": true, "hide_tag": false }, { "name": "FakeTelegram", "colour": "#FF4C93", "exportable": true, "hide_tag": false }, { "name": "FakeTGram", "colour": "#CA6675", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707070461, "uuid": "3ba9203e-246b-47eb-980f-53c059526d71", "comment": "Malware payload", "value": "656094071900d09e7558afb46a3ed4933c833f011df5dde98e64a42630177947c167f5d516af32e8e59cd407b466017c", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeGram", "colour": "#5189C2", "exportable": true, "hide_tag": false }, { "name": "FakeTelegram", "colour": "#FF4C93", "exportable": true, "hide_tag": false }, { "name": "FakeTGram", "colour": "#CA6675", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707070461, "uuid": "7bc24d96-843d-44d0-a421-74b85ba3e8d9", "value": "T175F723E7F709AC74C0F2837693B161A3F5254D509B13E2266949FA386AF79D0C10AFE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707070461, "uuid": "5102b205-913a-4871-89f9-bc7809c3217d", "value": "1572864:1qgTiU1ePJLX3iWQWDHdc4yL5mXK/zvy8EybEAjak0wTqQ3VYori1L:UgWUUBXwK2Hb/zqpGE4ak0eV9EL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707070461, "uuid": "6f099f13-3f88-44dd-afb0-8b2aeea90006", "value": 72242841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707070461, "uuid": "79f846cc-52bb-421c-8fc6-60b96716885a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707070461, "uuid": "1c65dfab-6b4c-4ccf-919f-24474393aecf", "value": "Telegram8583860.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e533b26f-c34a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707043693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707043693, "uuid": "57b3e5f0-1bb1-410b-a6dd-94dfeabb50b5", "comment": "Malware payload", "value": "4095f0e2ab14bd288621817285f43040", "object_relation": "md5", "Tag": [ { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707043693, "uuid": "a18b7d50-2fbd-4a4f-b211-34bd4874824b", "comment": "Malware payload", "value": "58ed303a0a48e4dbb8c2a5382cf1535331f7d5e1b2bb1c0d15cb0bdaf42e5830", "object_relation": "sha256", "Tag": [ { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707043693, "uuid": "34e16deb-c6eb-4521-831e-18c6a81cef95", "comment": "Malware payload", "value": "c7a9458c14ee3112ee6ca2918fb8d339f6c00262", "object_relation": "sha1", "Tag": [ { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707043693, "uuid": "124b6bf0-8c50-401e-8b8f-9275df0b6990", "comment": "Malware payload", "value": "10cc745b9d15308f26ef8977653898f9e9638d0c353b3a04d2327152b991cf59562735443e61a3892b809251f6e2bfb4", "object_relation": "sha3-384", "Tag": [ { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707043693, "uuid": "660e62a1-5fda-4567-97e4-085456be9a17", "value": "T105D2793985E79437ACAE3E48573D2E133D7F6AB7332590A3D51171006AD83B6AC9B08D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707043693, "uuid": "a71f874f-946d-4166-9183-d80237a23c5d", "value": "96:9pctvc23Vsn+NnNzxaFl5fBt+++++++++++++++++++++++++++++++++++++++U:WVFNntMFl9t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707043693, "uuid": "a9d9cecf-ad17-422a-bf53-b2f684aef25f", "value": 29390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707043693, "uuid": "0e203617-7bd3-403a-bf73-ee4cc380d961", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707043693, "uuid": "89c2bd9b-26c0-4d8e-b4e4-cf5f8a8c2711", "value": "Tax-Invoice_And_Credit_Note.pdf .zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ef2b714-c2f6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (BazaLoader)", "timestamp": 1707007390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707007390, "uuid": "80cf70de-4d34-49e4-9e82-278f036e1a3e", "comment": "Malware payload (BazaLoader)", "value": "cd4a505354f309859f81de46fd05f90a", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707007390, "uuid": "3390e4f8-d465-44d5-8763-cefc422b7f58", "comment": "Malware payload (BazaLoader)", "value": "5becad2dcfad4b96563b2cc9da05eec3a6511cb5f6f0072c967144ce6459cb29", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707007390, "uuid": "c03ee469-5c41-4f45-a07b-78f875068bf2", "comment": "Malware payload (BazaLoader)", "value": "be291c099743d1b64aee486e05c0dc4f1d752c32", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707007390, "uuid": "eb472ba6-5ad6-4ac0-bce9-5c59cc64ee7f", "comment": "Malware payload (BazaLoader)", "value": "3776f3c26e8c0dbd19cd08b6197f3c06b1e5045bcd3041a3787bdb09b82c48f3b841de5aa3855d95cf5d7802f426a4cf", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707007390, "uuid": "a35916da-89e4-428b-93a6-3cb292363e71", "value": "T13975C0227386C537C96E01303A29D66B5579FDB74B3140DBA3C82D2EAD744C16639FA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707007390, "uuid": "f6fa2b75-a83a-46f8-9538-a3fd8ff7fdfe", "value": "49152:MtgvYpW8zBQSc0ZnSKeZKumZr7Aryq3TGtezO:bYQ0ZncK/A1s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707007390, "uuid": "623dbe33-1b38-4966-9b91-7d86bba9be13", "value": 1608192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707007390, "uuid": "a45072ae-14aa-4a46-917f-ff03813f332f", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707007390, "uuid": "702b2faf-c2a5-41eb-869b-f38e62747759", "value": "msitest.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "024f0fc7-c358-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1707049325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707049325, "uuid": "e0a30b74-e8f0-41dd-90e3-642f90dd297e", "comment": "Malware payload (RiseProStealer)", "value": "983b78100c11a5b5ce869d48652fd6b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707049325, "uuid": "bed8bf78-a77e-471a-94f9-c5f79e732486", "comment": "Malware payload (RiseProStealer)", "value": "5cc6f6b9d69898c3d051509f55c982ef1336f5ac1285ad61b4c28b2ee3c16dd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707049325, "uuid": "c52253ac-596b-4d8d-863e-9ead76186b53", "comment": "Malware payload (RiseProStealer)", "value": "7e6ccb85c3142553a6d6c0388ece7d7b2cde5b07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707049325, "uuid": "4c912449-0cc1-48b7-a0cc-b966ce865636", "comment": "Malware payload (RiseProStealer)", "value": "29e0ab34e749809ff3e425d833e4d629085325b717d3e7ec29e8700e522ff57338fd901a451f2d3cc680b51d953f2f25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707049325, "uuid": "5884e435-909c-4285-93f0-a8ab71096935", "value": "T195563342BC87C61ED0652BB45542F43CB1B23FD42924CE0FB928B7CEADF76A86176142", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707049325, "uuid": "59ceff88-d059-40b4-a022-9149d127f340", "value": "980aa255e7e76def05f32c57f38059f8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707049325, "uuid": "2dc62b20-ba89-48ba-aab2-7007a593bc5b", "value": "98304:6dCR7TasFEuNd7ijZdaHvM3JK+CXThteA64VxU3ldSbTs4QJGhOqsBryh6:6dCRPa52WXGv6JK+cTaEVxUnSbTyJ86l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707049325, "uuid": "ff90d3c4-9ca2-46ee-9f7e-d6b0616c6055", "value": 6043840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707049325, "uuid": "52d9206e-72f4-41b3-8623-59310465be55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707049325, "uuid": "3c1c962c-bce4-4ac6-9499-25cba723b081", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7e14d56-c361-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707053603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707053603, "uuid": "c0600e40-b303-49f9-9f95-66c4566872fc", "comment": "Malware payload", "value": "9a5767fcac3d21bc732c2c62a892a7d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707053603, "uuid": "e338ef61-c73c-42ec-9bc7-0210d1d313c9", "comment": "Malware payload", "value": "5d1afc8f7bf2c74c1b4e9dd05204ac2385caa0c0799381704f792565a6ca155b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707053603, "uuid": "cff0edb6-0067-4ea2-a296-b7a26a118f8d", "comment": "Malware payload", "value": "35bbba1df940199428432785f450ddc5d551c083", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707053603, "uuid": "aac87e93-41e7-4531-aa44-fe8d55c76fba", "comment": "Malware payload", "value": "fd3b3d133a4f553ee2f621df8e8ac6e7ba4def3becdd30ff2c785ce4659404cbfbf0c8f3f25a9d540591bd521e4780a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707053603, "uuid": "e2299dab-2a93-4bb2-86db-4c853be6b564", "value": "T144A51214B35008F4DAAB923DC942C52AD776FC611324DACB03E899A73F277929D3E791", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707053603, "uuid": "b1d5b7c7-fc0d-40c1-a06f-0fe54413d593", "value": "bae3d3e8262d7ce7e9ee69cc1b630d3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707053603, "uuid": "cbfd3be2-ad79-4c56-876c-4ff92097dfd5", "value": "49152:NQDTG8ybcY99I8OR6fJyoik9O5OU+YJzKNdPXJNF8eMgWgZ4fmlapih1:SS8u9fA6hFik9O5OU+YpK7JNDVr4+h1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707053603, "uuid": "5d6922dc-7dbb-48e0-b44f-725041f51dcb", "value": 2207779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707053603, "uuid": "109e9eec-35a7-4c91-97ac-0428db948f04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707053603, "uuid": "57c7a93f-f68a-4e25-a109-c08003bb7be9", "value": "SecuriteInfo.com.Win64.Malware-gen.442.15245", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68ade0e2-c354-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1707047779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707047779, "uuid": "df40e018-cceb-40de-a53a-636bc5f96c08", "comment": "Malware payload (Smoke Loader)", "value": "b4984a96f357cc94dcc71cd41c584784", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707047779, "uuid": "01e7867d-b3ff-48f2-90c0-c1f3654bf1b5", "comment": "Malware payload (Smoke Loader)", "value": "5e71ef0583d1acd753ddbbedf66eba782e00aeadc9ddc6fb101de518b23a6df8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707047779, "uuid": "880ceca5-811d-4cab-bddf-260e356293ca", "comment": "Malware payload (Smoke Loader)", "value": "031db44cd56aba904c2a86bef810f468e8ed4aae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707047779, "uuid": "5b44788a-2772-4ac9-a57a-7a2385c324ed", "comment": "Malware payload (Smoke Loader)", "value": "85fcd349bb5f5373a2c3a7d04bda58fb9b3f14c9230fd22751c46afdf9f39e082285d1507f1971550c7bb58755d4f207", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707047779, "uuid": "a24f00e5-53fc-4544-878a-2b2c94346c3f", "value": "T14E548D9033E5D031E2B755355970C3F14A7BBC62763396BFBAD1A62B2E347918A2430B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707047779, "uuid": "b8728359-da07-4f2d-9314-eb34fb10937f", "value": "e73d248f8b5138b09f44525633bf1f57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707047779, "uuid": "9befb445-033c-43e8-88a4-736f5d5bc32d", "value": "6144:hW8pztQVn2NsRW7AWqdXyiR0Ip61U4kUbFppU1kqc:hBSVn2NEW8WqdXBs1U4kcVUe5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707047779, "uuid": "8931daa8-ed6b-4add-b6cd-73d1d81c8daa", "value": 297984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707047779, "uuid": "b6561747-9054-43b6-924e-dd36116f066a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707047779, "uuid": "217baeed-67cd-40b0-ac00-7f7efcda872b", "value": "b4984a96f357cc94dcc71cd41c584784.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e384190a-c369-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1707057005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707057005, "uuid": "7c4ce441-f693-4e22-8b53-357e2c22d395", "comment": "Malware payload (RiseProStealer)", "value": "7ced1bb243ed005bb0abdce463e8ce7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707057005, "uuid": "84e4459f-c32d-4284-b955-9630c99b0c54", "comment": "Malware payload (RiseProStealer)", "value": "5ec0957697ef3692607bc8a8d00bdad0ff86c129ead5fb698c035f4d6b47c69c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707057005, "uuid": "ccb9bf0a-f9aa-485f-93b2-61c097ce8fd9", "comment": "Malware payload (RiseProStealer)", "value": "5866fd17dae054b91483ff7d6cc0b6096b507fe8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707057005, "uuid": "fa2ed197-0820-4712-aa5b-97c5f67b0a0e", "comment": "Malware payload (RiseProStealer)", "value": "4d398f69c151d5820098e30e7ea3a332f119e558ca00a04e6b45dcf3bf61c1928ce31be79442f3507d66e8e54479a03d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707057005, "uuid": "64873de3-3510-4787-92bc-44e7223ec597", "value": "T1330533F82B19B881EA95767D05881A06FCBDBC504528A6379F3F249F0C685CF5F1AE07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707057005, "uuid": "ffbf578c-4ee2-487d-ac0e-948417479428", "value": "7515ecf8c0dfa4d230ad835fe0acb57f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707057005, "uuid": "8653decc-554c-45f7-8284-e25743a9cf23", "value": "24576:qjC8Bl4BtnEwQRBaWnBCqNkShcZbmNrU0W0RzEGQ:qG2CnElRBaWntuucZSgu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707057005, "uuid": "73a0d8b2-fa86-4deb-9fca-1d0db9136a16", "value": 811520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707057005, "uuid": "6670e8ff-d2ae-4c82-9456-486f338e0b90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707057005, "uuid": "2f90fdd0-766c-4829-b634-c2d5a80b0af8", "value": "7ced1bb243ed005bb0abdce463e8ce7b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2b73259-c312-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RustyStealer)", "timestamp": 1707019557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707019557, "uuid": "46a2c44a-1198-43a6-91b8-6ea0e3954104", "comment": "Malware payload (RustyStealer)", "value": "b4d9a3f0cc39290e03fca02b3f8e2da8", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "tsurtokiobinder", "colour": "#407519", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707019557, "uuid": "4a9f13f9-ec82-48b9-a211-46bdd1e8b668", "comment": "Malware payload (RustyStealer)", "value": "5f25c2f4dc5ae83882588dd60cc8dbae741bb18af40b51629244997ba32a9597", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "tsurtokiobinder", "colour": "#407519", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707019557, "uuid": "ecd2f423-8b7e-479e-bd41-b20f1a89d6be", "comment": "Malware payload (RustyStealer)", "value": "22d1f26c0a5c06bb0aa7cb0fec228b7c4d2c7d3d", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "tsurtokiobinder", "colour": "#407519", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707019557, "uuid": "3c9afcf5-1a32-4c5a-99ce-d2c870a90cae", "comment": "Malware payload (RustyStealer)", "value": "518067b8a5f562ed816fbd7356f6fd9245a5fd5eb11d28fc7ae49ad70f31a5cbea508d52a5e9f7ea22c56b95ca3d8aec", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "tsurtokiobinder", "colour": "#407519", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707019557, "uuid": "79e6044e-639a-4f39-bfd8-462af5516941", "value": "T1AB5633B19F3E3B1475612984BCD749D16DE97D3CA5BCFE1A42266C40EEC88468C7B483", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707019557, "uuid": "59fa4e3d-865f-4d0d-a6ca-2643bf1fae8f", "value": "196608:EzX/O6c99ruzTRAlVpxE9LUwW0d5Eek9:EzX/rc9uNmpxzwEek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707019557, "uuid": "c8110fd9-0938-48c9-9aa6-00030412a4ca", "value": 6302682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707019557, "uuid": "87318190-c7a5-40f7-b919-b7b477b47e5d", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707019557, "uuid": "735b5dc6-8f52-4f43-9f37-bb2b8fab78fe", "value": "App_file_x64.exe.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "854546e4-c34e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707045250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707045250, "uuid": "a400f584-96ed-4279-ab40-2c9830e7532c", "comment": "Malware payload (AgentTesla)", "value": "3db869fa44f3ce906c6728d111c3ea53", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707045250, "uuid": "128875a2-325e-49ab-a687-be44c8b06c54", "comment": "Malware payload (AgentTesla)", "value": "648305313f600305895aa8b78f7981768fbb87eca02337170883ab0194ea1e32", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707045250, "uuid": "c96a1712-1f92-4ee3-b315-b4dbfb44e223", "comment": "Malware payload (AgentTesla)", "value": "99ec697ab5d63926f62bd43ec93590cfac4199fa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707045250, "uuid": "09820405-627c-4d55-9001-8b1c73117d47", "comment": "Malware payload (AgentTesla)", "value": "8c1e1c88db7583e9d48aa48225ddefdf699aa5dbc1b08bef2fe3d538a2c64f987816419cf5f1a4cab708566f40078dde", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707045250, "uuid": "d2dd4d02-480e-42c9-8e04-a18072f4a863", "value": "T1FF9501ED322D171A34234A4CD8DDE288675C890275BD57A0E0F569F65F1F5A6F23220F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707045250, "uuid": "29c600bb-e108-4916-9a75-8133fb125595", "value": "192:E3Dp7fGs0JPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPA:MpDGs9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707045250, "uuid": "b1712c46-622b-4315-949d-f199e533662c", "value": 1884149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707045250, "uuid": "302b3f3a-5ffd-48cf-82b4-bbafe52024bd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707045250, "uuid": "e619a30c-44eb-4068-8c4b-ff51f59817e4", "value": "Bill_of_Lading_32984734.pdf\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 .JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0b3402f-c346-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707041941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707041941, "uuid": "130f8087-d0a4-4a9f-93e5-4ceb1e692a0b", "comment": "Malware payload", "value": "1a7a48b8f5d944944e327507c425d43d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707041941, "uuid": "b9fc7d20-4ded-4e4d-892d-bd3c218b2bdd", "comment": "Malware payload", "value": "64c3bc7845e33f64de943e3e52180a55d32e0a62fff04ea2826e3816b0ba1fb9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707041941, "uuid": "c0d51d05-da1e-43c2-b36a-ea8c4183a4c0", "comment": "Malware payload", "value": "ca5846c016f58bccfb96b04c269a471ee2948ef3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707041941, "uuid": "25f8141d-48ba-4148-a898-5a61fa2fe5e2", "comment": "Malware payload", "value": "ca8af2f6db5d3cd5f202df591e559f1d82a435ce12b35eb0e53f3b70ab4b9f707f27920be6846cab825f1c1e31c4afe4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707041941, "uuid": "4682a850-b1c1-4e25-bb44-673b79deb5a8", "value": "T163564A43ECA555A9C0EEE231CAB29253BA717C445B3123D76B60F7382F76BD06A79700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707041941, "uuid": "a47b8311-90b1-46ae-9573-b0dafe07f97a", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707041941, "uuid": "9a95a2b4-5a4f-445b-b26b-54cac77ddc0f", "value": "49152:FtgCoG6ny6e1Vhgf+m6OJo3rHv2MZsbpZ7WWn711xsv+cpJQjX5EcYfhNv7yriBa:A46y6enLlZsBn711+v9cEdPA980o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707041941, "uuid": "abacb154-a33c-4dad-9ac8-dca999fc20e2", "value": 6047232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707041941, "uuid": "2c88837d-cca1-4896-b0e0-a9c6f93675fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707041941, "uuid": "290ed141-0035-44d7-97f8-d3663a0e651f", "value": "SecuriteInfo.com.Trojan.WinGo.Merlin.4441.7803", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1af90478-c36a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707057098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707057098, "uuid": "46d296c0-16e7-48a3-942e-c38c017e39c6", "comment": "Malware payload", "value": "f619f14d19db93c671eb6214a3881d50", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707057098, "uuid": "8ac2c04a-9050-4756-8b0e-50aec4464289", "comment": "Malware payload", "value": "6679f84b342073e78829cfbd45dd44ad2e63dc78c0723e8ea2334a1105265023", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707057098, "uuid": "1d578334-e105-4d32-9666-cda6e218b32a", "comment": "Malware payload", "value": "31b1a9464933bcbad1f4d6bbe18d557cf9159a85", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707057098, "uuid": "98bd6705-023f-4e3c-ac66-2395df556a12", "comment": "Malware payload", "value": "f3b0d44b780ba515cfe154c5b8e176daf7dbb5eb8a6cd543a55853c7d7ea4c870585d3333a99df69963b3b2166f40460", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707057098, "uuid": "794b6a9e-406b-4aa7-beb5-b66a6f59bd16", "value": "T1ED159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707057098, "uuid": "204c1b7c-4edb-48fc-913d-13777db49370", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707057098, "uuid": "9c7f6e2c-5786-4ce9-8a3c-9d3022a52151", "value": "12288:/qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgagTH:/qDEvCTbMWu7rQYlBQcBiT6rprG8a4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707057098, "uuid": "d98b0cad-79c2-492c-b0a2-1b133e587d3e", "value": 918016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707057098, "uuid": "cd07492f-cabe-453b-be0e-3d08143e8e78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707057098, "uuid": "4ac895a5-505a-43a7-bbca-64dfae2cd3aa", "value": "f619f14d19db93c671eb6214a3881d50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cecb5255-c385-11ee-b7ea-42010a9c0006", "comment": "Malware payload (VenomRAT)", "timestamp": 1707068996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707068996, "uuid": "23403ee1-7348-40d4-b885-71baf13bcebd", "comment": "Malware payload (VenomRAT)", "value": "61570c8c0df19c62b674c1e477730a87", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707068996, "uuid": "98087038-f806-42a5-970b-a21b70ba9262", "comment": "Malware payload (VenomRAT)", "value": "67579963b6060fe6549091481dbb7808bebcf21b3c994fa6791d656786773c9a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707068996, "uuid": "cf699427-2b44-4e66-a57a-743728770c9a", "comment": "Malware payload (VenomRAT)", "value": "3da25ca5f272d2408ce47f4ff848f220217ad040", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707068996, "uuid": "c9bc1b95-bd77-485d-a839-39e46314288b", "comment": "Malware payload (VenomRAT)", "value": "13964cb7db2b699bcf662d43d30810d48696c750a81ad34ef989e51ac73e5807c1080e8d211ea714d4b17b421790e90d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707068996, "uuid": "3d6e12ea-b82e-49a4-9348-4097d2388fbf", "value": "T10A735A013BD98D2AF2AE47B9ACF252074EF4D5176112CE5E7CC440CD5A67BC68A037EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707068996, "uuid": "b39df971-d7ea-48e9-92ee-38416b52ed4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707068996, "uuid": "8b4fccee-762a-4dbf-8589-bda1c4fd1e30", "value": "1536:vUdUcxsbiCCJiPMVCe9VdQuDI6H1bf/mQzcOSVclN:vUGcxsbX+iPMVCe9VdQsH1bfuQjwY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707068996, "uuid": "4e471b19-7df4-4e21-9975-d0efdf175f61", "value": 76288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707068996, "uuid": "9fe86c70-3abb-44f6-8ec2-54c510794df2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707068996, "uuid": "b8b4d253-98ce-488e-abd1-a1c04e57d3be", "value": "61570c8c0df19c62b674c1e477730a87", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5623b1a-c346-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Adware.Generic)", "timestamp": 1707041949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707041949, "uuid": "ea6cb35d-219e-4be8-bbd1-6130b5450200", "comment": "Malware payload (Adware.Generic)", "value": "fb2d4831fa8b36805c6783ad9c62b968", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707041949, "uuid": "cedf2bd4-2008-487a-8b61-76231d87b8a0", "comment": "Malware payload (Adware.Generic)", "value": "67a02e7607687bd182cb0b3440935fe5edcdb786677d258eff117fd7c18577c2", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707041949, "uuid": "0b58cbf0-2bd2-44bf-ad3d-d024f200ab15", "comment": "Malware payload (Adware.Generic)", "value": "ea1ff884d2d71f00f2a34047240dac05b619af63", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707041949, "uuid": "6fab7a2d-f7db-4af2-b7ce-f3e64fe0fddc", "comment": "Malware payload (Adware.Generic)", "value": "638fff0f6f4ed43b1237dd225b24b21c653d4c6cc099d22ae197f4fc594e2188e759f607376603ba5ca9e68b850d53f6", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707041949, "uuid": "225429ec-c509-4fb4-a832-636b8be66425", "value": "T1EDB7333FE2A8A43DD56A1F391973424099B3EA55A81B9C2B07EC340DCF365701D3BE96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707041949, "uuid": "1e9d6ed0-8536-4c4a-9b50-0903279eacf3", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707041949, "uuid": "c10ebb85-187d-434c-b63c-9a45f4e2df16", "value": "786432:8IOqlP6xb7Ft72sxZrm+fQHOuqcr3KuQakORic6vt4I23XKsJBntrID:8IOqlixFpRxho3zKtakQ6vtk3X5JBtMD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707041949, "uuid": "81cdb68b-5817-4f57-8cf0-c60347e5618a", "value": 48925464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707041949, "uuid": "7548e693-a191-433d-a57d-47b11b32d01d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707041949, "uuid": "0d717eb1-f6b5-433b-90fa-049992bb3815", "value": "SecuriteInfo.com.Adware.005ac9541.10056.19521", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4525acb8-c391-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707073919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707073919, "uuid": "d4afdc8b-4de5-4b47-ae9b-985b10eff217", "comment": "Malware payload", "value": "1d133a10b900f9fc801542a830a7d868", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707073919, "uuid": "46316abd-c003-4498-83fe-e4cf2e079479", "comment": "Malware payload", "value": "6982e0a68518ea15b03150bccf3d6faf113caa2f57d9084f071eaddad16fa8b6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707073919, "uuid": "bdcf506e-bde0-4dc1-83c4-383a7a13f43f", "comment": "Malware payload", "value": "49d7a9e049d28e22d72e38340a21cd53cccb7a72", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707073919, "uuid": "16f3a406-e88a-457d-a305-cfa7245f5b8a", "comment": "Malware payload", "value": "72116cadf1d154291e634b23207de808e6bbd4e0e3159e5bb94c60eca22166cea26136b88c09a15874e7363f08f3e1f5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707073919, "uuid": "43ba2ca6-521e-4cff-bf74-654f44a7d057", "value": "T1349302C10BAACAB10E5F11866B1EE8CE5BBB294940CE540FE763F06F47EC44935756C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707073919, "uuid": "00c2770f-8456-4517-bcb3-7fd6cd9af7df", "value": "1536:w5c5C/X/v8pBLUr80qM7YppZ5Tl53F8q7loUHAXFHOrAu6ACBKrQIGK9:/Q0IeH3Vv7ikA19bUrQIj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707073919, "uuid": "fa69d141-bec6-4c87-b04b-bb9eb3c58da6", "value": 97296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707073919, "uuid": "3037c14c-7186-4207-8ec0-87d504ede45b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707073919, "uuid": "4e6cc176-e6dd-47d4-aaff-d0d43339ed65", "value": "fuckingdllENCR.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a26f67f7-c391-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707074075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707074075, "uuid": "f599a3f7-2e1a-4e2b-b9c6-dd3e18bb1f18", "comment": "Malware payload", "value": "9466e2d816f882284a37985e3266d8ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707074075, "uuid": "f1ea123c-1158-4394-aebd-09c1789427ce", "comment": "Malware payload", "value": "6ab70d43fd9ec56216389884b1707021a4f7c7958a120756341bcf3d9fc8733d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707074075, "uuid": "907aaaf2-0f64-4018-9847-c175db981dae", "comment": "Malware payload", "value": "f0a7914a2ffa7975a9edb88ea666697c0cadd2cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707074075, "uuid": "020224db-a04d-4490-9161-67acd752554d", "comment": "Malware payload", "value": "786ef7add65dfcd3f2faeb7cc742bd731ce65556eecdc3be73bcfdc2aac9b39cdb9bfccadb657cb273cb6c0bd11b2cb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707074075, "uuid": "e03de949-c20b-49a4-a296-774fd668d3d2", "value": "T17D7633A5A37519FAF9BAD33DD506C916A771B1344360DBD703E0822A1F13A926C7FB02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707074075, "uuid": "d38c2c3f-cc3d-42b9-bdd9-9f5233b0221d", "value": "1af6c885af093afc55142c2f1761dbe8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707074075, "uuid": "264fa55d-0fda-4b45-aeac-7776e6708a11", "value": "196608:TNV1geB6ylnlPzf+JiJCsmFMvdn6hVvs4:XBRlnlPSa7mmvd+U4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707074075, "uuid": "fd0be187-0b7e-4b70-8124-a6f46c69b0b4", "value": 7139746, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707074075, "uuid": "58149f00-bb10-4a0c-9d27-0ffff4744f0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707074075, "uuid": "4bdf0743-1e1f-4952-aa8e-ce94659b7d7c", "value": "SecuriteInfo.com.Win32.Agent-BDOJ.30083.10754", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3632b7bb-c3ac-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707085490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707085490, "uuid": "695b2ada-dbd3-4958-b5a9-50caf4919aaf", "comment": "Malware payload", "value": "b46be07a8fd4967547ffeeb11358946c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707085490, "uuid": "4eaa60d0-20e0-4727-a29d-ad9b6fc31944", "comment": "Malware payload", "value": "6ad74b6f17c5a179a4a9cf9df91dd45cd9ec8321c6024639753a3e31108ece17", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707085490, "uuid": "864798a0-7363-4bd9-88f4-bbf2ab8d40da", "comment": "Malware payload", "value": "4cd829ddc6fc5c0599191e38b21c31609da4a2dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707085490, "uuid": "7bf46bc7-983e-4f4c-9133-03e399dcd9bc", "comment": "Malware payload", "value": "2982742840f1ff71652dd1344d567a79f5b54d41c911aa1795afe965f04441a51e09d11521e5bffc534014946b941beb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707085490, "uuid": "7d84d3c0-ce77-46e8-aa23-e9823b7ab6dc", "value": "T1C7A53376CDD0A093C4E0CBB64FEB350727A568F20560AE6466B268F81DCD8D9F471D8E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707085490, "uuid": "ffe84d09-366b-48ab-ad88-d8a12d322102", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707085490, "uuid": "7942adc3-eb8d-40e1-8d46-8afbc435f4df", "value": "49152:fdfKiidbeTYI/hGMpvsBKatVtDRsZfzAduOp6P:GbeTxaDtuZQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707085490, "uuid": "2b135d34-9a0f-4866-87d9-9815da183d2b", "value": 2105856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707085490, "uuid": "028eee5d-35ff-4a53-8630-90963d52ffe8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707085490, "uuid": "ed3d9ade-35bf-4c6a-84fc-e0130e94cb85", "value": "b46be07a8fd4967547ffeeb11358946c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3927d9c2-c35d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1707051565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707051565, "uuid": "fdb855d9-66d0-400a-ae73-0864f8abaf41", "comment": "Malware payload (RiseProStealer)", "value": "8ed85982b93adb880090ee53525e9264", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707051565, "uuid": "d4f45f22-8828-4187-b242-74a3bef75c44", "comment": "Malware payload (RiseProStealer)", "value": "6afb1240c2116e26ef7462f2aacea73f2823a25c942c7a843c228fe765077b5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707051565, "uuid": "513ddd23-083c-412e-87f2-8b500542406a", "comment": "Malware payload (RiseProStealer)", "value": "43c5c496427e062ab287787b8f04d48eea3c5bc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707051565, "uuid": "1e564fa5-e0fc-46e1-9b6f-1a9162001dcb", "comment": "Malware payload (RiseProStealer)", "value": "5594d70adc5e1c01b2e376fa32191605d54eb4bfcbb3695724d89514821ef39c89688a4cae411fc26b454f7579ea5100", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707051565, "uuid": "5aec56d7-eae8-4d86-ad7d-7bba2a52a4db", "value": "T109F51212D98530A9C489B9758342ECEC72FDAD514C33B436EC4C39CA87B6E9D91F6386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707051565, "uuid": "80a8279f-004a-4fbb-bac1-f198b185d17b", "value": "52fec336fde93a93e87b094ab8362937", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707051565, "uuid": "b814f5b3-e1bd-49d1-8488-8502020483d1", "value": "98304:ZstCKWGdJAvgndqiS3zrfcCPwmiNlwtpYJQnpy333F:WswJ9ndqX7wmi2VpW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707051565, "uuid": "c9ff26aa-4275-4ab9-879d-4076951b9e64", "value": 3361840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707051565, "uuid": "a9d5e627-050c-42e0-8e83-31a5ce6d6854", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707051565, "uuid": "a672c6a7-3d90-4230-93a7-f829f67dce30", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12014eb0-c3b9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1707091013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707091013, "uuid": "36fa320d-9a38-47fa-a655-a2db1a836a4c", "comment": "Malware payload (Stealc)", "value": "f99cddefb34c8ce86cb76747cc92a996", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707091013, "uuid": "ca40e148-084a-4984-9644-4080ef08add5", "comment": "Malware payload (Stealc)", "value": "6c1a2d364c63d957989483ed42bab9c880c0cb96eca3c56b86f1ed360bd39c8b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707091013, "uuid": "e5833853-ce7d-4903-b7f5-50dc82078a4c", "comment": "Malware payload (Stealc)", "value": "3f64eb44097b857a77aaae4a67d42bfd1720b9ef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707091013, "uuid": "3bd12806-a503-483a-9c69-c02f8293df9f", "comment": "Malware payload (Stealc)", "value": "74e6b5af52020e8849fd48db9df3f195723c292c43a4c09f7ea6742d961a6c2f3cd8286e4d575916b90b8af41f79e837", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707091013, "uuid": "ef149d35-f08b-4111-841e-fd319e148969", "value": "T1C8A5334DB5538E22E8B94972A5312BF767BE8E7845D436197734B7C8387002B239FB42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707091013, "uuid": "fd6b7576-d6fe-4ae7-9e1b-fd2f6077a156", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707091013, "uuid": "940744dc-0da1-4a23-8ce5-029b02ca0847", "value": "49152:ChEF2z0X1W34qvuyXPHcqaGqW9gwLgMyu5noEiyIJAuy:CCFdFWINS/NF9gpMR5oEfv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707091013, "uuid": "7b6e1f4e-d139-49f7-83a7-cee8220aa2a7", "value": 2123207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707091013, "uuid": "594b4980-8998-46fe-853b-b602d340999c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707091013, "uuid": "a3d986fd-737a-486b-ae45-2224d4ae1e78", "value": "f99cddefb34c8ce86cb76747cc92a996", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05dd0e1e-c33f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707038594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707038594, "uuid": "4f0d9585-1f7a-421e-9059-901603645a38", "comment": "Malware payload", "value": "0b101b37c373291fc8dbac097125e695", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707038594, "uuid": "25aec709-8994-4e16-8bca-1eb6b4737ff1", "comment": "Malware payload", "value": "6cba4bd30e036441c0d4f18092a881ce514ff719c84598cc4b7e3990bdc46ac0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707038594, "uuid": "39db6b08-a043-4c39-8f8c-a82936629698", "comment": "Malware payload", "value": "66c8115b0929f918bf2385cecf715ed8fa425ec0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707038594, "uuid": "5ccd6a22-9ff9-4685-88fe-b9fe8f05c36e", "comment": "Malware payload", "value": "aa157bc59d6d20b0bdba2e2126b1bffe5949a482b48d9ee49aeb7b6e38baa9672e9c3a93a93f5bff440fa846e01375d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707038594, "uuid": "bf9fc5dc-6088-40e4-a56d-26ee7ec4e0d0", "value": "T199F4AF4AB6E401F9E0779139D95BAA07F7B1340807609AEF23E446692FA37E05E7F311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707038594, "uuid": "6a31fbe5-7260-40d8-ab95-b655c74661dd", "value": "0c45b94f9006d7dccb8adc504e48e098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707038594, "uuid": "0c4f79f5-a1dd-4ca1-a9b7-0a422931dba2", "value": "12288:IJeQIYHjf4qxfWeJlf6TCbyTqEx2SLPAxHZVy5oj9snTgG:aeQPf4SWcB6ZGEkMPiHG5O9snT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707038594, "uuid": "51af1cd7-2b53-43ee-975c-21340d7d485b", "value": 758272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707038594, "uuid": "6dbc589c-3aaf-4d2d-8af7-2f3d99376a34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707038594, "uuid": "03c3adc4-a158-4a0e-acec-f5b1df2dbf95", "value": "SecuriteInfo.com.Win64.MalwareX-gen.5697.29593", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c463148-c32c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1707030605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707030605, "uuid": "95395065-d997-4daa-93fc-686c9cd24273", "comment": "Malware payload (GuLoader)", "value": "de1eea564341f54778fad64cfe63cba0", "object_relation": "md5", "Tag": [ { "name": "cre8ure", "colour": "#7B880E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707030605, "uuid": "bf6ea33a-5d6e-4d07-b481-2843171c8afa", "comment": "Malware payload (GuLoader)", "value": "7024a42f9603f626380fb0f26105ee53a1562d3dd94a5907b7d64ce7194745e9", "object_relation": "sha256", "Tag": [ { "name": "cre8ure", "colour": "#7B880E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707030605, "uuid": "db9b35f7-3110-4012-ac4a-66fe03225554", "comment": "Malware payload (GuLoader)", "value": "6e75f5dfe0991877df85a6a993059fef47a1ab46", "object_relation": "sha1", "Tag": [ { "name": "cre8ure", "colour": "#7B880E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707030605, "uuid": "adedb967-6afa-4b84-9758-3305b8a8dd0d", "comment": "Malware payload (GuLoader)", "value": "6ea1d613c22062216d870ce008fe3365647f73428d881dbc546ec5350af1a23fff5be83760941d1494c7a6304cfec809", "object_relation": "sha3-384", "Tag": [ { "name": "cre8ure", "colour": "#7B880E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707030605, "uuid": "39bd196e-73ee-4bc2-9904-fcf61da2c9ce", "value": "T17DF533088514B011F006C9B3DF173BAA9F68B321DBEA9FF22F559E57A973127684C906", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707030605, "uuid": "fd0d2cb6-7071-4941-a7c7-2047fd9b872d", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707030605, "uuid": "841bd620-dc71-4be2-8dd6-6f0829175595", "value": "98304:mi++qX8iuivYw7Kx0tJI7dKeZICH0dTzdD:9cNuyYw7RtJI7ZZhH4x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707030605, "uuid": "bae40c78-73d1-47f6-b31e-9a2afd313943", "value": 3427915, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707030605, "uuid": "957627a1-3377-4afb-b6c8-5adfb8766b06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707030605, "uuid": "2cf46717-55f8-4f80-b28b-85eb26721c45", "value": "12029.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d49d8c6-c3b0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1707087327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707087327, "uuid": "f31d056f-4c8d-46cf-9860-8c51b08f2c2f", "comment": "Malware payload (RedLineStealer)", "value": "0782ab4df5bf9762d48f670ea4838ee1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707087327, "uuid": "a24915d0-550d-4596-924a-e9bf30c3a4fd", "comment": "Malware payload (RedLineStealer)", "value": "715611b34cb20f59ad2825081e43b3abde8b654492073e4406f325dcf615e57f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707087327, "uuid": "23645396-0f4f-4648-a00b-67f6f80897e6", "comment": "Malware payload (RedLineStealer)", "value": "a78610da7da3ef572ed61114c29d5c138a83bc3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707087327, "uuid": "d49b1dd9-5e72-48b7-a7e6-8e2640c04d24", "comment": "Malware payload (RedLineStealer)", "value": "0e886c6fc924e8822a57908eddd96bd2633335ae648c586867707681a69c37059bf727cafde57576261471556b246f63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707087327, "uuid": "96d325fb-9011-400a-9364-d0f05ce71bc9", "value": "T166B49E1437E58E62EBAE07358060C014C779E84565E7E71B6CC4EAEBBD23F42F5426E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707087327, "uuid": "8de9680f-3a37-441d-92f9-daf78e4b89e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707087327, "uuid": "c7bd9bb6-3eca-40d7-a341-794eb8d38e76", "value": "6144:QJ5SW+xLSo0rXDnBZ3UG/ifcwr9OcHqr2HDQLVnQIOieEcFfuuYcOFMOqNzm:FeXDnBG9OcKr2HE5NOmpcOGn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707087327, "uuid": "dac942d8-398b-443f-83af-1316fc1bfde6", "value": 511488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707087327, "uuid": "56415558-deee-4212-ba18-08d3f7f73cf7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707087327, "uuid": "56ce7656-58d2-4705-b6b4-61c3adbf8190", "value": "0782ab4df5bf9762d48f670ea4838ee1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "554424b5-c32d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1707030996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707030996, "uuid": "209cbbe2-df03-4201-9976-3673d48d13f6", "comment": "Malware payload (Socks5Systemz)", "value": "f7ab347fd067c4704ff94acbd642ac50", "object_relation": "md5", "Tag": [ { "name": "cre8ure", "colour": "#7B880E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707030996, "uuid": "7fd5565f-8a46-4909-bc34-804ec7742b17", "comment": "Malware payload (Socks5Systemz)", "value": "718187d925935a982d1afaf246363593e3a5b296be6545a78232ed9c3d24b300", "object_relation": "sha256", "Tag": [ { "name": "cre8ure", "colour": "#7B880E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707030996, "uuid": "f43b3384-28bc-49b2-9cde-2b8f3301ef98", "comment": "Malware payload (Socks5Systemz)", "value": "a045b433491e665dacc82830bc1a1cd39bbeb1bf", "object_relation": "sha1", "Tag": [ { "name": "cre8ure", "colour": "#7B880E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707030996, "uuid": "07f13d9c-52d7-4a08-bb4b-521796e60bdd", "comment": "Malware payload (Socks5Systemz)", "value": "697fbe76aeb89ef41b706936b9f453b7cbcd73e0071f8c517e1f3f1c8f2161f697740cbf440feebdf53ffe5a57bce756", "object_relation": "sha3-384", "Tag": [ { "name": "cre8ure", "colour": "#7B880E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707030996, "uuid": "aef0e48c-042d-4cb8-922b-a3fcf9f6dbc5", "value": "T13A8633B285AA4F38D369C9309C52B1203333B45D561331AD32D95DFEF9CDB2A6C986E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707030996, "uuid": "77983b45-6ce2-4233-8529-36df047630c8", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707030996, "uuid": "3f93f1cb-fb53-48fe-9ab8-82abcfeff9d2", "value": "196608:s5oNN8S6lP2LKEnGvVzvC/Zt5P6wPVtsaqaP2c:sE8S6J2cVU3kOP2c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707030996, "uuid": "5d6c93a7-45e8-486d-9d50-af1a3a14fe41", "value": 7988728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707030996, "uuid": "6262f70a-8c52-4995-8c91-8c781407b475", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707030996, "uuid": "8aa830cd-ac50-474c-a99f-b54be4b4b411", "value": "june.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caa4f87d-c32c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1707030764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707030764, "uuid": "30b5c1af-e635-4d9e-b67a-4866b63e2000", "comment": "Malware payload (Amadey)", "value": "86e90a0e4fe2f98f8f2478324ade935f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cre8ure", "colour": "#7B880E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707030764, "uuid": "281445bc-ead8-4025-bcdc-ede68be019d7", "comment": "Malware payload (Amadey)", "value": "71b221f5f267ec6c822d1c47a7d00900e617221b5dc7a2eee79bf8cf11de2b13", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cre8ure", "colour": "#7B880E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707030764, "uuid": "cc32f591-b284-4321-bb4e-5f2032a65382", "comment": "Malware payload (Amadey)", "value": "0e2bac43f7b2b302c1448e253c0d26aeea4bded0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cre8ure", "colour": "#7B880E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707030764, "uuid": "a0430107-f681-49ef-a890-358074e3882f", "comment": "Malware payload (Amadey)", "value": "9170c09d6411bb21eff347b027d55d5b5fed37c746e9aa89e431a0da028b6c5fafcfd2ec953f1e5cffff06289fa68069", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cre8ure", "colour": "#7B880E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707030764, "uuid": "55a98621-bb19-45b6-ac80-5c8711f0bd95", "value": "T1A60523A91326CAE5CB3299F600CB05D48F7C387919805113325F52F68B70AEE7F67987", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707030764, "uuid": "e2d759b0-785e-4f4d-be43-fe3bd83906c2", "value": "7515ecf8c0dfa4d230ad835fe0acb57f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707030764, "uuid": "3a793b01-f8d1-4642-9041-0f63a41393b6", "value": "24576:8YKy8eYf8HnawQ8RHW/nSka9QZbmNrU0W0Ru8PqF:l8eYUHnal8R2/Ska9QZSgug8Pq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707030764, "uuid": "c1f4b3a5-7a61-4f3f-b3ce-3d26413162b7", "value": 811008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707030764, "uuid": "3fbf5477-a638-4d2a-8752-78510dddb545", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707030764, "uuid": "9bfc1918-ee07-4484-9c37-8fef5d9bf2f6", "value": "amers.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9582824e-c30d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PureLogStealer)", "timestamp": 1707017360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707017360, "uuid": "4f8d61ee-fb8f-4b5f-8978-82c6062ef122", "comment": "Malware payload (PureLogStealer)", "value": "c37847efbb39482fe9e84b578f9d1e40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707017360, "uuid": "65c7739a-876d-4598-b0a4-eadc3da8c6a4", "comment": "Malware payload (PureLogStealer)", "value": "76b4bf79082396405a61253bdd503e29f78e71e96ccdab713eeac411e45eae0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707017360, "uuid": "71eecfda-2cdc-4f35-8971-775a54be8fd9", "comment": "Malware payload (PureLogStealer)", "value": "f301668269daab121b2eb6453a297d1c7644553f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707017360, "uuid": "06cd7122-ab4b-4261-a6b8-862c61ccbc69", "comment": "Malware payload (PureLogStealer)", "value": "8bac6b5406c1afc08791a6a68ac5d5a97f6f3ca8a479fbb0b57e96316173cf58ca3de5777a2ed93bc1eb5e9a04311df8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707017360, "uuid": "24976a2d-bde5-4da7-8946-fbd227ba1c60", "value": "T168748D0A76D08A02D7D92E38D5E7852957F5E8477373F74E2F8822A52C523F08E857CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707017360, "uuid": "f3ff000d-0051-40ed-8a3c-e24be9a78660", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707017360, "uuid": "314670da-f699-405f-a72d-1eb5d9ab87f1", "value": "6144:OodhTZOfLcPBAZkDw4L/BJoJs9svzetS0bWQnFQnqwMSfKfqSONzRu3hoC/i9aE5:/xBAZk3as87u/SvPRu3VI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707017360, "uuid": "8291e0d1-0ef6-453e-b6a7-b56fcd7f6642", "value": 361984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707017360, "uuid": "d3cfff39-60fe-4e57-9909-557a70d7a858", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707017360, "uuid": "f986b591-a5a1-4c04-a85c-6e68731574d9", "value": "SecuriteInfo.com.Win32.TrojanX-gen.1376.19475", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dad144cb-c36f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707059567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707059567, "uuid": "4a3f8228-2ddc-455c-bb57-061b1b2ce634", "comment": "Malware payload", "value": "8f7dfbec116017d632ca77be578795fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707059567, "uuid": "cae20e57-729e-41fa-87c8-6b1f6cb72083", "comment": "Malware payload", "value": "78eed41cec221edd4ffed223f2fd2271a96224fd1173ed685c8c0b274fe93029", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707059567, "uuid": "7da654cd-9d8d-4ef0-a813-f173cad1a94c", "comment": "Malware payload", "value": "5a341a41bb909bf577465491420e3fce6001c5cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707059567, "uuid": "ad51826e-fa74-4943-8569-5e3e3618da83", "comment": "Malware payload", "value": "7145c5665efca9adc654e3483ea20c614a4d9a42f61702d8533afc5b6b5c4da5681789c7fc50538c05dab2b7191ed160", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707059567, "uuid": "7659b4fd-7524-46be-bb72-cf31d11e7986", "value": "T1965633F1863B6BB3A626433CB614541BF2CA95B395CE10369BDC59E3C97DB2034EC426", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707059567, "uuid": "331f14c9-f65b-4036-b841-9892ee92cb7e", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707059567, "uuid": "08cb491f-d03e-4c6d-a262-ef17e0f57c28", "value": "196608:3Y2UaraSExxzSDpDIrC+wnI54QXTW0sHyIl:qHzShIO+wnSDs5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707059567, "uuid": "2639b19a-d069-463e-ae8d-7d38c92bc1fb", "value": 6427136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707059567, "uuid": "4f2b9acd-4332-4c6b-aca3-554529e1da92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707059567, "uuid": "8af18f14-2b02-4089-a801-6bb78875f051", "value": "SecuriteInfo.com.Trojan.GenericKD.71237918.29366.5523", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b3600ef-c349-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1707042898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707042898, "uuid": "89a2a897-de90-4685-93be-c6cda1bc792c", "comment": "Malware payload (AveMariaRAT)", "value": "fc920e07e3498e5d5287b8796f95b6ec", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707042898, "uuid": "f567b614-547f-44a1-b5e5-aa2594bb76a2", "comment": "Malware payload (AveMariaRAT)", "value": "79b8fda368f4c16579240c00a455d70436f649bc92becdfa713a8c23ce591935", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707042898, "uuid": "620302fc-bd90-4f1b-8eac-cd1decb4cb7d", "comment": "Malware payload (AveMariaRAT)", "value": "c031c3e9156d7feb50aab08c3039d69507eceb30", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707042898, "uuid": "39e0df4c-a535-4e78-a5d1-ef1f2ba54eec", "comment": "Malware payload (AveMariaRAT)", "value": "ee6eeeecadc3cd13cb4686ea1611dd95dfeba90d6f22d23630a77676ef324d1ddea041d18bf83cb733a82dc47972e8c0", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707042898, "uuid": "edfbdeac-e7b0-487e-a2fa-5f90c5184264", "value": "T1A6F433965F33D8B3AB0862CD86FB05162138A2355C22C8DDDE64F7107EAED04E91D793", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707042898, "uuid": "64ed7515-f3ac-4942-b689-4c897d9e8eca", "value": "12288:FAbLblgyxRHDM1jbxLGrzKAm+GcuSiamIv/Lsrdq/86r1+YKB:+fqyfHmq7mrjamIg4n+x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707042898, "uuid": "accf7ee3-9f17-480e-a221-98db05f21d20", "value": 730701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707042898, "uuid": "4a913957-3842-49b2-aede-af764eb65db8", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707042898, "uuid": "a5d78179-62bc-4add-835a-9aa82c69c236", "value": "PO-87365748668569.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d067d601-c365-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1707055255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707055255, "uuid": "a5f4bbce-b969-4f69-ae9c-526410a4edcc", "comment": "Malware payload (LummaStealer)", "value": "c47e12a1fec39e4f1a120a13e5c35c30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707055255, "uuid": "737b76ef-94b0-4809-acc4-5cd276aa8e12", "comment": "Malware payload (LummaStealer)", "value": "7b3606e2809dab9d70adcb1cfb485c9ed71c395a39da4ade0050cb4b32a0debc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707055255, "uuid": "284f7a3d-7255-4902-b182-ea2e78f3f4a7", "comment": "Malware payload (LummaStealer)", "value": "75ee1d1b1fedd4bf5b53a7d3c3758c56185b8a26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707055255, "uuid": "2d52fd75-a7a8-4d53-b01e-8936cc57c1f0", "comment": "Malware payload (LummaStealer)", "value": "5eb5b07f553c9313bd5b9c7b09449a2b53be2e554d6f64c3759a6f0220c19f3bde98bfe45e0fd51f97de245be7229199", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707055255, "uuid": "0bcfb6cb-f694-422f-8f79-ff762b8ada4b", "value": "T175664A03EC9146E8C0ADD53485A29256BE713C845F3023D72E60F66D2F76FE0AEBA754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707055255, "uuid": "18a9d2ed-56b0-4205-bfb5-69ef27b02c40", "value": "5929190c8765f5bc37b052ab5c6c53e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707055255, "uuid": "5456892b-77d5-4f84-96fc-9e916802f85d", "value": "49152:xDdYA+q/0fpgoin8yY3UCTkEKEmFT+zChRWfxmqZETmCojo5EMHtJ57c6wpvFe28:bOypFCkFNV/EfEcM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707055255, "uuid": "ad8a663d-319f-464d-af4a-a5d7b49fd507", "value": 6919680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707055255, "uuid": "b1de8a61-ac26-4576-8ec8-c3797e9c5fdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707055255, "uuid": "45700953-2e79-4354-a85d-fa718b33977b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09f21f5a-c350-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707045902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707045902, "uuid": "9178a6cd-ac65-4edb-bdc2-bf89fcd46d1f", "comment": "Malware payload", "value": "a35b71225f9b981283abecb7053c125f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707045902, "uuid": "beeb7455-0826-462f-a3ed-adfaca29be7f", "comment": "Malware payload", "value": "7c51b16b848cd4d3b2905702c038e3b0de00abe2c576b23a86e298764232ca50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707045902, "uuid": "bd673c03-bfb8-443f-948b-9b7b86ae7404", "comment": "Malware payload", "value": "38ffa536f30f1aa29db73e202d967c09d59f6aa4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707045902, "uuid": "18590ec5-9d5d-4cb5-b7d3-60e83e2b4339", "comment": "Malware payload", "value": "31c022e0511feb352c329d8bd9b4cfc82261ce2f983589045df237548cba31de1f5f6606dfa691efcdc6dc14143afe48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707045902, "uuid": "1ffe0c66-5c6c-489e-ba51-260e19ce3b96", "value": "T113B6338664E7F04DE75E35782C4B6047A3FA1E125CA6185686423BEC79F8DB4CFE2C60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707045902, "uuid": "ea86a664-95dc-4654-b2b4-5875acdcdb89", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707045902, "uuid": "94d2bf60-83e1-4663-bfcd-23d87ea6390a", "value": "196608:2gejFdU1Vu/Rh9R8Q4Z28xO/cQg2PqIzrIIikqMLpeP6MXNVIs150+j:2geRZRhb+tEGf6UujMXnHD0+j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707045902, "uuid": "de333ce6-4254-4c00-98ec-a4dd9028744a", "value": 10872240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707045902, "uuid": "1f8437d2-ae94-418b-aec1-043583eaa0b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707045902, "uuid": "99708905-bdfd-4175-bdd5-46b45f55c234", "value": "SecuriteInfo.com.Trojan.DownLoader46.38180.32598.31159", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dffa15d-c395-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1707075625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707075625, "uuid": "965e19a5-f920-4fb9-ba38-3cea08edfd00", "comment": "Malware payload (njrat)", "value": "c0f18b64615091670873c2f86898590c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707075625, "uuid": "bdf24fbd-e176-4706-9b5f-892ef20d063d", "comment": "Malware payload (njrat)", "value": "7d66d90ab8f58ff0a83093728239ac6ec9380b15653e328f8b9d2d00ca338d48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707075625, "uuid": "72f20f46-1f57-435f-964c-4b72e6f2b2bc", "comment": "Malware payload (njrat)", "value": "6e4a1bc64217c600be16e1fb74c5a165eaa99c80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707075625, "uuid": "1d49422a-93d8-46fb-a963-63aec4692303", "comment": "Malware payload (njrat)", "value": "acc7dc1b51040193365811d77c4dde317a6c2564a8d93972331234e2ee58b4cfcad6de224f7a5c8b282266f688406094", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707075625, "uuid": "e315ba3d-45c4-4c03-a881-05ded2dad8b3", "value": "T10CF3C7ABB688CF15EE582872C4DB943003D5AED71B33F28A3F49365919423F35D49AC9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707075625, "uuid": "8af224e4-79f3-4787-bed2-e1289ab143c2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707075625, "uuid": "b9ceea70-ec05-4854-8977-6294c4398b7f", "value": "3072:BNacqIpafAK2Him3xt9aJeg8sr1yuch/1/gASLRqOyP50Jq:BdNiYX08I7+/gVLRqOE50Jq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707075625, "uuid": "51e9a597-7388-4f16-8fca-33912212e7b3", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707075625, "uuid": "7cea1a34-3fc3-4aee-b940-53a4d0565471", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707075625, "uuid": "7979ea2a-8645-465b-8c06-b2061c5f26d2", "value": "c0f18b64615091670873c2f86898590c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa759195-c361-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707053607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707053607, "uuid": "3ceb3941-37e5-4d44-ac05-f116a6b8b866", "comment": "Malware payload", "value": "b38a1365056fb235fcc066d7a3ac483a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707053607, "uuid": "bb8d9b8f-80e2-40d3-8251-f964c98a13db", "comment": "Malware payload", "value": "80b0f705f0479cc926b2d7fbd3e7b73926e4caaed0f2519ffc43e82a7c1fe8e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707053607, "uuid": "834d1dbc-f31a-4880-9e69-0a91e82df47e", "comment": "Malware payload", "value": "5c471fe50efd22538f0f7828a20999e95149929f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707053607, "uuid": "e551ac48-b072-4810-9de0-bef8a3f49baf", "comment": "Malware payload", "value": "c34dbf9e9f624e3aec84e6fb7aa7f591593656986f098cb16c2e3a51a770ccf1b1e68037821828bc9e9f161cb679113b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707053607, "uuid": "2014cdc9-33d9-41e1-a280-66bbf52f6d8d", "value": "T1A9E32957A3A510ACE5B7E2B89AB50612E7B27C150734D3CF1360813A0F67BD1AD3EB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707053607, "uuid": "0072084e-e602-458b-81e1-70066322f4d0", "value": "2f7ae5cf50f80f4cf6e0d858b17bed85", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707053607, "uuid": "7c6dfa68-26ac-41e9-85f1-dd6c61476aba", "value": "3072:tnIIk+R5LhOqwM6IZ6HCLNy9rdmJTQSaMm5/607je61Y:tnbkC5LEq9LgqWlZem", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707053607, "uuid": "39d8c5d0-c4cf-4760-b797-7300849497a6", "value": 143360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707053607, "uuid": "be48752b-0630-4482-9cb2-5d96c308ef9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707053607, "uuid": "a3d938e1-d028-418b-9225-d4ac24b5b72a", "value": "SecuriteInfo.com.Win64.HacktoolX-gen.30823.20838", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cb59d1e-c37e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1707065878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707065878, "uuid": "a635c310-3985-4987-82b5-6875b2a63c54", "comment": "Malware payload (LummaStealer)", "value": "2cacce0bad26aa9301f32a1a7e2dda39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707065878, "uuid": "8096bd31-902b-4be4-8ca0-1668b9153571", "comment": "Malware payload (LummaStealer)", "value": "8111d1cf423d5496e7c48e6177cae3ed3d83aae6097ef206f55b870de951933a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707065878, "uuid": "e36e6c86-6fc8-412b-8ebb-7b7d6b7bc4f5", "comment": "Malware payload (LummaStealer)", "value": "fc2bd435311933fcf7f8bf4227c8a65a42073db9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707065878, "uuid": "d3d4a51e-6a31-4d38-b943-4de50f94f17a", "comment": "Malware payload (LummaStealer)", "value": "333d2f3bcd47f2bd10388d3a6b0d82cee53226305f0e96a80384c680a52ab13bea78192be64c8779d1baf8bb559d0f04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707065878, "uuid": "8506d075-19c5-41af-b0f7-1658749cb829", "value": "T1CBC533192F32745FCE058433ACCFB0986D36461FDFE526AE30A1E1658FA4A97226C5D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707065878, "uuid": "e4039fd2-534b-45d8-ba7a-618092abe077", "value": "0980a5bdf7b225ee6a859c0ebee6a4b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707065878, "uuid": "58c304f5-0649-488f-8e97-f64527fe47fd", "value": "49152:9ioXepeo1dkXT83VgxJOIGX0Nktj5LHyYbppORoHKZQCytZck8y6qRV2hCU:lOM6SYCXM0NSFmYNWoHKVytWk89hC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707065878, "uuid": "6635a0ed-2b96-499b-b91d-3df396eb3e77", "value": 2669568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707065878, "uuid": "9f8b3216-d52e-4aff-b175-5466bbeb6638", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707065878, "uuid": "7e11aa99-89ae-47e9-a76a-cce3bf523168", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84717153-c354-11ee-b7ea-42010a9c0006", "comment": "Malware payload (XFilesStealer)", "timestamp": 1707047826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707047826, "uuid": "0db4b87f-66a9-411e-96b5-b17b07dc7b12", "comment": "Malware payload (XFilesStealer)", "value": "8e45da861c2203a9d67ab775941f36a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707047826, "uuid": "1451e51e-f28b-41be-b29a-ec1d8b0601f9", "comment": "Malware payload (XFilesStealer)", "value": "81ca74b2a39791080e6e4b7bac45a8ef8b0688b5b09ddf72417b9fe7f8a3a133", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707047826, "uuid": "e1f5d03c-6e34-44d7-8683-2d5a659d52b2", "comment": "Malware payload (XFilesStealer)", "value": "c8dd1987345117faf2a45a43a1420704dd815116", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707047826, "uuid": "af127c65-babb-494c-9eed-000ea4ea65c8", "comment": "Malware payload (XFilesStealer)", "value": "be2ba7e4bc1838f6b1a1134232436a1e7328db128b4db0a1779e15ecdde647e87bde55adfa0a9e660707d7764a7cdd17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707047826, "uuid": "522dc6f7-202c-4ac5-b62e-de05578cd8b7", "value": "T175845BC114834D79D65CAFB22C287E8971B7341ADDCC8B427AECD06C1E66BB0D16D297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707047826, "uuid": "bb996279-ad85-4842-b0b8-38fd2c8cbd21", "value": "b204377790c6767afa2d0bfaa5654670", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707047826, "uuid": "4bbd6ad7-b9aa-4acc-8d9b-a8c0a2fc683a", "value": "6144:BnBmybqXEdViMEGUMJDCn/FgjmAfQVyfuveAxWuCfvEH4540s272FNH:BUGqXEdViMEV6hGyf2+vEHJ0sV5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707047826, "uuid": "bfd3ef36-d9da-4b59-b403-85f200df97e0", "value": 387656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707047826, "uuid": "ffe81de1-3f37-4ed6-a2c3-28aa3d69a46a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707047826, "uuid": "06bbfa6f-a901-416b-8fcd-93af54bb76a6", "value": "8e45da861c2203a9d67ab775941f36a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dec4e59-c37d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1707065451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707065451, "uuid": "ec37e9c1-3aab-4f08-bcac-9c5ff47895be", "comment": "Malware payload (RiseProStealer)", "value": "613fdc04ffdcb927ce9d48dec7c59538", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707065451, "uuid": "15c56936-e3dc-444f-959b-198c9823f251", "comment": "Malware payload (RiseProStealer)", "value": "82e1a2bf56bf88007f83c52216c7f730aa8526cf4c164f6996d48bd8577eb914", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707065451, "uuid": "a10f2157-c658-4333-afed-9796bf7dca97", "comment": "Malware payload (RiseProStealer)", "value": "3c11a3ad2972f59d019a75a8d1ae4fe384eea956", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707065451, "uuid": "7ae4a7f0-5d5d-4581-af9c-0345ec2229ef", "comment": "Malware payload (RiseProStealer)", "value": "9752908972a703a7b2124348f1c5a04f1f3359616442c4a6bda7c5caa8670e9bc43b71d22313344616c6fa4121d7f6b1", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707065451, "uuid": "d22eb649-3402-48f8-9f28-7a4e90441b5a", "value": "T1D8C5D04112DD8164DF7B7131B66D7ADAD833FCE84D288A2B1FB486C50BDB2A217E6710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707065451, "uuid": "0179fc9c-e2af-45e6-a0e6-455cc3c43839", "value": "949b5681cca3577603875ab156ae6257", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707065451, "uuid": "b4a4d32d-a4fb-48f9-b733-36c640c0e991", "value": "24576:Tzmzt8lm28n4BX1BFqO/h1SKrw7d/FWOWKjPBrT8+Vz+oLux4GvWfj3ysdBC3zrp:TsFHjPJJzwKwEyzilfP0r98Cfo/0GUF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707065451, "uuid": "57e66438-ef40-45c1-986e-24023e623008", "value": 2576000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707065451, "uuid": "3c9c841f-d2ce-4a44-9e3b-d3c24ef705d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707065451, "uuid": "9ba6196c-6057-48d2-ac9f-495481ae0588", "value": "613fdc04ffdcb927ce9d48dec7c59538", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32f5f8f8-c329-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1707029221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707029221, "uuid": "ba5e4bea-c80a-4e4f-b52b-e67bad414682", "comment": "Malware payload (Stealc)", "value": "4913fe0e4d17f0a4b18a9acb04c255ac", "object_relation": "md5", "Tag": [ { "name": "194-120-116-120", "colour": "#060034", "exportable": true, "hide_tag": false }, { "name": "CVE-2023-27363", "colour": "#36119D", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707029221, "uuid": "fad3898d-3f9b-4db0-9558-8f37db896309", "comment": "Malware payload (Stealc)", "value": "84626884775edba43d27869acfe98ce6e7bf687bc1d71fa4a4383d69cfe9d0b6", "object_relation": "sha256", "Tag": [ { "name": "194-120-116-120", "colour": "#060034", "exportable": true, "hide_tag": false }, { "name": "CVE-2023-27363", "colour": "#36119D", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707029221, "uuid": "d854a011-f9b9-4e34-980f-9ee9acc44579", "comment": "Malware payload (Stealc)", "value": "5dcf904992745d124e65f5b5adefeafed78b7ed9", "object_relation": "sha1", "Tag": [ { "name": "194-120-116-120", "colour": "#060034", "exportable": true, "hide_tag": false }, { "name": "CVE-2023-27363", "colour": "#36119D", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707029221, "uuid": "b77dc5b4-e43c-430b-8494-245af796c061", "comment": "Malware payload (Stealc)", "value": "ed30e153e52fad15c830f3be15a2d69c749a1f2057e2f78f216a0624630c52620932f28636f35722cc65b0157ebba0c1", "object_relation": "sha3-384", "Tag": [ { "name": "194-120-116-120", "colour": "#060034", "exportable": true, "hide_tag": false }, { "name": "CVE-2023-27363", "colour": "#36119D", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707029221, "uuid": "1d8d5a32-f9db-4eff-bfda-d1a558319cde", "value": "T14CC30231E8484CE5FA610B3A151E9C342CB28DD78C47579FC3B964928BC4A6DD27E7CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707029221, "uuid": "c2512a5f-a9d1-4308-b359-8f0ea38848fa", "value": "3072:SCmT2J09HCxzDRfzU4g3i9/ptUDKMXC1RuGjFR0A:4TNiztfojujUD21cmx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707029221, "uuid": "e6d7b7b1-dcfc-4917-8085-109f4293151c", "value": 118502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707029221, "uuid": "0af9b80d-b8a2-4d49-8530-6cb6d52a8872", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707029221, "uuid": "3b09f445-9e21-4461-b086-1c1bb706f530", "value": "officeupdate.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4805ce59-c3b0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1707087238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707087238, "uuid": "df465973-6eed-4fd0-93d4-775708ce7738", "comment": "Malware payload (LummaStealer)", "value": "205557b4a34f1c6ed8fac7abf5282870", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707087238, "uuid": "cee888aa-8996-475c-be38-dad744488cbb", "comment": "Malware payload (LummaStealer)", "value": "84e43fbfc690a7c12bc1c06fe9c72c46f46e8de88218cc28ac2903f82b77e2f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707087238, "uuid": "2cde5b67-6512-4ebc-b680-95b011657318", "comment": "Malware payload (LummaStealer)", "value": "38b3a65273d388b907c6e5f4323e43769d0c7ab5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707087238, "uuid": "76e8a783-99ff-4336-99c7-7272504eb607", "comment": "Malware payload (LummaStealer)", "value": "9d7052e248cd48b5fbf32c0ee803e9cd132be7de85755bb7ffb37b57332a885644542aee9da3d7d1e255b16673a8368e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707087238, "uuid": "2314f64e-8110-4623-8468-82e28613a3c5", "value": "T19846BF12B7A8CD6DC65D9B32D1B3243287B0DC42C3A6E3971A9271A93EB33D54E461D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707087238, "uuid": "08b4de4a-8441-48ce-8be7-9c51465093dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707087238, "uuid": "4965a4e5-474b-4e51-8d6b-707721fa4034", "value": "98304:AUlplcecnPvfHAZDsC3pxqKEZTehMxAD9mRLMOhDZRX++GkjSdVl/:AUlplcecnPvfHAZDsC3pxqKEZTehMxAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707087238, "uuid": "26614ec5-57c9-4b23-8f53-c56c8afd377d", "value": 5580800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707087238, "uuid": "962c3ab3-bd77-47b2-b5fd-9b58828f336e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707087238, "uuid": "74a0c602-4712-479b-8241-0ec05b9af52c", "value": "SecuriteInfo.com.Win32.TrojanX-gen.7203.10097", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "391e47e3-c3ac-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707085495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707085495, "uuid": "12f4721e-5ed0-481e-a7d0-e551e2e5ba7c", "comment": "Malware payload", "value": "f50536d2ac683c7edc8706198103ccb8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707085495, "uuid": "4eee512e-635c-4d72-8815-fed5755bed77", "comment": "Malware payload", "value": "854929dccfca0bc24198bb737a81a8d74b2bc924049167b8ed6ad8e96a75610b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707085495, "uuid": "ba701a67-5c38-42ef-bc52-380c9db8a8c6", "comment": "Malware payload", "value": "4545e786b576dcda04acc2bb8370627f7d7bbf83", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707085495, "uuid": "805db579-4ecf-4d33-a2b5-1ef0450bb2fa", "comment": "Malware payload", "value": "a40a8c2b72e2f2aba68eee3f7ff2c999b82324bf0c5e1350f0df8dd4dc4451f06da9188b2b75464f0e7a41d6610da42c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707085495, "uuid": "1f3033a6-0425-411a-98d9-c9913bb3ee47", "value": "T15F7533E1EBFF8922F44F02B47D54804005D04B807F6BB5BAAC7E1A27E91B63586765B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707085495, "uuid": "35e51544-5871-4fa8-ac52-b960d78beb7b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707085495, "uuid": "94369489-f941-4288-8d53-d0830ace10cd", "value": "49152:tL+AtHq6P+X2Y1HKrbcFWzpr8i0EjEm6Saxe:tyiKM+GYKrb4WVr8iLjeR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707085495, "uuid": "3071a611-50ef-4460-92ad-143412cd556d", "value": 1644544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707085495, "uuid": "a7a8a052-4cc7-446a-8560-7fdc304386f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707085495, "uuid": "ecbd92a4-6edb-4dbf-bbb9-da6a021d996e", "value": "f50536d2ac683c7edc8706198103ccb8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87b95a58-c329-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1707029363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707029363, "uuid": "e823ea2c-0915-43df-9951-a5b14bf99d66", "comment": "Malware payload (Stealc)", "value": "a7e899088ee574a2e977080acb00c849", "object_relation": "md5", "Tag": [ { "name": "194-120-116-120", "colour": "#060034", "exportable": true, "hide_tag": false }, { "name": "CVE-2023-27363", "colour": "#36119D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707029363, "uuid": "f1c30e90-12fb-4a8f-bcf7-49b4c9d2a522", "comment": "Malware payload (Stealc)", "value": "85735229bd3b6ae1d0c60d43f3e24a2be5f0d21d87b7f2c01f13373c051c82a5", "object_relation": "sha256", "Tag": [ { "name": "194-120-116-120", "colour": "#060034", "exportable": true, "hide_tag": false }, { "name": "CVE-2023-27363", "colour": "#36119D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707029363, "uuid": "53c740f4-28a4-4792-a504-c76baf964491", "comment": "Malware payload (Stealc)", "value": "f3e260e8699102d2ee43e1c5a99231005438bb69", "object_relation": "sha1", "Tag": [ { "name": "194-120-116-120", "colour": "#060034", "exportable": true, "hide_tag": false }, { "name": "CVE-2023-27363", "colour": "#36119D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707029363, "uuid": "9066df6e-a574-4134-8905-d68bb714b359", "comment": "Malware payload (Stealc)", "value": "850c160a7fe0fdb3b8aba93ce11c26d8c038fa548d93daa0f5c84d7ee0348aeb5e0e1f1f2a404ed4ecfb8e52ee35f632", "object_relation": "sha3-384", "Tag": [ { "name": "194-120-116-120", "colour": "#060034", "exportable": true, "hide_tag": false }, { "name": "CVE-2023-27363", "colour": "#36119D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707029363, "uuid": "ad5ccdd4-c2b0-4f8d-8392-748a2d470a04", "value": "T162369E02BF95CE12C25D6B33D2D7411453B1D8D26373E74B7AC513A92A0336EDE8E68A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707029363, "uuid": "758601bc-9f6e-4077-b7bc-5f5bcd59e776", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707029363, "uuid": "cea72f02-f9f1-4259-9e6d-ef8cac0115fa", "value": "49152:G6+uF3aQ8oal2XJfYGClcSHIib2DszK7GSB2kTRBsx5QgAgZrFTZ:G0dalotJBAcl9TaSBvEx5pTZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707029363, "uuid": "1c15ad2c-80c7-43b7-94e3-7f35523a5c7e", "value": 4865536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707029363, "uuid": "501a6450-2558-419e-a5ae-cc97183a70ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707029363, "uuid": "c7269351-ada8-4bb7-bc90-06f6a23658d7", "value": "stale.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "111c2c50-c39f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707079844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707079844, "uuid": "1f72626a-c575-4465-a043-7b560cfa7545", "comment": "Malware payload", "value": "371facb4ecd722b5ebb158bc62a35ac7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707079844, "uuid": "f8e97f85-f80d-4c3f-b2e1-0d50dc5621ff", "comment": "Malware payload", "value": "88154b9847f3ca4997fad3a02abd3747e306aa4802a69fc778aa87d5706205e9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707079844, "uuid": "9409df74-85e6-4fb9-b55e-5f1a6d521575", "comment": "Malware payload", "value": "fb031600add646a14089aff29d06a44d59c63c97", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707079844, "uuid": "79dd2b40-cfe8-4f50-a384-a9cef86177bb", "comment": "Malware payload", "value": "53b222c7c8be3e67b09181bd0f4c5d81f285bedd4a486f5ef90194e7f70c2a939ffefe7cd04ed02b5574abcbc333d9f7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707079844, "uuid": "02f273ca-57a8-4ba2-9a72-199b74bacb6f", "value": "T1AD438EB3C82A6E44C5498970B4304EB91B53F019D2970FFB59A9C36A9483EBCF6463F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707079844, "uuid": "ab5b7c39-53c5-40a3-b2e5-a96698539794", "value": "768:ICivmy5Pea51tYLUYO90WJqK2xukaGoP0VZOCIAw4sV8fbRTKI:ICU1HtYu9EK2xu3ZP+OCueR+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707079844, "uuid": "b0261f49-4bbb-4226-9e57-47b14f7b63ea", "value": 55744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707079844, "uuid": "878f6161-d40a-4c89-a1b0-4e8ac36a5a1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707079844, "uuid": "4b3c1d87-5e3a-4186-858c-8a1d565f84f2", "value": "371facb4ecd722b5ebb158bc62a35ac7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a77e349d-c38a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1707071077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707071077, "uuid": "dddc6552-b8f7-42b6-9df4-741e2e727b58", "comment": "Malware payload (Amadey)", "value": "2afdbe3b99a4736083066a13e4b5d11a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707071077, "uuid": "2d895177-7ed1-439c-880b-cb8fc646bd3a", "comment": "Malware payload (Amadey)", "value": "8d31b39170909595b518b1a03e9ec950540fabd545ed14817cac5c84b91599ee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707071077, "uuid": "045a42b3-b5cc-42a4-8492-0d59b81e46be", "comment": "Malware payload (Amadey)", "value": "4d4856cf02b3123ac16e63d4a448cdbcb1633546", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707071077, "uuid": "103e7a9e-75ee-49d9-9040-9b98e8557e6b", "comment": "Malware payload (Amadey)", "value": "ccc4af7933775ddadaf70c6c62e6b88bd64f5358dc9f85631830528236d40dc7d7c2ef0c20d06c125f1404e5006b9d59", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707071077, "uuid": "9a92afc7-ffab-4926-8790-74f1505e9f38", "value": "T1E4B35B1135D1C472D6AD0A790864ABB1CB7EB810DF745DEB37940A7AAE342C29F34D36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707071077, "uuid": "75632c89-3363-43d6-bc22-2ee6a34fa377", "value": "61d6334c6ae4948c906d9fa7fdf019fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707071077, "uuid": "34ecb167-dd2b-4ff6-a791-3f0de11f765c", "value": "3072:xE5kJp+s5aP40bGsuZR+SVhJQ3ICRv4l:m5ka2obfuZR7Py4l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707071077, "uuid": "539b28ff-f592-4210-ab96-b780c4fc7167", "value": 112128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707071077, "uuid": "e8d5224d-25ac-440f-b95f-e354f1ef113f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707071077, "uuid": "f8c315ed-cc9a-4178-8dad-28a4f7497efd", "value": "2afdbe3b99a4736083066a13e4b5d11a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7171819b-c354-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1707047794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707047794, "uuid": "e46db114-8cdc-439e-b77c-a929bd0bf1e5", "comment": "Malware payload (Smoke Loader)", "value": "5b9a879ce94a34a4934845b684375525", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707047794, "uuid": "3d6964bb-928d-40c6-be24-c93733a3689f", "comment": "Malware payload (Smoke Loader)", "value": "8e805694075e2a0ed78cdddde1890a93d056b501ed37a6815181923ae9ed1f69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707047794, "uuid": "af540c2f-bc15-400e-b4ea-c2b1b1fc157a", "comment": "Malware payload (Smoke Loader)", "value": "23184a3e3f87778cddd07b00ed7882b808691e58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707047794, "uuid": "6b159759-cebb-4488-bd5c-4dd40668e592", "comment": "Malware payload (Smoke Loader)", "value": "124db9291456ecbe451d5cc95c26f9fb7b2dbd658580b92ff0380e76cb90485ff2659d3bde9cbaec1732c94229fba782", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707047794, "uuid": "498347e9-b816-4f11-87a7-407345008019", "value": "T1BD547D1033F4D032E3B755314979D3F14A7B7822367356BFBA91262B2E34E91991932B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707047794, "uuid": "8fce6e76-6cb7-4b7e-8df5-fc2212292cb3", "value": "e73d248f8b5138b09f44525633bf1f57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707047794, "uuid": "6c2c797d-948c-4839-b756-74a7ff957ce7", "value": "6144:0W8pztQVn2NsRbE+K4iV3Cy61U4eLk1kqc:0BSVn2NE4zVVS/1U4eQe5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707047794, "uuid": "06bcae0f-bb7a-43fd-93b0-5dde6dcfbc52", "value": 298496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707047794, "uuid": "40eed1fe-1e2c-4469-9b50-3fa9d36766b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707047794, "uuid": "d843ce65-6b91-49d5-ad40-8e7e9ee45743", "value": "5b9a879ce94a34a4934845b684375525.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92b5f683-c32d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Healer)", "timestamp": 1707031099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707031099, "uuid": "fdcba0ef-869a-4b0d-875d-886b8165c92f", "comment": "Malware payload (Healer)", "value": "abfb4efbf3a16da819b19b0357d5e356", "object_relation": "md5", "Tag": [ { "name": "cre8ure", "colour": "#7B880E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707031099, "uuid": "0caa47f6-2f8d-46f6-959d-c19a5dc522b1", "comment": "Malware payload (Healer)", "value": "9005e65297622c73482ec28469563c91706ef7e88baf666fb6951dab1b389655", "object_relation": "sha256", "Tag": [ { "name": "cre8ure", "colour": "#7B880E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707031099, "uuid": "77f06def-cdae-443b-9e6d-def1a6c7827a", "comment": "Malware payload (Healer)", "value": "e773a51b6262c1bb6410b1bb826b58b05adea148", "object_relation": "sha1", "Tag": [ { "name": "cre8ure", "colour": "#7B880E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707031099, "uuid": "500283fb-e323-4302-b42d-38edc871c25a", "comment": "Malware payload (Healer)", "value": "d374875694b5984658ea73828b720d0ab4c1b21686bf440a57203386a91143852659b5c8c363c32ec1d26b1e6a3792ae", "object_relation": "sha3-384", "Tag": [ { "name": "cre8ure", "colour": "#7B880E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707031099, "uuid": "fc8c2013-fb70-474b-a976-f8f539213d27", "value": "T126D423FC51929681D61027B151C193F82628FAFA874D5B2DD07F8FA28EB55CE2B43C87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707031099, "uuid": "cce244f8-9c08-40f8-ae03-6817bff08f70", "value": "436f7e4bc6bece183fb5bacd9f2ff7d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707031099, "uuid": "64cef2b0-db46-4188-8fe7-0f9546657110", "value": "12288:uo7YNQuJBeW8/LViyIakQz15bbPZrqz08NLb0lvPtD4ibqVI:HwQuUiyIakELBrqY8MP1rqVI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707031099, "uuid": "eff381db-4cd7-4b9d-9bd9-2e7004cb1c4a", "value": 617472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707031099, "uuid": "1d36a8fd-e2ea-47a0-a684-5da1af5c3c25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707031099, "uuid": "466badf2-ae44-4eec-b1fd-d3b399593460", "value": "niks.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f1f2b61-c349-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1707042904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707042904, "uuid": "3cfbd931-6534-4f80-ab8b-a7d9a4fd8114", "comment": "Malware payload (AveMariaRAT)", "value": "e91ffadc5a9582e57acbd29aa9b2b97f", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707042904, "uuid": "f7f473ec-1f06-42ee-8922-66eaf32b222e", "comment": "Malware payload (AveMariaRAT)", "value": "90b0e81cae870478e28e0902f8011e63315394fab478fb790827d95d1c34ba6f", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707042904, "uuid": "3645ce36-fc0b-410c-8717-9c7fc73a7d1d", "comment": "Malware payload (AveMariaRAT)", "value": "d8cc3d7f79e8a09a15759b3de91406eff847eb46", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707042904, "uuid": "287f2ba0-5fc8-4771-8bbd-eac8c0728349", "comment": "Malware payload (AveMariaRAT)", "value": "37f479b6b605c495e099c631b12b003221945f514ed848981b70ad71771cf9594de0be7fbc4dfafb1e27a5a8cd918452", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707042904, "uuid": "fa294e6f-7f38-419b-885d-5a538e71d6de", "value": "T10D159DC8798171DFE4A78E3E84A09C5197717C6F1246E94F6007B7D8BA3D5838E223A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707042904, "uuid": "0af34046-f54c-43da-9558-6d52f727ca0d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707042904, "uuid": "1b73b46b-bf45-498c-ad58-f7f5dca4fac1", "value": "24576:V8IH/5Tc2NLJlVSDiCb+Q8iAqaQddq9rDy08o:XHhA2N97SmCb+Q8HEADD8o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707042904, "uuid": "f07ab6bf-d42e-4b2e-a9f5-662de71e7db3", "value": 961024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707042904, "uuid": "27769889-3120-467e-a8e0-7978dcb539f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707042904, "uuid": "c0fef544-1464-44ff-a442-773584eba9e6", "value": "ITEMS SPECIFICATIONS - UNITED ARABIAN COMPANY UAE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c34376e7-c398-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707077137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707077137, "uuid": "e233c8e0-3f6f-4442-981e-7454ccacfee1", "comment": "Malware payload", "value": "605db2ce265a2886f8791ccbad575e58", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707077137, "uuid": "537e94ab-1648-4405-a97c-08874859c8a2", "comment": "Malware payload", "value": "920dc3757098754ad387c1c10b2fec7250a17dd16722295a9e3fe451c4445154", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707077137, "uuid": "ca0fb5e2-5a48-4a44-b009-531a47d363e4", "comment": "Malware payload", "value": "2b4c6e0283c7597f3b51603418ee7c087763c034", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707077137, "uuid": "39b65b7c-c3cf-4ece-8997-16f98067c426", "comment": "Malware payload", "value": "5e73d56f0fef99432855f23cb68f9844c8df7f0b6292b18ce36cb4bbee04464497f8fde158502874bab28c0af8dfd96f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707077137, "uuid": "c169eba8-7fb6-4667-a19b-aa86ed8091e7", "value": "T1E8634A41BC819623C6D4227BFB6E428D372613A8E2DF7317DE226F1137C296B0D6B651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707077137, "uuid": "c75a9cf6-da30-4d8f-865d-57d724a6ab65", "value": "1536:6wPXmKOGnfacWlk9nBHP7Okt2rGjXD/4nv5:6wR9nxArQE5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707077137, "uuid": "eb554703-3599-46b0-9c1f-40d874ebbe8b", "value": 67112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707077137, "uuid": "8e9f4ac7-ebc8-4f5b-a8bd-e0a4d25a4512", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707077137, "uuid": "96dc5acb-82d0-416c-b271-20f12728e150", "value": "VRarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97e4daff-c378-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1707063320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707063320, "uuid": "a87d54bf-507f-455b-bd7a-02c00e12e8a3", "comment": "Malware payload (Stealc)", "value": "c1d361844740dd2caefe62dc78193a21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707063320, "uuid": "0dc915d7-4f0b-4f08-b2f4-c64f36f0dddc", "comment": "Malware payload (Stealc)", "value": "9563049118d61a4e55b54ee7fc0f4c0984063598ec030c3ff6bc080e5320a4f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707063320, "uuid": "5a7fa9c4-23f0-46c9-b494-abd229805445", "comment": "Malware payload (Stealc)", "value": "eb0eaca6314a0ced3c8dfe3594cad3fa00850fe7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707063320, "uuid": "7ecdef4d-4708-481a-9506-4df7e075a6b1", "comment": "Malware payload (Stealc)", "value": "e9e94b377dc4a550d02153c9c7c4ba55daf738d10e72ef2564a4f08e594bb676870126c5fa870c1f4ca117105d940f4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707063320, "uuid": "20a92f85-ac5a-423f-9301-cab8daad4fc8", "value": "T12B647C2066E4B561C043B5334FBDE8EFA73E7511A7166EFA08C607A0BED5E986B34704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707063320, "uuid": "94fbc9a6-63a5-4048-8456-80bd7c1a85cf", "value": "382a4d7b99200ee7e9686d1f1cde0258", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707063320, "uuid": "bb10fea1-b9c6-447e-8f20-fbd404cea32e", "value": "6144:v0t2+muxwlpn10oVJ4C3CO2uWGcTATRsYQiANCpUxEJKWc+T5omu7Uk9NTeeqKAG:vchm2w90K4C3CO2uWGcTATRsYQiANCpY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707063320, "uuid": "2342a110-88ad-42e6-8948-386e10d0f7b8", "value": 310784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707063320, "uuid": "68d19b96-b57d-4b4d-a662-7aa7707f9812", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707063320, "uuid": "1b31f455-bc08-45aa-861a-24cae6538dc3", "value": "c1d361844740dd2caefe62dc78193a21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f18755c6-c377-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707063041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707063041, "uuid": "2073a3ba-28d8-48f8-ada2-fac9b3b1f2f5", "comment": "Malware payload", "value": "0e973251bca74da48281a4df47c1df81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707063041, "uuid": "3df0ece9-db99-448c-9090-3ec610cfc48e", "comment": "Malware payload", "value": "9b7ad283cb8bc838c6bd8dda50d76d56723407b13bd085f062598c4934b565a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707063041, "uuid": "f4b960af-7668-47e0-9cac-f20b982fd65f", "comment": "Malware payload", "value": "b7b770424fbe2b7bde87bcfd87c5028e63ccf7d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707063041, "uuid": "bd97efaf-325e-4a54-9253-87ad6fcf8dc4", "comment": "Malware payload", "value": "74358da88419da828a0d4972afdfa72c4835ba2be01141e2e5659d50e840a88f150c2b8e972a7d4a6004f7c318e15cfc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707063041, "uuid": "3d96bc59-25d9-44d8-abc0-e3844ad390c4", "value": "T1F3935943E2B190F8C06EC1B49B6BB5A7BA66FC4E093DB61F4BD49A203E29F10535C715", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707063041, "uuid": "562b95c9-184b-455c-8525-e8ad004133b8", "value": "1536:xdU0Vh9RSBjDRBuswVZuvFs15a3Xpr9NE+aRsM6GKhqVYOnZstcDYIoXr:xdVOjtiVJaRuiBOzst4YIo7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707063041, "uuid": "7e426a6a-1804-4725-84bf-6e02f3052bed", "value": 96369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707063041, "uuid": "03c1851a-6c13-4031-8544-1b4b69c9d510", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707063041, "uuid": "f3e4252a-3c28-412b-a733-05f0d05c8f96", "value": "0e973251bca74da48281a4df47c1df81.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5eb9ac1-c34d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Hydra)", "timestamp": 1707045010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707045010, "uuid": "1fa68f88-156f-4908-b69c-94f31e7404c0", "comment": "Malware payload (Hydra)", "value": "2a1c7dd7e54a4423071185006a4c9cb1", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BankBot", "colour": "#7BC738", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707045010, "uuid": "39c76f7e-301e-47cb-a12e-ef4dc0fc6e84", "comment": "Malware payload (Hydra)", "value": "9cf1ad53db4a31e4be0cfba7bf15f1e414cdf12327063a419be6cdea4700adfd", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BankBot", "colour": "#7BC738", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707045010, "uuid": "4ec32a02-fada-49c9-b120-1a6ed96ca9b5", "comment": "Malware payload (Hydra)", "value": "e88adaa5066d4e19f2f89d7cd732dc0e4861b629", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BankBot", "colour": "#7BC738", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707045010, "uuid": "1891a5eb-194c-49af-be64-9a15847f7c85", "comment": "Malware payload (Hydra)", "value": "c01b89c7ce695f6b849613fe8e23f1461cafc8f1070a3fd337850fb8aec9175feea79ccefb881a216f679323c87b1ac4", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BankBot", "colour": "#7BC738", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707045010, "uuid": "1a973387-2ef7-4f94-b490-08896fdb3295", "value": "T16A16338074A9C147D9F91B344EBB85C905796F64DF4196337821376C8CBBACA0F26ABC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707045010, "uuid": "a5cc6675-6b30-46ad-ad53-442ef2c0cf40", "value": "98304:O7oPTXMG+wd4RCFWW7UkEjLBoLDmaF51Siu5lHPV+Lp:BXH+wd2CFnwPUSy1Bu5JIp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707045010, "uuid": "31359437-af0c-48c5-b2bb-27896634cd84", "value": 4166220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707045010, "uuid": "83b72998-04be-426e-9cab-377a7e406474", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707045010, "uuid": "1ca63cbd-0899-4c7f-823b-faacebefb53c", "value": "chrome.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53c157a3-c38b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707071366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707071366, "uuid": "79fd8db0-5243-47e5-bb5d-5d8919b6d18d", "comment": "Malware payload", "value": "05aef2221ea6cc47def254618a61d437", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707071366, "uuid": "f7d463c7-5e51-47da-8e5a-e242ad6f4e3d", "comment": "Malware payload", "value": "9da4c067d4be2414c6dd9a7dc7ee89faa4ad19b474b55e73605c707405a71339", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707071366, "uuid": "6312e8cc-b077-41df-a50b-aeb1253a5545", "comment": "Malware payload", "value": "2d9e79b680ab3e570761d337857e674280f8c64f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707071366, "uuid": "eb059ffa-eb86-4b89-836f-1ecddf94b10e", "comment": "Malware payload", "value": "42272dd3a778a18d55499973d96a01c2b98744d7ade70f5f06b4436269b5b08271682783d003ae060f49a95064658542", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707071366, "uuid": "fc7c5d53-1db0-4737-bda6-13e4eda1c8fb", "value": "T1B4C533B5684E4F64FD536637ECA34E6DFA68259CD199C3A800720B3E76BC9831442F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707071366, "uuid": "a20a03fa-4a3c-4cf4-b5b4-9c2f13ede39e", "value": "0980a5bdf7b225ee6a859c0ebee6a4b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707071366, "uuid": "550ce396-77c8-4346-97d5-236de6579923", "value": "49152:cm128kaMpHwMko1d19tPkgN0D6ofCrzEVdnLddvOM:cCTTMk21fN05MAVlLfvO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707071366, "uuid": "1ea57add-5bf8-4b5f-830d-f4ffc73b675d", "value": 2616320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707071366, "uuid": "598205a8-1b59-48fb-a4e4-d68345a7e636", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707071366, "uuid": "72c6f3ef-f747-4bf4-8e05-b9b9cb3c4ae3", "value": "05aef2221ea6cc47def254618a61d437", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b62ae10d-c373-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1707061223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707061223, "uuid": "7491c473-cfa4-44de-a9a2-41fada93f2af", "comment": "Malware payload (LummaStealer)", "value": "54c261968a0afb7401aba919a3986d68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707061223, "uuid": "62011102-bb9a-4212-a584-6fa7e6d67a61", "comment": "Malware payload (LummaStealer)", "value": "9e10c2844d0f5bf2a2f5d54e5c1194db318824d185ee7b3cb2166c9054b0d5a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707061223, "uuid": "c88ab848-b29e-40d5-b454-3b84ad96b74b", "comment": "Malware payload (LummaStealer)", "value": "fbbfb6abb99c24924c6666a76acdf8678e9db829", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707061223, "uuid": "ebf042fb-7ed0-44c6-b2f7-4b44872fa9a8", "comment": "Malware payload (LummaStealer)", "value": "537258c7e4c883f5fd43b1205ac6da6611f3e46782c9d508d0d19ef2bb089b6ac7c8e66bd860278ae7049ff12fa9574c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707061223, "uuid": "55976e16-a8df-4a0b-b17b-2a2b00dfa9f4", "value": "T1F0D4238537334D68E57216B470BC8B455FB59319AD330B6A35B8503FB9E938B03E12D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707061223, "uuid": "1e9ffefd-8a21-460b-a7f6-3539ff17f1ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707061223, "uuid": "7c740fec-4277-4bee-bf2a-f17374c43ec5", "value": "12288:RGHWE5f+GaYSHBIfcpSsxQr/MragGC2H5bosEI5u1Km52Y//ERYKw:RS5f+GaYSH+EpbPragF2FEIz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707061223, "uuid": "78e3b25c-957b-4ac8-85b0-9bf307d1a17a", "value": 613888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707061223, "uuid": "685436c1-861a-4349-bd33-ddc8a4a18568", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707061223, "uuid": "87bfa165-5c01-4cae-a510-880c6a8581b7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "798bff91-c384-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1707068423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707068423, "uuid": "28532779-e277-4207-b542-17aee9178526", "comment": "Malware payload (Stealc)", "value": "f003b1834558952bc2ab81ca7a6908eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707068423, "uuid": "0ce2d8d3-afbb-4f98-b8d1-36124b9f58ac", "comment": "Malware payload (Stealc)", "value": "9eda80b21be4608e90d5f90cf721412e929894ce6d077f8bb45365c0f5d1d613", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707068423, "uuid": "62c58ac7-e8f6-4e54-be3f-bd1212f96278", "comment": "Malware payload (Stealc)", "value": "88c43ee05323d6735ca2f4aba114ebe94f7a15d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707068423, "uuid": "e5db3e06-54ab-43b9-8d15-aa4c50009f90", "comment": "Malware payload (Stealc)", "value": "afd57fa7e96c5eba8ce8d00e348e613d7b6a65a8e0f085fa0787a204fd78f11e5ceba5087c2dccb43e0d7e67e3faef81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707068423, "uuid": "f04047d2-bbd7-451f-b5d1-baacda6c37f5", "value": "T18054BE106390E031D15725358961CBB24AAB783669239FBFBFD62B7B2F34390DA2470D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707068423, "uuid": "8211192b-12dc-4745-81cc-287b53e7f6d6", "value": "8030328de4abbcbe9ae8898cebdc9230", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707068423, "uuid": "c3254dd4-133d-4cfe-aef7-6858c18cbbaf", "value": "3072:g0JSlLGeCLdVEV4IJqUMzU+rKPMkCrt0GXdPFhOBT0FfHPkeG9D6P0s4iNT:g8SlLFCIEprZNKBTiHPkF1s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707068423, "uuid": "b6489121-65e3-4893-8921-1455bbc781c0", "value": 294400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707068423, "uuid": "22c40990-6bbc-47c3-aee0-2f8f269fc386", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707068423, "uuid": "6dd3ca97-22b7-4850-877d-1b924b91d7ba", "value": "f003b1834558952bc2ab81ca7a6908eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2652ca25-c38c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1707071720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707071720, "uuid": "31361535-9405-496b-8270-353d13e7b33e", "comment": "Malware payload (Stealc)", "value": "976f6386a6c31fad6a4e2996306bbf3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707071720, "uuid": "8dd85a92-19cb-48e6-9d44-98a3acb83962", "comment": "Malware payload (Stealc)", "value": "a2e56b293874962f8ccf1fc3d1a6f96b01222f470a6891d7cad95b70bc3e99c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707071720, "uuid": "9e422d98-1c6f-419d-bd55-ec624e0f9ec8", "comment": "Malware payload (Stealc)", "value": "82018f85cab8337f8fe294a3864bada0cc5d845e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707071720, "uuid": "7f7d4f04-539d-4187-a53e-a1e5cb6570a4", "comment": "Malware payload (Stealc)", "value": "e30c9b34571c208fab5fe6de8c0efb9af2284e19fd0669aee36dbfbb2becf1698383924ef867f4c1e007273700941bc4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707071720, "uuid": "ec2ebd77-286e-41c4-bd6f-415d74136ce1", "value": "T19376016D32A7D4B2E7F7FEA5899436C2E50BF0537C81AEDC324B26118CA5641DD7208E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707071720, "uuid": "65ca6543-13dc-4856-8785-a3ab23944510", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707071720, "uuid": "7b42ade1-da33-4170-8cce-db59f3e688ef", "value": "196608:SqVSV1KkmYUVB9daURUyUlYS1yaxK8gb2ZcsS:SXV1r4DOYS1yaE89ZcsS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707071720, "uuid": "2c86f38b-2a65-48b2-8957-3ee1601c8eb5", "value": 7472128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707071720, "uuid": "6ffc0cb4-7543-4820-8430-000388a70114", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707071720, "uuid": "c68189bf-c01e-444c-9e4f-50591e401014", "value": "976f6386a6c31fad6a4e2996306bbf3d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65e5f5c2-c39a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (OrcusRAT)", "timestamp": 1707077839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707077839, "uuid": "8417abaf-6e86-475f-80c9-36b58ebfe9bc", "comment": "Malware payload (OrcusRAT)", "value": "bdbe50403b411db0e07511e098bdb9ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707077839, "uuid": "838423c3-a037-4f12-8f25-2dee9767d0a5", "comment": "Malware payload (OrcusRAT)", "value": "a758763a7fb30398cbdab370be24c389a1927fb376772fcb31f4017ca942a284", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707077839, "uuid": "ee2b6f9e-07b1-4c3e-b67a-beb079e6c70a", "comment": "Malware payload (OrcusRAT)", "value": "5772743e950c1c647a5cab202fc3cc29039e2749", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707077839, "uuid": "2b8f26ea-80b6-4599-bd9f-ad926b7cb3f2", "comment": "Malware payload (OrcusRAT)", "value": "9c59504a982d7a311dfef227214f56026fbae0d4c1380e00f32845df2c0b6e5a4fb9b2bc89f720e9baaa3934de9c5581", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707077839, "uuid": "24342fa8-be6a-45c6-8bb2-5af400b3dfca", "value": "T11015BF013FACBD07C1BE6678B6771AC90FB8E8066052FB4E085861AD1DAF741BD16367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707077839, "uuid": "e41218c5-caa6-44aa-b094-b1f310bfddb5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707077839, "uuid": "39e2be98-2a69-4ad2-ba3e-919061ab223c", "value": "24576:+cI4MROxnFD3jEsYxrZlI0AilFEvxHiH0h9:+crMiJWrZlI0AilFEvxHi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707077839, "uuid": "1fea50cd-6dc7-4537-88cf-6e11d355f4d9", "value": 938496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707077839, "uuid": "66ddad3a-f485-4e95-9b5c-0777016e1da6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707077839, "uuid": "70eadb66-4835-4d91-bcf8-587f3ad4f687", "value": "file.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48b2cd6d-c3b0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1707087239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707087239, "uuid": "bb3c32b0-eaa1-4e7a-aec3-877cf2f039e2", "comment": "Malware payload (Cobalt Strike)", "value": "7d9c852903de2a824aa3f80dd1ab2b89", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707087239, "uuid": "f977c16c-9680-4bc0-9123-50f3fcd289bd", "comment": "Malware payload (Cobalt Strike)", "value": "a777c77555a33b8263f836c5a029047fdeb74fd1f9abb69d0b8f2a2b3d572583", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707087239, "uuid": "aa060f52-b5a4-47bf-984e-4a2abb49d33c", "comment": "Malware payload (Cobalt Strike)", "value": "a2d0096fb101a25ac6ad33f6a303e58dd064541d", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707087239, "uuid": "98188e16-fef6-4228-9c2e-6763d26d7fdb", "comment": "Malware payload (Cobalt Strike)", "value": "fa886319a3bfc7b084b33aff42711d0b9f5f85eba20e294917694d8e376b4f3c94b4f69e411a421151c9bb2ef6e88b4a", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707087239, "uuid": "56b9598b-a817-46cd-8f39-9f98c30c7278", "value": "T19E643C80F944FDF5DCCA8FB914E2131A53EAA181D71DDA2F7910FE3C001AA58E97265B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707087239, "uuid": "75de6ac1-236e-4394-9f0c-52ef1ce2d110", "value": "7aa038e9c65b0fe66bbc2775d7dfe42f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707087239, "uuid": "64ca0b48-a12f-428d-ad95-8a9d7d5471b4", "value": "6144:zTgsza7AL2vWwGeiAP+S7BhJC0VYaEudDWiPm2ia5F+Qva8qT6wNbYd8:Pgs+O9h6h7XQ0N34RZQF5vXtd8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707087239, "uuid": "8e4551d8-6c29-4d96-828c-f6ca1a56609e", "value": 335071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707087239, "uuid": "a5d53a7f-eb39-449e-81ca-62a74d28b254", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707087239, "uuid": "b12b8fdf-1d2e-4313-bf82-a57d00153bcf", "value": "SecuriteInfo.com.BackDoor.Meterpreter.157.32593.26868", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcd44ca5-c358-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707049746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707049746, "uuid": "ca9e1169-1675-430c-a490-9fc81c737658", "comment": "Malware payload", "value": "14185c322c35395f0d6663c3c3f65e5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707049746, "uuid": "969678bc-f13e-43e0-8871-9c7c6dd57f33", "comment": "Malware payload", "value": "a8aea3c2c28ee2d88b8c294434b6807c870939b4348829bc2c4b2344dae2a5f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707049746, "uuid": "ec45c43b-b56b-4e8b-a3c5-334208db4526", "comment": "Malware payload", "value": "3728cb7f184950b7f5542e165ea5c1231ca03abd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707049746, "uuid": "d3b2e896-a34c-439f-88e4-220ad3302ea9", "comment": "Malware payload", "value": "a014429f319201052239bf79750616e4063ae6902627b877f2b7fe96e4db8fb5b3a13a7a423b784543a91546e2d66f0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707049746, "uuid": "764972c3-17ab-411f-8420-5ed223507f0d", "value": "T1EBE73348EA12DCFEE49D66FE5141E12636BE7A084E0FB08CE8D514EB5C07AD5CE12DB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707049746, "uuid": "494f302e-86a2-4369-b38a-ee834ea8789b", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707049746, "uuid": "8c6a9358-d1de-4cd3-9301-be1c447b6ede", "value": "1572864:irziNx5qxnlaM68zaloAfb4UvrdonM7dIhav58RPa7:lx5qxn0VXbJzavM7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707049746, "uuid": "d17a8d25-c73a-464d-80cc-ccc9a2939a5c", "value": 69053556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707049746, "uuid": "66e1af46-d91f-461a-a054-e477fb54abfa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707049746, "uuid": "71d0d0b3-0fc3-4e83-8460-a3c567e22bcf", "value": "baldur-1.5.3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1c315ee-c32f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1707032064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707032064, "uuid": "ebb25ee8-1739-4fe4-8eeb-b19ab459d304", "comment": "Malware payload (Stealc)", "value": "084222b639a1b3f35be40ca5282a6e0a", "object_relation": "md5", "Tag": [ { "name": "194-120-116-120", "colour": "#060034", "exportable": true, "hide_tag": false }, { "name": "CVE-2023-27363", "colour": "#36119D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707032064, "uuid": "b8e5c84d-7630-4de8-b8e8-5bf82c609ec8", "comment": "Malware payload (Stealc)", "value": "a9a4d321d6ccfe6ba9e0f870fb1bf590535c6e10a091805020930dce46e116b7", "object_relation": "sha256", "Tag": [ { "name": "194-120-116-120", "colour": "#060034", "exportable": true, "hide_tag": false }, { "name": "CVE-2023-27363", "colour": "#36119D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707032064, "uuid": "2744ec17-364f-4bbd-9442-aead398233fe", "comment": "Malware payload (Stealc)", "value": "bf246f61d7d62133efe5401388cf6168b4191b20", "object_relation": "sha1", "Tag": [ { "name": "194-120-116-120", "colour": "#060034", "exportable": true, "hide_tag": false }, { "name": "CVE-2023-27363", "colour": "#36119D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707032064, "uuid": "f7c10e3a-5f07-49cd-ab90-bc57db2ebfdf", "comment": "Malware payload (Stealc)", "value": "4934153cab569235e33650e8fcad651129dfa3a7efbc9c1747abf2ad9176c83d53d17f3d87d93a6e56adf1f37224b0ee", "object_relation": "sha3-384", "Tag": [ { "name": "194-120-116-120", "colour": "#060034", "exportable": true, "hide_tag": false }, { "name": "CVE-2023-27363", "colour": "#36119D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707032064, "uuid": "3faa912c-f2bc-4bc8-aafb-482969243d0c", "value": "T1DAD633953BDF80F8DBC2183457275FCB13F292F9898498287AC5A946BD61F7110AFC62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707032064, "uuid": "7e6a9e16-0faf-4f60-8592-b13672e4970e", "value": "bff37c7a49190d2c339ddd01860611a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707032064, "uuid": "a25fec38-5c70-45a2-b2b4-f4fccf4c2715", "value": "196608:GU+cdCfmrKBePnrd/dff/Qf6QyakYOtPdyxVmRPoictmJMVPTAvrnEtmcDp75:VsMKsftd3oiwO/nVRLrnGLb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707032064, "uuid": "198e4c75-a025-4c9b-96ac-e309b940b184", "value": 13657088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707032064, "uuid": "7f80f95d-e0c7-4850-bb1b-9a506a36093e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707032064, "uuid": "06292b99-d0dd-4dad-8f8b-0371ed6c67c7", "value": "stale.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "784e0722-c34e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707045228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707045228, "uuid": "c37a085e-60e9-4bd3-b868-442482f8d8ca", "comment": "Malware payload (AgentTesla)", "value": "b28e80ca602b36613415087d01ea1bf4", "object_relation": "md5", "Tag": [ { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707045228, "uuid": "e24a707f-b1c7-44f6-afc3-31bc5ac068cd", "comment": "Malware payload (AgentTesla)", "value": "aabf74952ce15eea2974a78d5c49cc977f167d290650ca65277c5aea1558b67e", "object_relation": "sha256", "Tag": [ { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707045228, "uuid": "0ca36871-4bb5-46b9-bbb5-2e2ac7b0c622", "comment": "Malware payload (AgentTesla)", "value": "e972c3613018a85ae22498d976ab8b70f31d6458", "object_relation": "sha1", "Tag": [ { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707045228, "uuid": "a14a0096-e58b-426c-bf30-d5ceffc5a148", "comment": "Malware payload (AgentTesla)", "value": "bea296851fa8472c4cd3ce86cd417b202c47e2b797d2eeed6116691beadac8068a516a6e0e5b325de38d7d117224a086", "object_relation": "sha3-384", "Tag": [ { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707045228, "uuid": "dde8c966-11e6-4e71-ba67-3c8d7ae1450e", "value": "T1B0B25AC5CD9997E39F8CC71791A74DAB882437B0C5143D2AFB2462B30432E9A80FDA4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707045228, "uuid": "706dadc3-36f9-4272-af85-88cf92df61c1", "value": "384:8MIccccccccccccccccccccccccccccccJcccccccccccccccccccccccccccccY:A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707045228, "uuid": "05817cf7-42b6-4903-8ca0-a8405530d72a", "value": 25196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707045228, "uuid": "b50728f7-b5b2-4113-a5df-52410746bba5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707045228, "uuid": "7d7e8d30-1896-4e4e-a7bd-4389d4864593", "value": "Bill_of_Lading_32984734.pdf .zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1c82381-c31d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707024279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707024279, "uuid": "f0aa5fbf-4d90-4722-8332-b5f6ed229d54", "comment": "Malware payload", "value": "fee9ee508bdb7d5610fa40e02200464d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707024279, "uuid": "424c37b1-774c-4162-a319-7a836441a9a5", "comment": "Malware payload", "value": "afbf3c76279a710ca932edefd43182be85a8da80d1b87dbc4b99d9d09355dad1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707024279, "uuid": "a528bcf6-4c84-43cf-bc2d-4fd6fb66f97a", "comment": "Malware payload", "value": "20a410f889c191079ddcec4774a130553fecbc81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707024279, "uuid": "fdd52a78-fe57-4916-a8ff-ba76c83f54d7", "comment": "Malware payload", "value": "efc2090b51f0f80165039c6bbc01921f3bf316a6e56e8ab6520cf57bc911ec77186ac82d57e6fe00197ff6ac8393330a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707024279, "uuid": "003ea2e3-93f8-47f3-9b24-14a1b7f404fe", "value": "T12D16E0F4DC2CC6CDE776657A1A04C2840AE05C01B205BAA7765074B6D5FA3C189BEFAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707024279, "uuid": "c54541cd-067e-435d-a15e-32f25c7a3929", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707024279, "uuid": "43143648-d30c-40cf-91c1-b20630ded38e", "value": "49152:9cWyw9/rnrRRBZSM4rL5TtGba23roJVoXPrMLv5zJZCMG9L5DtybMSBpQDlW:yiDrRrZSM4T8u2cWrcv5lZCMcDQQSIo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707024279, "uuid": "03e1cc84-2691-4934-ac41-260e8ea75a29", "value": 4128480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707024279, "uuid": "dc466df2-0b05-4b96-a8b9-46649156d98c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707024279, "uuid": "f5bab4f1-42e3-453f-b10e-d734cd81792e", "value": "SecuriteInfo.com.PUA.MSIL.Exceldna.12332.7724", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "555b057d-c35b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1707050753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707050753, "uuid": "b54754ae-6f87-49d0-8d6f-52d8f88fe073", "comment": "Malware payload (RiseProStealer)", "value": "caef65aadf71f0c55dad8ed47201da1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707050753, "uuid": "ce1ca395-d812-43b5-a522-5fa759fdccf7", "comment": "Malware payload (RiseProStealer)", "value": "b12e6740f47e0a7678ff721f7fb26c5b05af05998cf10f9063c55bf3400c4389", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707050753, "uuid": "41565f26-7fe9-453a-a2cd-d3cae6c02ef0", "comment": "Malware payload (RiseProStealer)", "value": "ead915c1c0e00e74af310419a8c7180f28474429", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707050753, "uuid": "2349eaad-e1c1-4f80-bb3e-4143a17f86e9", "comment": "Malware payload (RiseProStealer)", "value": "91f2eb3946bba0780711be8a9f659a09c4a6d67970e672678745cedf4073a58c939277b2f048f5532e13a5a7920dbde4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707050753, "uuid": "f6ad57b2-2def-4496-abc6-a65f4b4e9182", "value": "T1FB563341BDC2B0B1E19AD2B50A53FEDCB2761E3118508D6A3F0A2BCE6DF3A647B35055", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707050753, "uuid": "bba7d9d3-1d2b-4690-bb65-926536dc22f4", "value": "980aa255e7e76def05f32c57f38059f8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707050753, "uuid": "dd5925f8-d2cd-47fb-b39e-dde20b1a4588", "value": "98304:Qa0iioGLTVE325cH91JbicEyt4DxGnd0efjVrIPjhFWyD/7Bx1CxQk4KU0gBM6+K:p0iQQ2561hiBy8GOefjdIfVTNn8PgBP3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707050753, "uuid": "d597dbb6-0628-4eb0-a3a0-6d73e158e5ed", "value": 6033088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707050753, "uuid": "0f6b03aa-9a9e-4567-b46b-c175fb7fb08e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707050753, "uuid": "f532bdc8-1c9c-42cc-b2fe-abaadb56a4d5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a28cdff3-c354-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707047876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707047876, "uuid": "b58620bf-caa5-4a5c-a033-d3b039515ebb", "comment": "Malware payload", "value": "ae97efe7c42ea0891fdc47b4b68d2c8e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707047876, "uuid": "ce34f337-ce3a-4fab-a9cd-a1e41026302a", "comment": "Malware payload", "value": "b29be102090d348f5345abc8ddf315017384acba22bb75c456f373fa1f7f7798", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707047876, "uuid": "b3d0a64e-631b-4286-8992-b3729e3fd446", "comment": "Malware payload", "value": "95db149e4a7621f6114c7fed7dd39774212ace97", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707047876, "uuid": "02c0f0a2-7268-428a-b4a7-401ba74c8e50", "comment": "Malware payload", "value": "c336c908c44ca3eeed62d65ced61e1337d1aba82e80fb4ac3c7acbf532cdf391355c5bcc65fb72803a8459b909ca62ca", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707047876, "uuid": "7d2c7980-07f1-49e1-940a-f65a47de238c", "value": "T1F3E318323BF69911C46CD5B085E67A962DEB6D8BDC32150BF3ED7E08AF306416E87205", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707047876, "uuid": "d8cd6783-c19d-4d8c-b5c2-ee76b2950237", "value": "1536:85eAlLrsuKlgB1I1K7t3EgVtRR+r0hhhhhHU5E5E5G6I5Y595Y5f2fy:4eAtrsFau1q3VtRoQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707047876, "uuid": "076192f6-2ef2-40f3-8f74-d4534542e634", "value": 144384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707047876, "uuid": "513783f0-6069-4686-a656-0727bd666e06", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707047876, "uuid": "d5fad183-647c-400d-9705-9ce255281df5", "value": "CORALIE ROUDIL.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4cea6f5-c320-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1707025546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707025546, "uuid": "570a009e-4184-408a-83e1-81b8b1569cb9", "comment": "Malware payload (RedLineStealer)", "value": "2060ab69656588e8acefcde9c7cc0a5f", "object_relation": "md5", "Tag": [ { "name": "cre8ure", "colour": "#7B880E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707025546, "uuid": "9a33db2f-be0a-4079-93dc-cf38bfc90c5c", "comment": "Malware payload (RedLineStealer)", "value": "b39f3c1533ff0a817a221ec313c11b926dfcc1b0e3a3a49fea5cb3151b094ee3", "object_relation": "sha256", "Tag": [ { "name": "cre8ure", "colour": "#7B880E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707025546, "uuid": "724acd1a-c889-4c6f-9597-e3212bb30085", "comment": "Malware payload (RedLineStealer)", "value": "f4501b82e348b38cf4f877bff1c1447828585c6a", "object_relation": "sha1", "Tag": [ { "name": "cre8ure", "colour": "#7B880E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707025546, "uuid": "98be9356-486b-4e69-9a95-4ce10a51b468", "comment": "Malware payload (RedLineStealer)", "value": "de421111213b5d50079c819afcd803b8a1509371d5394b837920e9a6413c6db13462dfa2e7ac9fff6b1da7dc8e357e9d", "object_relation": "sha3-384", "Tag": [ { "name": "cre8ure", "colour": "#7B880E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707025546, "uuid": "09f13da3-8fd0-42b9-b826-490726de3d62", "value": "T1EED4011579C0D2B2C8B6503144E6CA7E8E3635354B7692D376DC1BBA6F113E2B33A2C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707025546, "uuid": "fc9ce987-bbd8-4aa9-b88e-d3236d221c32", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707025546, "uuid": "fd15a585-aa77-4854-88fa-47dc82d5550d", "value": "12288:ih1Fk70TnvjcWYbRQsBTNcHG2k+Nfw3HtUZwi+rRvoR9yrc4+GX:Mk70TrcWYbmsBxN2otUf+Yyrc0X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707025546, "uuid": "3848561a-1b22-4576-9a34-228fbc847287", "value": 610048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707025546, "uuid": "d71febd7-e87d-4bfb-8c0f-443116d2bcd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707025546, "uuid": "13382283-61f2-4efd-ba23-6048ab4f08bb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67176976-c306-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707014276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707014276, "uuid": "5fd98972-a2c7-4d4c-8749-6f9ab2b4bb68", "comment": "Malware payload", "value": "c19eb58b01e01fc8a235bf9fe8ea726f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707014276, "uuid": "060279dd-d135-4f9b-b627-4b12750ffd3d", "comment": "Malware payload", "value": "b472ff04026591feff5442c6635273f749c2002fb15236f045669912691fa58e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707014276, "uuid": "1cdef297-e812-4cf9-8d14-a09751d3382e", "comment": "Malware payload", "value": "bd442b0aab71f7bb0bee8e5e373214365e23742a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707014276, "uuid": "7cf2232c-f735-4bb9-b403-17221178bb12", "comment": "Malware payload", "value": "a929f21220cc54ab149800cb39a11606f1ac6f9f29990330cda8a12ba385b3a6ab6a6887a8882eb1715f46c776c56746", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707014276, "uuid": "ea150c49-945a-4573-b0ac-caa391ac8d73", "value": "T12A1623F741725523D17AB2B0398609F86A70786E76C8EF7A730F05A529642AF9703F43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707014276, "uuid": "706fb1ba-57cb-4066-b062-7443b1b15c64", "value": "12288:fFP2SlusFFrnRo7YNQu4WioPJicryGBWECTFXB5XHrvBOXNpbyk8MtU1h/KH:x2ULjnqwQf6icoECJPXLvM8MYh6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707014276, "uuid": "619b2fe3-1438-44a2-86c9-6e0cc2520b90", "value": 4227072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707014276, "uuid": "68d1d653-ea27-4ac2-8fcb-de40d7bfffe7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707014276, "uuid": "7dc1ae5a-ab3f-41d4-bb59-731f92b1fb28", "value": "68e4ec5353ebf39650fef8827957802e36a0f2617838bf57d3eebc9bb9a8df61_dump.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa2864d9-c33c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1707037715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707037715, "uuid": "5d6d2541-e3f0-45a3-93aa-47f76c01375b", "comment": "Malware payload (LummaStealer)", "value": "b1e667f017f3d651da195f3d8ca09b48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707037715, "uuid": "4a196f0e-7697-4bce-b674-b4ddbdad9080", "comment": "Malware payload (LummaStealer)", "value": "b4e7da2efa986bcca47d484f92d297fa04e8a8cd0cb1b282719a524bb9d84f56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707037715, "uuid": "7ca27e94-537e-4034-a48e-a84946d93e9f", "comment": "Malware payload (LummaStealer)", "value": "1f938d6a02ee6a5bc108e99a35f031da423cb856", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707037715, "uuid": "c08ac531-2df3-4f11-b37f-9b3a99b01734", "comment": "Malware payload (LummaStealer)", "value": "e373aec9aead28e3de427ac8dd522d6924eebfcc055ac00864fc61b5a383fa45584342f6d465d5d502466f5022f7ee81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707037715, "uuid": "c053d258-5c27-448c-87cd-9467f38c0896", "value": "T13046B001B7E4DF57CA5E2772A172222097F5F4A26372FB8B2B4950EE1DE23404DC6693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707037715, "uuid": "03bb42ed-43cd-4f8f-a0f3-c1d683ef6719", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707037715, "uuid": "563a8218-6bcb-4301-97be-4268d2b278fa", "value": "98304:cM3+5Yj6Vkv2BQby98nuJITqFUfmRNCTw5e7u8oASojHeHzldVRQ7zLmVeIi0SvE:cM3+5Yj6Vkv2BQby98nuJITqFUfmRNCm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707037715, "uuid": "07fc05dd-beea-4bfb-8df9-3fe3e97db5b6", "value": 5555656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707037715, "uuid": "ded6d999-3c08-4bf1-890c-8dd3b6b8e339", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707037715, "uuid": "b9f69144-30ec-44d4-b763-f278e5ddd39f", "value": "US", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "393fa9cd-c325-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707027513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707027513, "uuid": "3591650c-c1af-4c26-9ece-3ea127b2f8b9", "comment": "Malware payload", "value": "a71ae2070528ea284c29069d6f6acf7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707027513, "uuid": "c571f2ab-4199-4f71-b5d3-61db2a891510", "comment": "Malware payload", "value": "b5cfe3438fede95a3baacb4d7f5602bc0c7b28bba4fa1d1359aef8b664cfaf98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707027513, "uuid": "445b4ac9-9f48-4bba-8df9-6831cdb76954", "comment": "Malware payload", "value": "88aa3102c60672217253b15ee33cda87dd69eccf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707027513, "uuid": "4cfb993e-796f-419a-b8e1-5df4bc694ae4", "comment": "Malware payload", "value": "31867b3e34f136177737adaf2690e179f3bfca975b6298d93e37d81519f7a9ba1899450c8c6f65f28a502e9ff9a22f1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707027513, "uuid": "468c2800-9b9f-457b-9fb9-f8cb21e170c0", "value": "T10685D024E3924DBDDE2799BCD08E44DBA65BBDA303C4013717F18AD28B653E4542FE29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707027513, "uuid": "d3d44d8c-42db-453a-a08d-7ed0ea9f26bc", "value": "6b43713c2dcdf19e54a9964767500d9f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707027513, "uuid": "7572dcd9-5814-4ab1-8f8f-29fafabdd4d6", "value": "24576:UjClfTPLQS8UgFbig37bTs4dcWUj43TABFRX8eVcGNOwjqZGYeSe5OuXiA:U2bzQS8Ptf3W88B3JlFqZGYve5xSA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707027513, "uuid": "07048291-e8ec-4f15-821c-67f20495c8ca", "value": 1796600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707027513, "uuid": "c8354497-dc28-435b-942f-fb513fecc31a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707027513, "uuid": "0cc5c992-862f-4718-9c2c-e64f5855523a", "value": "SecuriteInfo.com.FileRepMalware.11197.11851", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd55efde-c3b2-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707088294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707088294, "uuid": "e0218765-8ce0-4ba3-9a0f-8550917954c0", "comment": "Malware payload", "value": "91f52f26984352e3767ea204305361fe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707088294, "uuid": "1363326b-07e1-4f18-ab96-8d6ba5da7fe2", "comment": "Malware payload", "value": "b67b70028070fdde4beb0e0f0a45c29201b119c8b126fd7dccdf9f8629eabdc7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707088294, "uuid": "fe37f969-bb30-4cc8-95a5-14cffc972b5e", "comment": "Malware payload", "value": "87f02e09c5b2f98cc5ff3c57e0088c225803d5f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707088294, "uuid": "51a099eb-ef75-45f7-a099-7235dd429c7f", "comment": "Malware payload", "value": "1f294107057f4683416f1e88188e2c323848f7953a178cf05c15dcfbc74f53d11d28f9984c2fd099eddf14f69639b5b4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707088294, "uuid": "08c7c385-6f49-402d-a0a6-881cbcbc7e1b", "value": "T1E9B533F129364288E243077B76157A855C23FE83E922157D3419FAF26BFE2F26245F09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707088294, "uuid": "dcc29f2e-4b16-4636-b251-25250747df09", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707088294, "uuid": "83a1a1c5-c26c-49ac-93c8-cccf4d2cda83", "value": "49152:osE/CdKEl0Lk2+qibePHiBxC1RhgMeF5YJx5rTofbey1MXBv+Vwp:os8CsFLk2+qibe8A1Rhc5YJHoj9c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707088294, "uuid": "31f2c274-192e-4f5e-ac0d-073182e70b91", "value": 2338816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707088294, "uuid": "e544a689-aa7d-4425-9d63-c117113da22c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707088294, "uuid": "1bf018a1-e62d-4fe2-ae19-985edab62bb4", "value": "91f52f26984352e3767ea204305361fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a9b8a08-c35b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707050762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707050762, "uuid": "7e129077-55df-4f2e-8008-cd170195ddbf", "comment": "Malware payload", "value": "a3d9becb456a81e215abeb634ebbaf2c", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707050762, "uuid": "a283be25-169f-443a-beb8-df28f7b92023", "comment": "Malware payload", "value": "b68bc0bde731962adabdf67bb8205cf8032601dde9660a0cc72b57997b2e42db", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707050762, "uuid": "efbeb207-0c70-4412-92bf-c69f4f1e3024", "comment": "Malware payload", "value": "7143d2e9ba063f989aac90d29d68d0dd10d9c4fe", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707050762, "uuid": "91cf9335-9a1f-4979-8250-aef94123e075", "comment": "Malware payload", "value": "231e441e0d09d203e7a6adaed7405a023b71a151f5338aea89b1e0eab1b75424b1ee938ec7eb85f13d9f5a750f227a3c", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707050762, "uuid": "34a6c1b7-4ba0-40a2-897b-9abe2d59cba2", "value": "T129E73375DE4A083BCF1D91F980803DF53EAC21609B9BA1AC947914EFF991254CB247FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707050762, "uuid": "a87ab1f8-7d51-4c04-aa56-66128e9f1791", "value": "1572864:krziNx5qznYYDx9jR+iRes+bjK9YGVfY2PUVonPVvLSZqP3AV+nkTXPU/II:Px5qMC9jJeNm11tPkonP1LQqIVwk7U/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707050762, "uuid": "c5c2f329-62b7-4303-acd7-e4657160b5e1", "value": 69102766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707050762, "uuid": "fe93f450-4db7-4098-8de1-f2a39a6f802c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707050762, "uuid": "bfb7d17f-fb16-4a52-bdc2-fd7389bdd214", "value": "The Damned RPG.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "124e57ea-c2f7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707007691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707007691, "uuid": "0d7eb5d2-a769-4382-968b-c083e98ed236", "comment": "Malware payload", "value": "8f5a742238b9db460a583b01f23d72e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707007691, "uuid": "e009f9d0-85bc-41d3-aa04-e5dfa22a4f71", "comment": "Malware payload", "value": "b8d07af39d72c2f6a65bac410580a5128b0f038928f93d74a8cba5addb5a0985", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707007691, "uuid": "ff206950-2a5c-4399-aa12-4e63f5d7b9ef", "comment": "Malware payload", "value": "f1e4631193b3acea024a30f5f1652797949b0452", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707007691, "uuid": "5409280e-2780-4a75-ba8d-d4312ad13a4e", "comment": "Malware payload", "value": "ade0e180df93ca4a2b0fbbded3e1b87c0021198d900873d2ed225c5df3d6a749c315e79f1c55d9d2632bdbaf9c99893d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707007691, "uuid": "10065b61-df8e-4f49-813e-a873b1b10205", "value": "T1DA04F683125C8058E266E67D69660B41F3F67D5843A88FEF12F04C794F67BD0783EAA4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707007691, "uuid": "c4495269-ab40-40b4-afb2-8ef39b674a56", "value": "ac3ceb68295dee43285666634de351f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707007691, "uuid": "eb055624-bdba-48b6-b901-12508f4b1965", "value": "3072:Y6+fyUkRKKfW5dl0T3GEq/GiQc5GpzD+NnxMHzfvbIFKh0kEpm9rxmJTQSaMm5/7:xqyUyKKe5dlSWEqOiR5YzCJxMTfvUC0S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707007691, "uuid": "c7b77076-5033-43ea-86f9-ee5939877be0", "value": 182272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707007691, "uuid": "3669ca0c-3cdd-41af-b79b-43c48932ec8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707007691, "uuid": "062b8176-0a9a-4879-8fe1-833ca4f6e03f", "value": "SecuriteInfo.com.Win64.CrypterX-gen.7296.19136", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67d73922-c374-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1707061522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707061522, "uuid": "b7013a17-6f4a-4df8-bc8f-ee20d902ebfb", "comment": "Malware payload (Stealc)", "value": "16df5767c8bc7f6460cd757fc5f08c2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707061522, "uuid": "0726fbb0-0b6e-433a-b624-9a63f13ce99b", "comment": "Malware payload (Stealc)", "value": "b98ecbaea45052a394226c6e2ac41b07a249f225993a8387e8698701c1cdbcc5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707061522, "uuid": "c8da6a5f-2cf9-4347-955c-1cb8be971bb4", "comment": "Malware payload (Stealc)", "value": "55206e5d3b43c2b13730c545e597a89d63c32420", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707061522, "uuid": "4b2d9628-0469-410c-afe2-92abb3556598", "comment": "Malware payload (Stealc)", "value": "1d8fd0b62ae0cb2cef2a08456312e1aee0a5c7824dae5507d0f5f9de2b459281f05a4e859a8161bdd700da3e9308c166", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707061522, "uuid": "7ebc03af-f99b-47cd-b311-edeb179d1a43", "value": "T1FE649D0063F5E031E2F72A354971C7A64A7B786779339ABE7B91167B2E30780CA1570B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707061522, "uuid": "88c52760-5876-4721-8641-d882a1a6fe65", "value": "98be55e334636f2b313f62420192c2b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707061522, "uuid": "c4eb2776-ea3e-4f7b-8e27-42d4281bd67e", "value": "6144:mFS18ce+leA2JzPwho7ZkDdV5QlTU2WGPkK1sEc:mFSace+lAPGgs5QlT3WqkK2n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707061522, "uuid": "28acf82a-b3df-4aa4-980f-8caa8e01d230", "value": 308736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707061522, "uuid": "f325b015-23ea-45b1-bf87-9cdaf2bd66df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707061522, "uuid": "6d7928ee-b3a1-4b2a-89b8-2422d13eb45a", "value": "16df5767c8bc7f6460cd757fc5f08c2e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "596a0f85-c335-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707034439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707034439, "uuid": "3834cb9a-89ff-4bb0-bcbe-219a6cce498a", "comment": "Malware payload (Mirai)", "value": "8b36bfc73581ed60e388240f8a5def58", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707034439, "uuid": "698ebc31-df3b-429c-bb98-0c16b3859505", "comment": "Malware payload (Mirai)", "value": "bc401163a94c655c1fd41f8fb267ceb15c00790016d672cfd60e46593e621fce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707034439, "uuid": "a3b49e7a-0496-44d2-b8a5-47271bd7693c", "comment": "Malware payload (Mirai)", "value": "64e9141bcb46bfafdad4b12b63878aee77907e93", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707034439, "uuid": "40249691-2b07-44cb-89e6-7327c29bf694", "comment": "Malware payload (Mirai)", "value": "64103c7578d0eaa0d98a534cb0eb1deec84c526d90a154e780d5bf7f86c9f3c5eb5c6ae01d095ca9f338cfaf152d2370", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707034439, "uuid": "80665fc5-1084-461e-945c-6f71baef0fe1", "value": "T1D5E33B46EA414A13C0D61779BAEF42453323AB64D3DB73069928BFF43F8679E0E63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707034439, "uuid": "47c548cf-6aad-40bc-aea7-9be51a1288f0", "value": "3072:4S90lg8L7XEvVCBM00Hahbyt1SQyKaHul6Saai7s4FM/9l9:p90LLgt+D0Hahbyt1SQVabnai7s2M/97", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707034439, "uuid": "69e186de-9a8b-47db-a574-ddb878bb5b20", "value": 147640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707034439, "uuid": "90894494-1083-42d0-a7c3-1f8888157e01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707034439, "uuid": "a963608a-1a48-4e0a-bd9a-608805fbc9f8", "value": "8b36bfc73581ed60e388240f8a5def58", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "defd38d6-c375-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RustyStealer)", "timestamp": 1707062151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707062151, "uuid": "67a0975c-2337-4565-8c93-42cb5efe2fd8", "comment": "Malware payload (RustyStealer)", "value": "5b32fd55fe0d459269f2c09bb286cddf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707062151, "uuid": "8a531c22-5bc9-495b-8a34-f14843d6c29e", "comment": "Malware payload (RustyStealer)", "value": "bc72ff9af642f90aed120dbd3c9c0ff0315b88f9badf6b59f55943252c7c366f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707062151, "uuid": "daf70877-8370-4391-b1c1-219411b09739", "comment": "Malware payload (RustyStealer)", "value": "73343cbf7c655f92226cfdd5454c1440bbb720cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707062151, "uuid": "0e160f08-7372-4730-a3e2-fc8b5639de05", "comment": "Malware payload (RustyStealer)", "value": "e5783d66a7c307bfe13f28c09170aea5a6837937f3ed8efabf0f52ef5d395d75da93a769e4e4f2d5ebc675e9bdf9fbb5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707062151, "uuid": "eea82e2f-3c15-467b-8036-13afc8371b43", "value": "T1C2855A03F69489EAC45AC274835BA333F672B84D4B25F76B1BD08A313E16B50AF1D758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707062151, "uuid": "55e73f66-1830-488d-81f9-bf798bcd1520", "value": "bcdb03ee8222d8fb75e62428fd387fb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707062151, "uuid": "636b6389-b191-45be-9a95-bd9e53c8e889", "value": "24576:sIj+RS2Blc5B8RHOUe0u26loPX95epesmNY8XnQn6528POZqHW:s++RiB8RHju262P9cpesmNrX6yNH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707062151, "uuid": "25edcaf6-495b-45da-919a-f20e546ad826", "value": 1772032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707062151, "uuid": "5a308a15-6b33-42f1-bf6a-d147fb3a365b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707062151, "uuid": "4173a550-a3b6-4834-b32c-7b763e21cc38", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f4078cd-c2fc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1707009833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707009833, "uuid": "bcac7fc3-db84-4b03-a34c-c9ef4a49d969", "comment": "Malware payload (CoinMiner)", "value": "34d4591575fdbde20d36469f54b0022f", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cre8ure", "colour": "#7B880E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707009833, "uuid": "d3d37712-8c9a-44c6-8d95-ecf14d583210", "comment": "Malware payload (CoinMiner)", "value": "bcff459a47eedc1d7377aa23e1089918516968cef8fc4fceb9da77df9854907f", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cre8ure", "colour": "#7B880E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707009833, "uuid": "b57d4867-09d6-438d-9ba7-019572fe3090", "comment": "Malware payload (CoinMiner)", "value": "0a938faca18c4733bc5fad3b1ae8c523eebcba86", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cre8ure", "colour": "#7B880E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707009833, "uuid": "913f2fdd-2cc7-4d92-a511-8765483bfb16", "comment": "Malware payload (CoinMiner)", "value": "c7742f4457d519efb983d88b8dab19de4df57236962b085f20d5e9481c23e68406c4ebb535d12665352c27be1fd88832", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "cre8ure", "colour": "#7B880E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707009833, "uuid": "b8d7ca99-e721-4d47-bc7c-442aca3e78ed", "value": "T11BC53369B8C5A270E94C4576B608EAB65AC47C6DC778D1F725D0DEF3BBE20F0162CA10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707009833, "uuid": "922cb743-db2c-462f-956a-fc7cef919995", "value": "de41d4e0545d977de6ca665131bb479a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707009833, "uuid": "c4f377ca-1c7a-499c-aa98-d343dfe2ec14", "value": "49152:CrifRBLHC9vvGmkPqzwhzcVUjEBjALZSIlvPfcM/uW8/ae89VqyJBbtKn7:CrALHC9vGm6hILBjALUIlvPUM2W3e89I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707009833, "uuid": "e64db9f8-2ab7-441c-80e5-1365923e6569", "value": 2676736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707009833, "uuid": "1aeb75eb-440b-4011-b4ef-82b794f8c058", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707009833, "uuid": "654ca603-89e6-498a-877d-97c1c8352bcb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00a5b4b3-c359-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707049752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707049752, "uuid": "c664104f-1bba-4250-9c6c-93fe279d2b04", "comment": "Malware payload", "value": "462ba3a09ab6eb2fd3081dcd94d33038", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707049752, "uuid": "9867db18-beea-403a-a194-277bb6c5b0ca", "comment": "Malware payload", "value": "c0854706ce5ac8e5414ea847ed3e668fefb06e9953fe46375665b1bcd3575488", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707049752, "uuid": "8ce24d0d-3075-4736-879a-eb5712a605dd", "comment": "Malware payload", "value": "072131a0129c5eccf501841650730d4d7151a751", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707049752, "uuid": "044d2efa-5466-4c37-9b83-55c10aa41bf6", "comment": "Malware payload", "value": "8dee682015f3dd2b85497679d72a594b8d2ae206f18669757535eeb8c422876c6e16524fe1b16b0f728ab1fa07312f34", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707049752, "uuid": "8ad965d3-91ff-4cff-97fb-e92fdb50dd5f", "value": "T156E73348EA12DCFEE49D66FE5141E12636BE7A084E0FB08CE8D514EB5C07AD5CE12DB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707049752, "uuid": "4aeb234f-8d85-44f0-9ae0-3a3b7d324630", "value": "1572864:+rziNx5qxnlaM68zaloAfb4UvrdonM7dIhav58RPaO:Bx5qxn0VXbJzavMO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707049752, "uuid": "f01f86b2-966d-4561-b24f-a1ad470f260f", "value": 69053726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707049752, "uuid": "a2d0943e-4d8a-4c61-8076-1d8b1643891e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707049752, "uuid": "5882c37e-42cd-4894-8ff6-54f8f09fe967", "value": "baldur-1.5.3.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c44b7d83-c398-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707077139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707077139, "uuid": "75631fc8-c27d-4615-9403-66155b66f39a", "comment": "Malware payload", "value": "bace29c59788cb1061ba2481f164ec22", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707077139, "uuid": "ab50fc44-770a-4fef-b20c-bed397ed1462", "comment": "Malware payload", "value": "c142f7951a3579b0e52d70b8bd5dcf8229fba772af45527e58070975b808b30e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707077139, "uuid": "03630aa8-d390-44cc-8e0a-339bde9ffe2b", "comment": "Malware payload", "value": "57082f2b25326d80c9ab1b220f4b8cb794c2a6b2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707077139, "uuid": "f56bc581-1dec-4f93-9a65-97c0ceb7eefd", "comment": "Malware payload", "value": "5bc48d0ed27d2e7bccfda9e44f0ed8765831e12aa9562191b8114d19b4368fc869e6532388815fb1f1cb550df2fa928b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707077139, "uuid": "7c699280-8815-4d06-a925-8c9643357ef0", "value": "T12383E506BF654FFBDC6BCC3706A9271135CDA50A22B47B367934C82CB44B25B1AD39A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707077139, "uuid": "607f7d8f-cf33-4bda-8814-a3422c373b09", "value": "1536:NP7Z0TBjwamd6UVmByy6Yk4SPZ3pPvZCtZFfZ/:l7Z0VjwCyypcPgjFB/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707077139, "uuid": "4c77674f-2415-4f36-ae6b-7f7036ee0df2", "value": 85176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707077139, "uuid": "c7ee4bbc-5c1b-4252-afa5-1cbf4d7b7547", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707077139, "uuid": "217d3fce-442b-4cb2-ad2a-2fd1ea7f37e0", "value": "VRmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0724b8b6-c33f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707038596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707038596, "uuid": "6044dff8-6255-4955-883f-1861495816de", "comment": "Malware payload", "value": "97a14f42683917d6d27b1e41c96a442e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707038596, "uuid": "408a73c5-e23e-47ed-9601-113b7efa79a3", "comment": "Malware payload", "value": "c16bd301c11e58a64501ee5462bf3deab6bedb0c84d64d16003fde0bdf6fa4fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707038596, "uuid": "0806fec4-9797-453a-9564-705e7d6848b0", "comment": "Malware payload", "value": "9fa6a12de6a5b17cace63fca42df52d008682dea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707038596, "uuid": "8cc60b5b-d23d-4c7a-97d9-5a500d198820", "comment": "Malware payload", "value": "db6767197163e61efb3aaecbdb6c9479ddf8a4ef5ff6b3fc0dbf2082a40905facf1cc5eaa7a99066b1976df2fac46401", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707038596, "uuid": "31accf4b-7297-4c97-8eae-ac7a3cbc8cea", "value": "T157546DA963A20E26C79D23B7F51B42A8F33258C277117777C257C1263481749ADC6ED3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707038596, "uuid": "01d7d5ca-d481-44b0-b85e-01a1c75f04a7", "value": "2c3ed07dfb34c79124a4487410d8e0bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707038596, "uuid": "9cf30fda-5c9b-4ed6-a035-819152cf9d05", "value": "6144:cfrBCFeGjuHV1ZVTc0/YxuQOPLnrU1ZE2pkLPVQW13fe0I2028fOTMK+epwMgIOG:cfrEj2ZVTc0/YxvOPLnrU1ZE2pkLPVQ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707038596, "uuid": "57b587e1-1edf-4d52-a324-5615f690fce8", "value": 306176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707038596, "uuid": "90dad1d3-7251-4044-b5c1-6d8e7e62b7fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707038596, "uuid": "24de2255-5e4c-4584-aeee-fca197363b58", "value": "SecuriteInfo.com.Win64.TrojanX-gen.24540.22542", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fea1e37-c38d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Adware.Generic)", "timestamp": 1707072219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707072219, "uuid": "7b05cfc8-305b-4394-bebe-00b3ef8c3109", "comment": "Malware payload (Adware.Generic)", "value": "f81205f2fc005d09efce54795de54f14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeTelegram", "colour": "#FF4C93", "exportable": true, "hide_tag": false }, { "name": "Stealegram", "colour": "#778FAE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707072219, "uuid": "626aa00f-853f-4f7f-adb6-b3ca91378d86", "comment": "Malware payload (Adware.Generic)", "value": "c42260cae648336e0253c27e18ef19455c7e092ca69de6125a9a2ca9ffdc0acc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeTelegram", "colour": "#FF4C93", "exportable": true, "hide_tag": false }, { "name": "Stealegram", "colour": "#778FAE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707072219, "uuid": "69e1c612-6e77-437e-9cfa-050786631893", "comment": "Malware payload (Adware.Generic)", "value": "bec46d294a609468574ba0e1fcaae56c4713b0c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeTelegram", "colour": "#FF4C93", "exportable": true, "hide_tag": false }, { "name": "Stealegram", "colour": "#778FAE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707072219, "uuid": "fc541716-b450-4862-a103-8f34adcc6a7e", "comment": "Malware payload (Adware.Generic)", "value": "03252f5fdc24e8b688329addd7ad0d5ab78a2afdb8acbc7982a02e38b8d0c90f53492210fc5d3999ecedb424a280d3fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeTelegram", "colour": "#FF4C93", "exportable": true, "hide_tag": false }, { "name": "Stealegram", "colour": "#778FAE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707072219, "uuid": "b0410fa5-9901-4ed9-9a3f-93f9a42a9b8c", "value": "T17497333FB268783EC6AF0A35087386515ABBBA90755ACC1E17F4881DCF764311E3AB15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707072219, "uuid": "7c59eeee-5835-4f8d-b44c-bb23960c3159", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707072219, "uuid": "89269aa5-4494-4e59-9644-a45952d94575", "value": "786432:iIhjfau4SpCLJwt43T0EWNSKzpQ3ecbGF6a6dNazLE:iIhjfau4Sp+NaSKNt8izLE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707072219, "uuid": "448d0034-48b8-4841-8781-bf3fb0ae79c1", "value": 40465823, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707072219, "uuid": "80df9794-a2ef-4721-aeed-c2a632095fa1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707072219, "uuid": "bd4a3021-f113-4625-a501-0ff943cabf57", "value": "tsetup-x64.4.2.5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b00e4384-c336-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707035014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707035014, "uuid": "062b7190-31f7-468c-8c44-60487eaf1e27", "comment": "Malware payload", "value": "3e0c525842b640ba02abbb82cd390325", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707035014, "uuid": "3c2437f8-3eb0-4f58-a631-07b8258caa3e", "comment": "Malware payload", "value": "c4ac84f75878c041e2f17dff7c6d4eb462b5a378d289792eb42b27863a98e6e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707035014, "uuid": "e316bd29-592c-4e2c-9871-a26352bfc179", "comment": "Malware payload", "value": "20bab9acc3b031f948c5a76553489959048f4445", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707035014, "uuid": "3a548a31-1bf3-4d6c-9a41-9dea7bb4441a", "comment": "Malware payload", "value": "26dc0bada3b978f92e6fc03821d39c84968017ff24f8063eeeb6c7e43fb492ac4a4ea9c2926ea522926303f0d6cbda2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707035014, "uuid": "7a4e684c-f8b7-42a8-841c-f03f3f09e1d5", "value": "T197D4AE86B2E504E9D267A03C519B7217F63A380807204AD777EC84A52FD77E06BBF761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707035014, "uuid": "69aace25-7111-409d-bf70-60b8cd40adbe", "value": "8ba4b588eab2fc40857ec6b4ca82a8a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707035014, "uuid": "fac2aaa7-e6cf-4b9e-900c-b9279004256f", "value": "12288:nSUxXWDx1siYHgQ7A4UxCj2AqeMQmKnx5N:nSIXWzsiMgQ7A4uGKFKnx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707035014, "uuid": "e4565e7f-4aee-43ea-bc59-c15d163123de", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707035014, "uuid": "abd3454e-47cc-494e-9b91-b466c68a1fc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707035014, "uuid": "58a3184f-1f9e-46f3-92a0-deb207588069", "value": "SecuriteInfo.com.Variant.Tedy.426296.20929.3809", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "680142db-c35f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707052502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707052502, "uuid": "d4d337b3-9c32-44a4-a7f2-86d28fa8df79", "comment": "Malware payload (Mirai)", "value": "e97c8b62e6926dfb29729d3e365b5269", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707052502, "uuid": "7d81a576-bcb0-495b-930e-7c3a41b66e67", "comment": "Malware payload (Mirai)", "value": "ccb57d42d849af0b08d5664550a746a4f6e679146d3fba76d586c5a03dbbec93", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707052502, "uuid": "241f17cf-644b-48d6-95da-e2cd5ec5c177", "comment": "Malware payload (Mirai)", "value": "ab5456489afa4c9d317e1eabf0c4c067e6c91b81", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707052502, "uuid": "fa603fb6-6ff2-4aa9-9b4b-fa761246cb22", "comment": "Malware payload (Mirai)", "value": "bde79eb0a412f24e07b0ebd1a3df848d7af6ddb345ead762c7ee0ac85b530408a8f4d79bcaf228c1941f5d03ff24729f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707052502, "uuid": "cb03b749-15ef-4124-80c5-c2dc90c744cd", "value": "T1BBD34C46FB418F13C0D51779B6EF42453322A795A3DB73069A285FB43F8669F0E23A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707052502, "uuid": "fe141321-0667-46ca-891f-f2ae98504d05", "value": "3072:BxioDMQI5nrkaO4nt3qZg2IWu6b4MX7LkDM/94PmPw/t93:DioDtI5rDnt3qZgPWjHX74DM/9YmPw/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707052502, "uuid": "709fc7f4-29e8-49e4-95b7-70e181380096", "value": 135877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707052502, "uuid": "906af820-7f75-4a3f-a0e7-726384b48093", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707052502, "uuid": "9986264f-b691-4c5c-b54a-6761075206f0", "value": "uYtea.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02a3caad-c32e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1707031287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707031287, "uuid": "bc31121f-5e78-4fc4-9997-6c980fa5a56a", "comment": "Malware payload (RiseProStealer)", "value": "ed123d4187a265621239a2a35f7aa570", "object_relation": "md5", "Tag": [ { "name": "cre8ure", "colour": "#7B880E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707031287, "uuid": "9b71339e-5d67-4b4e-a176-3e942a359471", "comment": "Malware payload (RiseProStealer)", "value": "d06ee8f76ec60eae6125d4b47fc0f2e06c7a5239f14c178eff63b5d13801e039", "object_relation": "sha256", "Tag": [ { "name": "cre8ure", "colour": "#7B880E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707031287, "uuid": "bf679bb4-1702-44e5-8367-b75daa0482ad", "comment": "Malware payload (RiseProStealer)", "value": "a60faa1c7a5a5b831b957c6c8f96368f1e816c1b", "object_relation": "sha1", "Tag": [ { "name": "cre8ure", "colour": "#7B880E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707031287, "uuid": "9fe4842a-f29f-4d5a-8f37-80cfc9166aa6", "comment": "Malware payload (RiseProStealer)", "value": "31663e68df64e8c14130a2b88af34c9c806278fae26ffed971cc26a2e9c609605cfa68d31fdf9480a343103859a10649", "object_relation": "sha3-384", "Tag": [ { "name": "cre8ure", "colour": "#7B880E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707031287, "uuid": "268805ec-77d3-4c6a-be26-210583e723ae", "value": "T13A453323050A7044ED31EBF6A11A6E99EB7C3AF94318AF210D8E55EE94DC4DDE772C42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707031287, "uuid": "ad0fced5-abf7-45e9-a487-360db71e4a5b", "value": "5ab723dc8d5af21b79dc301ed6a56a64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707031287, "uuid": "fdee4dac-5e46-4c6f-9926-d0d88910392f", "value": "24576:FCdbuREexzp6P9L1/LX8K4/C/5xDgvyvwQUsiK3H/jZbmNrU0W0R1:od+pIP7X4/C/5uvyvll3H/jZSgun", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707031287, "uuid": "2d4c6083-f737-4fa5-b093-04806b4e1f0b", "value": 1197568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707031287, "uuid": "7e1c4ab5-e933-41cf-a1f6-cf9a2c62927f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707031287, "uuid": "2658157c-f2ee-41fe-a16c-320b987d3305", "value": "vinu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa917ea9-c391-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707074089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707074089, "uuid": "637d55f1-f7d6-4e4d-8437-205730abde5f", "comment": "Malware payload", "value": "cf361aea1198ea2ea7e608ac3950eab8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707074089, "uuid": "baef457a-122d-45f1-b9db-b662bd5eae66", "comment": "Malware payload", "value": "d12b78b7be43750a57e10e2f989f01dd22fb3a3c8bcec4d15877be0d9dffc3ef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707074089, "uuid": "ead10296-baeb-4044-a47c-da27b64b2969", "comment": "Malware payload", "value": "48575acaa251918ad515728b01f68cbc2ee694a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707074089, "uuid": "0689d845-b567-443d-a8be-795a1a1d3eb8", "comment": "Malware payload", "value": "750a808853a36b37d49e68d69884ffd51234147d2170ef97133933df03c95668d0fa9b396975372a4b96674fb9a8925e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707074089, "uuid": "dd1ccc24-24bc-4bdd-a899-9d677096ded7", "value": "T119C533DC02B78013E9D54B7D5B4F9D1B8E896772205AE8533B0B5CC2B8162F12BFA671", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707074089, "uuid": "1f32375e-4380-45f0-80b6-820791f2ff04", "value": "0980a5bdf7b225ee6a859c0ebee6a4b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707074089, "uuid": "ed964ba0-66b0-4c09-9a39-98e1203034ef", "value": "49152:rm+I/bulQHFc67Tms3Rhg7U28gM4HC7J6L7WRm+qoqaE1aYJ8/0EP3KNfuvLzMJD:rm+I/6lka6/pRIUTgM4uJUic+/qa+a5V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707074089, "uuid": "55723cb5-1a5e-4c71-857d-891604c6b4a4", "value": 2582016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707074089, "uuid": "f1902407-1513-40b9-89df-3c27a3b3b66d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707074089, "uuid": "1f30215e-ca32-44ce-ae3f-a4b15bd20134", "value": "cf361aea1198ea2ea7e608ac3950eab8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c86b1d9f-c312-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RustyStealer)", "timestamp": 1707019593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707019593, "uuid": "b86d6d9e-ac28-4679-b806-d5f67d2ffe37", "comment": "Malware payload (RustyStealer)", "value": "2348e0fbecc6c3e0c4a7bc7f70fb9fc2", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "tsurtokiobinder", "colour": "#407519", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707019593, "uuid": "f57a804a-ab87-4d3f-b699-ecd33c0ef39e", "comment": "Malware payload (RustyStealer)", "value": "d420bbe330a69c299a563f112bf5723f0080c8533e1dbb62513159376bbe8c33", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "tsurtokiobinder", "colour": "#407519", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707019593, "uuid": "ce6d62a9-730c-4197-8e38-fb5ce09b1daa", "comment": "Malware payload (RustyStealer)", "value": "78c16f58d04717fd19a44991533602cc3c6be4cb", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "tsurtokiobinder", "colour": "#407519", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707019593, "uuid": "357fb036-7082-4d06-b927-2204b4903745", "comment": "Malware payload (RustyStealer)", "value": "d8ef06adb620072e2a9ab0079f1e7ceac974256ddddbd6a652de603e7d06e15840284f536e5d678898babf35306c5220", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "tsurtokiobinder", "colour": "#407519", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707019593, "uuid": "6392846a-9ce7-4b7f-a88d-e6ccadfc47b7", "value": "T1DD0533254655860249943736D7B32A63E9FEEBA197B3A4B403D6E3C4427C630F9D433E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707019593, "uuid": "8229bf59-7e61-434b-b334-854a38060452", "value": "24576:D/JTMrPJwPimjupHop2UzUbdVb5Csdqlr:D/NMrPJzpHopcpVbMsdqZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707019593, "uuid": "265f9d27-0f4e-4b21-9479-1b6c83c223bf", "value": 831162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707019593, "uuid": "c99905d6-4110-4c9f-aa1f-0138a2a3383d", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707019593, "uuid": "7daa83b7-5c9a-40ab-a038-81830911fbd9", "value": "AppFile_v1.1.exe.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbf487b4-c305-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707014096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707014096, "uuid": "f6c0e1a4-91b7-4abf-9dde-13c25f22413b", "comment": "Malware payload", "value": "68287d9b67bd259601d197b251bd0924", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707014096, "uuid": "e6a5e827-9861-4af4-a091-fb2aff08764d", "comment": "Malware payload", "value": "d8e1d9575763f56a2fb222deec263db5c0ac4452ee959a98e062b0a85f347e52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707014096, "uuid": "c4074966-ece1-47db-a8f8-576220065097", "comment": "Malware payload", "value": "3cbb90408543039312bd387f1da231a21bf3def5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707014096, "uuid": "ba49be44-bed1-463e-8870-7ec017148493", "comment": "Malware payload", "value": "8a24b79642fc8e048edd5bf39df0f5b7b51c7c25f9450212681f9a2ba6d7572aff06fd965631d88e539eb8cf4de81a84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707014096, "uuid": "0867619d-5e05-4e18-9d43-9b6165a8bdbf", "value": "T1B0E32A5763A510A8E5B7E6BCDAB20612E7B27C150734D7CF136081390F627E1AE3EB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707014096, "uuid": "0352e252-c2fe-4640-b979-50d03deacbdf", "value": "18d973303cbf5c84ab8adf0f20f140d7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707014096, "uuid": "3e538d89-f896-4c8f-8c30-34386c88bce0", "value": "3072:gk1C7VGLRG4iGPPicSABbVqvwi9rSmJTQSaMm5/6+tMmxQb0S:gkE7VIRFiPlJWlZgj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707014096, "uuid": "c96d67b6-4f0d-448a-9425-39e722e5a8c8", "value": 143872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707014096, "uuid": "c35925f8-4d2c-4d70-8e37-1b6be477d67f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707014096, "uuid": "e89d32f3-f518-4ce9-8757-4ab5ed694c72", "value": "SecuriteInfo.com.Win64.HacktoolX-gen.16324.22064", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c149223-c31c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1707023706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707023706, "uuid": "8c404a45-feda-4b8d-8d5d-af11cbbf8738", "comment": "Malware payload (Stealc)", "value": "db93b7eff4c2415afc573cba1930c376", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707023706, "uuid": "d7c0efff-2deb-40f0-ab81-29424b76c86d", "comment": "Malware payload (Stealc)", "value": "d9731a8aa35b79ab73cf572052820f160fd86948e546eafc9f8cf66c285229ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707023706, "uuid": "bcd1b673-9211-4da6-a242-c0ab974fa946", "comment": "Malware payload (Stealc)", "value": "104b8b572f8080aa914bf162eb0762d40da1b6ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707023706, "uuid": "ad7d1d9f-4c19-42ed-ac16-0c2c18610654", "comment": "Malware payload (Stealc)", "value": "3be66ab6ddb0b67af658cc613e648f7f6e1f74622db1c556567d168907c3d7432634f9cb3003a10641d390af5b13f355", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707023706, "uuid": "356a1366-8283-4159-8dac-05b341fb6647", "value": "T1900533EA015651A2E171ABF2A0C656FBE5953C1C65CC9A123F8F13920F7017EFF8A305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707023706, "uuid": "c7ddb641-6412-4e44-9e2a-8d4ef601eee9", "value": "7515ecf8c0dfa4d230ad835fe0acb57f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707023706, "uuid": "61b92849-b46b-498a-877e-0f896e2f6d16", "value": "12288:2N0TBLJH+SjPqZ8VfwMnSo7YNQDLPxez8dFlZqBUOZjSVXNpbycdc1mFdj/RA:2N0TBLNDqZ8VDnDwQQz+8PjSfcM7/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707023706, "uuid": "817808c9-2b02-4b05-99df-6d756e125a62", "value": 810496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707023706, "uuid": "15114a70-4275-4fae-8112-8ee55af05e6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707023706, "uuid": "d0eea9e6-d97c-4f67-9cc4-b161dad8416e", "value": "db93b7eff4c2415afc573cba1930c376.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf9a8952-c346-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707041939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707041939, "uuid": "c79df79f-8ef7-477a-b085-3fcce906b770", "comment": "Malware payload", "value": "0c83c33ffd66c63b9401f628b89a1e87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707041939, "uuid": "29f16427-ece0-4359-9c56-9d7bf7a17e01", "comment": "Malware payload", "value": "da2676eb2037e9c29e4a65b168b0cc84c2b7eac167d99e12524126962075b154", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707041939, "uuid": "21428a0f-bcd7-4f90-b690-e06a8c4db081", "comment": "Malware payload", "value": "5fcc64668fe325fe7ec9087b58b7c9cc71d64a39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707041939, "uuid": "204a2bb8-d1e9-48dd-a383-93957d69ade0", "comment": "Malware payload", "value": "3169c876870f2429bdcd5c110d4ed60c8a9039975a4bde1b5057e93ea2f59a8b4b2d82e692b408a7b3428e914add6ef8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707041939, "uuid": "76b00b5c-ca0a-4369-8078-8a9a1563ee81", "value": "T1D9A58D06A7F84A5AF26F1B78E870153047F6FC17AA6AD78F6544F8A86D63740CE11323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707041939, "uuid": "cbdf33bd-a695-43d4-864f-39cccadb3d4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707041939, "uuid": "59aeae29-3e74-42d2-a56d-37ce803b8a9a", "value": "24576:7pn9l7TSlnUuL2Kk8cfLDxjqGosxy8m657w6ZBLmkitKqBCjC0PDgM5A4woGf:9zuL218cvxsVV1BCjBkf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707041939, "uuid": "4d39641a-087f-43e2-b4c5-f549f8b3a65c", "value": 2234592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707041939, "uuid": "68b54b81-3c0e-4c29-995e-8fd6f06fa919", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707041939, "uuid": "6dd8489e-e33f-4458-93d5-e47e4766419b", "value": "SecuriteInfo.com.not-a-virus.HEUR.Server-Proxy.MSIL.Luminati.gen.21829.28282", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20687c6d-c385-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707068703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707068703, "uuid": "7d25914d-6a62-465f-998c-23055934e9cc", "comment": "Malware payload", "value": "4c881a51c633cc64886b21371cd26fef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707068703, "uuid": "3992a824-3fe2-4acb-972d-fbf118c75b28", "comment": "Malware payload", "value": "e30bbbbcc4382318111e16114a89c1d9aec3bcb151331be1fd3442e701cbbb66", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707068703, "uuid": "eae2f03b-f139-405e-9db4-6c6e6770f37a", "comment": "Malware payload", "value": "9a624b1f948a2b774466dea51f5f59170adcea6f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707068703, "uuid": "85fc43f0-d9e0-4eca-ba20-87a81180b2eb", "comment": "Malware payload", "value": "cdda607793d6221fa67cdfb9550881dcf37fa3abc89b8f757e76109098ccf7c93ac0146f8c48eeed85e426314168a9f6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707068703, "uuid": "a5aef60b-ae5a-487c-be46-c30ad6ed005f", "value": "T155642A40F944FDF5DCCA8FB914E2131952EAA081D71DDB2F7920FE3C012AA58E97265B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707068703, "uuid": "aa6d1c47-23eb-470d-ab41-1aec176e5a4c", "value": "6144:R6za7ALkvWwGeiAPCS7BhpC0NUa1udmWiqmuiapF2Qva8aTsYW0b:R6+w9h6l7Xw0ZY3SxIFRvXqb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707068703, "uuid": "d36f0611-753a-483a-af01-f54c2fd8de42", "value": 324669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707068703, "uuid": "e6bf8ec2-1ed0-48aa-b905-c73b5828bf82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707068703, "uuid": "0233257b-4bbf-49b6-a009-b7aacdedf342", "value": "4c881a51c633cc64886b21371cd26fef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1c327cb-c354-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707047875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707047875, "uuid": "2e47b366-9085-454e-8e84-a1e25bb96ac7", "comment": "Malware payload", "value": "faf3615952a38683e1d9c23d45ae110b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707047875, "uuid": "0fc5376e-620c-4a03-9e09-7cb80976fe2f", "comment": "Malware payload", "value": "e407dea2469954515ddcc24910a7a93fc8eba3109742b0e3db334865e7195be3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707047875, "uuid": "2b1af894-996c-4e9e-a522-1b518ba76656", "comment": "Malware payload", "value": "cfb0d11b46b33fd8be8dcdc00a7bb36c08f06d9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707047875, "uuid": "f032611b-d0b1-43e3-bd13-39e848401e7f", "comment": "Malware payload", "value": "fe2c79b0da637950f5699f410940d0da45c2c38471397b253f99736ecf9919b2fd905202b471749e3db9c2eb2252c12d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707047875, "uuid": "14de9659-eb08-4c04-a62e-84aafa5b38bb", "value": "T107F56A43F6A255E9C05AC074925B6332F632BC8D4724ABE757D08B313E827A06F7D798", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707047875, "uuid": "8a0e1e6e-bbf7-406d-a284-9a4c68caf9c4", "value": "e8e345354e3bec735f191cdb7da1839d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707047875, "uuid": "0d770407-61f1-40fe-bb4a-358879bc5756", "value": "49152:5JxkjLNO73TDFvOTt8FkM7JsDy2U8TGSzqCd0IFOvmJNSX1Lrw/:5OuGen7JghZNC1rw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707047875, "uuid": "25aafbe7-72a9-4627-84f1-8d23d255511d", "value": 3618816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707047875, "uuid": "efae6647-63c5-4357-9f65-0aad27a78b19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707047875, "uuid": "8963251d-385c-4a25-8f53-30240d08a953", "value": "faf3615952a38683e1d9c23d45ae110b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69052c38-c35f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707052504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707052504, "uuid": "d8a9a4c5-a316-45e0-870f-7b1780c24707", "comment": "Malware payload (Mirai)", "value": "19ccc99faab571343695fd05f85dadc1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707052504, "uuid": "51855589-1185-46fb-a0f5-03b7a590c3cb", "comment": "Malware payload (Mirai)", "value": "e4476042c69389e2789f5014eb54d5e4015c1e94f9ca2a39ffde9bfb121caed8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707052504, "uuid": "a75e8e66-0593-4bdc-8f62-4d2d3e184db3", "comment": "Malware payload (Mirai)", "value": "92f2d80fd7324d67b984f445402d0ac7195ef095", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707052504, "uuid": "9d805afd-fcbc-4dc5-98d7-483447c736b2", "comment": "Malware payload (Mirai)", "value": "42eab3737068bc3bd23c43f080c50f2416a60bae8b39b119a539d712bb184f67bd9428d4b984d76a8e43ed0129fae95a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707052504, "uuid": "af051845-05bf-4134-aacf-75e13432b964", "value": "T149434AC4F143E9F5E85301741026EF37AF72F2EA115CDD93D3A9EA226C92A12E446D8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707052504, "uuid": "a125733e-1a30-49a5-887b-fc709833ce6f", "value": "768:FmnthEsW5qnF15RY1dhPe7oXTmcBDj5gk9vWnTI4eBH+4sToQLDLFv:Yn/EsW5qhSh6amGlWnU4GH+dNLt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707052504, "uuid": "bbe88e6f-cbad-4f9e-9b92-6ac33b200fbc", "value": 55348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707052504, "uuid": "78b39921-97d3-41c6-8f4e-26bc79c3905c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707052504, "uuid": "9383c842-fc5e-4133-9702-c42630972a98", "value": "uYtea.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea2fad18-c34a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707043701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707043701, "uuid": "2543706e-c60d-4bea-a690-ea7b88776311", "comment": "Malware payload (AgentTesla)", "value": "8a59b8b9f4adea924bfcd20e798d2324", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707043701, "uuid": "81e74da0-6a8d-45be-80f3-e9a29ef86e69", "comment": "Malware payload (AgentTesla)", "value": "e491d8460b958600e38ca1b037b0e33bf4387620386ddf15cf8ab4316451a707", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707043701, "uuid": "4868db4c-0dee-485a-b6b8-29b90705a65a", "comment": "Malware payload (AgentTesla)", "value": "6934a737351ff1efdf15a0a1c945367fd7ee1d36", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707043701, "uuid": "11bcd20f-39d3-4eb3-99b1-00a6d4abe8ab", "comment": "Malware payload (AgentTesla)", "value": "132665e6a34fdbb35fa8fbad002d95d8953b8be9b3dce481a0784a8a1a0c6d30d9d38cdef725c77c15be9bade5367e4e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707043701, "uuid": "07c7fdb4-c971-404a-8307-76d8efb25ca7", "value": "T1DFE501ED322D171A34234A4CD8DDE288675C890275BD57A0E0F569F65F1F5A6F23220F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707043701, "uuid": "8b8dbaa5-4865-4157-90fe-35a4213fc7f4", "value": "192:+VhD1h2Ow3XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXs:6Dv2OP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707043701, "uuid": "587a34e9-8f8c-4d06-a7ab-a74ec550c1b3", "value": 3222277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707043701, "uuid": "333d8b85-3b52-4010-a6c4-221169c143f8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707043701, "uuid": "6b94121a-a178-4095-bf71-54f76702db2f", "value": "Tax-Invoice And Credit Note.pdf\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 .JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a62af590-c32d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1707031132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707031132, "uuid": "f065f770-5c82-4676-ba75-dc7a6344cae3", "comment": "Malware payload (RiseProStealer)", "value": "c3926d2fcc1ad39cc7d0a18fc74f126c", "object_relation": "md5", "Tag": [ { "name": "cre8ure", "colour": "#7B880E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707031132, "uuid": "fc99ee29-383b-4fcb-bf4e-47b6ddb7a6dc", "comment": "Malware payload (RiseProStealer)", "value": "e5b544bfecc90168093fca4e129c59d8676ae5f6220d537d3b7c46a2c985a765", "object_relation": "sha256", "Tag": [ { "name": "cre8ure", "colour": "#7B880E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707031132, "uuid": "19829480-3b8f-489a-92fc-e821546b6aeb", "comment": "Malware payload (RiseProStealer)", "value": "07bab78c76dc7625d03514d4f6aa6d453e862732", "object_relation": "sha1", "Tag": [ { "name": "cre8ure", "colour": "#7B880E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707031132, "uuid": "36e2fc39-8b03-466d-9661-2a72b13edaa5", "comment": "Malware payload (RiseProStealer)", "value": "2e1a8e766d9b131c23641c4a7de687502d71c5039f1cfee03f9afeb883e7248607ef86660952fe1ba48f2b75d6146e01", "object_relation": "sha3-384", "Tag": [ { "name": "cre8ure", "colour": "#7B880E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707031132, "uuid": "b70a01a3-2f7d-4dfe-bf7d-3b6882ce6233", "value": "T14D4533D24A2D0A44C175E6F0145737EDCAFCBBF4C81E1B06368B9EBA90341DEAF16A45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707031132, "uuid": "9b16c405-6be8-457b-abfd-6332c884e111", "value": "5ab723dc8d5af21b79dc301ed6a56a64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707031132, "uuid": "43cb444a-241d-420a-9c8d-4e7b912f8d27", "value": "24576:bEsbjnclwspQwsbhWblPCXxoX3qwQbsiK3rJRGvFW6:uX4hWblPQoHqls3GW6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707031132, "uuid": "b0dd9e34-8b60-4eec-b833-702a4bef6e20", "value": 1197568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707031132, "uuid": "e9c93cb1-095b-471a-a111-247a1717fcd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707031132, "uuid": "97d14e86-c67a-4246-80f9-e7f216cb1a78", "value": "plana.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6495a9d2-c39e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (BlankGrabber)", "timestamp": 1707079555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707079555, "uuid": "584eeafb-13be-4d56-82c0-cbb96d66839c", "comment": "Malware payload (BlankGrabber)", "value": "4b404daa8d1f29d86c6873799066808d", "object_relation": "md5", "Tag": [ { "name": "Blank Grabber", "colour": "#1DBEBA", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707079555, "uuid": "78bc5252-ab9d-4b5e-bfe0-5d4a079adb5a", "comment": "Malware payload (BlankGrabber)", "value": "e60d698a088c4637eacdf70a04653c6d232440d90930ae0b3f72d4bcb01c4f0a", "object_relation": "sha256", "Tag": [ { "name": "Blank Grabber", "colour": "#1DBEBA", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707079555, "uuid": "2df4db08-c234-4a5a-ab30-ccdde2c9d7c1", "comment": "Malware payload (BlankGrabber)", "value": "6c9d1a5f9b4792e71c278e5f9af3e80f8eef4fbc", "object_relation": "sha1", "Tag": [ { "name": "Blank Grabber", "colour": "#1DBEBA", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707079555, "uuid": "6570a23e-45f9-412b-bdfb-ecd18feeb8c9", "comment": "Malware payload (BlankGrabber)", "value": "4b8e8dda67fae3383b2f258948118521ad6dc578a36e024e497ffe00db5a30bb69e49b5406c6bf7b36c9f00b561272a5", "object_relation": "sha3-384", "Tag": [ { "name": "Blank Grabber", "colour": "#1DBEBA", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707079555, "uuid": "7e3be810-0b1b-4a3d-af45-f4f8a70bddbe", "value": "T1D95633B0279804E0FDAB4A3EC456C859C6B4F8150320DEDB52B492BA1F737695D3FB92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707079555, "uuid": "f4b734f8-66ea-4342-ad74-0b7c5182bbd9", "value": "1af6c885af093afc55142c2f1761dbe8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707079555, "uuid": "2105d71a-bc81-4d87-8fb7-f85e471e501c", "value": "98304:aREEtdFBCCuamaHl3Ne4i3gmtfXJOLhx9fZAzDJ4wzQgsRuGK4RhOuAKMenmrv+:aBFIC3eN/FJMIDJf0gsAGK4RkuAKMTrG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707079555, "uuid": "a7b27078-9dde-4f3d-b904-38fe76af4377", "value": 6217064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707079555, "uuid": "98232c57-1b8d-497d-8583-dc494b148dd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707079555, "uuid": "c60cb958-8b3a-4c5f-b3cc-7c995a255677", "value": "proquota.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f8645db-c32d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1707031013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707031013, "uuid": "216ac2c9-73d3-4bd3-bc24-cd659b5863b4", "comment": "Malware payload (RiseProStealer)", "value": "f6b07af2bb9041e13a2e7a55b53355d3", "object_relation": "md5", "Tag": [ { "name": "cre8ure", "colour": "#7B880E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707031013, "uuid": "1aa2aef3-6d13-404b-9139-863eca93143d", "comment": "Malware payload (RiseProStealer)", "value": "e705ed2f1ce39a17f40a404f82858ef18d8afc2d25ed1f89a9fff5d9b277a020", "object_relation": "sha256", "Tag": [ { "name": "cre8ure", "colour": "#7B880E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707031013, "uuid": "0ce4c112-a8f0-4280-ac12-c12bf960bdec", "comment": "Malware payload (RiseProStealer)", "value": "bf2ffc125ee60ab0e4f4674d5697fedad513f61f", "object_relation": "sha1", "Tag": [ { "name": "cre8ure", "colour": "#7B880E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707031013, "uuid": "bd3fc5d9-7099-45c6-9316-886f24549188", "comment": "Malware payload (RiseProStealer)", "value": "8a384bc4be5aa288a6bb130e8d080cabd1a4cc56d64915c53bcfcd94a70f8468bc158b2667cd41576b2ae3610d92f6b6", "object_relation": "sha3-384", "Tag": [ { "name": "cre8ure", "colour": "#7B880E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707031013, "uuid": "57254085-d59c-48a5-9148-910139e5eea5", "value": "T12DB533E5DEB1AAE1D54B9FBD435D9441B8A7ECD38688A3C41906F14C93FE8B08D24F48", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707031013, "uuid": "19170975-2b95-42a8-9f1a-0a7ab04d46fb", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707031013, "uuid": "009949e8-ef29-4e0b-9cd8-895be7fbde6f", "value": "49152:o6OJIgIAkrP4bI/geVxtNWhaUukVwZJWm8Pn4g340Y3RCOO:XwvYv/gyxtNErPPtbmzO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707031013, "uuid": "3f409ac4-5437-4dfb-83df-3c480e221842", "value": 2332672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707031013, "uuid": "74755b84-63cb-430f-b886-755874888b2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707031013, "uuid": "3c26acf6-c3d7-417a-9a36-d8a71c998caf", "value": "ladas.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26dad862-c356-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Meterpreter)", "timestamp": 1707048528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707048528, "uuid": "c6d7ab4f-fb46-4fb6-826a-7ee03c6d74d7", "comment": "Malware payload (Meterpreter)", "value": "75cf461c3f018d2fa3f5c5dfbbc93876", "object_relation": "md5", "Tag": [ { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707048528, "uuid": "f4d18ebe-c172-4309-999f-4677b0d2ed64", "comment": "Malware payload (Meterpreter)", "value": "e777aa6cdc996bc7c31c018850d32c0c84744cbbfd9752029b0da2e95b4b02a3", "object_relation": "sha256", "Tag": [ { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707048528, "uuid": "ace02c69-adf5-4895-bf07-f11684264adb", "comment": "Malware payload (Meterpreter)", "value": "da6a2da1602c3c67c0875cc4b70994bc36542515", "object_relation": "sha1", "Tag": [ { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707048528, "uuid": "9a94cca0-59a8-498b-b90e-7524e31c2572", "comment": "Malware payload (Meterpreter)", "value": "f5a92bf7b8ac735a1e259abb2b5d1973eae52114ac1d0c4e6d149638a19e2cc733e5840964845f64bd0be072d038d90d", "object_relation": "sha3-384", "Tag": [ { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707048528, "uuid": "3e978c79-da55-4463-956f-9116acb236c3", "value": "T161130292C715D2645E338CF6276C9AA4E51C143173EBD82B50D2CCE873EE02A6BC6B13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707048528, "uuid": "ba246df8-b4b0-4275-81b2-7ec456c09768", "value": "768:H5CMPTadPgvHWsRmv4dlfT9zBv94DcPUfAChk/E1W2qBRT/ptZKLciFFwOSwo9jx:Zxa9gvD4v2nlVc7k/Eg2qBJ/ptYbqO1W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707048528, "uuid": "5d1a35b3-0543-41f4-be67-5e0061f524bf", "value": 44106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707048528, "uuid": "16c57a50-ef1d-4e56-b6d1-234fc0537e1f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707048528, "uuid": "6a5660bb-12cc-4ee3-b7c5-f3a92c85a07c", "value": "75cf461c3f018d2fa3f5c5dfbbc93876", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "731d956f-c384-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1707068412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707068412, "uuid": "67d17b93-2bc5-468d-9bb3-3ea033d7c696", "comment": "Malware payload (Amadey)", "value": "99eff145491f05a17a5c26a22da6f906", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707068412, "uuid": "6b767bae-49fa-4552-bdfa-3fb262f7a089", "comment": "Malware payload (Amadey)", "value": "e7edbe5da62663460a654f213ca46634ad7781aeaa18416544d8a6e0035be268", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707068412, "uuid": "97e8bb73-5921-49e3-8977-f7fe98239e34", "comment": "Malware payload (Amadey)", "value": "caaaf3354e249616f8cc1a31750f9d647c84d7ea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707068412, "uuid": "303dd01e-934f-421c-8e79-151c6a7fe00b", "comment": "Malware payload (Amadey)", "value": "0a91703fb37114c73301194eea2711da69a49c90721f81cc9eb056707cf5d168cb746a0fdc2311652442b67a06bf3222", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707068412, "uuid": "75e2ff8b-6bf7-47cc-b146-ec2512f7a6a4", "value": "T175C5333022935FAAD0933132B79530C82167DA8BCD321963B695396125FF1F9B2C7E97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707068412, "uuid": "4a2198e5-e6e3-4103-9ee1-2df2dee52a24", "value": "0980a5bdf7b225ee6a859c0ebee6a4b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707068412, "uuid": "c8745104-a56b-4e0a-9d5c-404431539704", "value": "49152:175d6qQ7zFLTenNTaQytwv0eyV+L4QmeoPi8A0/vpxp:17277zcnNTXLyymb/A6z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707068412, "uuid": "8f76b3e4-7f5d-4581-9fa8-36ad5ae2c970", "value": 2572288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707068412, "uuid": "3ddfb9c8-ae2e-4148-ba8e-db4a73d84556", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707068412, "uuid": "db9554bd-faf2-4921-84ba-1dea28dda0b8", "value": "99eff145491f05a17a5c26a22da6f906", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a56956ba-c2ff-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707011374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707011374, "uuid": "9006f4d0-41e5-4f1c-b08a-a674997d4936", "comment": "Malware payload (Mirai)", "value": "48723153d493cf20c0b32830edaa8ed8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707011374, "uuid": "2fb1033d-6fec-4236-a5d0-a34402c2a251", "comment": "Malware payload (Mirai)", "value": "e95827b9888bb47671a4c07fa978c3a160f1ef720edc912ab403abbf77aabbfb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707011374, "uuid": "8788d455-668f-4e10-a29c-f7573969011b", "comment": "Malware payload (Mirai)", "value": "6477cda467b7455a35ff631c8ffcef07b445f4d5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707011374, "uuid": "0b326929-0b5b-4068-a117-9a35091d41e5", "comment": "Malware payload (Mirai)", "value": "0ee263f116a0ec3b2f9e7051ef77b35d977aa8022ba00deba534ec48f6d8d13d51588f08bdb40f6f03692045945da17a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707011374, "uuid": "18f30c1e-5ff1-448e-8cdb-5c6a45b109e4", "value": "T1CB83C70E6E218FADF769C33547B78A21A79C33C637E1D681D25CD6106E6074E241FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707011374, "uuid": "7096f63b-6cd5-4fe2-a7b4-0f113108bf8e", "value": "1536:+PdCho3TJwEh76/qzgcCkjEN5hWehGGLG:GdChoD2czgcCkwN5lLG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707011374, "uuid": "5b9aadfc-b6c8-448a-a0c9-36240b17bb66", "value": 85176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707011374, "uuid": "80f0a79a-28da-45a8-b08e-1a740b0241e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707011374, "uuid": "22b131bc-e6ad-460a-b624-8923924e554f", "value": "48723153d493cf20c0b32830edaa8ed8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c89c30a9-c39f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707080152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707080152, "uuid": "d0759559-62e8-4a24-b0f3-bb5948f23fb3", "comment": "Malware payload", "value": "9f5cb3a9a4053a53063a9da9afbf6273", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707080152, "uuid": "9131772e-b2c6-4109-94ca-f9afa22d7f96", "comment": "Malware payload", "value": "ec91ef3c4c02b6c8aff61058bf0b2bb013e2e6a2ee6c805c6d07ad0ae46fa9d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707080152, "uuid": "7590c421-1862-42a9-85cf-6e1722bbf49e", "comment": "Malware payload", "value": "b1ad9fe9cd4e8ddf11909751a2e0334c86ff206e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707080152, "uuid": "07acd432-be08-4487-a37f-48b5258cb2a9", "comment": "Malware payload", "value": "20f08131b717fb69e57809cd2274ebdfcbcb7956ae49b38293139a0945716857452a3cb757eaf41132ba9f7370bd4ba7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707080152, "uuid": "c6994518-bf1a-4f21-bb10-c4a21b9ac4f2", "value": "T1FAF4CF9030B59A9ED13FBBF16D657CA493F16403661AD984CD8141D2383EBC2AEE3D1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707080152, "uuid": "dfbb2094-82c7-450e-ba84-e6b1a5657628", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707080152, "uuid": "1782ec03-1104-44e8-b49b-315808bf6a68", "value": "12288:xYRY4kQvFK/hSB8W5yWz2izHvqIknzbUtaD0Drt+/wQVbAV:/48SB8W5lzfqIknzCaoDWwWA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707080152, "uuid": "c3e4273c-77d5-4bae-8eac-d856c9847c86", "value": 753016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707080152, "uuid": "a0bd4bd8-1b86-471a-83fb-43085d65613c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707080152, "uuid": "6565d199-8117-4bda-98d0-6318b2314f01", "value": "ec91ef3c4c02b6c8aff61058bf0b2bb013e2e6a2ee6c805c6d07ad0ae46fa9d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1413099-c391-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707074073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707074073, "uuid": "7abe6ae3-e4aa-448e-a9d3-c427de4c6494", "comment": "Malware payload", "value": "d2ac685eeda58af6736009306740f2d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707074073, "uuid": "9122d372-1b26-4511-95eb-be85e8e93bd0", "comment": "Malware payload", "value": "ed4eab9895579d948eda9ef4d1320511561b78133c380e2be8c87500caf58ef7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707074073, "uuid": "bfe138be-ea25-48b6-8f2f-6684b52c425c", "comment": "Malware payload", "value": "68f140b294d76746b966e583757a1d5753ad7766", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707074073, "uuid": "9d27f6f9-82b6-4d29-9622-f194a4d8732d", "comment": "Malware payload", "value": "57f029494cb55dba3e5dca089b7a2be695d66f11d5397de4d8d6248758623cf2c090e6e2fbe07ab35724c349acf3dd59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707074073, "uuid": "238b4949-6c26-4f42-a9c1-1f69c591d845", "value": "T12BD733E1F880F8B8FC60B672A57CC56ED6DB2B831544ADC12B4D24FE5528F369405E2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707074073, "uuid": "2cdbb8e9-67f3-4ef3-83f7-61d5c1b1dccc", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707074073, "uuid": "b4640d2c-49ca-42e5-822a-562a1125ecc9", "value": "1572864:um6fMpekHYiJyTJNIxWFXGkxtHN7uagGk:F6k1HYiJw3FWk9uagGk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707074073, "uuid": "09aca9e3-c4c8-431a-b11b-98b0b36294a3", "value": 62546841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707074073, "uuid": "990aaab4-0b9a-4a7b-81ea-d72a5f791fcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707074073, "uuid": "5f2d1a6e-e07e-4fbf-b934-31497007de82", "value": "SecuriteInfo.com.Trojan.Siggen25.32651.9819.20773", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af00ea20-c349-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707043173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707043173, "uuid": "baa7fe6f-68fa-434a-b49e-939969fb00fd", "comment": "Malware payload (AgentTesla)", "value": "dbebe759f55534ce8e2fd9f5fb0d19ed", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707043173, "uuid": "9ee4a9eb-a67e-4803-adc4-34edecfcea3d", "comment": "Malware payload (AgentTesla)", "value": "eed5c37e375690420ac4b5ba5ddfcac8e3cb2d997dd8107fb4f00a60d4703ec7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707043173, "uuid": "0a2a9afb-3eef-4dba-99ef-33529a446012", "comment": "Malware payload (AgentTesla)", "value": "c1c7319ddbb06364a9d8c5765bde03b07c096efd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707043173, "uuid": "acbd38d2-6d9b-4a80-aac8-0731836cfa08", "comment": "Malware payload (AgentTesla)", "value": "9e0d6a14c8db1dbdde3213194e83c114b9305d62ae2498352c41ae4d2aebb86c1edb2b4eac342a64af0fa0e46365057c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707043173, "uuid": "f36a318c-cd46-4a8a-82f8-e4aaac4c5ad1", "value": "T17F452FBC8F124053D019C73447D1BB22AFB1BA5932764B553DCD0749AF5A780BF681AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707043173, "uuid": "88bda44a-4d51-4f6b-8bb6-b9382c570598", "value": "48:5pTzD0T5S/unnz5jemU5O6+kpoWA5dEfOaA1uiQ4oXEb7jcHYznodUm9lO:59zD6vnzPU86+kp08OaAYLNgjc4pm9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707043173, "uuid": "99bf2bc2-1b74-446f-b352-69e9a0cfc110", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707043173, "uuid": "d0de310c-7165-4d11-bc4a-f88afa5dc605", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707043173, "uuid": "eb75bb0d-9ca8-47c1-9a16-cc548f9f1bb0", "value": "doc20240201061911.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bc360fe-c354-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GCleaner)", "timestamp": 1707047811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707047811, "uuid": "05c52111-9988-4213-b1e8-7612a755be99", "comment": "Malware payload (GCleaner)", "value": "271ef58f9fee5d30529db1c37d511aec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707047811, "uuid": "fcd748d3-8e3f-4c91-aaac-96c77ca7fe15", "comment": "Malware payload (GCleaner)", "value": "f35e7d5c0de2b78a040a1d5932ad894f2d5f21b26d5cee3f702c9ccf7c86337e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707047811, "uuid": "51ca3598-b552-4145-a9b2-0625811e20db", "comment": "Malware payload (GCleaner)", "value": "a87cfb71f5f72481c9b5ed69502a6370f62178e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707047811, "uuid": "afe2a052-198c-428e-b607-d7f67926acad", "comment": "Malware payload (GCleaner)", "value": "63b9ac6ee5a04c02c1eed06bd580d08288ab682c7935dc4bb49df219b5b6a0b34e4ab767168fc51aa6db7dd4f6d6ce72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707047811, "uuid": "50cefe00-7983-4081-a234-39470ebe3b0a", "value": "T14984AE1073E4E031E2A716344A34C7B58A7F7C767533A7BFBA91163B2E346819A2570B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707047811, "uuid": "d6a59777-e825-4bc3-8e70-7b6978705965", "value": "e73d248f8b5138b09f44525633bf1f57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707047811, "uuid": "60a5e560-5a4c-4655-bf8b-c2222d027a2f", "value": "6144:G09gnq+CU2+BRghYLExJqTfGJ7LcXLPbBkc+y44W6a1kqc:GvdCU2+PXLEofonWj9kc+t4W6ae5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707047811, "uuid": "3a9b5b63-196a-451b-acf4-dc733937cd88", "value": 387584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707047811, "uuid": "32318f07-497c-491c-842c-cfab50b9c599", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707047811, "uuid": "dae9b889-0d4f-42a8-b4df-0e207e588a81", "value": "271ef58f9fee5d30529db1c37d511aec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48f9ea79-c350-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1707046008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707046008, "uuid": "d3d74851-a44e-43fa-9a5b-9a3001de1fe2", "comment": "Malware payload (RiseProStealer)", "value": "ca2d9ceba76da7ae54f5cbe2bdf26e15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707046008, "uuid": "c111f088-e484-4164-8e39-505b7c79c239", "comment": "Malware payload (RiseProStealer)", "value": "f95764d03b457b3449f49d0d5e45fd4a9980ecd604808250c939936f1bb76d5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707046008, "uuid": "5c6d8507-2da4-468c-98a8-a3c0e5e0834a", "comment": "Malware payload (RiseProStealer)", "value": "d51551baa5e473b362975a123086ba663efb9200", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707046008, "uuid": "559fe803-ca4c-4e61-88e5-b17e31dc3ffe", "comment": "Malware payload (RiseProStealer)", "value": "ec7038445a43dce8e482d31422f91b23e8c8ca3cb9670a701b0f9a7380b7a18fb00c4c3a33c665d1feb794e4765d4bf0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707046008, "uuid": "c40e2efe-7cec-4f79-9135-08a07f4cf124", "value": "T14AB533D24876C882E47BBB37862691DFB7D77C433262C18A4411F982A33E5389D5EE61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707046008, "uuid": "4ed73801-734c-403e-bc37-7541741b39f5", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707046008, "uuid": "5d5d8803-b02f-4c77-a9dc-ee5ecf3e1201", "value": "49152:zuWFuP8og5euL0ij/uqmhctsxonW2xANqmQVvvJ72vVgtR:zL88A3/xynxANeDqvGtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707046008, "uuid": "87eb4d2f-c8dd-41d7-ad9e-962d312f2398", "value": 2279424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707046008, "uuid": "04bb9426-5870-45b3-87b8-818dbc8fb978", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707046008, "uuid": "f163d4b2-d40f-49c8-9beb-e0928dc0af2e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06503c92-c349-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1707042890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707042890, "uuid": "32de28dc-70d0-42d0-8418-724fce46ada9", "comment": "Malware payload (AveMariaRAT)", "value": "95e6e04dbae059cc66fb3b1b84ba6edb", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707042890, "uuid": "8afbb6b0-93b9-49ca-aeeb-9bc0b5ea3a52", "comment": "Malware payload (AveMariaRAT)", "value": "f9657e0904b8d7eff113a6980933c00d9c86b662c79c8bd763f604a617b69383", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707042890, "uuid": "a5c0eca0-de2e-478a-9ded-beb8f52c0b13", "comment": "Malware payload (AveMariaRAT)", "value": "f08a0953cfe516e1412732f8435425fc79374998", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707042890, "uuid": "de124372-3543-412a-85e0-6e071c617cd6", "comment": "Malware payload (AveMariaRAT)", "value": "d5c1c1f6fe2f2edcfe32b341e9a5a585877357f0eacabc3a62da5ff1da1ea542b2d38f9ae6a49f52ab207cd57e2699b7", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707042890, "uuid": "d1081af5-a2f7-4910-84b0-39e74897bfc8", "value": "T181F433955F37D8B3AB0862CD86FB05162138A2356C22C8DDDE64F7107EAED04EA1D793", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707042890, "uuid": "3491f5b0-e597-424e-bdc9-7e52bc7beee8", "value": "12288:+AbLblgyxRHDM1jbxLGrzKAm+GcuSiamIv/Lsrdq/86r1+YKc:HfqyfHmq7mrjamIg4n+s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707042890, "uuid": "e5bfbb7e-e165-433a-a999-f02ccf8a3452", "value": 730765, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707042890, "uuid": "71a4d3aa-4455-4b4b-98c4-840db20ef079", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707042890, "uuid": "c2bbee76-5735-4be6-b0d7-d46352271413", "value": "ITEMS SPECIFICATIONS - UNITED ARABIAN COMPANY_UAE.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "020a11e5-c38c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1707071659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707071659, "uuid": "408ca097-a4cd-4e22-a553-1dad674d8d05", "comment": "Malware payload (RedLineStealer)", "value": "0fb1f243d0254aec7a1f00afa1be6154", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707071659, "uuid": "550f4395-3715-4d8e-a52b-5265e225160c", "comment": "Malware payload (RedLineStealer)", "value": "fac2721b3d0ca98c5f791e3eb14a1b89c3e567f3bce012e214d955bde2f00999", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707071659, "uuid": "e14a92b2-99e2-420f-b9fc-a46d7412b57c", "comment": "Malware payload (RedLineStealer)", "value": "10e860876be173668ee1779f79b3fbba4ff5a0b1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707071659, "uuid": "8e6d9ea6-462c-4ec1-8afb-f7c23fb65e6c", "comment": "Malware payload (RedLineStealer)", "value": "01ff0ccf733975c684f6e0f27779c867e3371f8dbf5bacb157b1a2efb4b76a80078686049a1a8b1be8efe053bb9b9896", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707071659, "uuid": "bf04e790-6a43-4358-a118-866d1fc7154a", "value": "T12E945D03C459A6AAC187A43E7F711A517135F8428B3206B2BA7ED975BFAF1BB3534304", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707071659, "uuid": "2bf2516a-1d0d-410d-8652-1aab6ae39f5c", "value": "382a4d7b99200ee7e9686d1f1cde0258", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707071659, "uuid": "2c27b8d9-a83c-4237-8dc5-39ee96781c5d", "value": "6144:dl7ILVRgXCtUqJI3O4JrDCsIFaDsxP66ZRoyILSfQ:HcLwyKqJI+49jKFP66HIWfQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707071659, "uuid": "bf0fe99c-992b-4494-9e45-f5d8dfe64fc3", "value": 428544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707071659, "uuid": "01c74a6b-df0a-4bd5-ba37-f128ea6431bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707071659, "uuid": "eb1dc842-0ed9-4084-b5f2-e10b577d36e6", "value": "0fb1f243d0254aec7a1f00afa1be6154", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74d6630d-c369-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1707056819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707056819, "uuid": "3df56b26-6338-4161-b853-1a5586cb0bc6", "comment": "Malware payload (Stealc)", "value": "e3a7a1f3322bad231e8e81d5e78452ed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707056819, "uuid": "f28d0f72-0bfb-4f74-a2fb-540f5553d378", "comment": "Malware payload (Stealc)", "value": "ff7167a57007b5368518b03e82ae9110aa55ba9e947719308a416f3aecdc75e1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707056819, "uuid": "b24e69ef-785a-4361-9dfc-0e8fc0b539af", "comment": "Malware payload (Stealc)", "value": "66b161168b4e03446fa6f1d5f5bf4b0ce8da6f05", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707056819, "uuid": "16ffbf2e-6e54-4cbd-9204-05c582a47433", "comment": "Malware payload (Stealc)", "value": "557615efa93fa4ecc373d1b7ff5873700bf0be145dd8627736d84892983ae394c082b14429eb7b91c28b63f233f87c04", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707056819, "uuid": "470e8847-8575-4dbe-b77e-5a65a37b4a2e", "value": "T1ED447C1033E5D031E2B756345AB0C7B54E7B786376739ABFBA91263B2E347818A1470B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707056819, "uuid": "20f26c2b-44c4-48cd-bc06-aa9ce25dd5c9", "value": "98be55e334636f2b313f62420192c2b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707056819, "uuid": "e41da125-9d92-4c07-b277-0f20fd0b0c17", "value": "3072:uLpISZhvIWX20528m8u1GWakdKjuYjVL1BQ58Urov0dRRjxM6P0s4iNx1FGLVc:SuSZhgWXPWPvYlJv0f41sEc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707056819, "uuid": "37d20cb0-9e43-406a-bbfe-f5f359c96f6a", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707056819, "uuid": "f5ce6419-08bb-4ad5-867e-9a94e81c779f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707056819, "uuid": "388abdf6-9b80-4a3f-8b90-22bfa4b3c39b", "value": "e3a7a1f3322bad231e8e81d5e78452ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }