{ "Event": { "published": true, "date": "2023-04-20", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-04-20", "timestamp": 1682035382, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "c3cc43b3-a57a-4aea-af5e-14d0d526ae65", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "295237a7-df87-11ed-88f6-42010a9c006e", "comment": "Malware payload (Fabookie)", "timestamp": 1682000712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682000712, "uuid": "0dcc9eaf-5550-4bac-a743-86720ab0d390", "comment": "Malware payload (Fabookie)", "value": "a41a6ac1f465981ddd378cbe85e6e5aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682000712, "uuid": "39859e2e-5df8-4fd3-955b-10ea764ff9fb", "comment": "Malware payload (Fabookie)", "value": "00be39766b1a091a3f59c367143d21d511991a465c8eb0a39c907d4cd398c90a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682000712, "uuid": "2eafa7ea-630c-4cd8-a026-99dd44b28372", "comment": "Malware payload (Fabookie)", "value": "d5bd3d9a46f165c12814344379a1afee1af762cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682000712, "uuid": "c323627f-24c2-40c3-8411-f2b5c765124f", "comment": "Malware payload (Fabookie)", "value": "05bbad782065efcd6b7663207fcb96ce0003a8e29b8d417ec663e1e519dcbe1ed1d350766a1246c7247c2acf942fe88c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682000712, "uuid": "16b36bdb-7bb6-4479-ba6e-0ef857adb2bf", "value": "T100C4E8A7F6600EF9C0BF8271C4B65776EBB27A8C4610870F0560E7326F171655F2AB86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682000712, "uuid": "c61aa022-ea11-4534-81f5-ebc40d7ff083", "value": "631fdb37f5587bb06fab5c930edc4a1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682000712, "uuid": "7dd547fe-40f6-4a18-8228-909c2d9c08e6", "value": "12288:z1/jIWMWMYzh6byzPNMf4in4qFPddnlpKuooue:z1/jIOMYN6byxo7BRdhXKuooF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682000712, "uuid": "088cbc38-2b3f-4a0f-a4d1-bb63b813ed27", "value": 558080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682000712, "uuid": "7115656d-6f7f-49fd-9b43-04ef8988efbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682000712, "uuid": "42b9cd4a-c289-450f-a330-acc78fd81567", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af4a4d30-df24-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681958417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681958417, "uuid": "02920c8b-dd19-45d4-8ff2-16b12c9d7025", "comment": "Malware payload (AgentTesla)", "value": "5cc0c336fc38231f8220dd959fe7ccee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681958417, "uuid": "27a13f28-270a-4cf2-8cf1-a9d59e451c85", "comment": "Malware payload (AgentTesla)", "value": "010493b98e6676ace7201480f106d8b348aac9118755a5f55137b410dbf31d0c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681958417, "uuid": "c84e568b-5e06-4162-b76c-08c61d079b41", "comment": "Malware payload (AgentTesla)", "value": "62c75a782b20545b29c879bc8c3f6307dd588111", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681958417, "uuid": "f3544580-8e04-4db9-bce3-589b8a4083c9", "comment": "Malware payload (AgentTesla)", "value": "c1ab93d49b77970aa315cc216e698b1dbf482a8de6089fba0e5951b73bc01576e7f9b593bdfa02a16b85cdd3874e0522", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681958417, "uuid": "a9d4a717-e2c0-472f-b9c2-ddbc0d97c0bd", "value": "T163E4BE1E71639F46C26EE7F610A468713BB06283366CD27D6CC743DB9ABAF01068475B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681958417, "uuid": "5761a5fd-5bd0-44a7-9d26-2769ada7a3bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681958417, "uuid": "2cda4e94-3648-4451-8e84-6a4a1977f5f7", "value": "12288:Mg+Voi1HDSFR7XFHgAIa8PHWm81DNCdGKOotgtUG:VSHDah8PHWmmuxCU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681958417, "uuid": "1bd34a73-d4c5-4909-8d42-78268157d5a7", "value": 703488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681958417, "uuid": "1ad1c530-e528-4a5b-9495-862d6925835b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681958417, "uuid": "99cd7e80-19ce-43e7-8efb-9561a0ffc495", "value": "5cc0c336fc38231f8220dd959fe7ccee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "311461f6-df3c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681968513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968513, "uuid": "5ff61421-ac52-4fc4-9aa4-2cffecf08129", "comment": "Malware payload (Formbook)", "value": "c1ddc7e96d1bdfc49881c4efb2876d8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968513, "uuid": "aea19a58-d097-4e40-8175-783b186d2fc9", "comment": "Malware payload (Formbook)", "value": "0154b955f0ee502829f50c158db51bad7b0c459310cff2ec5bc352a2e0e375f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968513, "uuid": "a81ceab7-da42-4ea8-9fda-d85d57d8be3b", "comment": "Malware payload (Formbook)", "value": "bba6fcd71f92573e1958ae46e9c8fabf47c89739", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968513, "uuid": "6c7a2c29-e426-4e19-b3f2-31183e53a28c", "comment": "Malware payload (Formbook)", "value": "5c92e356be00b787785d1be01160c558a15cdee45fd9d2fce8a591c66dc85a7ce45fac17f88f6e39b000321e9e8c0a5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968513, "uuid": "a91aeaf3-378a-489f-a0b8-d3e3d9bf6070", "value": "T1573623646671F924E51C163880B383DC6A273E657177EA0E1B893FCFB2FCA1D162D606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968513, "uuid": "387554a2-4a89-43ff-87ca-f239c956458e", "value": "98304:evND3SJDUPU2FhdM61ZbdjND3SJDUPU2FhdM61ZbdBy:evNjwJebM611djNjwJebM611dc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681968513, "uuid": "59f50228-7489-4bbf-b01a-84b72759f664", "value": 5180928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681968513, "uuid": "0b921b0a-abca-4142-b9cf-3e41e9a2e7ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968513, "uuid": "6385a1f2-15e2-479b-9557-0da6f5233189", "value": "c1ddc7e96d1bdfc49881c4efb2876d8d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44e4f98f-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681985726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985726, "uuid": "348079e1-e92e-4e17-8371-a18da0752ced", "comment": "Malware payload", "value": "cafe03b458aa51d67329d6b1712aa5c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985726, "uuid": "7105ad5c-7f16-4fa1-aa08-b345b0d6d571", "comment": "Malware payload", "value": "01ac1b6c7648c468057899db5dabf48936e865ceda52f126705d31dae266e742", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985726, "uuid": "e6a262a1-cd2f-44cc-9df8-7058ff90d141", "comment": "Malware payload", "value": "4bb5e308532e04f66e1917170e8e05c3c484bc7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985726, "uuid": "f1f23d33-8b07-4b55-b160-80318283ebff", "comment": "Malware payload", "value": "1dd3374b7d43416d78cdb6bf47b67e2ec8e259266042f4689c8a2ad573a60b08ccdf819faa8ae385e0cd0cbb14212eb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985726, "uuid": "1e3cf6dd-dc82-419e-bd26-c0cbf78bf062", "value": "T1E9632B12B7C5B470F4B159303ABA62724479BC31386DE20DB394C56E2EB0A86DE75F27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985726, "uuid": "e46c227c-2ef2-4782-9624-b619d57bb53f", "value": "1536:vY5qUgq3rd9VmpX3Yzd51P9RnBtODuq/5NKAnDgvfBv:vY5Jbd9VmpX3Yzd51P9RBtODuq/L9nDo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985726, "uuid": "34e99fb8-64cd-4179-a360-a8e2136b686f", "value": 73216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985726, "uuid": "cf5b09b7-95d7-4c5a-b183-873e828089f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985726, "uuid": "0a0c76b7-8654-460c-8219-78c8481f626e", "value": "01ac1b6c7648c468057899db5dabf48936e865ceda52f126705d31dae266e742", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17dfff22-dfb0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682018292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682018292, "uuid": "a4d5664a-ea46-4c09-a63e-6b8cdd76436d", "comment": "Malware payload", "value": "d41250dc69054e1d90f15970de7c9411", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682018292, "uuid": "59ccadcd-d803-4fe5-87ec-2a586061db26", "comment": "Malware payload", "value": "01ed842cef344a588e649c6f70d4b8081c5855a55decd201930ff5be959b2231", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682018292, "uuid": "72c2007c-0104-46b8-bbd5-43c91828d2ae", "comment": "Malware payload", "value": "a4b0ebfbee8ac0b0267786239b7e7e278c7016b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682018292, "uuid": "0e895405-b169-47e9-8eb8-0eff34e8f61b", "comment": "Malware payload", "value": "2494bfe50f082cdfaf38a77375f4513377886bb62d4f946d0c0648e8a95e632a3211cb68b4c35355f5ab5cd1b2059d5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682018292, "uuid": "908276e4-759d-4896-84ed-6690ef2a6d6c", "value": "T1A923F8987D648CE6F592233D94FBC3BB577CF18186275BA3BB24B63417233922894187", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682018292, "uuid": "49dc353f-2623-4958-b3fb-ce30a2b360e4", "value": "366cdc4fc745c0a3537cd5f3308919d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682018292, "uuid": "382e01a9-aee0-4b26-b6d8-c335834d399e", "value": "768:ROL8wUQkx7Rmgx8rH39Dqc+D9XWNdQIPXBvItsGK:RIUQk1IHtDqc+5GNdQIPXBvbGK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682018292, "uuid": "4d33e573-83a1-45e5-b316-27b278c9ca7c", "value": 46943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682018292, "uuid": "ab083659-f41b-4d50-be00-1796feb78341", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682018292, "uuid": "e904b3d6-91fd-403f-a9a1-53844c6f9faf", "value": "iplato_popup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e575dec-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681985769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985769, "uuid": "bc75faba-880d-4e19-8875-92a0669b4432", "comment": "Malware payload", "value": "78bdec71f37292fa32c6481ef8147a6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985769, "uuid": "b135db52-c058-45e2-923b-f719bc4589e9", "comment": "Malware payload", "value": "0235fde564274ab1f0426100b8fe9f261a0e47cb882079f6caa731679355297c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985769, "uuid": "f60395bb-cfc0-42ec-aa76-aa2e2825a9dd", "comment": "Malware payload", "value": "24d75e8aca0414826d93da13f3452ba597b2be57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985769, "uuid": "4593b7f8-76a6-48de-817d-a409372c87eb", "comment": "Malware payload", "value": "484cbe79a291b1c3d1b63126a9520ecdedfccf5465e51aae868fa91a1b7af8b1a76b027c12986b175a1500dc8788fe94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985769, "uuid": "c555f1b8-e226-4017-ae80-97c13eb34a16", "value": "T1500429552BDD4CABFD00873E6191962B29397693C64E43E2D6207A304F12BD87FEB11B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985769, "uuid": "c7b6dc8c-ca7a-4e07-98d4-ebbcf0ee97ab", "value": "a808411a04557309a9c41f351b379c88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985769, "uuid": "ffded014-fbd8-441a-a11b-9cfaf346bb3c", "value": "3072:aaXYFUEZ4RiKAXAbxb+Bt43EaZl/jL+5pUKbzhDZTKN8BwY:uyVAX6A0rz3+5pUKbHTKqmY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985769, "uuid": "3de65c50-8476-4374-b405-f01f7d4a5f2c", "value": 186151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985769, "uuid": "0357f4e8-8a73-4b3c-9d90-fc8bb24d35d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985769, "uuid": "3b0aa578-3178-4b52-8280-8a016dd7571c", "value": "airsofttotal.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "301ba6ea-df13-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1681950902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681950902, "uuid": "09a6ce21-b2c1-47b6-bffe-947f41060736", "comment": "Malware payload (Amadey)", "value": "85688cb5a05ad7e0f9ba893809929d10", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681950902, "uuid": "255d9709-9c3e-4531-8945-4d64e3cd843f", "comment": "Malware payload (Amadey)", "value": "03862212be75885b6aa2ae3209de23ec29737d431c53307308f2b93d9cf0a4dc", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681950902, "uuid": "5277226d-1dc6-4097-89f9-708c8ab11f11", "comment": "Malware payload (Amadey)", "value": "3cebe7367dbd1e54eabea2e5ccf48ab653cf6250", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681950902, "uuid": "290c4ca4-c337-4602-a660-7d5325e390fe", "comment": "Malware payload (Amadey)", "value": "0b27356e953016fde8478f779d97288420837deb1ccf0fc03e5975d5f1612bde36af5bd5c88162dab103b681ca95124c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681950902, "uuid": "0fdf9ff5-8b21-4bda-a808-e46480b3d4b7", "value": "T18E35231792DC8877C9B417F408FE13470A367DA55B75838B3A8A1D8C28B37C865B277A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681950902, "uuid": "8d8e7fff-cd14-4489-af9d-6facdbcc33ae", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681950902, "uuid": "62cdddc1-4e49-4646-bae0-2c1d092c225a", "value": "24576:6y5Nx+KG70mJWLrPddDAUHOx7AHbt8hkQjDEi8hBvk8h6tuoTDAI:B5KK0NJyPddDJHOx7nk2DUjh6b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681950902, "uuid": "4d722a1e-c2bc-4afe-8c09-ce43d59995bf", "value": 1138688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681950902, "uuid": "7f79d8e5-2221-4886-b728-22b4ef634da9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681950902, "uuid": "47678db4-100e-4c62-a989-4943e6579a2a", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f52923f-dfc8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682028613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682028613, "uuid": "a9cd5122-5d54-4046-9a61-2f6f05a7e64f", "comment": "Malware payload", "value": "9bd6b1f24b9589a3fbc1d54b6e6184b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682028613, "uuid": "007c73d1-c215-4b7e-b2de-4c001822a23f", "comment": "Malware payload", "value": "03a9d6afc99e70333723d921bd1265ac948cdabb8b15689b5ceb1c02365a9572", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682028613, "uuid": "0f616868-c570-4c40-8f13-608975fbc4ea", "comment": "Malware payload", "value": "f8473c6c8b298a3d72c8ca890667eddab62d2ba8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682028613, "uuid": "a4fdd3aa-eded-43c4-aebc-33eda1798524", "comment": "Malware payload", "value": "e2c96c160fdba9b3612a88e98a56d4b9288de07fa85da371b83882ca539d556814531c814f45d915c5767cd864217959", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682028613, "uuid": "0b4a5035-b537-45da-8104-ae117a9548bd", "value": "T138C49E10E540E036E9F210FD86F7D2B9893D6720136555D7E3C83ABAAF615E0BD30A6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682028613, "uuid": "e8b43269-585e-4739-a414-72b7e99a160e", "value": "cf4647166bef30af0359c0044653adbd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682028613, "uuid": "fde96c3c-6c74-49f7-8661-738502d4254d", "value": "12288:r44xG36A38gfmYzEMbvYYU7CrJdJWTd4pb:3xG36nkEqyydYTd4p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682028613, "uuid": "7bed7c85-a533-45a5-94cc-0a5b66bedf10", "value": 553984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682028613, "uuid": "b1043e88-954e-41ce-bde6-5daf3ebb9640", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682028613, "uuid": "15e86bdd-15e1-4f13-9248-073907a2ac0a", "value": "lsass.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "940649a3-df58-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681980705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681980705, "uuid": "52543742-9969-47eb-aed0-ecba9af71935", "comment": "Malware payload (Mirai)", "value": "1d9dfae5d5900e3f703668623670d31b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681980705, "uuid": "3a8a956b-22e7-478b-b8e1-e99e8efc573c", "comment": "Malware payload (Mirai)", "value": "0429bbf8a5adeedac7fd235bf5bbb82bb748d1a1e7eb9aaa54ffa0c15965711b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681980705, "uuid": "a7efa673-46a0-419a-a157-0a8d4341eb43", "comment": "Malware payload (Mirai)", "value": "b677e2bbb3064286a66ee14e47dc804f78bb555b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681980705, "uuid": "0d960759-c341-41cc-a20d-b72bbfa06d11", "comment": "Malware payload (Mirai)", "value": "ef8402899a59353508811cf3813db3cc92cf74e6a994b33785c82aa5738fbd0cf34fc1790be4998463a267fbb5e1a48b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681980705, "uuid": "8a5b1a28-684f-4511-bd79-ba69a1208199", "value": "T16183075AF9816B11D4D926BEFE0E1189335357BCE3EE7112DE204B2037CAA6B0F76512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681980705, "uuid": "5a24e233-78af-452f-874a-b1047d8e5029", "value": "1536:XUn7/fgAKGKVKZKMK/KiiDUdoqMj4g+aaKZCjnMSQdlVui/+Pr8BY79dP6J:wjKGKVKZKMK/KiiD3qMjz+aaKZCjnivY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681980705, "uuid": "e0f8d30b-05a9-4385-b053-f92d63ca07ef", "value": 87568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681980705, "uuid": "1331c9f3-d9ff-41da-9d22-99882861a268", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681980705, "uuid": "a900122a-ffef-44be-b0db-ef83c94ae3c0", "value": "1d9dfae5d5900e3f703668623670d31b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64c3fea8-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681985779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985779, "uuid": "ffb1a16f-1a71-426a-b359-dc8f54ece038", "comment": "Malware payload", "value": "0734e7fac7b8d9a83db21b418cf9c73c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985779, "uuid": "0d9a64a9-263c-4273-a6c6-2364be26f8ba", "comment": "Malware payload", "value": "054ce96080773ec36ec7b434d88811cdac56c80c26a136836c77d45c954e93bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985779, "uuid": "1859afa0-495b-46a7-85b0-a64f685c70e6", "comment": "Malware payload", "value": "e7fe0c423ffc6f4fbc766d38a6df981f2a8a1f6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985779, "uuid": "cf48073e-876f-4f22-be3e-dabf477e3525", "comment": "Malware payload", "value": "61d29ba3d52e24877974230074a4fc424a99d402435b12b5b5527f58bd82bc83636bbe45e74ef6dc9028be6a3f579a8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985779, "uuid": "0c4ada76-4e82-4a71-b818-774faad03b6f", "value": "T1F7D3E326BD6F1726E4030FF00CC925F97E2AFCAD322299707F65409D08C255DA59EB2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985779, "uuid": "8aaedcb8-ec5b-4941-b4dc-ec33ac12a520", "value": "a808411a04557309a9c41f351b379c88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985779, "uuid": "33028859-1bda-4bb9-8dc2-e955f3aa9500", "value": "3072:uOjkfoDiMukGPNGjuUVUWGDvisSWKWnM9:kfgiHPNQVU3Dv3+9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985779, "uuid": "c629854c-3dbc-4b52-9dd9-89c35617907c", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985779, "uuid": "bf83dff2-8b8a-459a-b4f9-a6f930208c6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985779, "uuid": "4ecfea6a-929e-4f07-9165-0e9837ec35c5", "value": "beszelve.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fc0fa6f-df33-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1681964591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681964591, "uuid": "afa649bd-9f4b-4058-ac0d-dc5d933d8d59", "comment": "Malware payload (RedLineStealer)", "value": "77a5d8f54f781fbbc4a00117ddaa427b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681964591, "uuid": "423e38ce-f6e9-4186-bf2d-a701d9dd98c3", "comment": "Malware payload (RedLineStealer)", "value": "06703aef70da23ee941e202033e330a6f3f9d8bc52eca3ac4917cb8654a98095", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681964591, "uuid": "d0cad578-79bb-4f46-8812-53809aa01ace", "comment": "Malware payload (RedLineStealer)", "value": "aa0bb166c3fedf9f9db70df721c50f7eaea0ec34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681964591, "uuid": "8d5e6e49-ad7e-4e5a-8f43-c649fee2b54d", "comment": "Malware payload (RedLineStealer)", "value": "eee1b4e8c8de164eac9a315a36fff60e5d1e589811b02480db287339220c1e63becd4d159dc83d0a2e32cdac2208f1f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681964591, "uuid": "cbb87656-f6ac-4303-ae2b-ebc1f161d70a", "value": "T15874F150B7E1F673D94B12751820DA95AEFEBC909644418B37193B6F3D702D08ABB32A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681964591, "uuid": "d3ee1fb4-aee4-47f1-950b-d7caadb68967", "value": "6d86aa147518c9f783875b9278e5ac78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681964591, "uuid": "8625c457-e793-4039-8c10-284d5296ea89", "value": "6144:wgOcET0UXS6FQqSJ/Qc5KfP6RyMhBtK+dO4esT7Ig4/ve:1OP0B6IdQsK38yMhB42O06", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681964591, "uuid": "f703f718-411f-4fa3-b599-f10effc21e13", "value": 369152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681964591, "uuid": "80030a23-6970-44b3-bb39-edef0a2f8928", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681964591, "uuid": "52ac71e9-3df3-40cd-b8c7-6d91d4076650", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ac0062a-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681985816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985816, "uuid": "c6285523-58f0-4688-82e7-c499aba0d084", "comment": "Malware payload (Formbook)", "value": "e9b13f953a1b88c46b1baf14578d785d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985816, "uuid": "b726a943-d8d0-4e38-94ae-c8c483744dac", "comment": "Malware payload (Formbook)", "value": "06aef7984e235a2877ea9fa1ac04b96104f8caa5b2a4fe61ef1ec98077f40567", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985816, "uuid": "ebc48567-fa86-4ede-9429-a0e4875d6f6c", "comment": "Malware payload (Formbook)", "value": "ef4675ba0db2c53aa33632a1f22b423bfdc79864", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985816, "uuid": "61a69260-2761-440f-abaf-601d021c6c95", "comment": "Malware payload (Formbook)", "value": "149706954d10155e6374d193084826d03f2e6dd19f674ddc01fb2ce819cf2dd04e4f77b0d2610e559cbd2810db32d5e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985816, "uuid": "157f5bd0-adce-44b4-b656-35f4fafa7b9a", "value": "T140B4F10495F888EEE178C1B20C95B98DB6137C5A9C214E864E13F9EDF933182267BD5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985816, "uuid": "483dca93-d69a-4699-b3f1-4540a7cd3bf9", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985816, "uuid": "d9c61a19-a5df-4f80-b54c-e9e60f2e61e7", "value": "12288:sYi8Yt6seqXYVlQXn0y2BbvFQaWD2S6O5:sYgt67zTQXndybdQaSxP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985816, "uuid": "df606345-932b-4c47-a4e1-6897ff25622e", "value": 500693, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985816, "uuid": "b20b01ad-1e54-4bfa-a18e-3635993d722c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985816, "uuid": "6f660d2f-92be-4d91-93a7-836f982271aa", "value": "ORDER NOTIFICATION_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89ba3bdd-df3a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1681967803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681967803, "uuid": "74fce204-0043-4eb3-9ca0-b2be5592f0db", "comment": "Malware payload (Smoke Loader)", "value": "c3b2984fa39626efdb3a7a43018e8179", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681967803, "uuid": "c7f8be89-a85c-4c20-aaaf-10823f965afb", "comment": "Malware payload (Smoke Loader)", "value": "070f7bb8630046f88c04f87a3416d713b66f5e75b84a65096561c322c4b60018", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681967803, "uuid": "39d15f70-acb5-455c-8a31-b74ab2db4f76", "comment": "Malware payload (Smoke Loader)", "value": "6c8f2e0d9e4bf7fd090db2cabe0fe9446630e8cb", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681967803, "uuid": "109f135d-512b-4bc0-a3b3-89a8c88d5737", "comment": "Malware payload (Smoke Loader)", "value": "6a852130453f8f8333e89dd91d9aef2687fac340fbd5c8ce47044c3800411de7ff12442619e9f40bf36aa9f041d59262", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681967803, "uuid": "9535dbe4-525f-4b7c-aad9-d8769c160d73", "value": "T10A34D1317AA1D8B2D85BC8B55834DAA53D7A7CE18391859F32183FAF2D303D18A77316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681967803, "uuid": "5e4e6c5f-6f54-4514-8d25-843ce86c25d6", "value": "d76f139ac2e472c829d3b2911d8e5893", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681967803, "uuid": "0704e206-e423-4916-86d8-6295c362fe08", "value": "6144:vPaJdKbchEOffOkYvrPH/f4jScXM/g4/ve:vKK4CO3OBPuxXW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681967803, "uuid": "e590b092-4ab8-4fe3-ad90-3fca23cf3247", "value": 240128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681967803, "uuid": "2228a148-4f2f-46d5-a9ab-5999a2054445", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681967803, "uuid": "da95d239-8f5a-4e26-8851-0f72a70e52f4", "value": "c3b2984fa39626efdb3a7a43018e8179.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f0e86bc-df61-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681984347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681984347, "uuid": "34a0bb22-1ab3-46a6-9f32-c0213c032b1d", "comment": "Malware payload (Mirai)", "value": "329990c316f863441bf09c5c1d9130db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681984347, "uuid": "45289782-f49a-443e-aa61-8ad3294330e9", "comment": "Malware payload (Mirai)", "value": "07780cabf0f0649dd7bd670bfb4c3c9e28e30f65c8b471a3a6da230d3dd3b353", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681984347, "uuid": "878e5548-da83-4896-99f8-85a3684d23f6", "comment": "Malware payload (Mirai)", "value": "4f994d83fb4bec6d9a15e58d41f42028588660b5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681984347, "uuid": "bb11851e-de45-453d-b543-a619ac5be910", "comment": "Malware payload (Mirai)", "value": "2fa60077ba909127b35b9570fddc8ecc3d05ad18586069a5af31d7207366c95b53f2e64a3341822d8c3742c2055f9284", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681984347, "uuid": "75f9d1a2-f52e-4ad7-9e90-9ad5d75fad28", "value": "T193137C7BE4AE5E54D0460230B4689E341F13F6C493436EFB1DAA82A15487AECF905FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681984347, "uuid": "4ddbdddc-73f0-44c5-a895-f1d42e313679", "value": "768:eaRH4ge4hYyFDinQT3yMILrvs+de8/C3o9ufR8C/ww:eaRYghh/FmnQyMiI+dB/f968C/x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681984347, "uuid": "d48d2f30-286f-420a-9ac1-3640beb9c5b1", "value": 41980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681984347, "uuid": "ed3915da-4d89-4b77-885b-c23717434076", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681984347, "uuid": "282348d6-801a-433e-b48d-89ed2a34bd1d", "value": "329990c316f863441bf09c5c1d9130db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45ab471c-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681985727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985727, "uuid": "2fa5b467-e546-4543-9a8b-76279221cb75", "comment": "Malware payload (Formbook)", "value": "c8c79a69eb143a1a7b7fd152143a4d90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985727, "uuid": "9f5d81c6-51f6-4e39-817d-5d09ef1632a7", "comment": "Malware payload (Formbook)", "value": "08844badf5c2bdd4dc6da38cfd0d774768efe5383f2a10ab811ade9e6c1c0eec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985727, "uuid": "71e8634a-1126-4e31-81ec-60ef66cda0ff", "comment": "Malware payload (Formbook)", "value": "011404cd67f49a5983d47b5e42f5ad56f273e86c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985727, "uuid": "6fe28685-97c8-4a1a-aba4-65b63d7684ff", "comment": "Malware payload (Formbook)", "value": "8212b9f343cd7e0fe2f7eac4b7bc5f76c34b8b456d23105b9af51b6f07a71f29765ad14a39df21e70d7cd236f70fe5be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985727, "uuid": "21a57e8d-e871-406a-bc11-cc8cb6b2a9c9", "value": "T1C804AE32D641C031E2B251B5F6BD0B7B883D0E343295A4EAA3F619E16EE45A5F43931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985727, "uuid": "b0e45934-fbab-4b2f-93b1-8ae9c44c457c", "value": "3072:Q4PEixFNc4m30iFoXjqApJffiJWZLWp5fD04:vxQ0iozqApJf68ZLQ5fD3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985727, "uuid": "cb6489fd-8b9e-4fc5-a9bb-34d77eed4202", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985727, "uuid": "8dbd774a-d918-4ad7-84bb-10dda4f7a259", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985727, "uuid": "d8f1ec22-6d5f-4e7a-b1af-753a61ff7455", "value": "08844badf5c2bdd4dc6da38cfd0d774768efe5383f2a10ab811ade9e6c1c0eec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f9160d0-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681985797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985797, "uuid": "d532ac8c-e9b7-4230-ad34-d786d66f29b7", "comment": "Malware payload (AgentTesla)", "value": "99d21413de1de7348089184f319ad6fc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985797, "uuid": "3b9b4dd8-29a9-4c16-8323-22daebd76a2b", "comment": "Malware payload (AgentTesla)", "value": "092c894a726504aa35af4e5b0ddb81738403a24556d4c86f3e9d404d63bd7f10", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985797, "uuid": "2140a49a-5507-4097-86f9-cbe1fe4de4d1", "comment": "Malware payload (AgentTesla)", "value": "dd5f084e20bf9ae3d87d09c87688fea3f764bd4b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985797, "uuid": "eeb03357-4d9a-4581-9498-71b050d86935", "comment": "Malware payload (AgentTesla)", "value": "70dd7bbc617ad4ffa04984afd92e96b7b5ec1d707ee20879642901b9dfd4ab560d5fb66d18d98a8c37202e59bc33f786", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985797, "uuid": "c16508cc-479a-4a9d-ac38-5af4a9d23757", "value": "T12BE403243301DFA5E6754BBD0D90A54057F63731355EE3AE2DCD22E5BA833224A07ABB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985797, "uuid": "0bdc7d74-02e9-40cd-b1fa-280f02f22a88", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985797, "uuid": "6d5052dd-d41a-41ca-85dd-75501d921276", "value": "12288:2nc86X50dLStbVOREechoZSitWpkrn9Adb:S6p0d2tsR0qZ5X9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985797, "uuid": "1af30f62-cf7c-4725-8503-0c3aa5c78df2", "value": 669184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985797, "uuid": "acabf9fb-90bc-4f5b-8c72-7332d64eb071", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985797, "uuid": "49979eae-35b9-4584-91b6-f633d8cda078", "value": "IMG-Scan_PO_#KRMU6644555 - TUTICORIN _YMHG & OUTSTANDING SOA TILL MARCH.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c65601d-df5f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681983537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983537, "uuid": "96f26992-60c2-4d9a-af1d-9941b5a56c85", "comment": "Malware payload (Mirai)", "value": "d0ab8c98a19d5da204fac1eaaad4e41f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983537, "uuid": "d7e22159-ac0c-44b8-94a1-6dd66fb7f002", "comment": "Malware payload (Mirai)", "value": "098d7ca78f1b6ab8b5df92463f4743a692b19f981a6d738fb27725a77ad7c80f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983537, "uuid": "40aec565-1102-4180-b639-4382e066ec04", "comment": "Malware payload (Mirai)", "value": "035f9c8d43eb0cdc29d4671973167c4241dcf673", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983537, "uuid": "3c080dbb-fb34-4790-af63-94c91505899f", "comment": "Malware payload (Mirai)", "value": "e13f4bcf7f41dcf8cf220ed41d2e0688e3a8a2d106425bac851128cc49bc8fc2eefddc2ddbad52314aeadac09a542f84", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983537, "uuid": "7ab053a3-548f-4fef-828f-4cb7b8f9c53a", "value": "T1CF44D744E9245F7BC3E237BEEA59428E723A1FA477EB72154E306A7433D8F592139120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983537, "uuid": "fcb21eb4-2933-480e-8b31-d3113d128fe5", "value": "6144:MbWIOfgu5APUupacES/J+JblTqWmf3kS178zt6:mWIOfgu5APrpavoJ+JbIWmf3kC78zt6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681983537, "uuid": "03e5be19-ad58-4c22-a746-64580f472855", "value": 260337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681983537, "uuid": "3991bfdd-994d-4f10-ab41-71d323ca7dd0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983537, "uuid": "0391d72d-cf6f-4428-ba8e-b8f736e1730c", "value": "d0ab8c98a19d5da204fac1eaaad4e41f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a512cf85-df6e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681990182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681990182, "uuid": "a04bb9f9-a15b-4afa-9a07-7d8ceaa98c6d", "comment": "Malware payload", "value": "a1eec1f584edbe77da43cfb5604ac33b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681990182, "uuid": "50429d67-9e5d-4f8b-ab80-6238c645b652", "comment": "Malware payload", "value": "09efeeec04d9e1d14ecf3bb656b47e1ea4bef242689551ef558ee9f073431c53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681990182, "uuid": "7a107cec-7767-49c9-a24a-c08d43da38a2", "comment": "Malware payload", "value": "50bd7086352d022bc1c89df5ec13d59d0185218e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681990182, "uuid": "0dc57aaf-ccf8-4591-a679-4a913a5c3ded", "comment": "Malware payload", "value": "244887d1fd8e4b7d81e72b653b4534ce5b45592e91acd7060e67a457c670f6178a1b7cdf23a1acd3d8bae60b2354afec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681990182, "uuid": "ac44391f-9195-4a66-ab5a-04c8487de6c5", "value": "T1D0263362FBA700F7F052753E255427696AE2C4799F6E68EB659811033C224C2C43F8EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681990182, "uuid": "cc7b7a44-9f70-4c91-ae1b-8488db76b98f", "value": "a1a66d588dcf1394354ebf6ec400c223", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681990182, "uuid": "b3c4cd3b-77fe-417d-91a9-7f0b19b974b6", "value": "98304:W5aFLmvjA0+cCuAmKnRNYuoV5+Q8/8jDPCXFeDtV+O:W5aFLetkRNToVgVI7CXFeDtp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681990182, "uuid": "372d9010-a1f6-439b-a77b-cd0ee98de6ea", "value": 4683021, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681990182, "uuid": "0fd6804b-5b60-4351-856b-7af965e3c9a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681990182, "uuid": "9ec0d903-e71d-41e4-a9de-c4acb82372ce", "value": "09efeeec04d9e1d14ecf3bb656b47e1ea4bef242689551ef558ee9f073431c53", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dd66511-df7b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681995700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681995700, "uuid": "09462040-738c-40dc-8237-5424719fc8dd", "comment": "Malware payload (Mirai)", "value": "4aaf69c52366483f168509ffd27d72d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681995700, "uuid": "f1e52a29-9c18-4001-b3c0-4820c16d42e6", "comment": "Malware payload (Mirai)", "value": "0a0d544567fd689b8d1a567d06444a7907dd45e42b97b089273c80d28887a2ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681995700, "uuid": "e076973d-db0f-4fc0-a89b-2824210115fe", "comment": "Malware payload (Mirai)", "value": "48a703f7b61139eef3d5ec98f411315ab4bee5e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681995700, "uuid": "77ce0016-99c1-4c70-81a2-9814d83f0c01", "comment": "Malware payload (Mirai)", "value": "62ce8abfb9973897c26ebedb52b0e582ba1bd3d8276641288ba940e60620d8e70552475c37b7864d62681f1dc662dd25", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681995700, "uuid": "a3f4b54d-f465-4fc9-a7a9-42a70f750adb", "value": "T180234BC49A43EAF5EC120A7420B7FB335B37F07A5159F987D3659932AC42B11A20B2DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681995700, "uuid": "fa5f9c59-9ed3-403c-a116-83e78672a007", "value": "768:c8/MjSNW4GBs82WELXamRfWzqNYeZjCpFEwaK3g+ZdG:c8/MjSNW4GBz3ELFdNYewpRaK3hZdG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681995700, "uuid": "70f68d14-4567-44e7-84fb-92657b7f58c8", "value": 46640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681995700, "uuid": "fec51430-32bf-413c-b096-97331546de99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681995700, "uuid": "be81e7e2-b8e2-4a93-8f98-4e9b12754e2c", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94406482-df4e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1681976410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681976410, "uuid": "dd6266bf-0935-42aa-9628-a1128e564759", "comment": "Malware payload (Loki)", "value": "d73faabb918bc8ac100ffe67140fb46b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681976410, "uuid": "0ba3db62-5240-4c48-9408-af62a97d2490", "comment": "Malware payload (Loki)", "value": "0af4bdeb4de3a9f8cac5601c872cd4d9a7e9fb06a4fc0a7ed4fb60d6cb64b957", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681976410, "uuid": "c0bc0ae7-4bc9-4ee8-937b-8eab6fdb85fc", "comment": "Malware payload (Loki)", "value": "484e73dbaed1e364b9befedb74b9b42666d577b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681976410, "uuid": "55ac2b02-3554-47d1-927d-e5a17d719998", "comment": "Malware payload (Loki)", "value": "49a2929facf2ec910db16f7d4f464f790589f07f24487b23ab38628fa6096a328be0d8307de085c88eda47c3479d90a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681976410, "uuid": "8300fc7a-5b78-4a8d-85dc-da0d0069082b", "value": "T11EC4E0C95756D7D2C2353D7D126A71783F7044DBEA5ADA32FE89509A3E32BC80E4038A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681976410, "uuid": "cfa02dc9-ebb1-4168-941f-fcbe7344c141", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681976410, "uuid": "47896982-ddc1-4fa4-924a-492ccb5cb838", "value": "12288:B2iNiDTMN3Tp/NPSTH+0fQNpN8KHVQKU2VEyyjbd:B1sDTMJjT0oN7iKcDV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681976410, "uuid": "327888f2-7aa3-424e-808d-1740704928b2", "value": 581632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681976410, "uuid": "a922d359-b6d1-4657-a7a9-1bd268936bb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681976410, "uuid": "39a8435d-184f-41e1-b519-a07a38a8b549", "value": "d73faabb918bc8ac100ffe67140fb46b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "becd482f-df24-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681958443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681958443, "uuid": "08cdbacb-89f8-423b-b997-c8338b6a31f2", "comment": "Malware payload (Formbook)", "value": "dd88527c60ca110dd60463949d30ec10", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681958443, "uuid": "07446b39-10be-4524-b57c-eff85c72cbdd", "comment": "Malware payload (Formbook)", "value": "0b89806418ec582854a24adb93fba607c7f27938f2b653a081aefd1a5e419e4f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681958443, "uuid": "65935129-4dd2-4678-8f71-47b196ad6452", "comment": "Malware payload (Formbook)", "value": "93df100035fb6ef689e1e01c8cb90618424a246d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681958443, "uuid": "0ac1cadd-28d3-4990-b527-7cab813928f7", "comment": "Malware payload (Formbook)", "value": "f2bdb8e0c264463a2d614fb552b0cbfd6ecf562a5b9c24ebb98d8b63a9d92856946c8ce7871b8e7a65b9c50a9de4695a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681958443, "uuid": "c68e7bac-e21c-4028-8bcb-0309904c74d5", "value": "T145E401ADABB9D6A3C1A80BBD401665883F7444E77273C638DF8B44C9FB97B040D85687", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681958443, "uuid": "a3d42397-d7d7-45a8-9e8b-cd43a8bffdf5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681958443, "uuid": "725d4308-e285-46b1-8151-9e1d0ba3962e", "value": "12288:stBO5ZZC/W2n9HXKx3Mls9pjFx9dRbQ1GMRay3b3N4hiz8J:stqTC/fFaxclCvx9DM1JRayLq08", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681958443, "uuid": "15358069-7f99-46d9-90f7-216e662b615b", "value": 715264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681958443, "uuid": "a42d8886-d32d-417d-bade-61e13f5c1a07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681958443, "uuid": "355d2f48-a76a-4e6d-a0ec-cabf21b432ce", "value": "dd88527c60ca110dd60463949d30ec10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "340c26ba-df86-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1682000301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682000301, "uuid": "3b1b7b18-4ab3-42d3-b9ac-f29c78409900", "comment": "Malware payload (Mirai)", "value": "31b02b27fea6734aaf323f26448e6890", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682000301, "uuid": "8e94cb9f-bb3c-4de3-a1ed-bceb4cca8d7b", "comment": "Malware payload (Mirai)", "value": "0b9198d66abb078e2940595f2139de5fdd40a3a2335d617cd32b29c1637f7b4d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682000301, "uuid": "cfa0581b-f5a5-41d2-abe4-cf9debb6e8d4", "comment": "Malware payload (Mirai)", "value": "458d27868edf9538d6ccbdd55af2fcd7b8495a4b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682000301, "uuid": "f34aeb7c-b03d-4e7e-951c-2577be52912b", "comment": "Malware payload (Mirai)", "value": "bf171d0a8b887785191722e98050f785f73245d0888789ccae4dbb999b229adccfc9e6afaf1eb841f6745f7f5caf6ba9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682000301, "uuid": "0e2ed0e9-2227-4a2d-b2e8-28fad05b2344", "value": "T1E3539E63C4641DA4C1544AB0B9288FB61763E60087637FF6426ACBA99057EFCF60E3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682000301, "uuid": "e8a13741-c288-4dd1-9c22-c3424e350807", "value": "1536:oagv1AOp/umClcqse5yYGsYh4ZSijKmR7GrxhCKkdV8:ox11KmqsmI44iGm2xhKV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682000301, "uuid": "64c6971e-d242-44fd-af88-72174f2f4a57", "value": 62592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682000301, "uuid": "c5eee890-82c1-4e4b-8e77-1ad934036995", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682000301, "uuid": "fa1678a3-75d8-4a05-ac4e-06df027b4056", "value": "31b02b27fea6734aaf323f26448e6890", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36985fbf-df46-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1681972817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681972817, "uuid": "29efb608-acb9-4a4a-a7ce-90641b62574f", "comment": "Malware payload (AveMariaRAT)", "value": "c4be103b1502b63faf9f0f18954904f1", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681972817, "uuid": "40067429-dd95-4fec-b65e-3483fed4cee6", "comment": "Malware payload (AveMariaRAT)", "value": "0c068a04f71f9fb987981519ad4fa540d88babba65a76c10e3640cf0d39e49f2", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681972817, "uuid": "09694987-9c82-4ecb-989a-240d9eaf74f8", "comment": "Malware payload (AveMariaRAT)", "value": "c49a722c5615005c768a6fb6ec9136c83ae84a9c", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681972817, "uuid": "48eb82e0-5e4e-4de8-82fe-5da71c4f4776", "comment": "Malware payload (AveMariaRAT)", "value": "5993191cfb3e6d4a4a12e15e7ebfde48f0e16c79b6cacd96f78a58baebc279f6f769e91659963b829bd7aa3c8dbbb105", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681972817, "uuid": "6a7d3039-8416-44a4-a7c0-91be51cd593c", "value": "T122058D6EB352D837D9331B358D1A97B58825BF34392AD9427AE43E4C6F3539138182B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681972817, "uuid": "91db2e11-ced1-4181-a7d1-9da93b84dcb3", "value": "e83c017938f0de29fc4e619e02b3d225", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681972817, "uuid": "3748d626-356d-4112-8c4b-26a7189ca221", "value": "12288:9jtATpxC7cYFqGwib8yzaeCvFJIqtIz2X9kJ/PufCUWUo2a:9jt2pHYkUraDvFTIaNkJ/Pu/ror", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681972817, "uuid": "34226822-22bf-4815-8179-01a9aef95741", "value": 797488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681972817, "uuid": "ec984a74-39a2-41a9-8d54-726f98c6c7d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681972817, "uuid": "e60bb6fa-7252-4e4c-8d48-e54d5c7b82f5", "value": "c4be103b1502b63faf9f0f18954904f1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05b6d332-df98-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682007954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682007954, "uuid": "0d3b305f-7d52-468a-baff-a7bf34d203e0", "comment": "Malware payload", "value": "f34b0468db1b27abfad576941dfed801", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama255", "colour": "#9A8BFD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682007954, "uuid": "f49ebf80-aac6-4bfc-a9c0-2192ff75161a", "comment": "Malware payload", "value": "0c6e3748f1302a25129d9be39ce5a2291c627e0d6aa366a172d7d454302ce288", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama255", "colour": "#9A8BFD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682007954, "uuid": "ad659714-8632-4b49-bef8-7dc88224cb86", "comment": "Malware payload", "value": "38266c675e8d8d032a1b80493a46e138791b9a21", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama255", "colour": "#9A8BFD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682007954, "uuid": "fac7f86d-5319-4ea3-8f12-ff25e956c391", "comment": "Malware payload", "value": "f2bf230bf66927a690c89349ef722d2c2531ad3a4cc14162ffb518d28e18fe0a998731fd58d2a721ff97c7e4967c131f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama255", "colour": "#9A8BFD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682007954, "uuid": "3fb3d425-c601-4d94-973d-fb3634f72c2d", "value": "T108155B66EA4384F0E95705F1054BF7FBAA349B194020DCAFE78CDD94EBB2E12245D326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682007954, "uuid": "fe427f16-ccc3-4847-9a90-e556e127a1e0", "value": "47c48064dbc000892407135387cfad7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682007954, "uuid": "ffdb84fd-130f-47f3-a258-ded388c392c3", "value": "24576:AK04/rF9FAwxK6cDmKVamPmdsqFhQdBTu0tSED1L0CgJ4AcjvdyOuRhWZQi3WQr6:24/rF9FAw07DOBFhQdBTu0tSED1L0Cgt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682007954, "uuid": "726119ce-6ed6-45e8-99f1-d79f7fbdc96b", "value": 892416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682007954, "uuid": "ddafac47-84e5-4221-bf35-72cb05f774d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682007954, "uuid": "4763cf0d-bf93-4a32-b9bc-14871992c2f1", "value": "aSxBaqnfj98w.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddc919bd-df8a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682002303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682002303, "uuid": "9aeed9a3-84df-4f54-9d2b-d77c13eeecd0", "comment": "Malware payload (RedLineStealer)", "value": "39ef6895eeb2f69726dea6a9c88717a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682002303, "uuid": "1b26273d-34d2-4afc-bde6-b17c6b505923", "comment": "Malware payload (RedLineStealer)", "value": "0cc686705e924703425f0da5b74295c22dff9fe7791de5b3d425e0919be6d12c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682002303, "uuid": "4ec4b52f-53be-4f6b-b88b-8bcd7ff68771", "comment": "Malware payload (RedLineStealer)", "value": "2086728406d89d5451d3171f8a00139027a66395", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682002303, "uuid": "5a4f1a4a-049a-43ee-afa8-6f4363c20949", "comment": "Malware payload (RedLineStealer)", "value": "9cadcfc28db628eb56908becb3c8bcdd5f7a25579dd169302b4f559c86abf85ef4b991f0b93bf9c447ae7bfd2a09e372", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682002303, "uuid": "37aaa76f-e51b-43a8-8ac8-8daedad1e9b3", "value": "T14554E6B80BAC4F55C6BB0B39D075D8E046A79912715A674B697CF2B0FA3070F62C32D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682002303, "uuid": "30996deb-f318-4698-a9ae-d81c9072dcc0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682002303, "uuid": "b453610a-2134-4184-9f39-6c4145d49bf4", "value": "3072:JjW3X24ItNGbuXPm/Np1iXsF7CyOhkQUGcsSpjNzYiG1kQvGuKUp/lhayEa7pKi/:J2m82Pm/31iZyOnDLMYn1VKCLGajax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682002303, "uuid": "7d1f5402-7bd4-4980-858a-3a75b9a6cad8", "value": 292352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682002303, "uuid": "11eed7b2-1eca-4ad6-adb8-ee1ccdff24d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682002303, "uuid": "7ba41d9f-b35c-4a29-9af9-641f9947232b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6d7547f-df7f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681997621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681997621, "uuid": "9fea11b2-d808-4f32-baf9-c92d5c06b2ac", "comment": "Malware payload (Mirai)", "value": "5d791e58800f1534244bd3ecf34a31c8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681997621, "uuid": "0514c55f-6574-445a-9d1e-8f054232c1af", "comment": "Malware payload (Mirai)", "value": "0ceaa68ead5c87ab68dc774147ea735bf0e34829be6335f1aafa90d3efd79092", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681997621, "uuid": "88e1c3a9-c93d-4b5a-9807-b966e7c553b5", "comment": "Malware payload (Mirai)", "value": "921a6f6ade1816b1e8f266f9aa467f186ddc0e5a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681997621, "uuid": "c6152c53-ae34-47e3-aa73-550e7cfe36aa", "comment": "Malware payload (Mirai)", "value": "0d772ac6394019d6a575779591252f678acb2e933d2dc693f3a6ee2a4127c6fcad6bb011759706ed874c1c0b490e5706", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681997621, "uuid": "6ae5ad57-3683-4afd-b63d-b253ab927f03", "value": "T19E332B97B701AD3EF99AEA7F84130A09F530779500930B3B63BAFD935D322945D16E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681997621, "uuid": "eae84936-f126-429b-9ee6-6cb3f03f7730", "value": "768:yHedjusHZxILuhg3kcJbpwc5ROfqQZI8uGQYzx1DBwNa/gT8IDF5cd:u4jpIL1U+tbRQZI1GQq1DBua/a8IFqd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681997621, "uuid": "7938c7ed-8ced-41af-9f18-c7b51e022f8d", "value": 53168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681997621, "uuid": "197193ea-57f4-4266-8de5-84d6f65061e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681997621, "uuid": "d2d00820-1ddd-4f93-b139-fab1ec276134", "value": "5d791e58800f1534244bd3ecf34a31c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "224be207-df5f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681983520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983520, "uuid": "5caac277-b570-4094-8491-cca55adeb4d4", "comment": "Malware payload (Mirai)", "value": "a6fc6a50aa373fbc78eb430ba2ab8adc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983520, "uuid": "6d3feb57-1cd6-422e-a2b7-fbb535f2cd38", "comment": "Malware payload (Mirai)", "value": "0d06f618dca957bd841f78717683047f5446d0a56ba05903f7e2af4c8391f9d2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983520, "uuid": "cf0514fa-3075-4052-b121-7bc25304abb7", "comment": "Malware payload (Mirai)", "value": "d8aaf4a0ddb44fe5e33d1254885220c78e1161ad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983520, "uuid": "8fe58dd4-3641-4633-8d6b-ac5c6c8d7b61", "comment": "Malware payload (Mirai)", "value": "215f7a9334dc3ac634ce29d4c3a716461c338244d64967a59980a3cca1ac256b49a899cc97c9fb2c5093cbc17ea01016", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983520, "uuid": "8b06cf70-6aab-4d39-a24d-2c8d586f6d79", "value": "T197C33B46E6818B13C4D61775B6EF42453323A79593DB73069928AFF43F827AF0E23906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983520, "uuid": "07310f61-0020-426a-9bfe-7ccdd37c33cb", "value": "3072:AQO3WqAnOKMoMuPGYlqqiaok+EuNM/9cE:AQO3oXMoMuPzQqYk+E4M/9cE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681983520, "uuid": "28811a6c-6dd8-47db-931a-ac3293824fa3", "value": 120446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681983520, "uuid": "74a2f546-3c25-4be8-bb34-787513ab69f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983520, "uuid": "ca96a71d-c2a1-482a-9be8-b7482a7a19ce", "value": "a6fc6a50aa373fbc78eb430ba2ab8adc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "687e6495-df51-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1681977625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681977625, "uuid": "f79fc8f8-703a-4906-95df-aeeaa90f7ca5", "comment": "Malware payload (Guildma)", "value": "b6652144870e22b5e8be893e79daa0f3", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681977625, "uuid": "b5f206ad-1e47-4ee5-9369-e26e7a3c7500", "comment": "Malware payload (Guildma)", "value": "0d3b876b5882119dcb0566de84fcad879daa745f0d0220db59db8e2fdced40a9", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681977625, "uuid": "34403615-988f-460d-9b29-b5c48be2f98c", "comment": "Malware payload (Guildma)", "value": "0cb2da4be59b3da59f226693301ef16793fcf865", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681977625, "uuid": "f988c133-984b-4594-bdc4-ac265b71ebeb", "comment": "Malware payload (Guildma)", "value": "e8c162cdef4c091bd943990fb70ca7e1a6827a17f01f92d19c0c212d6c282f4a5df268bc6724e71e310127540e149bda", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681977625, "uuid": "02a7dc0d-5311-4852-b902-071e1c11344a", "value": "T15E0166B6A3AD0E7B88B70681DC756E4C48F68CB30E6FD09DD9333944C529AE11FC0614", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681977625, "uuid": "defdce97-3d82-401f-8651-b9cc9b115e6f", "value": "12:QgkfDnQjNjeaTASJwf6VIkwf6VUaVuRawf6VIz87KZIxBwVwWw2WCOnUGivqI6lN:QFLQBpTfoTa8T40uFTD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681977625, "uuid": "1b37b99d-dd22-40c5-bebe-50ec8cd0029f", "value": 769, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681977625, "uuid": "ddebc1c2-2221-4a38-bfca-7c732a7af7ac", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681977625, "uuid": "310c1b2a-41f8-4f56-a48a-053cb170f770", "value": "Factura_Archivo2135828302.233830.17891.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ab6dca3-df3b-11ed-88f6-42010a9c006e", "comment": "Malware payload (VectorStealer)", "timestamp": 1681968019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968019, "uuid": "5b8b6c0b-7c14-40e0-94c7-100edba28b2f", "comment": "Malware payload (VectorStealer)", "value": "f5ce138bc35d3422a6aceab9460aeab3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968019, "uuid": "34ac6fe1-fd53-4023-b3e3-9586f8c8831c", "comment": "Malware payload (VectorStealer)", "value": "0e066259acae200cb54ee40e8bd101d51c3f41088c61b2cd9c93a1107b24a32d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968019, "uuid": "f2158459-96d8-40b6-91de-c9ec85f231c5", "comment": "Malware payload (VectorStealer)", "value": "0e1990cce60bbef77e7fc18891a3a78b16032226", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968019, "uuid": "c51f79f1-ad0f-4099-ad61-fa18cffcc0e0", "comment": "Malware payload (VectorStealer)", "value": "6aed5b4d9ec515c63a6be0b5709d0d4e7fce2f7c71c5d0b0408f461340a8f5902f37d646921bd7659aeef9cc5afb3042", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968019, "uuid": "0a8dda59-dea7-480c-b2cc-d44d948aa666", "value": "T11A069385490584F62030EDF33697E1A3C8776BEDB7F949DCE6952C68A38C7462BE06C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968019, "uuid": "2b96c5eb-857d-416b-9513-ea81a273313a", "value": "24576:SZyFk1/4V6aIrnp9jytaEabVzHpiUt2dFa76zTSqp1y0b0gU2oMxgAcrfFwNy3Ts:Z0n/UyvMTSh4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681968019, "uuid": "93ed33aa-0e46-4ac0-b382-76d80c2ac27d", "value": 3655873, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681968019, "uuid": "e96bd87c-b7d5-4f38-9efa-158ed4ac5bfe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968019, "uuid": "541d4b45-1917-4b08-a27a-9a615094fc44", "value": "REMITTANCE _20230420 PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b8833b0-df5f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681983616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983616, "uuid": "34bfc755-2c87-4035-a52d-66b63820c7cd", "comment": "Malware payload (Mirai)", "value": "4ea720e4b98df8b2724e6e1a8909dff1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983616, "uuid": "eee6bf29-a1aa-4d18-8c35-b319e68f500e", "comment": "Malware payload (Mirai)", "value": "0e587b5ec0ec7dcef809523a5b4003ec571a704dd4967f7fe377063da38851cb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983616, "uuid": "3f662bde-574c-4c38-8d46-a64fa406558c", "comment": "Malware payload (Mirai)", "value": "3519852a98aa349e2303ca1ccd1e55d1de0b77e6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983616, "uuid": "9aa918e8-4047-4e1f-bce5-daf06a3541b5", "comment": "Malware payload (Mirai)", "value": "8eb0261413bf4cbbb9a67bb220789a7e5b6d72a2520b49b9b9354c0a3b85a1f8e31aa27b625930aead475a9c46b7ccc1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983616, "uuid": "a83fa019-d247-4778-906e-a9e12ef29dec", "value": "T16D436CD4E643D9F5D80B19B1113AF7375E31E0F82228EA93D7A4AA32BC53741E54698C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983616, "uuid": "b8bbef75-6830-4e2f-a34b-f7935853bb30", "value": "1536:e5IzW32sRUqVZgwohPm1S5Qb+ZTYgal5TTSFap:YIq3FRUqVZgnBm1SGb+ZTNOT0w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681983616, "uuid": "ba29a9e1-ecf7-4ad9-8ad4-e37bd45f9690", "value": 55472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681983616, "uuid": "f4cf8fdc-1e08-4157-bc94-8a53a58d102c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983616, "uuid": "f6dd5653-84ff-4a3d-b4f6-8c4df6dfe72c", "value": "4ea720e4b98df8b2724e6e1a8909dff1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b6f5086-df7e-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681996823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681996823, "uuid": "c0c9574d-e553-4cc8-ba64-4d8a95169821", "comment": "Malware payload (AgentTesla)", "value": "42fc6870418ddb0645f9a6cac613e8a6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681996823, "uuid": "0b283783-3b92-48e7-b6ee-58e8643c9ccb", "comment": "Malware payload (AgentTesla)", "value": "0e61a0b6e3de818a74a457a051d6c26220f80edbd33370377467018f3655ce9e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681996823, "uuid": "5c9ccf30-ce50-41ea-8e61-8d77b89fb816", "comment": "Malware payload (AgentTesla)", "value": "66373d89647e3dc8a489dea9622b274673e1e84c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681996823, "uuid": "8b378d8d-7e04-4d55-b418-9357b06f219b", "comment": "Malware payload (AgentTesla)", "value": "2633d00c8fbdbd2d8e9a3e0784d6cea60c4f844bf7b5fc3bcc31150e497fadce8e2a26d765daae1c87f6d51f6a3f5a1d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681996823, "uuid": "c1deeae7-bae1-48a5-b5a2-b8423759abf3", "value": "T17D34E00736825721CD69ADB194EF053403F4EBC63A73DAD67F8D529D8E433936E48A88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681996823, "uuid": "c88ae8c8-7d21-4647-a577-6721bd5cfae2", "value": "3072:y5fW5CflcUTbK8OtvrH6IJTbzpHiHGwofYjEOfQVkoZFTh3U/EJP5YTPv/5bns1G:y5DJQrnJXzpOqiWkonTh3fYb35b4pn4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681996823, "uuid": "fc1274a9-aa4b-4c9f-b009-b2f57fabcd95", "value": 242248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681996823, "uuid": "d5069721-d2d1-4092-8684-ecc35aebeef1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681996823, "uuid": "2f98dbc3-6456-4240-a71d-6b49d1ac2c1a", "value": "Bank FOrm FOr Wire Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eda986b9-dfc1-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1682025952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682025952, "uuid": "0cf4d1d8-678a-45c0-8a25-e5d4fba56774", "comment": "Malware payload (AgentTesla)", "value": "dacea69d5bf77bd19d006a9d72863b0c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682025952, "uuid": "29ca27a1-29a5-468f-b6e5-1753c4dbe746", "comment": "Malware payload (AgentTesla)", "value": "0f55fad040e159d3c2363434d889156787db9dee6354294c156741afa6005af8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682025952, "uuid": "307b4e5a-3f33-438c-86a9-45d94d558b3c", "comment": "Malware payload (AgentTesla)", "value": "573c0800debbb27673946de7dfe6857114fb5f27", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682025952, "uuid": "c4e98e70-b8f2-43f9-bb5c-077586e5f641", "comment": "Malware payload (AgentTesla)", "value": "29a07d6e71c6b348922c98e83b9754e25745960d0fc1cf09d4033a5f225bafd8a86ba0c16fbffef8ae61d1d36b39235a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682025952, "uuid": "a2baba64-8d94-471e-8069-4379bac6b0cc", "value": "T1826412646750C1B7F4B606B19EBB6B533CB0903235C4660F2312A76D7EF662382993F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682025952, "uuid": "25fd056b-d8ed-48f2-a96d-2a6b3aee87fd", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682025952, "uuid": "2192c05a-19a6-4d52-b6ec-3c38d5b25c9c", "value": "6144:/Ya6iCWewBuOjxIYojgZlrgjqtGerNMCuKvTNi8p54DgZFupS/2p6+x6suwu:/YEjPBuOdIYoj5jqYerN+whJp24kp6Ks", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682025952, "uuid": "a3a33939-739c-4860-aed1-f0143a677d60", "value": 309714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682025952, "uuid": "12872c1b-a2d2-4446-963d-8accbd6b05d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682025952, "uuid": "7d25b3b7-0221-43f8-9df6-710ee7f3a05d", "value": "QUOTATION -328.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3a6c7cc-df24-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681958451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681958451, "uuid": "b99caed8-68a2-4b40-bfea-9367437f4139", "comment": "Malware payload (Formbook)", "value": "114f9c672304420a3b30e0c35e4f3d3c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681958451, "uuid": "5dae3bc9-b071-4828-b3ed-be8acd0f8cc9", "comment": "Malware payload (Formbook)", "value": "10e1fd083fbaa700f1580863bc6bdc928fff23f2edc479c6a8d4e3d7ff57926c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681958451, "uuid": "5bc0d98e-bce5-429f-b34a-b4043c33b54b", "comment": "Malware payload (Formbook)", "value": "2a61aeb913d2dcb7039eb404ab08dee569ba1430", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681958451, "uuid": "5960f9c5-b642-4b33-811c-d05743afd448", "comment": "Malware payload (Formbook)", "value": "ab6ecf9a7bc6b266e452a886df2382e31f33e2396388149903fcbdbf47819a6fd1746652af81304a0b28c544e06c2992", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681958451, "uuid": "a405eb68-1114-4000-bce5-20298060d30f", "value": "T1F9D4F1ADA7E5C6A7C2684F7E0012658C3F7050E77A2AC278EF8B445DFB977085D84683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681958451, "uuid": "5a045ab6-6b46-4b7c-9fdd-805b0581d852", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681958451, "uuid": "3c2e9464-7223-44e2-8ea6-d5ed0458205d", "value": "12288:1jPtzQnUFjZqf6x3T8QGZ3pXUmY1AvvVACy:1JGU5Z7T8fXEmY15", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681958451, "uuid": "a1cf202e-b8f4-4285-86b3-b30779ce69b6", "value": 619008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681958451, "uuid": "448b65b0-7467-4c07-b9b9-1e4d67695297", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681958451, "uuid": "c17d3b57-cf6a-4551-b24f-2c04b53cf2dd", "value": "114f9c672304420a3b30e0c35e4f3d3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fba24578-dfa3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682013091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682013091, "uuid": "2f47f633-73c1-4809-a5ee-cd7f69e82c1e", "comment": "Malware payload", "value": "ff8c3337c3a54aea03fddc10eedb06e3", "object_relation": "md5", "Tag": [ { "name": "1681985211", "colour": "#1A34F8", "exportable": true, "hide_tag": false }, { "name": "BB24", "colour": "#CEE0BE", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682013091, "uuid": "8a5bf9c6-071a-493e-ac7c-7355af370da4", "comment": "Malware payload", "value": "10f8092fdf0dc0d417bfc41406498dc4a1da8003e4a87b9fe57fbd712681d1e0", "object_relation": "sha256", "Tag": [ { "name": "1681985211", "colour": "#1A34F8", "exportable": true, "hide_tag": false }, { "name": "BB24", "colour": "#CEE0BE", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682013091, "uuid": "80d64bca-4bfc-4164-b528-8d27e1561a7c", "comment": "Malware payload", "value": "4e0d2f18f5437b13fda6e97e26c4107f9c6cd2a9", "object_relation": "sha1", "Tag": [ { "name": "1681985211", "colour": "#1A34F8", "exportable": true, "hide_tag": false }, { "name": "BB24", "colour": "#CEE0BE", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682013091, "uuid": "2cc1ba7e-00ad-414f-9edf-67387d4c79f4", "comment": "Malware payload", "value": "48d48eec16907355be2dd613585b057cf52e8d7df52126be09af94ea0fba4228366c2b791c37266e56bebb7eaf6eabf4", "object_relation": "sha3-384", "Tag": [ { "name": "1681985211", "colour": "#1A34F8", "exportable": true, "hide_tag": false }, { "name": "BB24", "colour": "#CEE0BE", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682013091, "uuid": "4976cb19-9c6b-4f4d-84d6-0a523ecbe038", "value": "T165B30235D6C509CCE4E6C33969731E8DD6AFB0060AEDBB53B63C01C1A5178A572E319E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682013091, "uuid": "750d97c1-099d-4041-a219-f5ac5470a1be", "value": "3072:OgTzFLkZUSpQsqVt4NxbKuEcx2Gseequt:OgTRLkZK9V0KDcE7B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682013091, "uuid": "118d3ef4-6593-4ff2-b15b-1a2781ea683b", "value": 108482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682013091, "uuid": "4576bed3-3d03-4161-984e-42211cdcf18f", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682013091, "uuid": "a6cfd0e1-b78e-41a1-a32f-e104c57181e5", "value": "Nobis.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c711f532-df11-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1681950296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681950296, "uuid": "2c506339-358e-46b9-b840-24aebb0badd5", "comment": "Malware payload (Amadey)", "value": "3308051ded87b1863a8d92925202c4b3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681950296, "uuid": "cba3a271-7e93-4443-8a5e-2a6ae185e37f", "comment": "Malware payload (Amadey)", "value": "13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681950296, "uuid": "32972061-5fbc-49a3-84d5-151cf06b19af", "comment": "Malware payload (Amadey)", "value": "7834ddc23e7976b07118fb580ae38234466dbdfb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681950296, "uuid": "082d1128-d3c7-4e64-8a8e-74d58b9c9dbb", "comment": "Malware payload (Amadey)", "value": "4f4e353005f5312fecfdde29968d38a51a361ff9b2c95cabbb1c105042eafebd4e5696308264f853ec088ca0e58b523e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681950296, "uuid": "c3a23536-ed06-44da-a7b0-9ba040a6aa7e", "value": "T1793409217912C032C52061B729F9BFF2C55DA8259BB049DB7B810F7BDA112E76A70E3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681950296, "uuid": "dab78679-d7a8-402e-b7d1-249c5b65f195", "value": "88e77976ee88242bd495e2b66bf3b0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681950296, "uuid": "1f9013f9-d01d-43eb-a96d-bf155dbd95ba", "value": "6144:mKVNIG75NpcElElt/DgK1yuFShFBr2D+:/5KE6LguFS7BB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681950296, "uuid": "ae4a83de-0325-4a27-863f-c5af131a040b", "value": 234496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681950296, "uuid": "1abae4b4-cc1c-40f6-8f04-d5fce8d1912b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681950296, "uuid": "f62d3ddc-2cb7-4438-a710-e9f5e06d053d", "value": "y49Xs12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84bc5ed8-df12-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1681950614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681950614, "uuid": "dd6a0f8f-c80f-4593-bf98-14f048e0dca2", "comment": "Malware payload (Amadey)", "value": "55a874f2e4f903ac29996461ea2bf23b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681950614, "uuid": "1aa80336-26e3-4750-b61d-a28182f8d8c5", "comment": "Malware payload (Amadey)", "value": "147132eeb5ef02fa8d2a3cdaad0467ef8684d1094d0f3ffaaede6302912fa2ff", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681950614, "uuid": "3d7d2935-8509-417d-9d07-94e8a4544544", "comment": "Malware payload (Amadey)", "value": "d96066d424f8fbc4e7fc5e7b02f7a26d1557b307", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681950614, "uuid": "cf219bd2-9e95-49b5-b95b-0751538eb369", "comment": "Malware payload (Amadey)", "value": "f07cd4b8c528e0595a79fe242e592f47dac2893cfbfcf6c683ad161a8df8e343768a1eb4d260c1b2c00891f7ffbfcd0c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681950614, "uuid": "e62118d7-cd53-45ef-8429-5ae884bb64e6", "value": "T158352326A3DC58B3C6F453F048F703570B3D7DAAA7A4839B239EA44948B32C99175727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681950614, "uuid": "8e4f2ce4-bc7d-49dc-9363-aea7f7e917f1", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681950614, "uuid": "b49f5d1e-53d4-4875-8d1a-227c409746c5", "value": "24576:UyFv4XSzT2aMveKb/xG4BALbraXXsbYUif1VO8r:jFAFFjbZG4BwYUQPO8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681950614, "uuid": "acc56a4c-47a2-4e96-9d29-5dd9cea5579d", "value": 1139200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681950614, "uuid": "f5b2c389-02ec-4e76-abd0-c2782eb83fc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681950614, "uuid": "abc7e411-5cd5-43cb-8944-4868d9cc3f2b", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dd855b9-df5f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681983567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983567, "uuid": "79d4a260-c930-49c5-b3f1-b86639b78fb6", "comment": "Malware payload (Mirai)", "value": "0b7e5c326898cedea29d91ce16fad7e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983567, "uuid": "36e3c745-7778-4b4e-bf22-a5b5a26a6dfd", "comment": "Malware payload (Mirai)", "value": "156eedc5a8ea9eb0f88079f1dd61bd2559ff3a72d5df7b07191bab190587580b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983567, "uuid": "905338a0-69d5-45dc-975f-3b07d96a0975", "comment": "Malware payload (Mirai)", "value": "0ba21bb23c3f9d61024ad130c502c93e5f9c972c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983567, "uuid": "c3931611-c783-4737-a684-09c0cf2682f4", "comment": "Malware payload (Mirai)", "value": "0c1d13025f1919c6e8388eeb41ce0b6e3914ea00f3c4c083f02c380d63eb7fd84541885483034cad2ac46898d79028bc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983567, "uuid": "2d63c8a8-7ad4-4882-9983-a5e556ebb117", "value": "T1F1644FAA6B329FBBE80ECE7301995501104C9A5953C96F6FF2F4C628E39AD0F49D3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983567, "uuid": "eccaacd0-7cd9-4996-82bb-68cfa7c85b30", "value": "6144:qh555ru0CQE9HcdJ0JFZI7sDjCeiVZwqR3T:aqjQENcH0JFZI7sDjCeiVZwqR3T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681983567, "uuid": "5b5d9289-150d-4cff-9a11-5db97c3786e6", "value": 317415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681983567, "uuid": "4f3f8a91-2a2a-48ff-8796-14a2d37df380", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983567, "uuid": "5fe40832-9b0b-4fa5-8e47-5928523ded6d", "value": "0b7e5c326898cedea29d91ce16fad7e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53507144-df45-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681972436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681972436, "uuid": "8d7460bf-8d2b-4d33-a882-6556a6d58fe7", "comment": "Malware payload (AgentTesla)", "value": "7e51eb2dcbaceb3cc651e92c03150ab8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681972436, "uuid": "edd5b2a1-fa5d-473d-92f2-36212c21944f", "comment": "Malware payload (AgentTesla)", "value": "15aa65fa8dd614a3073a19fe95b606ad2ccb43cd869569aa72309cc035dac3b1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681972436, "uuid": "b82d4661-254f-49c2-aa4b-f7c0e97ed5d2", "comment": "Malware payload (AgentTesla)", "value": "25a24aa0eb7c52463a4d5c451cfbe5638c33dcaf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681972436, "uuid": "289e8195-766f-45be-a7ff-a6b9c09d7649", "comment": "Malware payload (AgentTesla)", "value": "66a6a1d91411ab57e6c4e512fb32b3182be3ad13506127b212df549406bec5e8e685dc5959659f992c755a5b176b8086", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681972436, "uuid": "68b2605f-8b7f-4e18-a884-4593042f811e", "value": "T17EC42303EA08597CC70DE8ED5E59FD2E6F7D18DA6817C00B081D1B3A8D11AE6CE7D46A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681972436, "uuid": "07db4026-0355-47db-a185-83b092939cc2", "value": "12288:86dGsuOpa5L2NxoLENt1+gSIWXs+Mf/3UN6pq8qOj5ZHwxneVgJ:rGtMa5EdS0nUhaTQxnrJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681972436, "uuid": "cd30f44b-b1e5-407a-a1e1-d657f097256f", "value": 564895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681972436, "uuid": "1deae9a9-231a-4d6b-a91f-4ace49ebe790", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681972436, "uuid": "07605bc8-b0bb-4510-b3d2-2809ceff98ca", "value": "shipping documents.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c09f16ca-dfa1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682012133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682012133, "uuid": "8ddfe8bf-dae1-429a-b3ed-9c893657c0c3", "comment": "Malware payload (RedLineStealer)", "value": "0fd6abe16eb10c511c44e453b357092c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682012133, "uuid": "034b99ce-6676-44c3-9075-91c4f44421c1", "comment": "Malware payload (RedLineStealer)", "value": "16a6161a7efab534489a56476cf707a3ceffde375993f7991e23865ad7a6f706", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682012133, "uuid": "93906ed3-be89-4215-878d-7a65d0550809", "comment": "Malware payload (RedLineStealer)", "value": "62157973b0ca72f69cfe0fe29af26b66e49fc6d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682012133, "uuid": "bdd4c5c0-3721-42d2-983a-e0e7818ae7d9", "comment": "Malware payload (RedLineStealer)", "value": "585856eaf5c3ebe0ddb9ade52517fbef8e440aa5b71ef28bc3c9eef12c02063bc4e7a70b957d13e307becedb025d63ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682012133, "uuid": "b314b816-2e13-45cf-bc6b-d7f79af0f2df", "value": "T146F3C468364BA97EC97F887D9C600CD0767CAC562242A7079D8FB0E9393B7919F050F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682012133, "uuid": "ff1a4510-5ada-49c6-abcb-f7945eacb0c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682012133, "uuid": "f6f8237c-b577-43cf-af71-e5d871b719e2", "value": "1536:VLNTK6nNqlVZRGWhQureIh+xN7COTGqVsbuTESRsATTV83wYk88e8hX:VhTbnmIIG+rqVkKtR9TTV28e8hX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682012133, "uuid": "e22c5d75-350c-4b46-b850-850b74cb8391", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682012133, "uuid": "0f38abdd-cda3-4c3f-ae5b-67414af19fed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682012133, "uuid": "19359f16-b3e3-4431-8819-284f84f86b5b", "value": "0fd6abe16eb10c511c44e453b357092c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee8221f0-df3a-11ed-88f6-42010a9c006e", "comment": "Malware payload (DarkCloud)", "timestamp": 1681967972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681967972, "uuid": "959b0d52-987e-42bc-b418-e867d9de9fa4", "comment": "Malware payload (DarkCloud)", "value": "9e6291cf4c91f7fd4426dcc845748f4a", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681967972, "uuid": "65263511-2fca-463b-b311-bafa964c3ec5", "comment": "Malware payload (DarkCloud)", "value": "176be20e96487583d2fb30bcda4d0258e34d3b89e5e5bf6af486a78cfbff3236", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681967972, "uuid": "53e51115-9e4f-4c3f-84fd-fbedaf8898a5", "comment": "Malware payload (DarkCloud)", "value": "072ef218dd5c096c68f82708ae0871f092a2665d", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681967972, "uuid": "10fe0674-63e5-42a6-bd6a-1b9042ea2fc4", "comment": "Malware payload (DarkCloud)", "value": "c09a4c5dcc75c6a8329deefd046fbe334f65e103f9b7c86907a710203f5f1dad88cc8fcb4a6b0c7ea33a533fe68915de", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681967972, "uuid": "3a2667cc-4687-402e-8639-86670cf9d297", "value": "T15D25E05E70779B06C16ED7F9109898713BF0A2873A6CC27DACC743CA9ABAF011685717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681967972, "uuid": "67dad631-6726-4f0d-a2ef-fd262fdeb713", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681967972, "uuid": "d7947a1a-0d80-4bb8-99c9-dc8855a76431", "value": "24576:QqHXEYNvYQqDylAJm4s3DZqurh4CczD+xhP09Km+2VvYA5COh:tJKInTMurhqX+U91+2Vv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681967972, "uuid": "388f8bfe-8044-45f1-a80d-8ae52a9c6072", "value": 991744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681967972, "uuid": "cdc29108-75e7-4f83-b827-9b5497d6f608", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681967972, "uuid": "a291fe8f-5644-4942-9d2d-5f62eb6ceca9", "value": "Facturas Pagadas.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31bc1f69-df5f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681983546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983546, "uuid": "b4a8021f-8f68-43b3-8123-0bff1efe01fd", "comment": "Malware payload (Mirai)", "value": "15017bf664163163c913dc033d980689", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983546, "uuid": "d9d39011-9fe0-43ae-a3d9-0852d18205ce", "comment": "Malware payload (Mirai)", "value": "17715ee9aac44afdad55ec815dc8e58555fa4fd3c12679d13ca41c48dbd178ab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983546, "uuid": "acd66e29-f801-491d-aee6-6e68972dbef8", "comment": "Malware payload (Mirai)", "value": "4d76cacf55e500c3bf9b00db8fe9f6d22aa66524", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983546, "uuid": "d2428d0d-2290-4172-a2c8-958e2050162d", "comment": "Malware payload (Mirai)", "value": "5f04a6cc51ea2d37fc20d46e68c26701c6066b76723c74eaffcdc2464e700bbda6b53ab9af04e181d8eed531b2f8e4a7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983546, "uuid": "d665169d-9f2e-44ac-9b81-50a1a77e7d6a", "value": "T1C0832B47E9A19FB7C0866AB525AB5E300B13E9912B4F1A4A713CA7F4434F4CD780EF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983546, "uuid": "2c285293-9763-4f2b-b315-b19ba5e60582", "value": "1536:SlN9QyOXa0yrck9BIqKWgkKfDKJCqCKRNmkxVqOEeofzee:QLOXa0yrckWWzJNzmkxVqODofzee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681983546, "uuid": "1a65d676-7130-4af3-a305-33f61219a821", "value": 88730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681983546, "uuid": "0be3967d-05e2-477b-bce3-93618bef646b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983546, "uuid": "2e9b5463-ad7d-45b1-9530-a270735895f3", "value": "15017bf664163163c913dc033d980689", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "784ec26a-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681985812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985812, "uuid": "ee9f2ec9-dd5e-4d91-925d-d06a92d0df3f", "comment": "Malware payload (AgentTesla)", "value": "755dd65377370fb99dc5c1fac8419d56", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985812, "uuid": "4e2f004b-04a4-4179-9eb0-1e5846e32621", "comment": "Malware payload (AgentTesla)", "value": "180f2e96fe643eb64fdcae6b37e42540d208d4af43a5f5ba2048e4977c9485bd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985812, "uuid": "aae38169-aad2-4656-91c6-51c430de6c3c", "comment": "Malware payload (AgentTesla)", "value": "3cc88e152073c92e842c5014ce76ec4a83a3e4e6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985812, "uuid": "50520eee-3659-4a53-b0c2-e8783c9abd03", "comment": "Malware payload (AgentTesla)", "value": "55258def4c8c96267f7f7a137043d78e0ca9fd15ede5f5ad69ef3610c50b191aa2a4a553d0b0fa693a6807c7a8c38fe1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985812, "uuid": "4ece35d2-6540-45f0-b7df-2dfd1878dd3a", "value": "T184F4120277C86165D9049578D2E394A402E7645F3EFBE38ABEC412B92F417E89D6CBCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985812, "uuid": "df47995b-9e33-4746-a33d-4c67667b9761", "value": "12288:odour0nmu0fDys2p+V4TCBfik50erzTJ6KoFeBDIoIGzstfFDka97Hq0dT6Vk:7mTyhkV0ar50erzTJ6KoFeBDZapka97Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985812, "uuid": "6cd9f692-b91b-41a1-b27c-a7759a05ddf7", "value": 783360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985812, "uuid": "3f53e6f0-06bb-4f09-8812-879696baa679", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985812, "uuid": "2da5983c-cada-479f-a399-182143079d0e", "value": "NHhHhYg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18940826-df8a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682001972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682001972, "uuid": "154e2e18-0f5a-4e02-a755-bbf2577ace5f", "comment": "Malware payload (RedLineStealer)", "value": "23676e2e1a1773a5f49260581e5f579b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682001972, "uuid": "0d2569bd-63f9-4752-be28-fc52f66df58a", "comment": "Malware payload (RedLineStealer)", "value": "18555ff99386f652fd757c2871946607d418ebd538d267017a5d5dd4794f8a3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682001972, "uuid": "10c1170b-1453-4d5a-a2cb-6ad0962eb112", "comment": "Malware payload (RedLineStealer)", "value": "a3c25c174e3ec2876e9fa6bcd94eb9bbb283a6e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682001972, "uuid": "1257cc87-a4f3-45e7-97a2-e74dd14db2f4", "comment": "Malware payload (RedLineStealer)", "value": "c5480dadef9f60d745b955d76ad9c0190c5f215c6598daea4c3adcd96d0b9f2300b3f48655594dd8ba0723b7d4209509", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682001972, "uuid": "e6ec5a0c-ce3e-43cd-bb76-b63da491d9f5", "value": "T11D748E1232A4D0FED015B0B89DE8D4A8A61C54F63B6FE9D77BC21E7D47192E273A4213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682001972, "uuid": "497ff9d1-64ed-4a71-8b19-d493b1904a1d", "value": "4e54daa91eb371c1340f2a6338663dd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682001972, "uuid": "821304c8-dbd0-4830-b4fa-b2c22ee624c6", "value": "6144:5TXqRG+bWe2TdMqauZMc+uJcrzfeidVsQKRHuTBS:5TXSGtTSuZv+uJKTfdeRd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682001972, "uuid": "802afbb7-e613-4584-b73b-4b7dccceace6", "value": 353952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682001972, "uuid": "1cabef31-b87b-4337-9587-ee9d62abbcb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682001972, "uuid": "22c7fe81-b558-4ee8-8cbd-486910a381d6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25d8686b-dfb0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682018316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682018316, "uuid": "258ad369-429a-4562-8877-929bf1816487", "comment": "Malware payload", "value": "2f7cc32eab5132846f2c60cd49b11503", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mc1904", "colour": "#71A344", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682018316, "uuid": "5b2c1d6a-3b71-44af-b578-884c9e3c09ae", "comment": "Malware payload", "value": "187754f20558b7d67abb233e84ee14a85ea1791983d87d5a4dfe062799ae3d3c", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mc1904", "colour": "#71A344", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682018316, "uuid": "a447160b-50d4-40bb-9c1b-c3b51dc1cde6", "comment": "Malware payload", "value": "a3bd016dd1d2f26857594d4d60f36bc73e9ede99", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mc1904", "colour": "#71A344", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682018316, "uuid": "b2c13a3b-6187-4b0e-9a2c-190138e42693", "comment": "Malware payload", "value": "1449874469f07b2051405ac64af6766a1a48b86ab98a8cba8f84a3bcacf652305d17dfc78f628e6480c42b788c167b01", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mc1904", "colour": "#71A344", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682018316, "uuid": "8252bc3c-acef-4e98-b0f3-6c40c84b99e3", "value": "T11765CF24F5A63AB6E761CD33887F9E24CF382197A172A37714216077582D7F1BF06A09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682018316, "uuid": "a5b3301f-319e-4317-8b6e-5b735d75b911", "value": "7e67bc8966663720e52fe10778f5a917", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682018316, "uuid": "7ad36c6d-1945-4128-9a31-1ab73da87fab", "value": "24576:o9sBKJRPFHYCRNJYM9WFw7/ekQ6o2LRNtVRIO72f6hPEK3X5Kk:yhzLRQQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682018316, "uuid": "06ea2386-1ddb-4085-828c-ce3aee160007", "value": 1450496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682018316, "uuid": "c5a1a27e-6212-458a-bfa1-6e4cb026586a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682018316, "uuid": "2678e1e6-25bc-4eac-95cf-0cdaaccbd958", "value": "3oCGqe4g.UBr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76b20a06-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681985809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985809, "uuid": "26d4d7b2-723d-4728-a2a9-3471fd089766", "comment": "Malware payload (AgentTesla)", "value": "6dd8c33ae3e573164e80fac600a8e4da", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985809, "uuid": "f87140e9-d1b1-4f5b-a43d-1269817a3d46", "comment": "Malware payload (AgentTesla)", "value": "188b6a18fcd3ffdc757cb1438353fd909de357425455dcce4575c415582506ff", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985809, "uuid": "fabfd439-cea9-4f10-bbe7-876dbc854811", "comment": "Malware payload (AgentTesla)", "value": "22b28d10d6f03b27b9aaf9e3bdef994416ea4037", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985809, "uuid": "b8cf4350-5adf-4992-876c-2a82b7ad8ee6", "comment": "Malware payload (AgentTesla)", "value": "df1686ec48d63d6b101c0aba5d53f1827edf84c1f268c8e8569063fde2d1668e1f6e61ed1565eb8666a1c7ab76611a8c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985809, "uuid": "793a3fa0-a9ce-484d-98e3-3fc802bbf43f", "value": "T11615AE39359B0227F179CB778B87F050B3BCC437772EBA292EE6056442D694B28D916C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985809, "uuid": "b07cdb3b-a174-4f6b-8c21-c50d6a10d2c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985809, "uuid": "2cbc7bb6-ea18-45c4-870e-a15645ec000d", "value": "12288:8gG2B1iJO0BLWwL/GbQx4UTnU3RQEwLmAWOAlf6uldLK:XkI04Yt6U43y3CtOvul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985809, "uuid": "65166a98-f219-41b6-ba4e-b5061946a184", "value": 907264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985809, "uuid": "750d89cd-a146-4783-963d-f59d45047581", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985809, "uuid": "ab937a7d-981d-4f30-97ba-6f5841d691ec", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81fd2a4c-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681985828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985828, "uuid": "1746bf38-9ffd-4e19-af0c-bcd84d67fc27", "comment": "Malware payload (AgentTesla)", "value": "896b49f63d69f022d9a8716c3883c591", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985828, "uuid": "cbd4fec4-17e1-48ab-bdc8-c97c321b9c6c", "comment": "Malware payload (AgentTesla)", "value": "193e2444ca045fd813211cd2c4093f882b6d0bfe183d7a66ad3492bf90b00d3c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985828, "uuid": "01313dbe-cd72-4d87-866f-2a837e662836", "comment": "Malware payload (AgentTesla)", "value": "9aa77467347f5703869840fc2533cdcec5476aa3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985828, "uuid": "f0e359e3-07ac-454f-b6d2-67ddaafa48ff", "comment": "Malware payload (AgentTesla)", "value": "47f990fdb99465877dd107039560e230278cebacb87eab361139c61e4ea3ada42e7e8d1db76dcb9445eab591dfb2c3cc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985828, "uuid": "be13f75e-5cd8-4948-b4f4-512af550a2ff", "value": "T1D764125832A0C493D86722703E3D93329FF2FD1E91B2AD1717D5B65DB6B2291825E323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985828, "uuid": "09139b0d-fc9e-4c9a-9bd7-55ae7527edc3", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985828, "uuid": "93b94243-e176-4fa7-b2bd-ffe26fa2f708", "value": "6144:pYa6YXkwBZxQsFgu6YyffB1MZubkRHXrRx8MDcop4aqPALSVEPPtuhSeIVNxK:pYK0wBZOsNoB1subkR3Nx5Fp4aqPysIo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985828, "uuid": "c43b0ee7-e0bf-41c1-bfca-d46309c461f3", "value": 316016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985828, "uuid": "55c29e03-31c6-4f7b-8450-1ae092eccf87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985828, "uuid": "babe824a-31ff-42c9-880f-84bb2d1d4f78", "value": "RG098654578-09867.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50e8ff53-dfa9-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1682015381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682015381, "uuid": "0369176c-853e-4b52-ab5e-f7b6fd7bfbe8", "comment": "Malware payload (AgentTesla)", "value": "ee1b10319caecabab0da68953fffe7ef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682015381, "uuid": "9b599fe1-2437-4d83-b677-93bf0defe9ec", "comment": "Malware payload (AgentTesla)", "value": "1a37b22c671459258c8f420f9a6934dda93eb9c700ea86f390193dea31316724", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682015381, "uuid": "9bdc3325-c336-4df3-8a59-6b6b170fdd42", "comment": "Malware payload (AgentTesla)", "value": "e3161500917651893bf4f38d792fb6f4fe88a94c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682015381, "uuid": "85170219-4512-4844-995b-a86313b9890b", "comment": "Malware payload (AgentTesla)", "value": "08af8a404635402510eff7cb80239224a0e4e82cfd8cfdf8fc6a2157f29d29cd085aecc2a6db0c5b59c2fba18db42e18", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682015381, "uuid": "bdf3a21e-a3e3-4b4c-aec3-d9310b9a5969", "value": "T11ED4E0E17027A792CB7AFEF4232D25351FF242B7E500D46DBE0D64D93931BC44A582AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682015381, "uuid": "0fbdb929-fe22-4d6e-9794-71f026bafc7b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682015381, "uuid": "2d6eb543-2355-4750-b4f9-a7848a64bfa0", "value": "12288:gGRflPa0ap7+wh6bfQmr+eEoM+v/agklrbTDm0W9M6:56Lcwh60mr+Nodv/1WrTma", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682015381, "uuid": "254d71eb-d86e-40cd-9e90-570cb97bea3a", "value": 610816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682015381, "uuid": "3b804e85-5c93-49be-8701-6b0af22d7107", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682015381, "uuid": "dda59f53-d05b-4482-8f16-b94e447538f6", "value": "SecuriteInfo.com.Win32.RATX-gen.3367.22786", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fce02f4-df9a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1682008830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682008830, "uuid": "1a3bb419-e605-43ce-8dd5-14a936530f65", "comment": "Malware payload (Loki)", "value": "9b17b42801adcc89935913cdfbb3999d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682008830, "uuid": "95c961c2-b484-483d-b469-3cf2b5965482", "comment": "Malware payload (Loki)", "value": "1aa1a9e5b07f7e5a5d4cfb16aaadd4a68e2bd76c42f96e932396ccc8d5f18785", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682008830, "uuid": "e4232d3e-747f-428d-97b2-2109ab8cf35f", "comment": "Malware payload (Loki)", "value": "209b4c38dcb62c258a1211bdf0deb2a0707c991a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682008830, "uuid": "8a450059-7664-4aef-84e9-33481ea8ad4b", "comment": "Malware payload (Loki)", "value": "276abe3be63640240e5035e9625ab84257a509f75e078217ae081074249b953999e53c1774c40c0756f018d720899be3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682008830, "uuid": "0b11b193-67e4-4c2b-b22d-e80b95e17e1a", "value": "T146C4E0D95356D7E2C2253D7C226A716D2F7044DBEA6BDD22FD89619A3D31BC80F0038A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682008830, "uuid": "54a0a48c-ab18-403e-b150-6af58b6b9df1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682008830, "uuid": "6bb176e8-204e-4c6a-aafa-76200ec08007", "value": "12288:j2iNu/CqxRVhNaoWgJ2ENAFaGiemD/Fuf6K/L:j15WxZ3k2tjVKz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682008830, "uuid": "d64229f0-18a1-43ea-b98b-8f7f1edd282c", "value": 584192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682008830, "uuid": "094d0860-5ba4-43d8-8bb6-f062af338ecc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682008830, "uuid": "d0637408-2e2a-41cb-8988-1970d49decb5", "value": "9b17b42801adcc89935913cdfbb3999d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9dc3b95-dfb3-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1682019933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682019933, "uuid": "f1c8a351-7db4-4b1f-a530-17276beac9d1", "comment": "Malware payload (DCRat)", "value": "18ee18fe6d018e474d041a4bf270bd77", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682019933, "uuid": "ad341076-0830-4ace-958f-03da701d3eec", "comment": "Malware payload (DCRat)", "value": "1bbfe2b073baf26174bd282af2a5f91bdfde0ba917af6e0f5408e865e7fe6e39", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682019933, "uuid": "82c1334a-04cc-4b66-a66c-5145ba18604d", "comment": "Malware payload (DCRat)", "value": "c2a61b1cf51bfccb5bc4f96994ff237155483816", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682019933, "uuid": "81117a60-5807-4c30-8825-9c339c0b800f", "comment": "Malware payload (DCRat)", "value": "b97fa4a84d34b36e95187b533cbf0443630baa05b3dc9d65656922d7d0ad3f295872faacd26b5d7dcda4088fbb48ded1", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682019933, "uuid": "7fa024de-be69-4bde-bff8-0f89ab7519ea", "value": "T1B6351203F9C555B1D52214320625AB10BA3CBD301B668EDBA7E97A4EED321D0E7327B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682019933, "uuid": "ba88b229-bd44-4366-8cb1-f225ae87988a", "value": "aac51396886833dc961fcd7aab7711e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682019933, "uuid": "294efbbe-02fb-4aed-ad61-e9908651bf39", "value": "24576:ygZXoZUTVdt7KfwHYBLYLA57iozXivRW3VpHSb6t/mE+oY:xvHYiLo7BKR4VxSd7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682019933, "uuid": "fdf63883-d45f-4fd7-b01d-eb9835aa3de1", "value": 1073481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682019933, "uuid": "c54bd76d-6578-46d9-a896-02913c01ed66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682019933, "uuid": "0addd283-879e-4078-8b06-d190dbdcdd65", "value": "18ee18fe6d018e474d041a4bf270bd77.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e693abd6-df3c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681968817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968817, "uuid": "d876a82d-772b-417d-bb02-cc7572974d0a", "comment": "Malware payload (Mirai)", "value": "5834c785f1de664a76cda2b607d3c055", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968817, "uuid": "c8901e9c-690b-4e04-b0dc-400eb896f3ac", "comment": "Malware payload (Mirai)", "value": "1be389dc1b9522f7563ce643e1d2307bff73ec3cb4e8cc3cd2de5312e6a25d6f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968817, "uuid": "8713033d-8f80-49f2-81ce-bb1473c9e75d", "comment": "Malware payload (Mirai)", "value": "829356fd82a4b378ee8c2d352fc41474f0c0f4bf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968817, "uuid": "134163b9-00dd-43cf-9477-6cfeeba09c3d", "comment": "Malware payload (Mirai)", "value": "723dc8ada23768ec0aa08169114d26b280f83de16927bab6605c9031368dc85c6941ec7477f2a59a29670e225e3cfd3d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968817, "uuid": "eb766278-6288-4981-9a03-d6a0259dd1cc", "value": "T164633B9AF802DD7DF81BD77A4453090AB630F3D502831B37639BB9A7BC721981D22E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968817, "uuid": "ccc6031e-56c6-4a97-a79a-aa604a66946f", "value": "1536:UEgwFPlEJcngDYb/7O8V5jc1vxZ+45dJm7+dbsWhjQxa:UEggPlE+gET77c1pZl5/mWdYa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681968817, "uuid": "1a347dee-f058-49e9-8051-e8c6343f9678", "value": 69628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681968817, "uuid": "63429395-5c64-432b-82d7-1de5a8cabd0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968817, "uuid": "830e639d-1254-45c1-808b-d0cfdec09498", "value": "5834c785f1de664a76cda2b607d3c055", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1bc548e-df10-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1681949938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681949938, "uuid": "c2542d34-b0f3-4966-a928-8a9b18e02727", "comment": "Malware payload (RedLineStealer)", "value": "7a009d1495687aab7ce431fb0baa06a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681949938, "uuid": "49f64996-7619-484c-9a23-80c588a0fa16", "comment": "Malware payload (RedLineStealer)", "value": "1c0bc9122df8294adfe2d32266ca345c8c27d1b621a5660ec9509d3b3008d8f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681949938, "uuid": "40c64daa-06c0-4e14-b651-a35f31af6bff", "comment": "Malware payload (RedLineStealer)", "value": "181d718c11c0059108fec46615df45cf8c01f2c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681949938, "uuid": "7ba598ac-6c5e-42d1-8841-2cfdc7f7db4b", "comment": "Malware payload (RedLineStealer)", "value": "705c894d703bf9050653a813cf5c41573c2138cf7be0e776ccf1ae6c30134abd3b45a4e75c8cfdc0fecf529cb0b88a44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681949938, "uuid": "b6bec799-4aed-4521-9b96-dd5713783c48", "value": "T1D84537082FCD84A1C4EAB43138F08371B779773005706AAE3FF5A92B4E529F1957665E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681949938, "uuid": "012eb2c1-1619-493a-a17a-d26811bb0063", "value": "2ad0bbe7b488ccd9b02faf0349f3e503", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681949938, "uuid": "20ec9629-38e1-4aa8-b16e-1bd09bf4785d", "value": "6144:OG1dDszSc/wXmkAOkKbndsQXA72ZiEm1uLaddm:f1dDsqKk6QXA72ZiXAa/m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681949938, "uuid": "9249c748-4b09-4847-a1ea-1274f3658871", "value": 1257472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681949938, "uuid": "f39664f6-67d5-47aa-aa65-7dd43ca22746", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681949938, "uuid": "abe073b1-68e4-4c5a-b0ed-ec7422161ae5", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44b80797-df3c-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1681968546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968546, "uuid": "27b53787-fd82-4332-8db0-de822bbc7fc2", "comment": "Malware payload (DCRat)", "value": "6bbe726191eb8f53f344829c9966bc28", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968546, "uuid": "aae6aee7-61ca-4ea8-bbef-4253b8e674a0", "comment": "Malware payload (DCRat)", "value": "1c155a35a8e818aaa932583062be585a0b13f950ec2e69d4a68891c3f30ebc86", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968546, "uuid": "4c2cbb0c-3658-4f6d-8319-eabd697d7270", "comment": "Malware payload (DCRat)", "value": "d4bebf44db9cab041ef500d851ab674e0f4940da", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968546, "uuid": "28d5b2ec-04f0-49e4-85e8-94e3c66f3a1c", "comment": "Malware payload (DCRat)", "value": "92eb7d65e7e8db075bc1f370f0ca4b3f16127766251cbaf6d80e6d7dfb8ea711d8c7e59a120c182bf188d8175078e33b", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968546, "uuid": "8800a189-bf74-47fb-93a7-66caf4d0b518", "value": "T1AC859D027E44CE51F0181633C2FF458857B4AD502AA6E72B7EB9376E9512393BD1CACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968546, "uuid": "f2b4bc14-13cc-441e-a5eb-f6178bf0a6dd", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968546, "uuid": "94123552-7427-434d-a4aa-14748387ece4", "value": "49152:ubA3jetcO1Anlk0jXHEZuRmw+POsiu4Kt:ubj21nmZy/3wz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681968546, "uuid": "a621245d-dfec-414d-b4f9-e6e9881bc706", "value": 1763379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681968546, "uuid": "a77feb9c-f4ae-46fb-b231-253e03eacd8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968546, "uuid": "63a5bda7-40ef-43b3-8417-b0e22a011dd5", "value": "6bbe726191eb8f53f344829c9966bc28.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "466a0cdf-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681985728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985728, "uuid": "67d87647-ee58-4b9e-bde1-285f6030beea", "comment": "Malware payload (Formbook)", "value": "de907c0463b7b18118903ac88bdac2e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985728, "uuid": "52a8f7ac-cdf9-48d8-891b-f3de21284cf7", "comment": "Malware payload (Formbook)", "value": "1c1b55beed14a73d6c5447b9914e2219dbd018cfc3484e72e258a053b7176ed4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985728, "uuid": "0b6bb08d-7f24-4fa3-b373-4c4bf7561102", "comment": "Malware payload (Formbook)", "value": "4d99262c385d6e9384c52ee0b654a39aff70ddf3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985728, "uuid": "80bca08f-44a2-49ea-95c9-ef836d36d9a6", "comment": "Malware payload (Formbook)", "value": "3262a24098739e699cd3c568733e0f4221cf9520fbb47acc06390b877a6bf25ed8343394287227a6186dbec3fb0c39ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985728, "uuid": "16eb0cff-d2f4-4b9f-b50b-cfc69931ccde", "value": "T11C04AE32D602C071E2B251B5F67C1B7B883E0E343694A4FAE3E115A16EF0995F52A31F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985728, "uuid": "a403a399-5574-40ed-8e17-9b2f80b13bab", "value": "3072:K8QnUQwBFKRujtBxb7ZMcR0j2ag8GYFsh9h2mQlufoRR84gHy0QtHnqkQ:iNFuHl7ZMcuj1K9CufoRVgS0SHc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985728, "uuid": "ba256886-3a31-4672-bea6-41e07eef02f4", "value": 186368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985728, "uuid": "7f2a95a9-af6a-4f87-96a4-c75d211619be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985728, "uuid": "785f6f44-9276-49a0-a7c1-6e2b469e0858", "value": "1c1b55beed14a73d6c5447b9914e2219dbd018cfc3484e72e258a053b7176ed4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f895c14-df3b-11ed-88f6-42010a9c006e", "comment": "Malware payload (WSHRAT)", "timestamp": 1681968027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968027, "uuid": "ac9b0727-e5d1-401c-8d65-f9f94385527a", "comment": "Malware payload (WSHRAT)", "value": "8faf36edfae1ec0e8eccd3c562c03903", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968027, "uuid": "17cabddc-6796-4580-9e69-6fe5d79d1241", "comment": "Malware payload (WSHRAT)", "value": "1c546a6548beda639640ebfbb52abd5f6013c33500172cfccf0e8716c96bb196", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968027, "uuid": "b41522c2-7361-4979-b1ca-3e9581e44b1c", "comment": "Malware payload (WSHRAT)", "value": "0c44c3c6291c67c4eae6e1f8238f098adaee1a32", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968027, "uuid": "b96cea8b-c8fd-46ae-9941-b7bd0798acd7", "comment": "Malware payload (WSHRAT)", "value": "fe0c071eb63b3fc8eb9b0e90f9809744a3df9f0f7e83c87212a54d703cad2ff06c99abfba78d68dddf1b79b9f48a2ed1", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968027, "uuid": "111328f8-0985-40b8-8b4f-d0a137abd987", "value": "T1CDB4B90A3D87F93A199F3C05A9B70E364E4DFE22C118911B194A5F7883E3B48577F929", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968027, "uuid": "6681f66f-37c1-4f99-8c33-db08c28bfbe2", "value": "384:Lu1hvWiWMmkNULg4viK3Ai44MXziJGUSJ0Pw6qVskjhj6Zxc6Xx0f3+hFx+gItIL:cvO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681968027, "uuid": "e567982c-44a0-4a04-95e2-3d0f665b186f", "value": 540285, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681968027, "uuid": "17340ca1-5c1d-4986-8b58-787f8e5a6063", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968027, "uuid": "14061ef5-bd8b-4d36-aea1-2adbbaba409f", "value": "Purchase_Order.xls.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17c21b84-df61-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681984362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681984362, "uuid": "8ee84d69-a30e-4b78-af8a-64eba03fceb7", "comment": "Malware payload (Mirai)", "value": "59798b354ddebb258765ba5007466a16", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681984362, "uuid": "a2842a0d-08c8-4c58-a938-cee4eeba85e3", "comment": "Malware payload (Mirai)", "value": "1c7d5393db690c25d8d5aede0037f75196c23a158127555a8daf7dc7d358633e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681984362, "uuid": "fce62278-fdcd-4e8d-88d8-4c731b95346a", "comment": "Malware payload (Mirai)", "value": "e63a19da7cae578a754e214f330b0a6ca25b1887", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681984362, "uuid": "6406df23-1a12-4ac5-a8e8-458625cdcf3f", "comment": "Malware payload (Mirai)", "value": "e8620aaac4793efb81518548d74c94ae52cc76adea00f3d59ff6a720492a6adb88da52a1d5969c685d48f9b8a2bf3e20", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681984362, "uuid": "250affcb-6fa6-4799-83b8-c1acb1573af4", "value": "T1BA933A07B71C0B53C59B5AF12DAB3BF08B69B9E013D76185A10AEFD40372EB12512FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681984362, "uuid": "0b061cf6-71f9-4f4f-b517-5572c33df4fb", "value": "1536:wQKNfnzXd9Hj5ViBjMBVcfCUCJ3li118WREumXxVqDrstKfz9e:wFLTltVcfrMwaumXxVqDrIKfz9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681984362, "uuid": "2258ef65-1dfc-40f9-8cc9-bfc10f0bdefd", "value": 93896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681984362, "uuid": "ca159a39-cb21-41c5-9002-26f002e3f93c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681984362, "uuid": "cc6d938a-b0fb-4aeb-97f1-dca725cb8df0", "value": "59798b354ddebb258765ba5007466a16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea20f0ca-df55-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681979561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681979561, "uuid": "b829efcf-944c-4211-9b73-e44cd3cf0615", "comment": "Malware payload (Mirai)", "value": "69165b0d872a92190dd9ac44d80835ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681979561, "uuid": "e40b5e11-75d1-4171-a0f4-1cf1b7797828", "comment": "Malware payload (Mirai)", "value": "1f5f85103f382c72819546cd76d77ea0b172b287e381b0db051dad779268849c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681979561, "uuid": "9f335315-a6b4-4e97-a9bf-7e587630787d", "comment": "Malware payload (Mirai)", "value": "53a3a47054fda54e5a788c411c9f158caffea67c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681979561, "uuid": "c3ec421e-a704-4484-ae05-f0f93f62b9ee", "comment": "Malware payload (Mirai)", "value": "9d90068865201492612add2f664bd594d22aef04be097448df6a77cc34791f766a2e7a84c106be4c07ec97354d9deeef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681979561, "uuid": "6cc2864a-be57-40f9-a34b-1426be92ae6d", "value": "T1E524191A7391C8BBC19351B41ADBBAB2D860FD7C1631554B37A87F282B3ECD94829743", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681979561, "uuid": "f21b2ddd-6fe7-4239-9bec-44f2f433cde9", "value": "6144:0g2tR1TUBqZRHZrzRPJa9g2HRh1tzhx/Y7qwqJLPPPmZWD1X1x831yKP2:0KY7EJLPPPZD1X1x831yKP2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681979561, "uuid": "a66a3199-fd40-47ee-8ad3-111532633663", "value": 220065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681979561, "uuid": "e1d4ea8c-8c4d-416f-b6db-77724868034f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681979561, "uuid": "768ed056-3caf-47df-90d3-111ce040beb4", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "936f9b7f-df31-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1681963953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681963953, "uuid": "fb3067ec-fdc8-4f73-bfb5-8d9f08737b99", "comment": "Malware payload (Amadey)", "value": "b17cb83a6f3fc4a95c87c1a21dd3d243", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681963953, "uuid": "4186f7b8-1f85-4f94-98e5-8daf49f653cb", "comment": "Malware payload (Amadey)", "value": "2049f6849586033278076a923d69e9570857b677f61999d50ce7869c9b620830", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681963953, "uuid": "1c0fde7b-6f36-47b9-b832-b82c4f239b1b", "comment": "Malware payload (Amadey)", "value": "4c80f0747a4a0e949ff65a9b11ebc44be724dce7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681963953, "uuid": "6527796e-51af-45de-a0e2-6df53957ac64", "comment": "Malware payload (Amadey)", "value": "3b7321d5a0bddd88b250826f4cf86c923366552ede51b84413185002f0f0751156310e41ef753a73458dcc4de420948f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681963953, "uuid": "95c32387-5ca9-4fc0-90fb-79ad6adf28b2", "value": "T135552362A7D54122ED69233418FA03932D76BC91573587EB31C0AECE9D722C87635B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681963953, "uuid": "706878e7-8042-4433-8689-faada02b6782", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681963953, "uuid": "00922eb0-9721-40ca-b990-2d0b1400e0af", "value": "24576:iyxPnBnkZXImPk6Cota6EUj8Oebm830Zgbaqahu3QDRiikg5Os:J1nBnIkrQeb1wfJhu3QDRY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681963953, "uuid": "b2cad6a5-a198-42ba-8f5a-123975642c94", "value": 1381888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681963953, "uuid": "be96e7ab-3400-41d2-a662-20b83289deed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681963953, "uuid": "4300c36b-cc53-463f-b9f2-e4e57bab2211", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5230c4e5-df5d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681982742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681982742, "uuid": "23bce351-01a6-43a8-ae29-2ffaef2cc761", "comment": "Malware payload (Mirai)", "value": "302db0be87a0493719bbabccf414c461", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681982742, "uuid": "ca45b104-abaf-49f7-b671-e514a6600c32", "comment": "Malware payload (Mirai)", "value": "21871d90e17c9597b1262ef924f28923d0bc126fc49a8ff6ddd2df3791d88d0d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681982742, "uuid": "f5b42f4e-6f1a-4f20-b780-953d510b6eb9", "comment": "Malware payload (Mirai)", "value": "b074d866874c6b02e2591ea3994ee96339bcd956", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681982742, "uuid": "af15a6e7-5b93-44f5-8932-70cdcc84689c", "comment": "Malware payload (Mirai)", "value": "d48460b176f6cbcbb826f1b364c451c1608e3e2249a2177782e5a6a70924a3ff83129ba1bbac2bb43b32f39fc55162cc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681982742, "uuid": "4d5142aa-fc92-4088-884d-dd6dc5e237f9", "value": "T18A24084AD5515EFBC011A8767CFF2A600B2CB9921A1F1DE5653CABA4037F5C7A00FB68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681982742, "uuid": "61860032-0a46-4d9f-bd58-8928ac6a80a4", "value": "3072:3c/OXFxIYRayXOswki19hSJK7vJ2bhDg9MaF+nUgCL:s/OXfIYRg9/hSJKJ21Dg9MaF+nUgCL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681982742, "uuid": "822c1618-610d-45f1-aeac-0bb9d0568a1e", "value": 227424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681982742, "uuid": "07eb9e5b-2245-4d02-b855-d1ae06fc71eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681982742, "uuid": "6f2d8486-3f6f-4b17-acc7-bcaaf893b377", "value": "302db0be87a0493719bbabccf414c461", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdbd4982-df3c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681968856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968856, "uuid": "68a5fe47-886b-4e4f-a7b6-3d871b39e915", "comment": "Malware payload (Mirai)", "value": "aa5f984e65f40f9d1b4346e0e63216c7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968856, "uuid": "fbbb31e2-7a3e-4959-b530-d0e9f105acbc", "comment": "Malware payload (Mirai)", "value": "218fe9da113b9452350786c8666d471949058ca172f0e2e56a5503f0f988f1dd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968856, "uuid": "f0183d5b-3332-4e7e-945b-c18fa85967cd", "comment": "Malware payload (Mirai)", "value": "8946a730d5042afb06968a43e60bc2c14f7cb806", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968856, "uuid": "ee886490-f257-4c20-b633-8e4bd093e184", "comment": "Malware payload (Mirai)", "value": "171a8925596c3cf5ab2b02c7269d31baa58404ecb52093249a4af746fc6846d81a531e04e7b2620fc76e4ed11ecb9969", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968856, "uuid": "2be7d98e-453b-485e-b8e0-dd1de2d7fa00", "value": "T13A83A51E7E228FADF76D823147B74E25A69833C627E1D641E16CD6012E6034E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968856, "uuid": "78558e2c-62ad-4f1b-9a54-9fde3a8f1e57", "value": "768:2ty6IP7M/kq0INRhfuN2Eo9tl/de2YIwHKRH0I84EH6UT+7ZDYovZ73x/nL8y8Q4:Rakdn2Eo3ePu5GT+RYo99Be037Wt/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681968856, "uuid": "68e1f34b-f17c-497c-b452-5ab075ee2dea", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681968856, "uuid": "0c0081a8-9e27-4ab4-aba6-b679732f4ab7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968856, "uuid": "c661529a-2472-4d46-8cda-22c04d225821", "value": "aa5f984e65f40f9d1b4346e0e63216c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52a66166-df86-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1682000352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682000352, "uuid": "c5b88be8-be5b-4554-b7fb-a9e1f4767d7d", "comment": "Malware payload (Mirai)", "value": "027a63053631c6398b721a19ffc32110", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682000352, "uuid": "1bb2f267-af3c-4d00-8f69-2a3cad49b234", "comment": "Malware payload (Mirai)", "value": "2283b78e573a00dfedd867bbfbb89c77150555b4165ed3b8a82a2cce6893b376", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682000352, "uuid": "a5726aa0-6f91-4e01-a36f-25c5810d7a00", "comment": "Malware payload (Mirai)", "value": "e8f52a140fe3b7879f4eed161b68534b4bc4bc77", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682000352, "uuid": "0815e438-a29b-45c5-9ea0-9816f3e04dbc", "comment": "Malware payload (Mirai)", "value": "02c46e73e9753511b6dead1bdd7674c7f364ff7401908867cbdd27a02327ee1835f4443f66bd3e407dfa7df501393a6a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682000352, "uuid": "556351fe-6db6-487f-8712-3de3fa82daca", "value": "T1C1232996BC91DA0ACAD023B6BD6F64EE330163DAC2DE3247DC145F2436CA90F4E67645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682000352, "uuid": "b3ac828e-44d4-430d-a538-e14f59f89c4b", "value": "768:1TOD91Ug/ghNHSSxyhI7QgHZqx4F+ErnZJffui9eU5SpwpYWaBESO3VeeB16Y03y:wKgYjHSS0ucxUrn7b9Spwq/u5qZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682000352, "uuid": "b5b7a6b5-f706-4f69-8d6e-e3fadbf29563", "value": 48260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682000352, "uuid": "8f208ec5-6978-497e-ab20-9b70cf264b0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682000352, "uuid": "1634235b-ce8c-47e6-8e92-9ab97eb7f665", "value": "027a63053631c6398b721a19ffc32110", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65ad722c-df7e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681996948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681996948, "uuid": "d33b2bc0-30fb-4504-85c6-80d4f81b2b06", "comment": "Malware payload (Formbook)", "value": "d9f7f793a95efb38e1e5dfff61fab2e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681996948, "uuid": "896290ff-bf64-4166-bd80-7ded0354035e", "comment": "Malware payload (Formbook)", "value": "24f98f7fef3de7a8c4ae83117f7fed32c749684bc87cdcc7d1c96236d7278e03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681996948, "uuid": "6a31e248-bbf0-4f07-bb7c-0d03aa02ff2e", "comment": "Malware payload (Formbook)", "value": "79c866473207de090c75122570ffc4cb97ce5f25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681996948, "uuid": "5ae27ac2-e86b-46ab-b6e5-8aefda987017", "comment": "Malware payload (Formbook)", "value": "8b4551b5fa68b0d97cf9284b5234955a78f3995476311725753b772c4ddb5bea9a21b9ec4ab185143e54b8ce69f123ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681996948, "uuid": "9359537c-68cc-412a-b34b-760fc842cbec", "value": "T129F4E1D5B356E791C2683D3D52AA60242B709DCBF926C929FDC831593E377C90E8078B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681996948, "uuid": "0c67e8f4-cbd6-4f40-9e41-18a1a1d5c56c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681996948, "uuid": "7ffa6de3-5053-48ee-ac68-dc0fc4cec8b9", "value": "12288:JR/kLHMH91DzZYhmMJzJiPm2d73Amc1LGtWVNpuF3MCT:JOLHMd1DtYI8zAU5Xu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681996948, "uuid": "18517aea-214e-4ba4-8a1c-0c9f6769168f", "value": 773120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681996948, "uuid": "29bcaa56-ea70-4285-b3bf-44ef25f8e13c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681996948, "uuid": "a8e690ff-c868-4f27-93cd-77e7f8596240", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80772fd8-df3a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681967787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681967787, "uuid": "c20bf38c-a030-4fc7-a818-019a256bbc18", "comment": "Malware payload", "value": "d4c8457d045c264502fe0f6b8e400d5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681967787, "uuid": "1b226376-fe3f-4b2a-a6e4-e429a790f8ab", "comment": "Malware payload", "value": "26506c66bd96c236957e4efb0475e43b0438a64b947e612877dee3e7ca35cf8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681967787, "uuid": "26960519-5e0d-43c5-85ec-07745fe25cb0", "comment": "Malware payload", "value": "7808767234e230582e21ce8f5e21c8007759464a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681967787, "uuid": "e335e876-f1a6-436a-ab66-2ad04040cb2a", "comment": "Malware payload", "value": "6ef77770ae4673687bb0d7fbb060ea17a35f90db02924ce25c0b25e266855469ec417bc3ade07027a81115beb9a39e20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681967787, "uuid": "555eccc6-3c9b-4f19-b4d0-006b8523effa", "value": "T1CFE633527EC686B2FD26ACB617AB63238E7C65445FF783CF2F810A044D151825533FAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681967787, "uuid": "85d8d179-6f73-4562-8761-2fd56c7e60a4", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681967787, "uuid": "fa7e7869-8447-47b2-802d-7d77f2cf8463", "value": "393216:HkjTn761i6Q+rrpjOYqUakGkJ0ua2LQhOziLWNpK:a7611QgpZl7Gu0uzGOmLWi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681967787, "uuid": "a7262bef-84d0-4682-bf3b-5bc70d093875", "value": 14139299, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681967787, "uuid": "7ce7ad5e-275d-423a-9f9c-ee14bcb5b1ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681967787, "uuid": "dbbbb415-644e-4be0-ac5c-6fba7a38f0f2", "value": "d4c8457d045c264502fe0f6b8e400d5d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86e172d1-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681985837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985837, "uuid": "b86a5ba7-87d6-4ad6-a293-d65f12226180", "comment": "Malware payload", "value": "698314e88ade9ef427cd2a4fcf240618", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985837, "uuid": "f8371937-b8ee-4966-ac25-3b57c9d6c8e1", "comment": "Malware payload", "value": "268dabe8bc274814e3290e5717feee6ec7f12164e6ae837fe8e75c994f37329c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985837, "uuid": "84774150-b057-4b51-93c6-f304093acac0", "comment": "Malware payload", "value": "ce1f8727283c6bca5cdeabaea06d6372047c11fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985837, "uuid": "c0346788-e259-4ab4-a0d9-7f9f0a409d3f", "comment": "Malware payload", "value": "8b9dbbd60d007020529de46e6ce3583882b4e63e0dec88428bba94840e0aeee2c7789ba4aec33a5924a7736c85f91037", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985837, "uuid": "92e4d0ec-caab-4ce4-b6f7-523ec4c2c468", "value": "T11104F7D42E948CC5DD904A39C3E1A7F153BF7DE8C62193422F30DE728A1E5B4D49A3A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985837, "uuid": "3bb0b865-b522-45fb-bbce-dfa6130acb15", "value": "a808411a04557309a9c41f351b379c88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985837, "uuid": "12adbf9a-bea7-4f83-a6db-f683ca3f0879", "value": "3072:61Snoq0xPJAa7O09bftx8Oq4KqDn6b6G2+PnqpZQIMC9TKNPuCY:zoq0x6a609Dtx8Oq4ZD69vuZQIN9TK1E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985837, "uuid": "c543f03e-6655-4739-b3bb-18a657fb1cf4", "value": 182567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985837, "uuid": "23098ffc-066c-4c88-9b9b-a7d9f6226894", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985837, "uuid": "214f2131-c4a9-4244-8f4c-4aa5ba8c287c", "value": "tumueble.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daa50561-df36-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681966220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681966220, "uuid": "69d69099-f1d6-48ba-9266-58e065d30b65", "comment": "Malware payload (Mirai)", "value": "567009d5abf8b4feaa3d917fdc41cd38", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681966220, "uuid": "01f32958-b96c-43dc-a455-d90ed76ff013", "comment": "Malware payload (Mirai)", "value": "26e558327e879c11e818f3d0e4352c36b0ba889cbac13919c96cf171319c1d12", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681966220, "uuid": "ad9046cc-0978-446c-9676-50a89c4079ed", "comment": "Malware payload (Mirai)", "value": "4b958919e79c8ea145b1b7c70d234e088ba7fb23", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681966220, "uuid": "4a9c833d-989b-41a6-96cb-9563f9e07809", "comment": "Malware payload (Mirai)", "value": "9f86976437a9cf0ed27006045b13de0928061b4f9986b05bb7c5cb0b200f0f55fc957830d20338927716fd5e1b784bb1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681966220, "uuid": "0d45b8e9-d6e0-44a9-8340-a8b665822fb4", "value": "T1B1434AC1FA43D8F6DC5705701077EB3A8B32F4F5225DD643D7A59A32BC52602EA52A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681966220, "uuid": "ba9b7efd-b5d4-4742-80d9-b824a6bd61a5", "value": "1536:eFnRnVEI342TK5xZYwU3GCIX1rdOnBkr8SkKELrMM8:eFnRnVEI34kKfZnU3GJ1rEnYXjEMj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681966220, "uuid": "dc711593-364c-4aba-9bc9-55a17873a1a7", "value": 58672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681966220, "uuid": "0878d3f9-4321-4fef-bc01-840a86004607", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681966220, "uuid": "ac5076e8-4e75-4d74-8801-5695c925ad33", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "632c303f-df5d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681982770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681982770, "uuid": "d3db5149-d1b7-4bbd-b69d-4f7e99469948", "comment": "Malware payload (Mirai)", "value": "dc3df003504df9883312f1319e8f36c1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681982770, "uuid": "02b23eb3-3e6e-485d-94a1-9826a70cd079", "comment": "Malware payload (Mirai)", "value": "272985b04c0a39e3c098fab5252a8a933f9de00198d3077f801aff6cc01f25d4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681982770, "uuid": "7a2cfbf7-be90-46e2-8396-3a6b025e8d67", "comment": "Malware payload (Mirai)", "value": "5e6a1d34824362d9e87304bb267ebe555b466ace", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681982770, "uuid": "76dd81cc-e903-4212-901e-b99a5c8fe51c", "comment": "Malware payload (Mirai)", "value": "05426db6b8684f38048f0ca7bc3f697621f63056e7067271e3a7fdfe87ecc6b72c0f014476823ec9396f33d047f8e394", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681982770, "uuid": "f1195672-979d-4e85-ba1e-4b65691381f2", "value": "T143C39517BB619EB7D81FDE3305AA4902108DE58A12D96F6FB2B0C92CE74B94F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681982770, "uuid": "6d59df9a-a76e-457c-9845-42be39a6f90d", "value": "1536:/cHeT5CAms/Y8Zm3lKYA43gMJwSkJ8Epko1DlIrmW+IFB1Df11hR/:/cCLqAmgMJM8EOaDlIrmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681982770, "uuid": "e7d79e86-503f-4642-9aab-0567ce319d64", "value": 126039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681982770, "uuid": "c2d79cf3-54df-4450-b037-7ed1ce5cb503", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681982770, "uuid": "8ff67dee-5615-47e4-b2ab-264d1aa67135", "value": "dc3df003504df9883312f1319e8f36c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61547c13-df54-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681978902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681978902, "uuid": "fd70f9f9-4dfb-4267-96c3-bed147569d16", "comment": "Malware payload (AgentTesla)", "value": "152b36e05527390e0463acedc9f09688", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681978902, "uuid": "8b18f6a7-9de7-40ce-81b3-a238a5d15bb4", "comment": "Malware payload (AgentTesla)", "value": "28471ea3ac3b278f41668a52712af9747df51f80fac749edaf403dbaaef116a7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681978902, "uuid": "cefdf649-69f8-413e-a2b4-cd30aca604be", "comment": "Malware payload (AgentTesla)", "value": "98e6dbc0daf8f87465c79ca0310c34bf3b6a6d25", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681978902, "uuid": "96f45fd2-365b-4811-8665-02d2ff071ea8", "comment": "Malware payload (AgentTesla)", "value": "beef93b7321e6e31d30c8b95339fb6465d7eacc29ae078479b4042e58aac033dbf3b4b3c8941caee812946c046b0ee18", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681978902, "uuid": "324b31c1-7194-462f-a381-e60ad8c0bc08", "value": "T1A1F412243311AB77EA7586BE04A0A5002BA55776351DE7EE3EC822A9EFC33134607D77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681978902, "uuid": "51c81acc-381f-44c5-8b10-4409c49857da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681978902, "uuid": "1a0b5af5-504c-4504-bd11-d427be0f7c8d", "value": "12288:7wc86XiHpfOA++GV+rpAgcXWEoC3uPtx2JTEv3upm9rn7xINAk0haS83rjzHEBK:y6cpfOA++tlAgknj3Gtx2JG3upm9/ADC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681978902, "uuid": "cedeb1d9-37ac-4536-955a-7af14ebb5b36", "value": 751616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681978902, "uuid": "73a8b522-0fe3-4312-87c4-a45f31688d0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681978902, "uuid": "2ebfb0d2-8a53-4b30-9154-d1f1063cb041", "value": "Ship Docs,HBL,AWB, P.LIST, Revised INVOICE and Amended CI.docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7193db54-df6f-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1681990525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681990525, "uuid": "a2389b78-9b51-4dbc-93cd-9af4b3a8b991", "comment": "Malware payload (DCRat)", "value": "c809062f8c74c3555143eec236bec626", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681990525, "uuid": "5226b52b-4410-4a10-956b-8ac7eb1c8a4f", "comment": "Malware payload (DCRat)", "value": "28c22038a27c2fef303d27617b00f70244ad1cc4b36d72875d17341e539d4ef1", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681990525, "uuid": "b7aa2908-d29d-4d4f-81b9-d4e0040c4c50", "comment": "Malware payload (DCRat)", "value": "ec57ce4a59096421e9a2edad45411cea658f41ad", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681990525, "uuid": "6db71135-2aca-47ec-9b9d-a348f2e86e60", "comment": "Malware payload (DCRat)", "value": "8e41a04f5e0e7102abb7164f886edc5f6c0cb28d2b5790343796001e571ba3146085fe7e5890c4b102223dd5ddf4d796", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681990525, "uuid": "eb1e5eee-4929-4394-8808-b5247f92493b", "value": "T19C556A027E44CE21F1086633C2EF454847B8A9516AE6E32B7DBA376D59523E73D0C9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681990525, "uuid": "95eb59f3-b3e9-4269-b460-6eb348a6857e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681990525, "uuid": "85375de9-f20f-4281-9341-81deecc7ec89", "value": "24576:SQGhgyp3PKgG0reey15j6IaXG6hCqsNbSv0P6N1:vGhrpFNIO5hCqWPP6N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681990525, "uuid": "d9343be7-a281-43f7-a37a-e8886f21534c", "value": 1328640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681990525, "uuid": "85e056dc-63c8-4f52-bf8a-5b1482b44b30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681990525, "uuid": "841d33bf-7c29-46b8-b824-7a889f8cf805", "value": "28C22038A27C2FEF303D27617B00F70244AD1CC4B36D7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "773cee09-df8d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682003420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682003420, "uuid": "52a60379-2b8d-4e8c-a6be-8b87445806cc", "comment": "Malware payload", "value": "3740c116afc0ee65c76cc33fe90ea606", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682003420, "uuid": "13059daa-39f9-4749-858f-5af444d76592", "comment": "Malware payload", "value": "28e4f08ebf77fcd69b22bfc7b3250da50606993892c0edce8828492e08484c38", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682003420, "uuid": "2962fa2b-eec6-4a02-8735-e2f99bf50bb5", "comment": "Malware payload", "value": "0031631134d69598feb0989447e68062ff7c6045", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682003420, "uuid": "2fb073cc-8e1b-4db5-844e-af11ae489ad7", "comment": "Malware payload", "value": "6119a88ad103bfea6f32d999b85dd0eb8be0a5127856d3f75531f7343e52af3d93eb4cfef9f1950e005885a26f6b596a", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682003420, "uuid": "ce8e89f3-3849-41aa-b938-d9939f89542f", "value": "T12BC62325B3C7C933D52C017BE85DFE1E1179BFA3073441E3B6A9799A88F08C162B9A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682003420, "uuid": "f3f6a89a-2d8d-47f1-b4bf-1f67e2a8ae51", "value": "196608:S7rnW5v+PbhhdQRKaulMn1mXMdWpk9dz8VKlVB5sIekpdFol/bw/Q+:S7mEbDdkKc1KMIpk9qVK/rZekPFWbw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682003420, "uuid": "87e3197e-59cd-49fc-913c-08594bb16f73", "value": 12138496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682003420, "uuid": "015793ba-383a-428d-979c-9882c54c71bb", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682003420, "uuid": "e77229a9-e13d-4842-b32a-56c5cc30e9c4", "value": "n_f_f_3_3_l_3_t_r_0_n_1_k_4_2144325345.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47962efd-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681985730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985730, "uuid": "ad54db8e-c2e3-4e4c-8167-bcd84ac9c95e", "comment": "Malware payload", "value": "904026387131118e9d6324bdd4d8a43f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985730, "uuid": "2168bf8a-f490-445a-966c-beae68975e96", "comment": "Malware payload", "value": "28f1d9193945d40b4dda9e5d716e2c5bfdd43e08a8aae3435548d54382fc0a29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985730, "uuid": "2b85463e-bb97-4917-9a76-0d5c4e8b9aaa", "comment": "Malware payload", "value": "90c29f10dc5194653aaf196c561375263c6ba09f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985730, "uuid": "12c68324-cd7b-4c53-82ea-77c64cb483ef", "comment": "Malware payload", "value": "ebba13a457ccc74476a02a3fbb72641af59787879cb195e9f66d087c91e550edb666da166830fa6bbc797eb493adc253", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985730, "uuid": "3a156e8b-25e4-4185-bbcb-f3c0932c7036", "value": "T17FD3181137D2D032D0A519315A2EB2B5967EFD210C6ABB0B2390F76E5D71781EA27F0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985730, "uuid": "e69e5319-876a-4f96-a929-25a14b2cee18", "value": "3072:xix8goO80R5cWTUUrruSYnnSbItFkwqklB7hqMoMCDku+JbTxtV:x68HO80RuyaLntqkv1qMooRT5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985730, "uuid": "b8818c61-ac8f-4df2-bef6-9709133fe4d1", "value": 141824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985730, "uuid": "c5f68af8-c897-4963-b833-98704d6622d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985730, "uuid": "d0a2ecb1-3ada-492a-a247-33dbe3f0da89", "value": "28f1d9193945d40b4dda9e5d716e2c5bfdd43e08a8aae3435548d54382fc0a29", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfb8759a-df11-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1681950311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681950311, "uuid": "f930f29e-f20a-4c26-8694-941e4b67a863", "comment": "Malware payload (RedLineStealer)", "value": "aaacecac7af4f7b15b2406db2f4498ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681950311, "uuid": "4e5f1c77-e60c-498c-a091-82afd7bff0d3", "comment": "Malware payload (RedLineStealer)", "value": "2947ca92fe7c388c14c5a16b506a674d6c732a183ec8e4aaee7f3f4d8fe9e0ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681950311, "uuid": "0393f562-a69f-401e-abaf-2653c417029f", "comment": "Malware payload (RedLineStealer)", "value": "fdfda4cc785717ec225cdfa22434a7d31cacb01f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681950311, "uuid": "05b6c2c6-4ba4-4c7c-82de-23b4140ce53e", "comment": "Malware payload (RedLineStealer)", "value": "28dda113945215e98d2b70c2c2292cb36d2cbc3c0e16f90eac5de9de0c1d227f22aa5817e7f51d0d484b984964cdbd9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681950311, "uuid": "3d7a2df9-e163-475f-bed3-55e12e4fa4d1", "value": "T194152242F6D94672E9F917B02CFB12970A36FCA15F7083EB2185BA986DB25C07530763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681950311, "uuid": "9d3862a1-523b-45d7-b25b-51d5be11e746", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681950311, "uuid": "6222f6c3-617e-4210-aa49-f5b57d6b7451", "value": "12288:jy90OCPz0HvHNULJrGORVVZd6Zmql1fKFtuA5KOIMZdwehwRaNGxOHaF3SLA7B4H:jyzCGvHGLECZdaKFt0M4XavHaF3Ret", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681950311, "uuid": "675accd4-8346-4352-adaa-a19d48a51139", "value": 940032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681950311, "uuid": "f76ddd3e-b537-4e85-937e-130631d33ae8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681950311, "uuid": "4adc7b6e-b7ed-4d0b-b7cb-3339ca34ffe0", "value": "za679391.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04727b62-df3d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681968867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968867, "uuid": "b08eb679-3638-4084-8da7-901625555af4", "comment": "Malware payload (Mirai)", "value": "ef4506d7ec512c01b7f63454a9c3186a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968867, "uuid": "47ebf5f4-be1b-46b9-88c8-7f1d38dc824c", "comment": "Malware payload (Mirai)", "value": "29683c2faa65ea853fafa0e9930d384227481e89b2d5c898d680c7fa87262b17", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968867, "uuid": "1adba36b-e9f9-4312-982d-0726affbd35d", "comment": "Malware payload (Mirai)", "value": "1553a034ee65c1d4c7eaacef727d1161dd206b3a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968867, "uuid": "6c057c2e-8737-49bb-9df9-41abb45eaacc", "comment": "Malware payload (Mirai)", "value": "f626c648abfcf0ac95c1e4df27d95efb7af73b355486163425499924c36569d90a67b379dc9015ac66032fedf820d820", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968867, "uuid": "cd497d14-0af0-454b-994f-99f4c94aeb09", "value": "T13D83D606BB510FF7DC6FCD370AE91702348C594A22A97B367634D828F65B24B59E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968867, "uuid": "ddbce48f-db99-4009-92b1-0272b23785d1", "value": "1536:iVLyu95KBbkj752dCexuV/8UZlDwfkJ4MYfW1:iVLyMg4Fezxu5VD1es", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681968867, "uuid": "18670e8e-96d4-4315-8030-32b4a779c3d9", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681968867, "uuid": "3dce0211-0022-4509-bb22-8d4f57fa1b34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968867, "uuid": "29806246-b1ec-49ee-992d-c7c1b2c22cd7", "value": "ef4506d7ec512c01b7f63454a9c3186a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "486b285f-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681985732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985732, "uuid": "13fc79e7-c3ef-4c88-8e55-6e2979015c58", "comment": "Malware payload", "value": "3cfcde4666ed491bccb5be1530167c8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985732, "uuid": "afa0345a-97cd-4a0a-b08e-7f0d549b61dd", "comment": "Malware payload", "value": "2986fe1f75f4b015e1fe33b800a3bb3fa76d5a4de9075c72c6cd8a62da80ac31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985732, "uuid": "1b2130c3-f6d9-4e59-8eda-3b2908eb763f", "comment": "Malware payload", "value": "e7d73a760bf14ab1433d75608588a100213ebeb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985732, "uuid": "41b34b11-1e63-4685-9e32-944d01c57e82", "comment": "Malware payload", "value": "47f7f7808a4074a6c8c05cbf71a3cecf93cb08aea4d87716603117a2fb29cc3e25f43a8ae5f761b7adb1f8f038c58d81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985732, "uuid": "26c09414-04a3-46b7-9576-404306df808d", "value": "T19125BF40B242C933C5EA4531991BBA3461BEFDA08B2059D762E87F9F3931BC2793525F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985732, "uuid": "e88c8b50-2f95-4719-a7a2-b353973a0ddc", "value": "24576:54+qUCGU8BJ8MdFxHllZ7dAcy6XH4qvIReK1odddGdBnyEj6kKZnBF:ghqNK7jyRB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985732, "uuid": "a67058c5-d7c9-4941-a82e-c95135b068d4", "value": 978944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985732, "uuid": "92570050-1073-4e39-b079-db26f03552bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985732, "uuid": "ac6eee9e-787b-4685-b142-c3d4f57b840f", "value": "2986fe1f75f4b015e1fe33b800a3bb3fa76d5a4de9075c72c6cd8a62da80ac31", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "492cab3c-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681985733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985733, "uuid": "0b343911-bb9f-497d-87cf-858a66589b0b", "comment": "Malware payload (Formbook)", "value": "9d1251b033cbcb38b0f7af9fd0ed9492", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985733, "uuid": "f2bc68f1-f64b-4b39-8c79-c0db92ad7577", "comment": "Malware payload (Formbook)", "value": "2a1a01f7dbce9cae3601bcf859fd7984cfa761783f929448e59a90dd56f43fa9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985733, "uuid": "2f441757-9a40-491b-bf4d-2934e705137e", "comment": "Malware payload (Formbook)", "value": "0f85acb14033ffc19f4e66aa635624b618c37bcb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985733, "uuid": "9182fa77-f494-490b-a64b-f73607684fdd", "comment": "Malware payload (Formbook)", "value": "1d6f59d1c0e5d30d243510026af2b7f272e7f84fe2d9955818117fc2b5adcaaea96c2cd731baf93b6c296b64339009ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985733, "uuid": "1f55867b-ab07-4327-913f-804fe9ea8aac", "value": "T11204AE36D641C071F2B251B5F67D0B7B883D0E353295A1EAE3E119E06FA44E9B12A31F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985733, "uuid": "e9bbfeb1-1b9c-4f6a-bb8c-49dfed81ca5d", "value": "3072:57zDwkP4+vmiRS3AEMXJRSrG/gvPH3G0fo9KrURw+27RCtHEXwz:1+kEABZ4rG/gv/3G0A984wb7QtHEgz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985733, "uuid": "9bc78cd2-6dac-470f-82ed-d7bbedaf1313", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985733, "uuid": "80d3f7d0-397a-40ff-9efe-232b61ce9804", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985733, "uuid": "7b7da585-c9ed-4970-a058-4ee2dc088e07", "value": "2a1a01f7dbce9cae3601bcf859fd7984cfa761783f929448e59a90dd56f43fa9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e91205b0-df5d-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1681982995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681982995, "uuid": "7874c939-3b5a-4c9d-9431-a32b43a8f77d", "comment": "Malware payload (LaplasClipper)", "value": "5531e69bae1958fecf77492ce5091225", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681982995, "uuid": "e245bd45-3568-47da-b058-dff6e41f12b2", "comment": "Malware payload (LaplasClipper)", "value": "2a7e44c4035efa9cf51a7699c6731ef77322bd034f0db8936f7c484406ff05d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681982995, "uuid": "95a80752-c39d-4af1-b6f4-7407ade05662", "comment": "Malware payload (LaplasClipper)", "value": "6bfcdf2536ddfe4c48018e58dc8a20fa109d2892", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681982995, "uuid": "5d020c44-3a7e-4706-a172-81346a4c28e6", "comment": "Malware payload (LaplasClipper)", "value": "07e78fe5722dcf0f774b0c84b2a0d5cfd2b2e80302d3bd4ebc4ced484a59ad125470b2d7a1cf29db616c58aa7dc087d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681982995, "uuid": "0b949d4e-f1fd-4d36-936c-ba203a0e19cc", "value": "T1C9162A43F88145E5C0AED130CA659253BA717C886B3027D33BA1F7B82B77BD46A7A354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681982995, "uuid": "7a733d49-1cd4-4511-9a9b-da15fb397d12", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681982995, "uuid": "3a44b084-bd4b-4ea8-81f0-04cd776eb9f4", "value": "49152:bEjwvlIKv05z+UERnIcYmWjc3CdhR5E9UFiqeb0/B1:ZlhWzZ6hYEciqe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681982995, "uuid": "e1088198-9806-4147-aa49-57038068c0b0", "value": 4212224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681982995, "uuid": "c147b253-0811-48b2-b1aa-75bb06c51d93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681982995, "uuid": "0c1384f8-5ad3-451f-8ae4-cbe28d2aaf01", "value": "SecuriteInfo.com.Trojan.GenericKD.65060814.32074.28668", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18e931ba-df5f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681983505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983505, "uuid": "db95122d-d1fa-4898-b28d-f8b736941ea5", "comment": "Malware payload (Mirai)", "value": "2d324f3a3c85b6393c171a62bb10b78a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983505, "uuid": "d155c2cc-b5ca-4717-a3fd-669bc5e979f5", "comment": "Malware payload (Mirai)", "value": "2b77902ea62b2f011ab93b328cb61e3aad5a2d1db38d6adb2186e57b7496b86d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983505, "uuid": "0ef4a5d5-a642-4b4c-aae6-b4eab7727a95", "comment": "Malware payload (Mirai)", "value": "e87ecfadb6e7f43bce20a97e2f858323a05b9fe0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983505, "uuid": "55b4c8ac-fb2c-4f35-a6e1-5e42108518f1", "comment": "Malware payload (Mirai)", "value": "8461feeb21658abde2e20b01e9a8b2bcc3d973eefd5801c46c7f725e04ac25900adf4f025adb140cd7f4b6b657f906eb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983505, "uuid": "a8f327dd-8986-4901-ab67-1600fbb97ae2", "value": "T1A9B31945F9408727C3D327BAE78F478D3B36679467DB33116938BEB42BC17892A29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983505, "uuid": "84440733-8cff-4ede-b80d-453622d5996e", "value": "3072:NSs+s6m1qL6HxfpEPV+zXmkZrQAhPDCXFke:t6mgWHJpEP6mkZrQAhPDCXFke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681983505, "uuid": "98c3b714-66be-4bd9-9916-2c6c4ecc33fb", "value": 108414, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681983505, "uuid": "669634d9-670d-4a05-909f-9bf6a774eb1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983505, "uuid": "af8f56b7-6669-4b0d-b0cf-603db77165f7", "value": "2d324f3a3c85b6393c171a62bb10b78a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7394708d-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681985804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985804, "uuid": "bccd8c1f-d4fa-499a-ad8f-c85e152621b4", "comment": "Malware payload", "value": "8990e4b07884c04a4c3c2f9025c80826", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985804, "uuid": "46fecb28-4f03-49bf-911f-eec82fd21482", "comment": "Malware payload", "value": "2bdb8e5e76d4edbf5fd3f68ad00bef7996987d3b6ebec2408b42eac071e545bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985804, "uuid": "3860904f-1cd6-4345-8bf0-87ac79a28e52", "comment": "Malware payload", "value": "1eb0d489f858f6838985e3ed6ceba15435cd7638", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985804, "uuid": "fdb72a63-3964-4a06-a9c1-95a8b8bf88f0", "comment": "Malware payload", "value": "e4e3ac3a4b550dc7b895f426035f7e8cc96c692b87adca5be691dd919db6fb5cef0497397fd84100f4e61ee94dd9a876", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985804, "uuid": "4a6a6e8c-b0bb-4bbf-8eb9-2e1f43d0b97f", "value": "T17C0438BF61DB7C4AE5384AFAC199DFA13235789067078B4A191039A31E007DEFDB512B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985804, "uuid": "0f5cb0e9-1f92-460f-86de-2657fc6cc233", "value": "a808411a04557309a9c41f351b379c88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985804, "uuid": "e287fa27-8c2a-4efa-9258-9a8710d65b62", "value": "1536:lIcdjmP40bBjlwPgLs7ln3SNrmBKOlRysGI7SSQGK/+0nf46KuB5h+Jph1dEqTIA:lIYjMBje17l5BlzGGqTnqcDuzTKNXxxY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985804, "uuid": "a8971587-58ef-4a1c-84e9-ad4640c25333", "value": 184103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985804, "uuid": "70d0f981-1862-4047-9bad-549367a043df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985804, "uuid": "5e1d499c-432c-4098-909a-b8380c7cbd33", "value": "materialescolae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd88f3a0-df12-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1681950710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681950710, "uuid": "c1c212bf-714c-4c8a-bf74-c4e8c3379b19", "comment": "Malware payload (Amadey)", "value": "5e2cc3e89cdbe82c43c87eaf7f0f1e7c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681950710, "uuid": "f687fac6-f358-47c0-b03a-a88e16756a32", "comment": "Malware payload (Amadey)", "value": "2bddf6f8fdbb5b35f26650449bb62d41efa00ee957433cee62995420323aa84b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681950710, "uuid": "4c356183-5053-42bc-932d-6c37636bd958", "comment": "Malware payload (Amadey)", "value": "79f7d0944aca194ec9fdc0f45ba639d2fa2650db", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681950710, "uuid": "e01eea77-7fc7-425e-b2eb-d5f250c05786", "comment": "Malware payload (Amadey)", "value": "dff66b19cc6eff9612bdedd5d7bc2b10adddcf32abe61015cc0a8bedfd306e9a00388efd6ff0201bc619904a3f802bd4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681950710, "uuid": "b1d285da-b1e0-471d-a893-4bd7615d69d3", "value": "T16A34E021BAD1D433CCAB41B55530CAE97E7ABCA19245C59B73083BAF2D703D05A6BF12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681950710, "uuid": "036f9ad5-2111-4f56-99dc-85118422386c", "value": "d76f139ac2e472c829d3b2911d8e5893", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681950710, "uuid": "3a2d96b0-c555-429c-907c-1399c13bdab9", "value": "3072:qWgxv0gHDk1b+3zN1eJSy7b6Vcifaj+lHlbDdM49R5bN2DvRjk4/owe:5G0gI1eYgsETfaj+lHltM45NwZg4/ve", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681950710, "uuid": "759b5c21-f478-4f39-b995-05bf21e99bc5", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681950710, "uuid": "e8ba920c-83f5-41f7-8cf6-f20cbccddae1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681950710, "uuid": "b0385d6e-f2be-4e91-97d8-4aa494253abe", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "798db7a0-df76-11ed-88f6-42010a9c006e", "comment": "Malware payload (DarkCloud)", "timestamp": 1681993545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681993545, "uuid": "1943c616-ec05-44fc-810a-7f954fc4b163", "comment": "Malware payload (DarkCloud)", "value": "d3dd4ac28fe5ec83e3ccaf224585148b", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681993545, "uuid": "3a4e7e67-4891-4b3a-95b6-4ec520a4005f", "comment": "Malware payload (DarkCloud)", "value": "2c836dc9a1437278d5ec144e6c3e67d701076d9963badbaadda7d3cd1940be46", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681993545, "uuid": "2c32eaac-059e-4db5-8db2-eb425386d07e", "comment": "Malware payload (DarkCloud)", "value": "d8a40cbb1577dff8f6799b2b519c22748ce69d16", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681993545, "uuid": "2a90aa3f-6b62-480e-b698-0488e2165edc", "comment": "Malware payload (DarkCloud)", "value": "d646c86f510ba45574a306a1dc5f22a0903373f52ba71f172588291dd53a0c99a06eaaf5408b5e058989d46e589159de", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681993545, "uuid": "eb9c4bf0-7917-4909-9a4f-51d6a8b8aa16", "value": "T1F4A42391F5A0C136D0272D321A7EC762BADCCD068CB9960B2361972DBF72999C50F7B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681993545, "uuid": "686111e5-2ae6-4417-bffb-e82ef92a9843", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681993545, "uuid": "40833521-6c6b-4f27-8388-82798422ff64", "value": "12288:/Y1UU3P7OmHcum/ZNzQYgECQ4+5sOwIM3hFNzi7Ai:/Y1UUjDHHmZNzQEC+9M3hnzi7F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681993545, "uuid": "9f5b505e-8969-464b-b03a-5cbe55abb38f", "value": 457042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681993545, "uuid": "60483c3f-281a-418e-a63a-cd5af2f3b52f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681993545, "uuid": "944ef3f9-3757-41f0-969f-5633d1eacc13", "value": "IMG-419914.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49ddd9e3-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681985734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985734, "uuid": "7cb2f2ef-a29f-4d1b-bb82-ca8fcf842314", "comment": "Malware payload (Formbook)", "value": "7b5793ff6d56999c5e57853ce8c36da4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985734, "uuid": "74b33e0f-486e-4c05-a89b-aae84138a712", "comment": "Malware payload (Formbook)", "value": "2d7743c8856d944014debd92540a115744e67595744a717b43a00d9db9332734", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985734, "uuid": "41a5fdd8-bffb-4d22-abe2-3422ea28f3bf", "comment": "Malware payload (Formbook)", "value": "fdda56a3a001642bfd97e0f415eaa1a24ed68a80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985734, "uuid": "a1e53285-ade2-4ecd-a03b-fdfe3cbd46a1", "comment": "Malware payload (Formbook)", "value": "8ea57f1a19cbade60e201ba9b010d02927814caf471e6c7bf67dee1e3a4c887da8641794d7e2c5df875e66d3b6e46a9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985734, "uuid": "93fb63a0-f76b-4e97-84c6-77a48bb5466d", "value": "T1DA04AE36D602C035E2B251B4F6BD1B7B883E0E347294A4E9A3E516E05EE09E5F17931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985734, "uuid": "510bcf96-df45-4c72-9d2d-27165fae9b2e", "value": "3072:5I6AykP9vB8U23ArxkkZbxsrv4PBlf+1ZdZPZ0+D:gbgAdkWbxsrv4PBlf+1Zvn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985734, "uuid": "1ced3935-20f7-4012-8f95-9d38eb5b6a38", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985734, "uuid": "64f35128-4fd9-459b-85ec-5123e23b2db6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985734, "uuid": "1b7136a9-1940-4efc-8f87-cbfbda92c889", "value": "2d7743c8856d944014debd92540a115744e67595744a717b43a00d9db9332734", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a9fb85a-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681985736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985736, "uuid": "91c202ed-88eb-41ac-80c5-c82c7f5e246c", "comment": "Malware payload", "value": "283ff476adc881e1fbf3218acf50b76c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985736, "uuid": "d1c0d26a-ed22-4ad7-89b5-0fa201494870", "comment": "Malware payload", "value": "2da937f9905bb09f3c005f0efa1ca60e5e83a94a8450d0d1ce02a9deb5a191f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985736, "uuid": "639427cd-66d3-4c81-92fb-d5c57c5262b3", "comment": "Malware payload", "value": "8d8dffdeb013e39e6b5200ecbe31306fe7e75774", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985736, "uuid": "ea6e073e-f85d-4566-8a11-75954005cc65", "comment": "Malware payload", "value": "622a023ee264959fd32911394b773f0312cf6208271201672dc99aec0e93e8c51eb22ca319c053db705283fab8bd376c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985736, "uuid": "5c441c73-7600-4ee3-8423-d6ac69cd5069", "value": "T1E9A3F8223BD49172D4A211B64A6D7274967DE9A10B21DACB330C27DEDFB43C68E34397", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985736, "uuid": "aa76c676-bd5c-41e9-abf3-f2153558f1b3", "value": "3072:jw5lYiRqgB1Nq+Mz6N7wVctXRjXygVzUw:jw5lkgB1oXz6N8VctXpXF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985736, "uuid": "7553969d-b156-40b8-a697-793bb379db04", "value": 99840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985736, "uuid": "cc4d28d4-594f-4833-98be-220dcb48d01c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985736, "uuid": "2385ef51-90bb-4fa8-942d-da5befbfc069", "value": "2da937f9905bb09f3c005f0efa1ca60e5e83a94a8450d0d1ce02a9deb5a191f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79e3ac12-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681985815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985815, "uuid": "138f2510-ecb2-49a9-b916-4eff74e0cef3", "comment": "Malware payload (AgentTesla)", "value": "6917e37cc49ab94d2a4dad578d11b7eb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985815, "uuid": "66139a44-c726-4ae4-999a-54c7208957b5", "comment": "Malware payload (AgentTesla)", "value": "2dda5a5b01e4a02112fbe04d2c7ceea4a7ec0b37c7b4821ae5cb285d22ba6cbd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985815, "uuid": "94e3516e-555e-406f-8d83-7ebfe91b0ec3", "comment": "Malware payload (AgentTesla)", "value": "b1878ccfc95197b9118e29f8d75c0b021a8986cd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985815, "uuid": "4040085e-c6f1-426d-9bff-a483b0bd9276", "comment": "Malware payload (AgentTesla)", "value": "f880b70de183dd197d18ebadc156e66d7255ada125c93dd290da19645d63eee9da448c54d64b4f2f42c4deaf57eabcef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985815, "uuid": "743c82c0-9961-4a0e-ae3d-14598d7cdb30", "value": "T134C4F1F813C4971EDC012BBD5A04A8883BF648F9C4D4DE9DDA7AF48B5DBD7219004E9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985815, "uuid": "c47bf73b-be17-48ec-874f-1cab204fba1a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985815, "uuid": "20a8f7fb-0bf3-4bb9-83be-0fa83925fa64", "value": "12288:cRQZIPPokWHUfSxQYkQV1J6axEShU0FjwIEttLcW/kcaGL:QKIPwkW06xQYkQnJ6YHh5ytLcfcaGL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985815, "uuid": "e839dd0e-0b66-4aef-a064-72a5245dd699", "value": 565760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985815, "uuid": "36fe76ef-5512-4c32-9209-c15592b38d03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985815, "uuid": "70b1d8e3-b923-4b01-9401-91ee5dec16b8", "value": "Orden - PO-23-016827.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a311bf95-df84-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681999628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681999628, "uuid": "3499c4a7-aab4-4529-be29-bf22df3438f7", "comment": "Malware payload (Mirai)", "value": "1c7ceb4fb9546266cb892d204db4810d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681999628, "uuid": "51f975de-206d-4717-a36d-702b4f298a05", "comment": "Malware payload (Mirai)", "value": "2ebb2c64ff43a3b304111f82560598247138bd95ec519c650a422a681af7101e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681999628, "uuid": "da723e09-0f32-49b2-ab39-5ac039255135", "comment": "Malware payload (Mirai)", "value": "6ba41ba8fe980fd67700e74732692ab49ed0a3f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681999628, "uuid": "c71e4dd2-d5c9-453c-83fa-6f3237502e7a", "comment": "Malware payload (Mirai)", "value": "d1d9b569f40509e148284ac888470c2fdf8cbbb5f67f172ec907ef985083237330ba9a8c6f480421a264a69d3e7c540f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681999628, "uuid": "9f1478b3-3b8c-4561-b375-50c2cfdb6d1a", "value": "T14F831946BD819F01D5C912B6FE2E118E33131768E3DEB2239D109B247BCB92B0E7B559", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681999628, "uuid": "aaa96373-4c9d-41ce-abef-30f5eadb7db4", "value": "1536:CxnjOSuwgUtOJ8g7eoJHp0gNaIAEbSMDiYyom8Kxcl5kYG:FS09vB0qaiyom8KxcliZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681999628, "uuid": "a6a85c92-3309-4d20-a2b3-30a9e12dc7d5", "value": 83084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681999628, "uuid": "49dc06a0-8c6d-4432-a963-688afb6141a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681999628, "uuid": "ed953214-1309-46b0-8e8c-7a5522213691", "value": "1c7ceb4fb9546266cb892d204db4810d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "751a41c4-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681985807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985807, "uuid": "cc513c24-cacb-4fee-9cd3-21ef62577278", "comment": "Malware payload (Formbook)", "value": "c0eb35d394bfb9d3921098a18acf943a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985807, "uuid": "a02727bd-082b-43a1-aae7-0ce337df36f1", "comment": "Malware payload (Formbook)", "value": "3071191c41a879c8eba85480f068a9435cb56a469bf5c11403dc9cd0be7f9fbe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985807, "uuid": "6b2d50fb-4b55-431c-a81a-8339f4411ff2", "comment": "Malware payload (Formbook)", "value": "5f65cb5214130869f7618eef0c3c613eb94ce471", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985807, "uuid": "b19e39ed-2bec-433f-a9f8-5ab9d54f9288", "comment": "Malware payload (Formbook)", "value": "438d084bb546ab0df5454a268e1221670ff3dea59526575f5c5f17b891545e1d3b919ca173c2f6a17d3e9181a1539255", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985807, "uuid": "b07d001c-98b9-4519-9406-9da2c85db2cb", "value": "T1B784238172E0C127DCF317312A361FB337FAA5611CB920FBA344D66DBCA9681A51D396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985807, "uuid": "078b9be5-59af-4da3-be76-7fca5cfb924f", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985807, "uuid": "9561c750-1f0c-4de9-ac46-3ec860c949b8", "value": "6144:/Ya69eweAwpymrOifWxSh/obLRuGbA0g1iEWW2syZRyA6bhLuhsxBwzulpr5h9xi:/Y/EAEymND/fwUMuiRyA6bluhsPQulpe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985807, "uuid": "635a68ae-2b57-4110-843e-39ea6f338fd9", "value": 371204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985807, "uuid": "4b666458-8aa7-4201-8e27-cffad17fce16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985807, "uuid": "08629f9f-0faa-4dbd-a0d7-9d420b6e5e06", "value": "MTCN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af7db682-df57-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1681980321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681980321, "uuid": "a4af14f3-6db6-43c3-8e70-9f58ad892fdd", "comment": "Malware payload (AveMariaRAT)", "value": "46b872f5b8961f84cf5ba08b3df3a06a", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681980321, "uuid": "f570e7cf-5580-4b0a-80bd-25260c74ac4e", "comment": "Malware payload (AveMariaRAT)", "value": "3093cf9bd3018972a4dac42d9943317d2633465e75b43f5a23baab52f3b6afed", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681980321, "uuid": "c3adb9de-9655-422d-bb2e-df261dc8ce00", "comment": "Malware payload (AveMariaRAT)", "value": "b384376a029e89064dc8c25e155744e42a9c86cc", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681980321, "uuid": "d446573f-c98c-40be-8758-f72d4b7866d4", "comment": "Malware payload (AveMariaRAT)", "value": "2826e089ca91f4ac5ac38e5db9b10dbcd431827fe0b2b904ba6a856131266df7ae819006251ce25e99d4e8836e8c01e4", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681980321, "uuid": "cd54e5dc-4103-4de5-9247-57bf631fa896", "value": "T17C74A5405FA94952E5E4DF79B4DF70EAF1B6B6DBCAC3E3079840A4E90F083BA85012D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681980321, "uuid": "5d46042e-1174-4853-a33d-ba84150b16dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681980321, "uuid": "dfb00947-3130-41ac-808d-904ced8cc824", "value": "6144:76Vhm2ZV3kJb7ls+ga/w4ubEinw99qTJSnWLnlnXODL00FnDn0BPyR4UOPKkElw0:7ohm2ZV0Jb7lNgoOECAWLnlnXODg0Fnr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681980321, "uuid": "3dc43fb9-bb62-4e16-a7f8-10b4918a4281", "value": 344576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681980321, "uuid": "ebe06ec2-d373-4294-ae46-1e1c0a84365d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681980321, "uuid": "7559e405-82bf-496c-9fce-636fcfea42bf", "value": "Custom OEM Inquiry Details Catalog Downloader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e6f7886-df47-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681973394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681973394, "uuid": "56ed4235-6628-4bda-8d1c-817c3b2e3afc", "comment": "Malware payload", "value": "531863d1bb9f0cb4da8a888bb9adfb02", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681973394, "uuid": "ac044a6c-9842-4a56-ba47-5785e6ad1467", "comment": "Malware payload", "value": "31780dcf5681145d6be3652b7ea9974997651c4a020012bb82a7936d286ee743", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681973394, "uuid": "01dd74eb-563c-4e1d-b3bc-5b8c65beb0e1", "comment": "Malware payload", "value": "38fb5bf2718dc96305a0049d7c9a5e269af48988", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681973394, "uuid": "5d917be6-e703-4fcb-b6f1-ff3abe9a366d", "comment": "Malware payload", "value": "9cc37fa08e6e74b0a0ce158dd024ff204fb2b0b76d167d1831d491eaba4f4e2d0de68c7bbcb3dc51513e005c3518716c", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681973394, "uuid": "d4364fd0-f654-45ab-a8b1-73642fb4994a", "value": "T128263303E316D9CEE4FA43B61D324DBE2C766B0AC74319E790655B7A39272E10F590E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681973394, "uuid": "59f874b2-16f4-4c2a-940b-1aa7043a6635", "value": "98304:KUVuGUXLgVVYk/7aEYSIgVqAEP/uHiKaxwxXFVFKcZyZL:Ks4UV1DaLgAAfygVaCyZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681973394, "uuid": "180217ed-67d4-4821-a451-0e50f412e175", "value": 4523800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681973394, "uuid": "4a6389d2-c162-4342-8d9a-d35f098e0010", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681973394, "uuid": "579385c7-6f76-4bca-8253-4910dee1d201", "value": "Apartment Booking.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa349006-df32-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1681964421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681964421, "uuid": "6573a81a-8e95-4ed9-85ce-dc35404af765", "comment": "Malware payload (RedLineStealer)", "value": "089a8afdbd2da31e6180ea0d8a85b3e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681964421, "uuid": "c5013634-a8f2-4ed2-ac52-a3b36ef08d17", "comment": "Malware payload (RedLineStealer)", "value": "319875a4c7898ae0f636f5ee26e14172008724c4567eacfba7a36aa4b2a413c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681964421, "uuid": "6afc9ba8-1e2c-4591-a73b-2e569008f10d", "comment": "Malware payload (RedLineStealer)", "value": "7126a510297ca035b255abbeefab4385830b3ab2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681964421, "uuid": "360f6933-12e1-4ee9-8ca8-a6b2a4eadb71", "comment": "Malware payload (RedLineStealer)", "value": "0b6c28299605b2910a2c72ff184d31cc7d7e5362856e2d4e661a04bcdb1d4c6d4474176d912386977b32076231641ea8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681964421, "uuid": "88ef881a-3719-4e9e-a909-003e661490c3", "value": "T10B748E1232A4D0FDD016F0B89DE8D4A8B61C64F53B6FA9C77BC60A7D47292E5B394213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681964421, "uuid": "cfec4a02-e946-4f93-9568-30e257443ede", "value": "4e54daa91eb371c1340f2a6338663dd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681964421, "uuid": "1565d33f-0673-439b-b2e2-3424e4d50e87", "value": "6144:cT11Ka2T5jBmjEKCPcuyflTX8deh8I5jAriUzU:cT1aTvmjZCZolT+I5Urh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681964421, "uuid": "b9c53a31-9e2d-4fa8-98a4-e696542850b0", "value": 354464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681964421, "uuid": "b5263e6c-e522-432c-b02c-f276dd2adfd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681964421, "uuid": "b17d8706-9c9b-47ad-98ae-0296ae7af868", "value": "089a8afdbd2da31e6180ea0d8a85b3e1.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f24ee26-df11-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1681950068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681950068, "uuid": "c1eea2ed-d23f-4d06-93b5-0f5f52ce10d3", "comment": "Malware payload (Amadey)", "value": "bc68a3016474fce3f769c4beb52009af", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681950068, "uuid": "e8f7bc9b-4ad7-4ff0-90c2-c1c299d662f3", "comment": "Malware payload (Amadey)", "value": "32250b41de51363a7ebfe632f5a44ef8057376d622f32956e12368cf3024916d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681950068, "uuid": "cef4a707-6ec8-418e-8173-f10d12f09d9b", "comment": "Malware payload (Amadey)", "value": "4f15a90c8dea46b9c0993272631e5cb761fb3f4e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681950068, "uuid": "a98821dd-f734-47a0-a97d-10ba576fd5c3", "comment": "Malware payload (Amadey)", "value": "eaafa0e9a72221f70d3e1143d6880c62bd6da171b783e34c610757c4a8f5d1253f3601116b5ec24d80bd5287f58b7f18", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681950068, "uuid": "a63ba0dc-139b-4255-bc29-9f4c808a5fc0", "value": "T16234D0217AD9E473C86B04B55434D6A92E7E7CB19B56868B370C2BBF2DB1EC10767302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681950068, "uuid": "acc9b1dd-4cfb-4688-a4fa-e02641629601", "value": "fcefd95474e5b4dc39c6ed905cd56747", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681950068, "uuid": "436be739-740e-4d17-b6ef-5bf906fa99a1", "value": "6144:aMMGVP/dEhkQNNr90yBZ8eHbRQIgKg4/ve3:akP/dEhkWZrjHN5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681950068, "uuid": "a1da1a18-5e63-4170-bdc9-c56eefc9f6e6", "value": 241152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681950068, "uuid": "c0a80c41-c16f-4845-bcd2-0527876f9bfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681950068, "uuid": "ed2a8505-04b4-4db4-b511-d68897583087", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c5f411a-df3b-11ed-88f6-42010a9c006e", "comment": "Malware payload (VectorStealer)", "timestamp": 1681968022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968022, "uuid": "1bf0f189-f9b0-4945-a055-514ff89b7516", "comment": "Malware payload (VectorStealer)", "value": "1de1213f3b92347423fb223ca44d36f1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968022, "uuid": "f1d3cbc0-775e-4535-be85-15c0de729b1d", "comment": "Malware payload (VectorStealer)", "value": "3248a4b2b6e1514e9a63b2f40f54df79f0eee9592f9c1146e485ebd3fb4998b9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968022, "uuid": "20cad6bd-2cf1-4fe5-a2e2-c51fb1ce9374", "comment": "Malware payload (VectorStealer)", "value": "208df542788427737c54b61c99087878d0fcbef7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968022, "uuid": "7b799b42-a70c-419d-8ab8-871ef9b7a29c", "comment": "Malware payload (VectorStealer)", "value": "7c1e40ef319e7ca35731a31b20a021e7a90e24ca5db6a26b4f4c031e7e3ea9aa07f4a3ffff195ffd36a9ae5ce1ed6068", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968022, "uuid": "ba7b638e-9e7c-4208-b571-e19574e9e78d", "value": "T11411E39A71EBFD5B45021DA8101846C2F030471F9FE68C3BA40391B934E00FBCE9DC86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968022, "uuid": "69625832-c799-426d-9d93-85dadf6c0dd5", "value": "24:RqVEUFwFPqEF2F9EF9/YFD+FDZ0FDOdAYqVFD9FDq0hdwfFLgF3FOxYWuF/FUVbA:9UFwFlF2F9EF9/YFKFaFydADFZFe0hq0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681968022, "uuid": "eec1a453-b6d4-4201-b1b4-fa23c48eb40a", "value": 937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681968022, "uuid": "58b7ac98-c316-46ec-aa1b-4369e5232d93", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968022, "uuid": "07723ea3-889e-4456-85e5-e8ffd9103251", "value": "PICS09765432345678001.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4ef6251-df7f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681997591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681997591, "uuid": "6a3fc1c6-b239-4a1c-8fc9-c1d1186e05a8", "comment": "Malware payload (Mirai)", "value": "928b416f80b199e9442877e813ff51d5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681997591, "uuid": "5b806da1-9cbf-4b0d-bf92-5f747eba9330", "comment": "Malware payload (Mirai)", "value": "327e1e15b738718b5072a66da9fa18e6181682e0a24c4c34998462a30924473b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681997591, "uuid": "39e1fea0-1ff6-414b-8b28-e16377da786c", "comment": "Malware payload (Mirai)", "value": "dc045d8729514a3690d4097e75236a908704e170", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681997591, "uuid": "eb4d396f-69ca-4976-8056-713d2a945ba0", "comment": "Malware payload (Mirai)", "value": "1ddeb023134a8597926923b225f71d33dd5571e157e038ecb606f2d6354663afc4de69f68f3f50f1d8b0683af51846a4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681997591, "uuid": "e71c6960-0057-4008-8b51-34e95d3dfb70", "value": "T1A43309B41516F2BCE9E22078F40720F529930A1C3ADDE2D3B0930575FFB5B48B96AD5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681997591, "uuid": "344ad284-2707-4441-9674-56a6c02f5413", "value": "768:TxVhMqBAy5Juan3mEAqPQi1NtoFAkwrJ5Tw8W65mjV:TzAxaWE1FDtoFARro8W65mjV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681997591, "uuid": "8d9baed6-68d8-4f68-a9d5-15535ef49b56", "value": 50632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681997591, "uuid": "85aebc94-9cda-420c-8229-9fa3b4307825", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681997591, "uuid": "c6d2d1bf-2670-4f46-945c-37deeb044094", "value": "928b416f80b199e9442877e813ff51d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48071ec9-df5f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681983584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983584, "uuid": "67c413fc-5c4b-4813-b312-276d0664d5f8", "comment": "Malware payload (Mirai)", "value": "cda493db470a70fe9842b4e3621b9e8d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983584, "uuid": "50b42aee-f1dc-4b38-ad87-86c32fd29999", "comment": "Malware payload (Mirai)", "value": "346ecf180a9653b89ec86226cff41ca6e074991b924343946c2bed2c1b6eaa5e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983584, "uuid": "96d1e2ad-4736-4fd4-94b2-0880afc83200", "comment": "Malware payload (Mirai)", "value": "92ed53f35762aa977c43698af0e92a5cb0c408ec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983584, "uuid": "dc6df25b-16fe-40be-9ca5-f3d87fc033aa", "comment": "Malware payload (Mirai)", "value": "22f75e33983a4442c1812a6da56cc1df8a628f01361606a574ba84e9c7fe4ae7dc642a42aa9e73bf03192c22bfe2052e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983584, "uuid": "78ee667b-fd75-4271-b99f-b2294e917c53", "value": "T1D7F34905E6408B17C1E2277AE6CF824D33338B94A3DB33159938ABF43FC27995E26915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983584, "uuid": "1c22a411-3517-4d0b-ad39-e9cee79352ba", "value": "3072:41g2L2INNlzkCYYICUqaQcvB6gnyLRM/975mFwfBxKQodn:ug2LBNNlzDYYXUqa/MgnydM/9tmFwfBC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681983584, "uuid": "2cba333c-b5a7-4072-aa7c-d6eef3e11deb", "value": 159885, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681983584, "uuid": "3a3b96b7-67ab-4cdd-ba4b-805ad38093a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983584, "uuid": "ec3b0060-beb1-481e-9a41-3a0e6b6f147f", "value": "cda493db470a70fe9842b4e3621b9e8d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b5f3354-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681985737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985737, "uuid": "0ca4b37b-f49b-4439-8ef1-897928d4b132", "comment": "Malware payload (Formbook)", "value": "93a0b886c7da35e875f40f67ce8681a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985737, "uuid": "cdf980be-3260-4e38-afe5-50501a8120d4", "comment": "Malware payload (Formbook)", "value": "3481e03e601740b1e2c8643db90e35541dd2c76c24806ddcc47c5b1c7ea60e2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985737, "uuid": "b1f00280-d8d0-4273-a224-da385694264d", "comment": "Malware payload (Formbook)", "value": "4eaa61f0121db85f1dbf0b89e18915a72dedbc88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985737, "uuid": "c0b8ce5c-3c8c-4c13-b20c-86d92410ba68", "comment": "Malware payload (Formbook)", "value": "e2bc56d4e3ee2266c48d92a225ad0100ff5dcb55a11a4edfa5784cf51d5488b85030c41fafeb4f02a1e581a461665bf6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985737, "uuid": "bd5755bc-c771-4864-8007-f28266d91c98", "value": "T1F604AE32D602C071E2B251B5F67C1B7B883E0E343694A4FAE3E115A16EF4995F52A31F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985737, "uuid": "0f63f295-ca18-40c4-bb59-e9618f4a8ef7", "value": "3072:k8QnUQwBFKRujtBxb7ZMcR0j2Mg8GYFsh9h2mQlufoRR84gHy0QtHnqkQ:QNFuHl7ZMcujzK9CufoRVgS0SHc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985737, "uuid": "0b932a62-f7b6-4634-b8de-51d7b23a1169", "value": 186368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985737, "uuid": "70f5c5d1-c6ca-4c41-9884-aaf8f74f470a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985737, "uuid": "913b60f9-68fe-4b4d-8847-508f43d6dea6", "value": "3481e03e601740b1e2c8643db90e35541dd2c76c24806ddcc47c5b1c7ea60e2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f1f509e-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681985770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985770, "uuid": "a5a89ee1-5dc5-40f5-a0f5-c30da303c188", "comment": "Malware payload (Formbook)", "value": "aee03bf79fd98dbd7aa66fa6d507c4c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985770, "uuid": "a923a084-b6ca-45ca-92b9-b145fcfccf2b", "comment": "Malware payload (Formbook)", "value": "354c8752e895e413f243d8893cb1ba53c61d35c7e44233dfc59b85e382ec3c9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985770, "uuid": "9b3307e1-97fd-47fd-9e56-7254e8da48d1", "comment": "Malware payload (Formbook)", "value": "1f5658aa75101aec70f48038e09bd20ade00e68f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985770, "uuid": "b3846d2c-7970-48a9-958b-c53690a70aa2", "comment": "Malware payload (Formbook)", "value": "a8dfa390a09445112592b84686b607a6b4e369c979fe1d23107584371791ba14eba3a9c983171bb647b0d3e948ae51d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985770, "uuid": "16ec543f-3a21-479b-a100-00801a12fa38", "value": "T1B4D4F1EA42D09B5DE8412FFE5A055C2827F64DF5C4E4CE4DCAA7B4CB0DBC3218055EAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985770, "uuid": "04926e9c-d2ae-462d-9d73-1e4a5f4a0a1f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985770, "uuid": "0163f9a7-a03b-4441-aa57-391bb2931f5d", "value": "12288:o2iN1qgUdtEc+jgc2JrNpOLQDgnihki+F69COEneaGL:o1CnSUVrNcLegiKimneaGL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985770, "uuid": "b4bfd7d3-02e9-44dd-ab74-fe35f2dacb39", "value": 608768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985770, "uuid": "d99c1372-995a-4527-a76d-4ea4cad8afaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985770, "uuid": "2b806c94-5e4f-46da-afd5-7d0ffe216fff", "value": "akibet202304021122755.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c1ab9ac-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681985738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985738, "uuid": "a7ecd35e-3821-4677-9185-6fce391c2ab4", "comment": "Malware payload", "value": "e8a2c5a17f8745162176e26c92bd759a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985738, "uuid": "fcf9610e-2f55-4fe9-ac89-a2e14f197f03", "comment": "Malware payload", "value": "35aeaf1c7dff509e5f2fe0de070ea4acac7753fc72e8c1ae539ce709b74b720d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985738, "uuid": "d078b7a3-ca5c-4bb1-aca7-d075e7898d48", "comment": "Malware payload", "value": "48e08f37657191a61f9fc1b3abc960fae0029f05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985738, "uuid": "afce8737-f740-449d-8c0c-c573177cf4ff", "comment": "Malware payload", "value": "80b4886026c4111ee318b6e071a4c7624b1744594ef27a0927c13788621bf08510b1d4071e9cc4ce808409d1ff7adfba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985738, "uuid": "540d897e-1db3-4b23-b775-4d94a023fe21", "value": "T1D9933B60F1B56072E4A3963316AEB735E775FD281C1EAA4B72C0C7092470C43AF65B5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985738, "uuid": "d6b6613a-95c4-4552-a2a5-71b0849c878f", "value": "1536:TV157Or8uOL4XWxnKp/IYVutcVCJv5Y57ZLBv/cVU2n:B3Cr8NcuzY57ZL9cPn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985738, "uuid": "7e02db7c-92bb-4e30-a2ac-ec97d70b18ed", "value": 96256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985738, "uuid": "7d311d96-93b6-4cf1-bb42-63d1cb68526c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985738, "uuid": "6d6fb8b7-3fc2-4bfb-aa46-883d563a994a", "value": "35aeaf1c7dff509e5f2fe0de070ea4acac7753fc72e8c1ae539ce709b74b720d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68760766-df71-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681991369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681991369, "uuid": "d65619fc-0cf3-43a7-a349-3b1b3fe15e55", "comment": "Malware payload (AgentTesla)", "value": "16237d2147dc3200d2e4b4916052ea25", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681991369, "uuid": "c096bf41-4b9b-4ac1-8cac-3631a8a96b4e", "comment": "Malware payload (AgentTesla)", "value": "35b2e419aac0f4b99c12bc54c7e80f095184accbbc528833e881cf5e834c58e4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681991369, "uuid": "6c3f6e8a-2aad-48af-8308-97ba32e495e0", "comment": "Malware payload (AgentTesla)", "value": "3d11ba79317ac371157996d283e6be698afba822", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681991369, "uuid": "1b6811e7-0e72-44b9-939b-bbfbec8b2118", "comment": "Malware payload (AgentTesla)", "value": "21a760bd2363a3b615f1c57adc6253998783c796cb9a24dbe799077eb8da74d5fa1233a622fbbed886d934153ccfda45", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681991369, "uuid": "2b9b301c-57a3-4e4f-97b5-dd5c44752d8c", "value": "T1EA64230C92B0C9F7E0A12F722BB9596EBFF6DD210A68028307546E5D7967790D90DF32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681991369, "uuid": "d016b82a-6839-42dd-b958-0ea1341c1b78", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681991369, "uuid": "17c98e5c-017b-4de7-8304-af85123d44e1", "value": "6144:vYa6WHUXEY96FYAGzURlaBFebZtDOIiPmszL78TCeUiDKA:vYAH8EKIYD4RYBF8ZtDPiPJzYCvif", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681991369, "uuid": "5beace51-5220-44c0-b75f-ca01ff0f4899", "value": 313042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681991369, "uuid": "fc4ba18e-f342-4d4b-9fe0-5915572149ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681991369, "uuid": "a616e908-45c9-4bf7-ba5c-27a0565f9dae", "value": "PO23032517.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d63604c-df3c-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681968533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968533, "uuid": "f21a80dc-b239-4533-8073-6b7eb759908f", "comment": "Malware payload (AgentTesla)", "value": "fd4d349554b93a53a3d5540a92f251c0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968533, "uuid": "1254166d-64e0-46b9-9ea0-a59022242447", "comment": "Malware payload (AgentTesla)", "value": "36b0fbab2618611a165f399650cd3581a3a0723687164cd8482be37957ac4f35", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968533, "uuid": "5ca0238f-a168-4556-8669-1e0b5a309118", "comment": "Malware payload (AgentTesla)", "value": "a1b582b262d0088ebd284686d85ef5e5a7a14823", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968533, "uuid": "b8783116-5d27-40f1-9b93-4cbd60fff266", "comment": "Malware payload (AgentTesla)", "value": "d69cbc68c83cb4ef8c1ad87b0d0f63e8f11de2c103e1a687f0fad723f2fb33ed2efc93df0e17e572ce57b6957eaefb81", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968533, "uuid": "6e3c148d-fd35-46d9-87cd-5b340b26e6a1", "value": "T134641250A570D1BFEDA30F72667A4BAA4BA1AA262018574F13B1639D3F37391C80DF06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968533, "uuid": "37cc87e1-5c62-4cb8-abe6-4f8b5ef893bc", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968533, "uuid": "b601acbe-851e-47c7-8f86-652324b1215e", "value": "6144:/Ya6Kn3fQveA4HYDoaTJjjaGK916IIEt4L5R0Zu0Du2c25s5I5X:/Y03fQQioapj0jVQR0ZuSu2+a5X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681968533, "uuid": "ec49b456-1430-4334-aaa7-4af0561768d4", "value": 312697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681968533, "uuid": "5c8741cf-aa42-48fc-87e9-fe8b3ebd747f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968533, "uuid": "85498393-bebb-4b83-87e6-eafd32a584f8", "value": "fd4d349554b93a53a3d5540a92f251c0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2ab0a2c-df12-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1681950664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681950664, "uuid": "cf91282b-efda-48f2-a8f2-3551d97bfa12", "comment": "Malware payload (Amadey)", "value": "b043e0bddda6a78fcf7c6438fa9fc51c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681950664, "uuid": "c14277c4-e59a-40a5-b57c-361ac8de55f5", "comment": "Malware payload (Amadey)", "value": "379c7df574df0c5de1f917ec79d92b3c71c1ab44077021c608ec9fcc2af774f5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681950664, "uuid": "81091fbe-6956-4a71-95e6-19bc522739af", "comment": "Malware payload (Amadey)", "value": "17ccba5ddef82cf4bec31af3208f065df5a23341", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681950664, "uuid": "50e4c8c1-c914-4fe9-b4f8-6988ecb10c85", "comment": "Malware payload (Amadey)", "value": "05f4d1d0b4a1d6367ad91a4997f1a0cef165defd6811a9252d6bd932f5eb309edcd3421173199683946acae55e24c8a8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681950664, "uuid": "540d2036-90f2-4a14-bde5-a7c065d60d44", "value": "T158352343E2FD94B2CBB413B028F601C70731FDA2477182972B4669AB6C736C95A72767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681950664, "uuid": "bbe41aa9-676e-4bd2-a9b4-ea9c75e9ed0c", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681950664, "uuid": "81933c73-7286-49a3-9536-bf6e51ebd528", "value": "24576:Eymiks+BkOVT3cFIu8nxAH+aFd4qdnhq0BTIR:TmihiPTcF78nxfaFZho", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681950664, "uuid": "c3916961-29e7-4e12-a00b-91b4efcb8a0f", "value": 1136640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681950664, "uuid": "e85d5ea3-e814-4ed2-afa4-8a50363dea03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681950664, "uuid": "f8a9f85e-6d4c-49f7-a8b6-81fe1750d785", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69383f10-df47-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681973331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681973331, "uuid": "5ff74606-fa50-41f4-8121-9cc4dadceab3", "comment": "Malware payload", "value": "67c9ec80e9c261855213fa69c6b6088d", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681973331, "uuid": "347ea5cb-de7f-4dab-a2cb-c79943b36967", "comment": "Malware payload", "value": "3902dfbb4fd6557e041333b2804670ce90b7d4d873c9ee32941a15a1c8b71442", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681973331, "uuid": "a91bee23-6742-4348-b11f-fc71abe0bd5f", "comment": "Malware payload", "value": "7d5ae7a7bbc29f8ed19ecf0ec61f536a080cb932", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681973331, "uuid": "2fc5db87-f7c6-4877-aeca-3b7dec8723f2", "comment": "Malware payload", "value": "d354f5b44c60380ac5772f6d7b12104ca3a18bb2b731ee851419224385b506dbf7e9210d9e03501d1fd56a755dd394af", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681973331, "uuid": "b2453fad-e75e-40f5-9eeb-580325eaed3b", "value": "T146E07D2F721C3605C17CE4E0D8D862C5B426D54EAE8B7DC122CA27366D0A36C51C7C2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681973331, "uuid": "1a5575a7-a6c6-4557-b93a-7748c81e760e", "value": "6:Q0eoLftLYVJ2/CxVDGGIOyYn7G8GSLh8uWfBNuafvV18fQ98GLg+XSc7w9:QwZYVJ22Vyk7G8pGuYBNZVAQ98QF37u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681973331, "uuid": "bf2b5c8f-bb78-45e2-b324-559820687380", "value": 325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681973331, "uuid": "cfcf7757-970f-49af-9f7f-12cbba97c988", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681973331, "uuid": "1f6f5703-e7ff-4221-8615-4319239af3fa", "value": "newXorder.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69f4b258-df51-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1681977628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681977628, "uuid": "c6e241b5-2965-4881-8835-69dadd49d946", "comment": "Malware payload (Guildma)", "value": "cbcaa814b28805bf1a0b8c224a442eb3", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681977628, "uuid": "83cce003-7df7-4b7b-b15c-a9a54a0ad96a", "comment": "Malware payload (Guildma)", "value": "39f1fc4eca3b12e4957a2354f6a926e41d3a48cee67b642f3b534d688d625a23", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681977628, "uuid": "d7f3fbdb-fdc1-41d3-9405-51edbd778b5c", "comment": "Malware payload (Guildma)", "value": "e00b496b30d4e683235f1f17108ffff702c6224f", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681977628, "uuid": "d0c9604c-93d0-4718-b13b-095f3eaafcc1", "comment": "Malware payload (Guildma)", "value": "14a52997be0806bca3c00011f2b519e92001e51a390403584cebaa641210d50bfa1af77bf58b235df4d467c3423a7150", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681977628, "uuid": "25ac7bec-fd78-4366-b207-4d0df6276915", "value": "T1481117A693A90EBBD8B703B5CC31AE4C48BA9C730B5FD09DD9333584C4649E51FD4624", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681977628, "uuid": "ae6a034b-c220-4ff0-ac40-737f13ee8c3d", "value": "12:8D28OBE6ZG+gkfDnQjNjeaTASJwf6VIkwf6VUaVuRawf6VIz87KZIxBwVwWw2WCw:8loG+FLQBpTfoTa8T40uFTBd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681977628, "uuid": "100213b6-85f7-4034-b49c-6f93f28be8f6", "value": 987, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681977628, "uuid": "cf17e374-8ab5-4ba0-a77a-8e925db56a14", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681977628, "uuid": "08ddaf7e-e069-4a5e-ab74-e4a3952eee01", "value": "Factura_Archivo2135828302.233830.17891.lNk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7a526a0-df48-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681973946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681973946, "uuid": "08843d6c-de7f-4efe-89b9-a96edeab8bf0", "comment": "Malware payload (AgentTesla)", "value": "5996e651a47a5b67b4d831a4b5ecfcb1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681973946, "uuid": "8a5ca9b5-6357-4a29-9bf4-e05f76e18a5c", "comment": "Malware payload (AgentTesla)", "value": "3a699b8eac17817ae30e93fb0174624e35e89e13aa1db4464ec85f0f0460092d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681973946, "uuid": "5008ecc1-f20a-4c8a-947f-2f5c391df1c7", "comment": "Malware payload (AgentTesla)", "value": "f4915254315fd45622ccb4f6f35b77bacbd4abf1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681973946, "uuid": "520baa77-ba44-4817-bc34-248b44c97b67", "comment": "Malware payload (AgentTesla)", "value": "dce82ab29ce955d384c38f4c7604f1960e1245518827c723378736c1728820ab251f38f3ff2473a43b3096020691c916", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681973946, "uuid": "c1a95f4a-a88e-4fe5-a4a8-eac0028659b6", "value": "T1B9C423AC7729E741608D236D5FEB5AFF01E46C22D63BEAE8DA1ADB94D204224014F4DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681973946, "uuid": "1f48c7fb-fe8b-4e52-9e02-b9d2b0f36e80", "value": "12288:TdzzpBJXeI/kULcDFk99B25ZiOOrxBkjYKInahHr:pzzpB0I8ocq1ureKKad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681973946, "uuid": "8f55cf10-f44d-469e-8b63-58a200484bd9", "value": 549788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681973946, "uuid": "363c5395-297f-478b-ade7-d1b9d4326979", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681973946, "uuid": "a09830e1-a8e8-4158-ac76-ce25d2a0e3b3", "value": "BANK DETAILS.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a71b59e-df90-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682004660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682004660, "uuid": "42cd0b5d-b4f4-4dbe-96a0-2aa4e20904c6", "comment": "Malware payload", "value": "e91e68dfc644b263f505ff6701287e5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682004660, "uuid": "1f6b2aa5-f1b9-4c19-ae7c-728d80349101", "comment": "Malware payload", "value": "3ae27a7741a37b5ef68e56dcf589553c6e3516f9cf221a3491a7631f3c028887", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682004660, "uuid": "7b7f98fa-0d5c-4758-9e1b-01d440c9bbc6", "comment": "Malware payload", "value": "d6f17682e65b5b83a93ecefb65c8785ace7d1a83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682004660, "uuid": "482e31fc-aa1b-4ddb-9bd0-2fd46b420443", "comment": "Malware payload", "value": "d9ac33ddf115ef9fc035ddb669f167ba2f7611dd5e71ffcd43c87ce2c95d35fa3d823be52c6e971fa5cb0f6485c58959", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682004660, "uuid": "1351d553-3a47-4d5e-a1b3-c4753dba6f1d", "value": "T1431733E8676508A2E9F3903E581F880648B5ED4623D8E98F42F5867C4FE31625D3FF94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682004660, "uuid": "dbeba8be-8da8-404d-8301-e28f6c4dc6f6", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682004660, "uuid": "d14fa2ea-2b99-4d6f-8016-2fd75aa3f6fd", "value": "393216:HqPnLFCU/3KiMuQpDOETgsvfG3n6qcoJya3:KPLFCUSGQoEwNy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682004660, "uuid": "27ce6863-295d-4321-9597-977427041488", "value": 18593356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682004660, "uuid": "922e9be4-051f-4ad4-a6b5-0593ca4bcacb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682004660, "uuid": "f2640854-205f-42ba-9b7f-d02df0faacc9", "value": "SonarLoader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ce5f825-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681985739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985739, "uuid": "3390ee2b-551d-4fc4-a3eb-78978e8764b0", "comment": "Malware payload (Formbook)", "value": "daec170c667534269652d0cc2762e8c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985739, "uuid": "09ad6d95-2b4f-41a4-94f4-315bfcedf7d6", "comment": "Malware payload (Formbook)", "value": "3b13397c20abd804bfd731c28f9949f2cbfcc08cdc28ec34457729d0a645dbb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985739, "uuid": "86154cd2-530c-4eae-836f-1876afbc9044", "comment": "Malware payload (Formbook)", "value": "05ddc6e2369311b3aaaa9377c1cc960f95ecf449", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985739, "uuid": "4179f9d2-fba1-4dca-a051-c2e373cb4796", "comment": "Malware payload (Formbook)", "value": "02a3743969b025703812d57c385d11aeba885b4f287c4ee3c7aef85371165f1fa81ac23b7b83fde2cf717e1a04c468e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985739, "uuid": "2996c81b-46f8-47de-8279-b95ccfe24602", "value": "T10604AE32DA42C431F2B252B5B2BD1B7B883D0E353295A4E9A3F115E06EA19D5F43931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985739, "uuid": "ed5cc85f-c8d6-4036-a062-c5d3e10d41cd", "value": "3072:uGcUkxSHP3Er83AYT8NGSYW67OychpITU+ucNRPvCwlUKw:aysyAq6x6KycfUucNRP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985739, "uuid": "3cbe3505-4572-48ec-8984-2200ea122848", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985739, "uuid": "f44dea71-d5e4-413f-9f0f-b4ab85734307", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985739, "uuid": "583e1ac0-b2fe-4709-9eba-d452b97a6fc9", "value": "3b13397c20abd804bfd731c28f9949f2cbfcc08cdc28ec34457729d0a645dbb2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68e44fce-df54-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681978914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681978914, "uuid": "4bd85606-49db-4e14-9b45-ec54c25dd679", "comment": "Malware payload (AgentTesla)", "value": "38d70f854c058261923d4e38b26d0b3a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681978914, "uuid": "9addf6ad-2af3-4572-9dbb-64f089793e54", "comment": "Malware payload (AgentTesla)", "value": "3b5ac4dabb34a13b2deef8dd1844b125c592e6eac2801a2c69c09b4b44675320", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681978914, "uuid": "742156df-9d2a-4bc6-bb4f-9b21a39dc95e", "comment": "Malware payload (AgentTesla)", "value": "9560a9e307e3220a9d4736f8777a576a09f4d514", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681978914, "uuid": "7c5fbafe-0363-46a5-bf6f-0909837db6e8", "comment": "Malware payload (AgentTesla)", "value": "054a666a2b7bb9d7359fd97e465544930c6ef9a9310df98d73ac598a3f8fa28a60bc75bc874da7538977af6f8e740460", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681978914, "uuid": "b29e9717-7238-413f-8b6b-1af1da38a842", "value": "T10CC4F1B873C0974ED9052BFD5E046C4827F28CF9C0D5CE8ECA66A48B4DFD7614644EAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681978914, "uuid": "0c700af9-a0c3-4bda-962f-db5b932f9f8d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681978914, "uuid": "a7c4224b-bb78-4294-b5ab-358708bfbdbe", "value": "6144:XY/AbtfaGLsltdtfXZO1xPY3fE57qdbA9p6KPZnZ1lLDbXXam3rtRI4f2VCZkPve:XYAaGLy93fweciKBnZ195RJf2iHmk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681978914, "uuid": "5dc17876-9208-4e28-8d1e-a21cfe09ed4d", "value": 585216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681978914, "uuid": "554587a2-9a33-4f94-adbe-8c60f22f7c6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681978914, "uuid": "1270f803-2535-4d78-b09c-855eea3bc7e8", "value": "PURCHASE ORDER #PO-004-023.DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cb29167-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1681985820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985820, "uuid": "cf253284-a945-4051-a531-82165571ea7c", "comment": "Malware payload (RemcosRAT)", "value": "bc54f9e4ead035489d7c76247fda8e87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985820, "uuid": "506a55b0-d966-4454-ae0c-c5e093569c2a", "comment": "Malware payload (RemcosRAT)", "value": "3c2ffc42864aba9e07bb8cd494141ea7125a2d24a8717f0cf0a33da8020dbdfb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985820, "uuid": "166adc02-31cc-4c5e-be8b-7cf0e404e35f", "comment": "Malware payload (RemcosRAT)", "value": "4e3e3d17f11c5339b96ea7d367ffe692a0d23238", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985820, "uuid": "122c7041-3520-4161-9a57-701e6dfcf8c3", "comment": "Malware payload (RemcosRAT)", "value": "75a649296ab82fb0517576c1d7c089bcfabfc7c3f7367ef884962fecf5c8883d1a510050fec122198ee6faf3a7bcfa46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985820, "uuid": "f5166d82-c4ee-4f32-9667-cc4242b8b9b0", "value": "T1C11502F862C0975FD8202FFE2614985827FA4DF8C4D5CECDC96AA4CB0AFD7225404E69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985820, "uuid": "bb144dbd-834a-4cd7-9ea5-3c7c8212e0e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985820, "uuid": "18cafc6a-000c-4c5d-a6ac-386db12512b6", "value": "24576:8waGLBFP0feaikAvAKPzxCiBgN7dtGMiNdIW1:nvvAKPz0GW7dtG3NdIW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985820, "uuid": "9c005ebc-7e9a-4c2f-b69c-0b46b532d125", "value": 896000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985820, "uuid": "dbb217a2-4501-458c-a340-b569b6e5ba75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985820, "uuid": "0765ba37-687f-4648-b262-51789db67449", "value": "ProofOfPayment1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05350b04-df61-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681984331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681984331, "uuid": "59aefd6e-cb79-4afe-b869-902127d8c35e", "comment": "Malware payload (Mirai)", "value": "b62105fe909af7a1de7f9e0423e35ff0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681984331, "uuid": "18b62782-561d-4e9f-995c-39d963cc2e9a", "comment": "Malware payload (Mirai)", "value": "3c5b771ce93c5164603df0831b8d71a37fde0e3f66b170c699453c4c93e52ba6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681984331, "uuid": "157bfd25-2762-421d-a450-b98fb8638402", "comment": "Malware payload (Mirai)", "value": "240785fb7343ea37245b56f2b7fc20828ad32b0a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681984331, "uuid": "fa8f152d-dd42-4305-a2b8-b7580b7b9b57", "comment": "Malware payload (Mirai)", "value": "a6e07e48e42d0c0079bffa2e6fe065e022badab33ea51882461b38fff9b52c1871869d33782716bf155b06996e7533ad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681984331, "uuid": "d3d44b41-8611-4f93-a869-ada8cf97b7e2", "value": "T1A334F95FAA291393C4AB45F23D277BF1879D6D7011C6028DA705FAD00773AB86821F9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681984331, "uuid": "b8458023-db94-49fb-95dc-1d4e0c5178b9", "value": "6144:ULAQ+ohoJ0QRdGJ0XTSA1K85k4En2edUcMgajQ7mM4B/GzJbJqlo6DVoMais9Ug/:S928GvBQzJbJqK6DVoMais9UgLT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681984331, "uuid": "5bbd3918-ba59-4e94-8f5a-c88e5bf0a8dd", "value": 232841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681984331, "uuid": "2dcf3f92-831d-4a8b-a1f7-4e20ed1a550a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681984331, "uuid": "cc752674-4761-4291-a25d-92b5add8e58b", "value": "b62105fe909af7a1de7f9e0423e35ff0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "651385bd-dfc8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682028730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682028730, "uuid": "5d3bc38a-791b-4d78-a526-f02f3021a2bc", "comment": "Malware payload", "value": "a55f3ed6dd32ad30bc9d854b180f70ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682028730, "uuid": "757223a5-5313-4e2d-97ad-00068d7b4e8d", "comment": "Malware payload", "value": "3d04b793af44a791275acd012d307f64b6d3b5e99fdebb5b2c8d3e102a6b30ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682028730, "uuid": "608e26aa-cd51-48f5-92c2-cefd2daeba95", "comment": "Malware payload", "value": "d20b1025f5a2069cdf754f2e6b5814c413b48ce8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682028730, "uuid": "0692c46d-3c64-4be5-a08a-9dcc93cf8510", "comment": "Malware payload", "value": "6ef16196138da3c2e38834e3ede5699d84ded0ee2234295109d611ef77008477c5771098af96377d873e3ed4a16d1765", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682028730, "uuid": "d061983f-1ca8-4480-a6c0-28320546b948", "value": "T17AD53326BBE53430D0D23D70382AD88E5B73395756B86465BB7CAF1DEE97264E20C342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682028730, "uuid": "b792d000-7d40-4ba1-abc4-342f870274f0", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682028730, "uuid": "b0852393-fa17-4c83-99fe-22cad52752d5", "value": "49152:zGlJfsbW1QeRNX5WdH1Pdo01bBezLYcD3MUgq9ilE0ekanWHygU:q/11nXiPaOcL/sanWSt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682028730, "uuid": "b4fcf2d3-8bd8-4aa5-9545-018bf6ee176d", "value": 2751772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682028730, "uuid": "4f600816-70cf-42f3-8b5c-ca235356b6b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682028730, "uuid": "cc16311e-00f2-42fc-b7f3-8e75bd40c651", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfc93937-dfbc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682023728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682023728, "uuid": "9e9caa92-3c02-450e-aa20-847745b7d97f", "comment": "Malware payload", "value": "eb7e17842033389a32201d66222af3af", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682023728, "uuid": "1fdaec90-a6ae-4127-9933-4881f4e07741", "comment": "Malware payload", "value": "3df5db8c2ff81ab8bcb7cad032948e7fde261022a859eac4241b72070ab320c9", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682023728, "uuid": "5a2cb1db-296a-469c-8659-3a9cbb8cb26b", "comment": "Malware payload", "value": "b604f7bc464adeef0a1478b6e06f8a96f10d4c40", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682023728, "uuid": "3d9fd859-9a7a-4c54-b915-0d885aeda219", "comment": "Malware payload", "value": "3034d50d2941ccc950fe787ae633f8e695b4bb911afbfe5fbc5acf5ac99cb65dc52c3717179371f00fc352fd7caec758", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682023728, "uuid": "af90c3b5-16f7-4d94-a73c-6cb79885b517", "value": "T18281D79CEBE7BEAA95835047FD1DF8410F6C1F6695C93C00A5B063A61187CB4F257A07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682023728, "uuid": "5112e00e-b29a-40d2-8527-8fa6cf89c1a5", "value": "96:pg5SvvvOmVeLx1G7NYdpzKTJIunKGjBA0lgUV0la:SIvOPLx1GZ08lINibB6M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682023728, "uuid": "6bf7926b-0ee9-4f4a-ac2c-f802f9318736", "value": 4148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682023728, "uuid": "4c734752-2875-4dea-a345-d132563f8f71", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682023728, "uuid": "5001f28e-aa03-4600-8d6f-4ede4277ff5f", "value": "RainbowSix.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2a405e4-df8f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682004486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682004486, "uuid": "b5a02cef-9b94-43fa-a30f-d67d58362453", "comment": "Malware payload", "value": "82257f4df505e1844f432d59f5d17a19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682004486, "uuid": "970b1194-d29d-4bfb-90f9-4bbe5d043620", "comment": "Malware payload", "value": "3e3cb3c50be2631c4eb8d28d88dde31f88454e86d684789d3d4f891b097a9892", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682004486, "uuid": "e85874d6-9899-4718-afda-1009d6500212", "comment": "Malware payload", "value": "fbdfa83ccd940784682845bba0749bea98e7d51f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682004486, "uuid": "5e7b888e-63d2-44a0-a2db-94d912801f99", "comment": "Malware payload", "value": "7701146363084207fdd30d4f64fd553b4497d40b5e6e8da9b325128083a08631a5c79cedf22c07f463885710b0c1ac4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682004486, "uuid": "50f6d1b0-ec79-46b3-a63f-75dec260d86e", "value": "T1F5937D51B9E1C472E5B749321870C9608A3EF9604F509EEB3398063F5F316C19A36AFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682004486, "uuid": "0801e37a-2808-4020-87e1-5a022ca3fe7d", "value": "26ef0946c6abfa2c7c249b8994ac8e6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682004486, "uuid": "c80b11fe-d7a4-4a58-90a8-5bbbbc132f88", "value": "1536:Khpx1pZOsdMi2dlgVdiIiZQR99TEQ3CyAuklZfpwcyFOVbl2sW8KcdvVdyP:KhBd2dlgVBiZi3CyAugfuOVtvHyP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682004486, "uuid": "1df2d7be-95d9-45a4-992d-370d1572330e", "value": 89600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682004486, "uuid": "fad0c234-a7f7-462e-993a-e1067df52209", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682004486, "uuid": "964162c7-fa96-4c5c-ad63-3a8139367afa", "value": "SecuriteInfo.com.Variant.Jaik.140853.2506.12420", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f37ca6c6-df3a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681967980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681967980, "uuid": "2af9eadc-7fa7-4d65-a209-82a12472c42b", "comment": "Malware payload (Formbook)", "value": "023570b6cf6da26431aa2f783f0b6804", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681967980, "uuid": "204de28b-4ab5-4556-a073-b6aa69070b19", "comment": "Malware payload (Formbook)", "value": "3e742163144a721a8d6733f9653c2acca1638eced30159467a6768aff047f25c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681967980, "uuid": "5c30a43a-fd4e-477d-a4cc-e68963127cc4", "comment": "Malware payload (Formbook)", "value": "9e06e28025ca4f133c4a132b73f43d98d6961a3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681967980, "uuid": "f749f3b4-2eae-4e1d-8163-76d0bb790795", "comment": "Malware payload (Formbook)", "value": "feab94afa1747bf89cef2bb937b80a4b8f22c4e5c49d991623ed7e0a2aa14e4097fd67a1c427ae0867f1b36a214f4bec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681967980, "uuid": "b690b428-fdda-4ce0-a57f-91f2b6831a50", "value": "T1068422047F85E07BFA424EB10D761B7A86B5DE426E45660F93C839847D733C1AB3B24A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681967980, "uuid": "65716aa1-9ada-4e15-86a1-3f9346429e8f", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681967980, "uuid": "efeaac17-e1ba-40c4-a799-43aa707dacf4", "value": "6144:ehgqhwXoA0WfC8aKROEDsqmI47IOpXGNlUY27NygUQ39wuBUjuwfAljSHNk8pIlf:dqFWf1aKYEQhIdjlUr7NygzwOU14lu3A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681967980, "uuid": "47752a0f-1efb-4d30-bca4-3fa2f5dd37d8", "value": 390992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681967980, "uuid": "63b0a9d7-ec86-4a49-b555-b963f0cfb2ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681967980, "uuid": "bef1c900-d831-4ff9-9bd3-ea0e0d2ea1f4", "value": "Purchase Order..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56cd6c6b-df5f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681983608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983608, "uuid": "2d72fb4b-b28c-4e6b-859e-7f1ce9417084", "comment": "Malware payload (Mirai)", "value": "392814003495fb33ac0891d31efd8150", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983608, "uuid": "ae471e51-9103-4e5f-96b0-afa24f0156b3", "comment": "Malware payload (Mirai)", "value": "3f13ce6714aa36c9a382bb15df7d0fd3456ff4135e47ccd70fd8c305dfa2c41f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983608, "uuid": "804d0639-26dc-4817-9fa9-c0ac3b6d54ce", "comment": "Malware payload (Mirai)", "value": "ee971220c3975dabf57c785f79928ea31dc26151", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983608, "uuid": "c14d22ba-7cc1-46c8-a37a-ca1671597a05", "comment": "Malware payload (Mirai)", "value": "cea45e41702f80357077c5e4203961e1af534aba877c18a69d20fad86b829660023b8dc99e9487169518fb80228c80e3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983608, "uuid": "9fdce715-c871-4950-b90c-39c3fca352f5", "value": "T1C543F855F8818B22C5D4027AF92D118E332367E8E3DFB2139E106F247B8696B0D37E56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983608, "uuid": "364e88b4-7498-40ab-8ff5-5c5394cbd6dc", "value": "1536:5Jng2Ke3tTQZoSgLyUa/aBD3ezzIci13FihNJ:A1edT+dCn33FihNJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681983608, "uuid": "df2d61b5-fdfb-40a5-92dc-7ff65dd25ec2", "value": 58676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681983608, "uuid": "b8e27b66-c8dc-4eb8-b084-05ac55731000", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983608, "uuid": "e0cbfab9-80e5-4be5-8dbd-fc9dd11b9e1b", "value": "392814003495fb33ac0891d31efd8150", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dead367-df84-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681999619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681999619, "uuid": "84930e42-fc52-47d5-86c5-0ea44b26593d", "comment": "Malware payload (Mirai)", "value": "9a3aa44f4f56364a1bf58612834e4ebe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681999619, "uuid": "d7fdb728-95c9-438b-9fd6-810206fbb1bc", "comment": "Malware payload (Mirai)", "value": "3fb13f30d16774b818357e379695d4fefb571bd660b00b6a15b20957f9e6f9b5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681999619, "uuid": "256b0e18-deba-4f68-9ecc-4fa0fc9da229", "comment": "Malware payload (Mirai)", "value": "0e38f98e57306f753c61ac57168388b288f6a060", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681999619, "uuid": "fd0987df-cd7c-4735-895a-94457d34dc6e", "comment": "Malware payload (Mirai)", "value": "52815c390796de39bae44a0bac2a34dd43fe4ca6a759f85f09a82a258a045e245e3ec08bfc1a3feecf0f0947ca84cefb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681999619, "uuid": "ca7e66af-1ce9-498c-adb4-8dfab24bcff5", "value": "T1F4636B21B8391E27C0E4957A22F7872AB2F9534E24E4862E3E750F8EFF5558076472F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681999619, "uuid": "a0bd88a6-e1d6-423c-9518-099161ebf408", "value": "768:IcowEe26GLAhfg+MhN2K1sv11FN1nD3Id1pvUnh3Ei3LaJbyqCDSgPoGO+75ZLo0:IcIMlhfgNhNvRUnqVypX75mUotQ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681999619, "uuid": "713a0dae-7de1-47f7-ae80-cdb5d7455f72", "value": 72660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681999619, "uuid": "f0105403-93f0-4b91-b4dc-b440f7266a36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681999619, "uuid": "aa1d99e6-7686-4e25-8911-913f5f168967", "value": "9a3aa44f4f56364a1bf58612834e4ebe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddbd8033-df7f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681997579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681997579, "uuid": "672bb259-a870-430e-9c08-95ffbb4f1a52", "comment": "Malware payload (Mirai)", "value": "75b78c34d786976ae25aced96aa618a1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681997579, "uuid": "e64de21f-4131-42bd-a0a7-e177375cdf74", "comment": "Malware payload (Mirai)", "value": "3ffb3866e00de84b7d9272dcbad55efe84bd01a67599afaee35e9567f737417b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681997579, "uuid": "7cea1f28-4177-436f-85ee-037a3fbf3d51", "comment": "Malware payload (Mirai)", "value": "cdc3d66db06b38ab5a94043c84d54c87afa2e42f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681997579, "uuid": "313b37f8-310c-4421-9a47-8e8a17386e42", "comment": "Malware payload (Mirai)", "value": "e9917877385748ba9ff07fc6b556edc0983f0f8ff0e460cf9d3bb0ab8b6b58c2f48d42ea7e9a71be18752a10bc177078", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681997579, "uuid": "4710fef8-99df-4852-aef1-c994511ff0ff", "value": "T1754302769920F1A3E0DA7F7A5128F6D925743C03F72A41AF149E0D88CC8A3911B99EE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681997579, "uuid": "f7794444-8c34-49f3-a742-c634f0d81f35", "value": "1536:QBtq9fgL+3WT2HblbeWsfUOTVmmpNhUyklVSOOCq7Zw3P:h9fg63D7zsvVmmvxkiVZkP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681997579, "uuid": "4f35b371-0c4c-4302-979b-d2705403ed34", "value": 59336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681997579, "uuid": "c4d1ab07-1bfb-4642-9701-f84c1a19ca21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681997579, "uuid": "66d2caca-f2ba-4fa2-8c90-07e808a84fff", "value": "75b78c34d786976ae25aced96aa618a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f4af485-df0f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1681949156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681949156, "uuid": "4c75f3e1-7cd4-48d5-bc26-8b0fbadf4c5c", "comment": "Malware payload (RedLineStealer)", "value": "771fc0c5e36038917aeac5722cd4dd86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681949156, "uuid": "61e21c85-5d13-4f9c-a93b-d941c72937ff", "comment": "Malware payload (RedLineStealer)", "value": "405c1ad5dc6fcd07d88d0efe7d587ca21d6e02c4b74bc53c13017d2d4f648564", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681949156, "uuid": "48ad1eb3-b6d5-43c1-8efb-c5b2f4113dd1", "comment": "Malware payload (RedLineStealer)", "value": "0297b24df5cecc1a9e46fe57cb4338aed573112e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681949156, "uuid": "81092f58-ba8a-4991-94dc-9cf9c8132060", "comment": "Malware payload (RedLineStealer)", "value": "6d4a807331a90601b1902a333320d357e27d4a66727435abeb40ad8a0cccadf04d0c7237c28fa7a31be8669c25e871ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681949156, "uuid": "8a621520-1e60-43be-81cc-68209c88f084", "value": "T1FC34D0127AA0D573CAA705B55834EAA42E7E78B1F391CD4B731C2BAF2D302C15A67317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681949156, "uuid": "01db6bfe-0310-430f-a210-919f35e73c23", "value": "d76f139ac2e472c829d3b2911d8e5893", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681949156, "uuid": "9e8f9466-e6ed-498b-b33b-134e5c63450d", "value": "3072:efgxO/eDD5JAkjWqd8ikH+/+f79B+UIwsUsR5bTTqjk4/owe:IP/exJraiXWf79BhIwsUcTug4/ve", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681949156, "uuid": "e32d9dc1-ca2d-4182-a9a5-8e22aa0c8df7", "value": 240640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681949156, "uuid": "c14a1896-c5b9-4d8c-a1a5-7c3f4d536902", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681949156, "uuid": "aec53b90-09ac-4c24-86dc-c8ab3acb534a", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90a2eed1-df4c-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681975545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681975545, "uuid": "7b974454-5674-40cf-8425-5a6f2a627650", "comment": "Malware payload (AgentTesla)", "value": "39d87e482dbf6d47978fe96afb666e2e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681975545, "uuid": "c9045042-ad1c-4e3e-83d7-9cf98385aec1", "comment": "Malware payload (AgentTesla)", "value": "40f520059151169261544437b55034ba75964151f2fb4e931b9c5f648672d70c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681975545, "uuid": "0625752b-c82b-496a-ae29-62fc4a97f420", "comment": "Malware payload (AgentTesla)", "value": "8af3a38f15e31c9c343951bcfef1ddb403dadc62", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681975545, "uuid": "a15a88f4-085c-4967-953e-45151ebe695e", "comment": "Malware payload (AgentTesla)", "value": "6de523e8c8cd0684521985c5cb5f980e3e8ef3f4c9f029aeddfbfbb751ef81f7b6ca88da6cc3f488ce71055de20ee559", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681975545, "uuid": "a6470de8-e6a1-4e07-8bf3-63c806a39f00", "value": "T1DAD4E029A0B8EEA2E5ED0B76001436D8DF7061E33477C63C4ED674C9AB6EB591D84983", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681975545, "uuid": "697400ca-90ac-42d4-94d8-48aefacc6a91", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681975545, "uuid": "bdf29621-ee78-4bea-bb49-dda0e56da2da", "value": "12288:OPGAPQtwURCwFZRtstbaYKQtdVlUQAKqplf0g9YWRJfmi:OBPaFntstbXPFbAlf7v7u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681975545, "uuid": "cba2e81a-4688-4fbc-a9ed-ff708fb87c80", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681975545, "uuid": "26f3f9dc-1367-4453-987e-b84e1fceb01b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681975545, "uuid": "7ddf8852-17a2-4f77-b3ac-a07b40f53487", "value": "Q1-4001028L.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d9cceee-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681985741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985741, "uuid": "c07a070d-7435-45c0-9962-c25a9accc647", "comment": "Malware payload (Formbook)", "value": "71e50bf2ba54bd574b8ceed6887383f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985741, "uuid": "b66a48ba-ca03-4d8c-b17e-7e640a9744c8", "comment": "Malware payload (Formbook)", "value": "40f5c4cf3de1461b42dc81ddaf6bf3c1956d27e85773d8828e798b79402e6e13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985741, "uuid": "d5f2d968-b356-41c6-b981-2a9b24093255", "comment": "Malware payload (Formbook)", "value": "2d301efd7b4c9bb03c2c7dc381e74b767f861832", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985741, "uuid": "4736d252-d2b7-4f7a-9660-79dd8fff0af3", "comment": "Malware payload (Formbook)", "value": "872cd6a079cba1d71a5fb126716550cc395eaa137e11b41985f6adf3fdef755b455230120806ced7d527bf7f9bf7048c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985741, "uuid": "b629b5a4-4e32-4747-a308-f4f0186444f2", "value": "T18A04AE32D602C071E2B251B5F67C1B7B883E0E343694A4FAE3E115A16EF0995F52A31F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985741, "uuid": "07ac03d7-185f-429d-bb31-cb8ca46a8744", "value": "3072:B8QnUQwBFKRujtBxb7ZMcR0j2Vg8GYFsh9h2mQlufoRR84gHy0QtHnqkQ:FNFuHl7ZMcujkK9CufoRVgS0SHc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985741, "uuid": "04d148c6-4802-444c-ab7e-ee646b233a18", "value": 186368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985741, "uuid": "db57f6eb-eb25-44c9-aec6-40d12893ea3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985741, "uuid": "131abf53-33c6-4b4e-a7df-56bb1b2341b2", "value": "40f5c4cf3de1461b42dc81ddaf6bf3c1956d27e85773d8828e798b79402e6e13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62418034-df89-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682001667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682001667, "uuid": "138644ad-fbc0-47b2-80ab-bb2fc775ef26", "comment": "Malware payload (RedLineStealer)", "value": "2f67bb66312d942d6c1752f7c3c0bf71", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682001667, "uuid": "bde5f6f7-f0e0-4c84-b9b6-e0d360125a94", "comment": "Malware payload (RedLineStealer)", "value": "41110053ced1a0344def0dc53c512542dbea56910ab3678742c4a6c77533bbf0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682001667, "uuid": "e8faf1d3-0646-4bb8-b9f5-ee1a3eea9dbd", "comment": "Malware payload (RedLineStealer)", "value": "bdac2cd94c34a9025bae96db2edce7a1ed75914d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682001667, "uuid": "522e837c-793e-4559-b9ea-96794d1b123d", "comment": "Malware payload (RedLineStealer)", "value": "fe44edb0b277e5ab63fff0d73c52b5358f0722f12e1d7b60355936efba6f63902b8db2dae392eaf8436b684e4eb2b3f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682001667, "uuid": "dae51e1e-ab6a-45c2-ae63-bdbe0dd47943", "value": "T1B2B4AE1213D0A871E512DB728E6ECAF87B6EF4608F167BDB27494A3F49301E2C236305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682001667, "uuid": "c2c73398-1e61-41f7-9a3f-2fea2f8d4a7e", "value": "761da97ac2be4c1115573963fafba647", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682001667, "uuid": "1393feb8-16db-4eb7-9cba-125dc3e7afbe", "value": "12288:oSIhV7CejJvexDo2NSj/7GpsTN5e6Zfx1TE:o9hnvexM2NSTTTNd1TE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682001667, "uuid": "1739ddb2-7e80-4410-b536-4bf0be0f5d4d", "value": 500224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682001667, "uuid": "5cb378fd-2aee-4eb1-9167-5667fc66082b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682001667, "uuid": "5b7f0e13-a9ca-459a-95b9-97d864bfc2d9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49946238-df13-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1681950945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681950945, "uuid": "2226a5d9-fb1e-4072-b1c0-266bc72f49dd", "comment": "Malware payload (Rhadamanthys)", "value": "df16d5e9904bbaff20a19abc2649cde9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681950945, "uuid": "ff7c2bd8-a7d4-4f0e-b56b-e49a97f8df4c", "comment": "Malware payload (Rhadamanthys)", "value": "411ae76fa21378768d5038fa423837cf9909e5f91fa15e04e9a1c4a364b5b3a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681950945, "uuid": "fcd1975f-d944-40b5-a3e2-eb32d9cdce3c", "comment": "Malware payload (Rhadamanthys)", "value": "9a9b44f7ac4b5ec6a31faa61444e906ef47e8467", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681950945, "uuid": "df461980-3347-4551-a278-4a666ff214ec", "comment": "Malware payload (Rhadamanthys)", "value": "3bbb3c51e4b53ba9a613e643f5dbee6c2d5fed4e8a7bafaf91f53cd9376b9477d1193ba2b3aee23c2879669915f5e625", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681950945, "uuid": "ef34aa5a-3587-44a0-9601-52880518b4fb", "value": "T18654F22276A1D872C95B04784422EEB95B7E7CA08255C2AB731C3FAF2E303D25B77355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681950945, "uuid": "8f8e7c8f-9c7a-4276-8458-43fed89cfac2", "value": "fcefd95474e5b4dc39c6ed905cd56747", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681950945, "uuid": "a4fb0b01-59fa-4143-874c-aec6d91d644a", "value": "6144:AiUlFQB0QCCJuve4fOQH+5abvsc74Rzxhl0asJg4/ve3:AFFBYx4fvKcEJa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681950945, "uuid": "44d326a5-aa67-4414-8204-1d291d101745", "value": 305152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681950945, "uuid": "e55f5c1c-66f1-4966-a1e0-5df65a68dc94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681950945, "uuid": "00ab70de-dec2-498d-b33e-80c9e409a133", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e5a9e26-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681985742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985742, "uuid": "870953ca-436c-410e-bc4b-edb15949af63", "comment": "Malware payload (Formbook)", "value": "37219158fd985f91dbe001472cc0fa89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985742, "uuid": "fc8302a9-1ab2-4d0b-849f-0cd24a664a85", "comment": "Malware payload (Formbook)", "value": "42b1234da56fe61dddd91fed24d68d3d12add952d2dc36f7ef3b15d8441dc439", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985742, "uuid": "a3d13b76-6fca-46ef-9cf5-963ce5dce437", "comment": "Malware payload (Formbook)", "value": "69b00efbe96ad8da13e9f06e0c9c90aa7a6b847a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985742, "uuid": "8d05df1d-092e-41b6-9254-b86399049895", "comment": "Malware payload (Formbook)", "value": "57f0fe08aef8e5f738e8b04725ab10864ed7f7851a560a836120d255f7feed96099c107d1a7d747e8b79c54760120505", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985742, "uuid": "6d9a6829-d215-466c-bf7e-ff5042857463", "value": "T13A04AE32D602C071E2B251B5F67C1B7B883E0E343694A4FAE3E115A16EF0995F52A31F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985742, "uuid": "e0e90036-69b0-40be-b298-b5bb8752e9f4", "value": "3072:Q8QnUQwBFKRujtBxb7ZMcR0j2Pg8GYFsh9h2mQlufoRR84gHy0QtHnqkQ:cNFuHl7ZMcujCK9CufoRVgS0SHc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985742, "uuid": "2a9a5792-95b9-4e7a-8032-2d3b5b67307c", "value": 186368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985742, "uuid": "b59bf65f-88f5-471f-a1f1-56af602646f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985742, "uuid": "b9d299d7-9501-4413-94b6-5b4a22a2f5ed", "value": "42b1234da56fe61dddd91fed24d68d3d12add952d2dc36f7ef3b15d8441dc439", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "777f3a4d-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681985811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985811, "uuid": "71b4f45f-7a63-442c-bf61-7b26f03a495d", "comment": "Malware payload (AgentTesla)", "value": "fc10ec34c62aa33acc9b631e2a159759", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985811, "uuid": "10e59b13-88a4-49fd-baf0-553d766b0ccb", "comment": "Malware payload (AgentTesla)", "value": "437d464c090963f6558de403e1c770650438e2128d23eb502c2018e489e2df69", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985811, "uuid": "790e83a5-a9c9-4685-a971-54c35c5df47a", "comment": "Malware payload (AgentTesla)", "value": "ca330dde31f6e571abeb0f777305b9e3e4637f84", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985811, "uuid": "bb4e7232-5575-4256-948f-738c037a04bf", "comment": "Malware payload (AgentTesla)", "value": "c77ae8d3cfaaa5160c20351cc0632a326d986066515a1ecfae56e0438ca25161a130cac7ebb7b5700241a20795f085aa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985811, "uuid": "06f32f14-ac87-47ef-b494-20d1f1c13106", "value": "T140E4F129E1369DF7E2DE063900002AEDDB3996E77837C63C07A6718A9B9F7152C941C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985811, "uuid": "b91a9109-245b-4571-9f93-685e636da684", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985811, "uuid": "147065d0-d738-4110-ac94-a4446dc036ee", "value": "12288:VD+RJXJTxign/A520z0J+xXMZhpncur8+RxWDBLp3GuunPa7w3fUVk:wXNxi24PYEAhJvQfrWtu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985811, "uuid": "fd49cb89-6bb5-4563-9c4f-a928064050fd", "value": 674304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985811, "uuid": "bb1ff7a0-f64f-4e80-b173-20c209ad9a3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985811, "uuid": "2d1126c0-9694-4835-8378-c21fed1d4f92", "value": "NEW ORDER INQUIRY-002692023.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "920b8f17-df11-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1681950207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681950207, "uuid": "16a5228d-fad2-4a9f-80a9-291a4c581475", "comment": "Malware payload (Amadey)", "value": "5293d90a5beccedd5f9583a3ef0ebab7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681950207, "uuid": "5306505b-3303-40ce-9e7a-47e7aa5848a7", "comment": "Malware payload (Amadey)", "value": "44106a4ffe58d2249f517d45d91abe828e909b75c46c4682990327254a1a7cbe", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681950207, "uuid": "e2631568-8ca9-4b74-b11d-4d563fb95ff1", "comment": "Malware payload (Amadey)", "value": "951aa7bf6c8b60c920508fd7c0e7e4eea5d4f41b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681950207, "uuid": "5a45ef39-73aa-4488-91c6-a4c2f1208c82", "comment": "Malware payload (Amadey)", "value": "bb71c920ef0a4d4a2be222d7cb6cfdad8a1c1e5def5d479739133ee2440e9f22d9a6304a52de9c2eef9008f6f423b77e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681950207, "uuid": "4961bb4a-33be-4e99-aff6-ab16bb6be7b5", "value": "T14E352343A6E89137DFF62BF004F9468316797DE54FB9A3AB230154494CB2BE4913272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681950207, "uuid": "101df342-df58-45dd-bcee-358beacad49b", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681950207, "uuid": "b482259b-db8d-41ae-a2f9-2579fcfe09c9", "value": "12288:yy90yJxrowktX1d+b4B+SijkqOHhFBTB78FGmlUTN8D3LyMlBHGr4gLYk0sBiTCA:yyHo1X1cbe+SOeB5wlUMtz24gY10IZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681950207, "uuid": "28629c21-0968-4a8e-8358-9c4de68b55db", "value": 1073152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681950207, "uuid": "a978e279-29a5-45df-9cbb-f5673230feda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681950207, "uuid": "9ac7fdf6-2e37-4740-8c3c-e9238fa5380c", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ad42894-df3c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681968529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968529, "uuid": "fae5dfa5-4ecf-4963-945b-f20361fbf6cf", "comment": "Malware payload (Formbook)", "value": "d8bcc7fec4316837552ab05d31e9c555", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968529, "uuid": "ed96c32c-8f69-4d90-b841-611525f0d69f", "comment": "Malware payload (Formbook)", "value": "44665e986b18ac11dfc0d8226d232b436310ae04126362e26d9b59cb85b2827d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968529, "uuid": "e2d2acec-18c1-49e8-8229-dcfbe28254b1", "comment": "Malware payload (Formbook)", "value": "07d05cb3ed305be4bc00100de8ce1c955c0f0971", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968529, "uuid": "2b354878-c2cc-4f5c-b4b0-2b16bee02ac3", "comment": "Malware payload (Formbook)", "value": "cc433b8489fd2ad45bf4359e80a230954e82025009a4412ed68be4224092f274e2cbe3007b9312b24521369c866c5c92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968529, "uuid": "fa34ac43-9ec2-4ddd-ab37-65ee2e8f42cf", "value": "T18BF4E195B766E792C2683D3D42A660782FB089C7F516C939FDC8115D3F26BC91E8038B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968529, "uuid": "6a6166b4-1f64-403c-a8ab-3916bea8bf8e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968529, "uuid": "7d19c09c-7fd8-4191-95d1-aceeb4cc1c32", "value": "12288:nZZAXdHMH91DzZAsMaISA2gONZnRjBoQYBV/st2dHo5StoMZU+9P2rzLuRN0o:ZZeHMd1DtABaISA25jnxs/st8Amr2rfk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681968529, "uuid": "134f81e7-05ba-493f-92e8-5b42e486e47a", "value": 763392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681968529, "uuid": "916bfc7a-77c1-4b34-9ad1-9e217d8478bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968529, "uuid": "8568a34b-cebd-41e9-9d2d-567371303a35", "value": "d8bcc7fec4316837552ab05d31e9c555.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d96fe3f-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1681985767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985767, "uuid": "f436c71c-8ace-4209-b404-20c1f335ac3b", "comment": "Malware payload (GuLoader)", "value": "3989c5be3834b7f3acb409957baeb903", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985767, "uuid": "a1736dd9-b21e-461f-b749-f8090815638c", "comment": "Malware payload (GuLoader)", "value": "45156ac4b40b7537f4e003d9f925746b848a939b2362753f6edbcc794ea8b36a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985767, "uuid": "73bda9aa-b0cb-448c-bd61-845fdd7215f7", "comment": "Malware payload (GuLoader)", "value": "d3cbd6294c1e00750290322780096538bb566742", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985767, "uuid": "f7c01ae0-6f6d-46d1-b070-d433e72ce75d", "comment": "Malware payload (GuLoader)", "value": "bd1e9dc75607e573be5af67e24e701dbe33d5ee918ae7fbed3102ad1ef58227848c3d8482a307de5d00a012737a572d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985767, "uuid": "9b2d1599-2e62-40a6-ae9a-cccb8fdc0b0e", "value": "T165B423442BB0C463E1B601F1B973A67BB796ED00A994964F13959E0F7E7230DC20E39E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985767, "uuid": "59f3cc75-67a4-43e1-8e7f-00fe94366653", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985767, "uuid": "7ee5aba2-5012-4d72-bb23-2e9fdebae2c8", "value": "12288:gkmDOVLN5E+z28azyXd23HHsI7liagGI9NCnkMu32dW2bchw:gDOVLNe+zRGUv9N8Bqwn7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985767, "uuid": "d052e02d-c79b-4863-8fce-e971b253d9ed", "value": 522080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985767, "uuid": "653bce92-2ec7-4f5e-a3f8-8fe33862b800", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985767, "uuid": "50a552d3-f30c-4bd9-8400-3e0d9a9e3e1f", "value": "Adjunto Justificante del deposito.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4736bf0-df97-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682007925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682007925, "uuid": "bed865e5-b641-4a3d-9ba9-a9c95b89ce0e", "comment": "Malware payload", "value": "0ba7eafbb001ca1575f89a8cd60356ff", "object_relation": "md5", "Tag": [ { "name": "obama255", "colour": "#9A8BFD", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682007925, "uuid": "f16338e5-6357-478e-8bfd-31abcb9a0ce1", "comment": "Malware payload", "value": "4520ec4fc3710ba02d350b18ace930ab9d7c0a0f301b3147986b82baa33a1db8", "object_relation": "sha256", "Tag": [ { "name": "obama255", "colour": "#9A8BFD", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682007925, "uuid": "e828fce7-303b-4dfb-9fae-bb701bb8bb1e", "comment": "Malware payload", "value": "0b829abc1ffc577a2b1edded42e5b098178ae3ee", "object_relation": "sha1", "Tag": [ { "name": "obama255", "colour": "#9A8BFD", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682007925, "uuid": "79e79f8b-357b-4f6a-80bc-63e70a3d3a7a", "comment": "Malware payload", "value": "0cc3edeb7f11be54d365485b28360e895b8078830f45206409f53f91f47ffed85b4dd75bf3d9f5e78cccd767e46553a8", "object_relation": "sha3-384", "Tag": [ { "name": "obama255", "colour": "#9A8BFD", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682007925, "uuid": "89c53844-f5e4-435b-8335-2da1996fa87f", "value": "T13893C060B1A6AEC8FA403AB361783AF4CEDB0CB7CA541A373F8C405A5711EE7D49C556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682007925, "uuid": "e7603ebb-2343-4b29-92d9-fb32a6f08b5f", "value": "1536:RAHsbUBym8yF1u9YJT9xymczaYmZPKgUdYYYYYYYYYYYYYYYYYYYYYYYYYYYYYc3:6DF1u6bCaY8P3QYYYYYYYYYYYYYYYYYI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682007925, "uuid": "7ecfa320-be4d-49bb-a480-3fdc3db6a87a", "value": 91866, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682007925, "uuid": "4a718060-68f5-46ac-9008-9de1c89474d5", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682007925, "uuid": "f76c79ac-e015-4083-b70b-df7e1550717a", "value": "Payment-1337.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "705b510b-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681985799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985799, "uuid": "aecd22c3-280c-4d0c-a0f2-f673619c0e51", "comment": "Malware payload (Formbook)", "value": "5dfb3532254d4bb96344a5c0581874ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985799, "uuid": "c7a563f2-fdf6-4e00-b7e3-53099950fc69", "comment": "Malware payload (Formbook)", "value": "45c495f1765c2a86062980d2e2b196b0696247fa42199a6fd278cd739550db57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985799, "uuid": "42ba17ca-0fa8-4da8-8887-37bc6308852d", "comment": "Malware payload (Formbook)", "value": "50d9ab8e50ae6eab2b22897d6f349e28a1e61ff4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985799, "uuid": "e0a14932-bf21-4047-b67b-756a20ffd8c2", "comment": "Malware payload (Formbook)", "value": "e8192a6bc684b0c181325b569c6d255cb0291b98b90f1279dff26da3424a8a4ee42d3775d9a58c43206533e5a216436f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985799, "uuid": "a4441cd9-6313-4fa4-82db-62783880b2eb", "value": "T18AF4E05D7A58B55EC59B8E3289141C50A7B1A4A7471BE347A48F229CDD0E3EBCF002FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985799, "uuid": "18d4f5dd-0740-4c97-8518-f5072686f098", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985799, "uuid": "01041746-a0ae-4d18-8a7a-dcb0a2e4cd57", "value": "12288:sJs26jvbLVMJXUIxxxIahKRWY+Z9kjHEvojhu6kqiF1VSTEhrtriz5+ev5MXDp8o:7/jFcu09kQvojhu6kXnVb9Vs58", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985799, "uuid": "87c10587-c1c0-4b17-b902-bbf0994db765", "value": 769536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985799, "uuid": "c9645922-8fe5-491f-8c64-93e26df89718", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985799, "uuid": "a385565e-c44d-4710-a521-170b0186bb3b", "value": "INQ No. 1260.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "803f7eb9-df7a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681995274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681995274, "uuid": "e785000d-4c31-42b4-a49e-86ac37e3638e", "comment": "Malware payload (Formbook)", "value": "8a59c56aa5ee14b30084aa0c91285530", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681995274, "uuid": "fc667bc3-2173-43fa-b117-934ffaa74a45", "comment": "Malware payload (Formbook)", "value": "46ebeef0d2744f31a16c27b26e21eef38e687441e3121f75986127a4f93a5d4d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681995274, "uuid": "066f0d25-f14a-4e7b-8be4-ada157b608a3", "comment": "Malware payload (Formbook)", "value": "0ec504d09f2d4c82c6106d49280ef7f3433cdcb6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681995274, "uuid": "64e3b2e8-28e5-48fe-ad3f-1f64903046f5", "comment": "Malware payload (Formbook)", "value": "a70c359ac34f08161df4b9c081ccd98dfd5562cf5f844bc668ac936406caee607a67853a1aea90abd2daf9f08cdee9ce", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681995274, "uuid": "e7120334-9297-49ed-a9b3-cfc57a28c042", "value": "T17FB5AF370EB2FEE2E7A44A7FED4235941DACDDF74B1DB206388C30A90DB865499059E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681995274, "uuid": "f94ae496-49ca-4091-b673-a38a6b648872", "value": "24576:oB26eZ4fTPkhZ2PAG0pMn6+YZ8IOxSD68Q81Zr6kNefAd/YK2HzQX9Kub+YSgrBK:rhhj+EbjDE81R6iY7O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681995274, "uuid": "94a82847-a927-4712-bb3d-cb496d91e184", "value": 2394112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681995274, "uuid": "400b1bd7-4625-4120-a66e-f49d7d0845f5", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681995274, "uuid": "f2e93d5e-c934-41df-b4dd-e65586429d93", "value": "FEDEX TRN 771893954554.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "607aa4af-df86-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682000375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682000375, "uuid": "511f517c-02d1-4aea-96bf-53e25e519431", "comment": "Malware payload (RedLineStealer)", "value": "eabfe64cdbcd5c96b6593975ceb1a26f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682000375, "uuid": "0d6aa7bb-815b-493d-a729-10589b88bf83", "comment": "Malware payload (RedLineStealer)", "value": "4947a1012a59e1a5516ddce022d9ed6708f100bbe896245ff43569d2659f504f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682000375, "uuid": "be9177e7-a637-4a84-8f43-4f80a45a7704", "comment": "Malware payload (RedLineStealer)", "value": "2830dc42cc4624ab7f11333e577d3206634a3d52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682000375, "uuid": "2bcf60b8-a46b-4592-b0f2-3d72fcb21848", "comment": "Malware payload (RedLineStealer)", "value": "c9d98022b2dccdb634a2cb2f5f36ce5c292888ec2c79ac32bfa116685cbb75a2ff5dbd20057351dbc97fa93d9e9af97c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682000375, "uuid": "9951348e-0978-4940-9bb5-758c927e0c3f", "value": "T15AC4F102F9D2C8F2D5220932092AAB51757C7D301F258E9FF3D86E2DDA35191B225BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682000375, "uuid": "10b7b6db-5f32-4520-803e-6b0fba7ead4e", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682000375, "uuid": "57169ac0-fd7d-4cdf-9297-d82bfa2a2628", "value": "12288:JcrNS33L10QdrXZT+tcWnn9kjgn0PppW839L01+m4:0NA3R5drX/Wn9ig0BpWK9eg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682000375, "uuid": "09aec159-11c0-4195-87ee-cd86638893b4", "value": 563969, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682000375, "uuid": "347f8a07-0ccd-4370-a404-ebf6e6f02bb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682000375, "uuid": "2b6569dc-a766-4a2b-9a8b-05887730f6b1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d257f1e3-df56-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681979950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681979950, "uuid": "ed16a643-0c3d-4910-b4a0-e9d6b64446b0", "comment": "Malware payload (Mirai)", "value": "8ea224038ef1fbfcb9f1cd34014127ba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681979950, "uuid": "1167bcbc-4055-4523-ae5b-b151a573fbb6", "comment": "Malware payload (Mirai)", "value": "49639c317b5cfc09b243f68c7beea726217c5e89749361dcf2180f69922ff420", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681979950, "uuid": "73f3bb5a-3700-4690-9b4c-7f9588c91bd3", "comment": "Malware payload (Mirai)", "value": "3142a6ff0c729c1822c0cd5b7a68a55f8152010d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681979950, "uuid": "26f7cd8b-ed4c-461d-9b5b-a9c7d4c187b0", "comment": "Malware payload (Mirai)", "value": "a16f219378efe0527921081fcb440efd969a7d2f801673e6a0fdc6d5bb87802356eb5524840e426072ae8dd76220f6d9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681979950, "uuid": "3024fb68-b726-4e38-a106-df865f1b16e3", "value": "T1A7532B01F719084BE1F31EB03B3B2BE587A6AE8221B46248795FFB49D571D32544AECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681979950, "uuid": "6396db10-877b-4d57-977d-ef1c1ca49927", "value": "1536:RWw8FGBIrEYTLAbmHIDEZ62bYWTcwOMDh/KbTqcby4NQazTw4Y1HVA6rP:Yw8CI4YnA6HIwZfb3D/7fP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681979950, "uuid": "01d7d19f-f3b7-4c69-9d21-b5195cf2a68a", "value": 66332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681979950, "uuid": "39b3091f-8a37-42bd-b2e4-5f9e53763d3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681979950, "uuid": "38a01196-1ba4-48fd-9228-b79f4a72929c", "value": "8ea224038ef1fbfcb9f1cd34014127ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f18fc72-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681985743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985743, "uuid": "4b71772d-30dd-4269-9d10-cdf1e0605fb4", "comment": "Malware payload (Formbook)", "value": "3da3ed25f4629b85b9b3283458b184e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985743, "uuid": "51776f83-3092-4642-946f-c12f6b217c6b", "comment": "Malware payload (Formbook)", "value": "49698b30764a0b6ded2f0164c32670a784fa294b656008bee2337a4600da406f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985743, "uuid": "6a867c87-ba08-4460-9a9a-e403cc498ca8", "comment": "Malware payload (Formbook)", "value": "eb032228ac22e3cee4bc1f18e8277e50aa5c2ee1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985743, "uuid": "a0eb8d95-53ed-4e76-bc7b-85f520dc6071", "comment": "Malware payload (Formbook)", "value": "4b495cc37a485703906effd05d9cfbd30b400c549e87c608ba622a51938f476958a059778ff9130e584f99fa55940702", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985743, "uuid": "498abe18-d204-4f0a-a8c9-0428d140b739", "value": "T11E04AE32D641C031E2B212B5F6BD0B7B883E0D347295A5BAA3A516E06FF49D5F16930F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985743, "uuid": "7e70f93d-f8f0-4daa-a84f-6d5399b81184", "value": "3072:cwJFEh7A2hy+b13/R6r6Kj9uWcCeKIdo0Z56zGDX+SGj2g9v:Y7NZ/EeKj9uWmKId7nBX+z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985743, "uuid": "ab7d5420-d162-4bf5-b368-1df0e32500b4", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985743, "uuid": "37165c7d-3ada-42b7-a517-2605c2bbd376", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985743, "uuid": "9aa29afb-9699-4957-84fa-2ed98ba9ebcd", "value": "49698b30764a0b6ded2f0164c32670a784fa294b656008bee2337a4600da406f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36cc0433-df53-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681978401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681978401, "uuid": "27f86fe0-1089-4f69-b80f-e2f105ce952f", "comment": "Malware payload", "value": "35d87c3b5308ccc84964e3557204e7ef", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681978401, "uuid": "7b67e500-c4b8-494b-8949-df02e0800fec", "comment": "Malware payload", "value": "4b5bc3bdc0b072c5a961876056d0c495318a32dc18dc10b12b570e9140762987", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681978401, "uuid": "1b91aa60-1a2a-45c6-a573-359638b6413f", "comment": "Malware payload", "value": "dc324a4c0fd83e920c9ca8d59e2fccf89758eb9d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681978401, "uuid": "9cc4bd4e-fb67-4486-a924-dd46117a4f15", "comment": "Malware payload", "value": "16fcd844fbecd225361245cc01e08d869935f94675e7424de023117647042bd5e1d4a8ee6e805354e96e66a758ae30f9", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681978401, "uuid": "09962c40-8d88-4672-9b82-31ae5d7a4918", "value": "T117C633B2AACB13BBD077AA20DB55DD40D9431BE52D2E80093F5C37AF7A041A151BD4EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681978401, "uuid": "3c5092ae-a87a-46e9-aae8-b7a08146b2ef", "value": "196608:NIEg8cEK5hnpPoBND2AN3iY54VglDJ5/Ylwyot8KXFBzJDXgvrpd+U26EeMxWo+Z:N88cZpP6NpH54VgNgCygzJ7gv65pWo+Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681978401, "uuid": "df3867a9-7f14-4a3b-a308-1ebb0021126e", "value": 11469584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681978401, "uuid": "08c8b4c8-43a0-40f3-b8b3-2bd62fb5fd47", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681978401, "uuid": "b18b6fd1-bb11-441d-860c-4005180eb4ab", "value": "NF-e Emitida_pdf.gxxAN.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e48016c-df5f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1681983514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983514, "uuid": "0c2628cd-d0a2-4b64-9044-ac08e496ac0c", "comment": "Malware payload (Gafgyt)", "value": "0824062e7777c562a05dbecfd828afee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983514, "uuid": "5fc22147-30c9-436d-9293-ce683cf38df8", "comment": "Malware payload (Gafgyt)", "value": "4b9b7a549031674d95099bfd9c09e477ecfec838d19fc6c72a90ab3e1ae8b826", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983514, "uuid": "495b6cad-5749-4a3e-b6a9-5a539ec50769", "comment": "Malware payload (Gafgyt)", "value": "80eecf5929d420ef81cabb2c061b6fe344ed4c49", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983514, "uuid": "d1db3810-c1b0-4b05-9908-02adce92537c", "comment": "Malware payload (Gafgyt)", "value": "59401d2abb8ea6721e13d712fdb3efdaf43d07cf062f678743918c15a8fa51d7c4fd1c0f99149ce4ce73b0a4ffea58cb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983514, "uuid": "0fa6d8b1-0a85-4027-8add-d1b512eaf036", "value": "T18534C684ED149F7BC3D237BAEB6982CE76391BA477EB71255D302A7433D8B54623A010", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983514, "uuid": "4f90210a-dd48-4fbf-99cf-13152e141000", "value": "3072:oYV31Lfl8jXEzGf8eijrc86ACpZ/JT7vJ2PmRpbnODYDvSqWOY88kT:6ruCGbZmZ/JXJ2PmREDYDvSqWOY88kT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681983514, "uuid": "f097507d-ffa0-4fc7-9b80-a760eb217c1d", "value": 247091, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681983514, "uuid": "dd44d605-a0f5-471f-b6a8-a7988a9a2801", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983514, "uuid": "a50712f7-d3b2-43fe-9c6d-21d30f24423c", "value": "0824062e7777c562a05dbecfd828afee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b875696-dfcf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1682031774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682031774, "uuid": "a5671ea8-eade-4f12-ab2a-7ffecdb1d808", "comment": "Malware payload (Cobalt Strike)", "value": "648246782bdb175b0a51329feaa3d34d", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682031774, "uuid": "322a21e4-6c35-4987-9738-24403a5c6685", "comment": "Malware payload (Cobalt Strike)", "value": "4bbfa394a0c86357e195861893e162a61069ddd7cf883024a9bbf0e3b1d6449e", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682031774, "uuid": "6a9c2cbc-921a-49cf-85b0-4787484a8013", "comment": "Malware payload (Cobalt Strike)", "value": "30cf1fcf5136b39814c98bd0b2c059648b6cdfd7", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682031774, "uuid": "053e3a83-2363-4b7c-aabd-dae9f75dcc7b", "comment": "Malware payload (Cobalt Strike)", "value": "93353fe3c5c5defba202bd997a7fde12be7117e7a799642ac3274c9ba4e69e9dd41874f5820b60c5c5ad8f64582662c3", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682031774, "uuid": "c468fd90-ff6e-4244-8665-17c7299fb0f4", "value": "T13BF3AD06F6D556F7D076C535CCA60A19E276B4021B118F9F13A84336FE23790AF2BB29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682031774, "uuid": "9ed6c6d1-5190-450f-bc67-b36a53343f0e", "value": "c6f5b048202cdba165d5f1b102a12f5f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682031774, "uuid": "35fbe4ae-37e1-4d78-a58b-107f6c42d10f", "value": "3072:ab0EdH+/OCHKe87OXnBZJEGAiYd+fOTidC8Gn+Kdr3RHQ:aoE1+2Cl/XB8iYYpoP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682031774, "uuid": "7637a2df-0749-4a5d-9b34-35b9051c1ecc", "value": 170496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682031774, "uuid": "495cbb1a-d7f6-40a8-9069-15be91cf197d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682031774, "uuid": "be819910-ef35-4013-9e58-0f137cb1074e", "value": "4bbfa394a0c86357e195861893e162a61069ddd7cf883024a9bbf0e3b1d6449e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fda7b14-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681985744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985744, "uuid": "c6d72c5e-32a5-4b11-ba13-59d6bd38240c", "comment": "Malware payload (Formbook)", "value": "a25c756fd3e1b3c614eb2b53da9cda3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985744, "uuid": "09ad0d7b-6c43-49d2-a7e8-8481f4a60261", "comment": "Malware payload (Formbook)", "value": "4bc94463128cf70668fd065145a32e224079cea070e389b048ea28846de6f0c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985744, "uuid": "f56ff6cc-f0ee-4e48-926d-75b996e06de0", "comment": "Malware payload (Formbook)", "value": "8c6dd4a4a4973d2ff6f521d2bd0afef744a5b2f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985744, "uuid": "18445e19-43a3-41b4-880b-c5b896775b39", "comment": "Malware payload (Formbook)", "value": "ba5e42c5700311297481795c63998384544979306a8868a25f922ca7a311f27e7eeb17a57cad38af6bb46efca3a06a80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985744, "uuid": "d34cda72-7b9f-488d-b465-0643b79cfe53", "value": "T17204AE329642C071E2B251B5B6BD0B7B483E0E347255A4EAA3E516E16FE48E5F03D31F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985744, "uuid": "b0d1324d-1fd3-45ac-9eae-d07211a114d3", "value": "3072:ofoithEv97vYYzW3F2z0Roqfa4+/CnU0BrDv1FpWUP6k+tMRR6:ki9AFUWa4+/CnU0rL1ZP6k++T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985744, "uuid": "89389da8-b450-4e29-998e-c2ed3c48c8e3", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985744, "uuid": "e2b142f6-7748-48bd-ba02-356281d6faef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985744, "uuid": "e9165626-7320-4c9c-93cb-53d03f136870", "value": "4bc94463128cf70668fd065145a32e224079cea070e389b048ea28846de6f0c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "068d979a-df80-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681997647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681997647, "uuid": "e2dbb8b4-fd0b-4816-93e0-1976800273a5", "comment": "Malware payload (Mirai)", "value": "8192cf7bd7afc151aee53e2d1960d2e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681997647, "uuid": "98d0ab5d-fb64-4cfd-8435-8a7fc075f720", "comment": "Malware payload (Mirai)", "value": "4c90e90cf41ba4c4e9bd7ec80bab9a73bff2b94aff40977ddeab17a885dcdebc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681997647, "uuid": "dc7332ee-8314-42b1-87c5-720af9074646", "comment": "Malware payload (Mirai)", "value": "824f4a146807f5d3047e481fa79933e3dd4962af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681997647, "uuid": "9ddbfa48-99c0-4d6b-bef2-f7974ea1db72", "comment": "Malware payload (Mirai)", "value": "ba2956684181e1d98c6e86641516d15f500a18ba5a81853f4ee18706c57b7b42f384bc8676ee5d99eeb287482bd8b5ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681997647, "uuid": "a51ef2f0-ce0d-46ae-bec5-0a5060ded1ab", "value": "T15D333B21AD7A2E17C0D1B87A62F74724B2F6578A21E8C71E7D720E4EFF109C061676B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681997647, "uuid": "423ede78-6fa5-49b3-bef1-51be7f8c5cf0", "value": "1536:ewl2tSukgAHAqxF7z81llSqMLQR8YoTmc:eA28ttzeVMS8YoTH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681997647, "uuid": "a66f4f9b-25e8-473f-970a-7e1b4eb5f90f", "value": 54608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681997647, "uuid": "c58a9c10-53b0-4aa6-8b17-93153ba478cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681997647, "uuid": "6b37bdb7-61eb-43c1-8157-857581ead8f7", "value": "8192cf7bd7afc151aee53e2d1960d2e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4299887c-df77-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1681993882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681993882, "uuid": "30e66c9b-ee09-4bf9-bda4-0c4d40514a54", "comment": "Malware payload (GuLoader)", "value": "0d67a0b9a6e5dedc5ca37954baf54b17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681993882, "uuid": "0a160fbe-b65c-4235-82a8-206919989a92", "comment": "Malware payload (GuLoader)", "value": "4d9cdd7526f05343fda35aca3e0e6939abed8a037a0a871ce9ccd0e69a3741f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681993882, "uuid": "735288f3-2cdc-49c5-adac-f81b9d551fda", "comment": "Malware payload (GuLoader)", "value": "3684266021fb50f901c431a3c050ee4edad5922a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681993882, "uuid": "63f78749-2c79-41c2-8670-8f96873410c5", "comment": "Malware payload (GuLoader)", "value": "aa2ecc3ab26d2a67e5faa51c6c9643b9112c4a3aab0acb0e9fb09a9dedddaf02e7d6290c2d1e40cc24358bc00012943e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681993882, "uuid": "cb8f2c36-fcb7-49e8-82ea-00ab74ea7115", "value": "T16A94127503A1C656EA715E30C97EE2F6A9A1AD22C67C572337307FDDB832381C60A365", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681993882, "uuid": "b8691a57-9a0c-47ce-a142-baf95de018eb", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681993882, "uuid": "22e66290-961b-4326-91f8-e335e994728e", "value": "6144:agORaMgJiUyKoFK1+vIG1yWNtNIFOuO9l9jtEuOoy7Dy9W1ykZsdHXxjQI5QY9w0:agvZCFK1+vIG1ztGO39lSHyzkWX5QTyn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681993882, "uuid": "222b99e7-f268-4cbe-ae50-996ce666fd98", "value": 426184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681993882, "uuid": "d2b9030d-9281-47d0-bf29-a44f237ab966", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681993882, "uuid": "edb3eebd-153a-42cd-8273-dd0b115ba58d", "value": "DLAWT.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15894e2d-df93-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1682005833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682005833, "uuid": "e0332c46-ed1a-418c-ba89-7142e6e7a957", "comment": "Malware payload (DCRat)", "value": "04ac3994fdb094e25be02ebf3accf42e", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682005833, "uuid": "6114e6cb-40a3-41ee-97d0-4c7a64ad31d9", "comment": "Malware payload (DCRat)", "value": "4e1742205a1c552dc1978d9b2bd12354ca58095c3c5588539383555f406b9504", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682005833, "uuid": "3aa9b8f4-6f96-4b69-8283-306b8271ed54", "comment": "Malware payload (DCRat)", "value": "d0d0a95e43654cf938c3df4fd79a4d3d3e1dfb2f", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682005833, "uuid": "94872fb2-9091-40fd-98cd-374d78dfb531", "comment": "Malware payload (DCRat)", "value": "9cd7948ea90376a105454eac3e909e1c0cecbf5ea320514022148977406e007d25a69e88ab3bcdffdf5baae431884c5c", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682005833, "uuid": "0914cdcc-c146-41a2-84f2-6b55cabe65a1", "value": "T10CA54E342EEA102AB173FF7D8AE47596DA5FB7A33707985D10A1038A0723A42DDD153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682005833, "uuid": "a038e4bc-3e39-4c3b-a447-980fde9d6cfc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682005833, "uuid": "bfba97c2-5d4e-49b9-a4c2-f581dad72037", "value": "24576:ttc+utajXCOjBRoZqpOkmXHmc3iFfg+UcE506sSAr:t++PnyV/1BCP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682005833, "uuid": "ebeb4b04-562b-4f9f-a116-d7e76ed185c8", "value": 2239488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682005833, "uuid": "387f9a94-8df9-4af8-856b-7e59c245d479", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682005833, "uuid": "4c168a51-bc8b-4aae-acc6-9ad6342c2092", "value": "04ac3994fdb094e25be02ebf3accf42e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df9d7221-df45-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681972671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681972671, "uuid": "658b6ba1-2418-47fe-b97c-213541b9b3f7", "comment": "Malware payload (AgentTesla)", "value": "334d0aa7ce060ad9abbb29312906cd6e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681972671, "uuid": "9c37a24c-b178-495d-a003-31cb2972149d", "comment": "Malware payload (AgentTesla)", "value": "4e366229658b4ab9e02e153016155c5b09050f59f035dc4339954fbac54536b1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681972671, "uuid": "37f8dab1-b8d9-4ad4-b1f5-eb43f618cc1f", "comment": "Malware payload (AgentTesla)", "value": "0e0e7ed72dfe922273ee88fbb75a77a5ee0b20c0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681972671, "uuid": "9fc32d16-50bc-48f0-8508-221c0140ef02", "comment": "Malware payload (AgentTesla)", "value": "1b757b1c5d04f92fbf570bbe34424e395b26fd5c15ac79612aef1373c065aaace01cd08a37b840894416a1a2ccf088e0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681972671, "uuid": "23594124-10f2-4e66-beda-4d4dc61c45c9", "value": "T19D14F411F754D17BFA584739AA4386A61266AC73B91EC80721C3730F2B33FA25D32E52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681972671, "uuid": "e19a2d81-89eb-4768-ae9b-d4810cab2bc5", "value": "6144:cZ+RwPONXoRjDhIcp0fDlavx+W26nApl045eIx03cS:r24EcS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681972671, "uuid": "d0d0a7d3-ac52-48b8-9629-088f8867ce8e", "value": 208384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681972671, "uuid": "ac3d3784-d917-47bf-9ee0-a7c2e6f03c2c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681972671, "uuid": "b1f48bb1-d99b-4d4a-b1c9-f72b7ac4ebd6", "value": "shipping documents.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df0a22f1-df6e-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1681990279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681990279, "uuid": "7111c667-d262-421f-a90e-fe8996699ba1", "comment": "Malware payload (SnakeKeylogger)", "value": "a3d95c3e81072dbad9de21ce5a25d154", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681990279, "uuid": "a42dec73-dd76-4a60-840d-a88884b4abfb", "comment": "Malware payload (SnakeKeylogger)", "value": "4e62540930b121dc5eb404032401ac2b37cd86b591e14c4404610a2e59f06b6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681990279, "uuid": "5eab54ab-7c5d-4c41-ada2-3bfdc686d0c8", "comment": "Malware payload (SnakeKeylogger)", "value": "44d61f99d2b96cbd3669b0d8797659032fefa264", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681990279, "uuid": "820a2d52-5bce-4cd2-8aba-917347a2e91e", "comment": "Malware payload (SnakeKeylogger)", "value": "f4db682bad312e310105a9d4d607a8eaf02469a95e893b0a5c2c0b7d0373de4494e67921ae3c7bb5f7fd25caac647af2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681990279, "uuid": "511b44f6-7ac3-4f12-8ffb-a2fbd6302265", "value": "T1E1E4BE9C7120BDEFC55BC93289542CE8EB2064F7631BC22A955735ECDA4E79B9E040E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681990279, "uuid": "3855e238-c676-4638-a74f-5c0860f3cde0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681990279, "uuid": "74860e24-3caa-4f76-8804-9d2cf905d26e", "value": "12288:F40EH4PTsmo4RfTG0bBWOKzAIb60GBV8EmZm/+ZOM2v97WgJrc7Hvn8F:fPAmoofThN+DPGEZmbHV7x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681990279, "uuid": "4ac0ff27-546f-4120-a848-7ba14ee401f3", "value": 662528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681990279, "uuid": "aabd9b6a-95c5-479c-bd9b-6d15775e0406", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681990279, "uuid": "6597f63c-cb9d-44d4-a0c0-45a8ac5bc2ae", "value": "PRE ARRIVAL DOCS.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83f4bbc0-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681985832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985832, "uuid": "9814a813-8c68-41f9-a773-8a5027500b9d", "comment": "Malware payload (AgentTesla)", "value": "6b828a6807328668ffb7c525e28c532d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985832, "uuid": "198dffb9-b600-4ac5-9664-8ca687fa2ccf", "comment": "Malware payload (AgentTesla)", "value": "4f106e71463410c0880736786b987b0329cb64a441481794230890d48661c9b2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985832, "uuid": "09c86c22-9358-4f05-a965-de2f65079022", "comment": "Malware payload (AgentTesla)", "value": "cb5fb13193e55dd6a4a89f9512b8cc4615a0d31b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985832, "uuid": "4a6a65a4-b7f8-42e8-b92f-9ac226c04c89", "comment": "Malware payload (AgentTesla)", "value": "a4e93ed181d668c73a1f82cdc69ab04fd6de30e003b56cc92de609dfadcd18209883cdb13b6e8a9ced617260f58deada", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985832, "uuid": "497abff2-a471-4a32-8aa9-47ab51674301", "value": "T172059E3C1ADE4721F07DD7749B704030A3B1BAE7FA29E91CD8D341895A62E81B99076F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985832, "uuid": "bce62cf2-5392-4a98-8266-298e30b89006", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985832, "uuid": "7f79db7f-03a3-45cd-b786-87806585e52a", "value": "12288:2qvmXRfQINqyEwTvs2o3ti1hEsmaPEQ3OSuzqHu24IO:2xRIINqyEwTs2etiPEwM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985832, "uuid": "ece63250-2167-4155-87c6-7ebfdf849715", "value": 859648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985832, "uuid": "97136d3d-e670-4f2b-914c-1cc31e3887e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985832, "uuid": "9b7ae94c-0155-4b0d-a1d2-8f7ab4a8ab50", "value": "scanned copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ba2fe9c-df12-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1681950465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681950465, "uuid": "9c36dfe2-8bbf-448f-9af8-586fe5963529", "comment": "Malware payload (Amadey)", "value": "7d753ef09ae1d8dd2eddc65d0863df77", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681950465, "uuid": "8437a2f7-c2f5-48f2-90dd-c8554abffa16", "comment": "Malware payload (Amadey)", "value": "4f2511446696ef6f94132718981b6f3c32d95617f10cf23b10d1d1a28cbb6e7d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681950465, "uuid": "c0f087ac-626f-48ff-a226-a0af3230ba20", "comment": "Malware payload (Amadey)", "value": "ede10d3a0a0f3573d343c7aca1d6108a1a38d5ea", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681950465, "uuid": "cbdc3ea4-fec9-4abc-a9c4-75d356f938ba", "comment": "Malware payload (Amadey)", "value": "fe419ae914dcc2f7452d48bc5165eec85562d744ce82114ac1bb8f9370ef07ee4ff829067e19b43a6a706b31bd13719e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681950465, "uuid": "128602d1-d51d-4773-a8a4-83bbbfcfd904", "value": "T178352302A7ECC477DDF44BB50DF60793032A7E9297B582D72588CE4A6D326C56A72343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681950465, "uuid": "a043f5b6-e815-4f2b-885c-1a6c4c29e57f", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681950465, "uuid": "baf976e6-ff54-4a6b-9bf9-84c9da7a66fe", "value": "24576:sytmnkdiTu8OF+l+otACp1ezaY/g4pMR9B:btm7C7i+otSamMR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681950465, "uuid": "478ecf5f-d1a4-4d31-bb61-b268004ae3c6", "value": 1138176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681950465, "uuid": "fae5053f-671c-4ca7-b849-c1ff75e93e0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681950465, "uuid": "ee172bd4-fb52-4cd8-b755-4cb68f6ad1d0", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50a03d16-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681985746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985746, "uuid": "a049e23b-b6f6-4a5c-88e0-2b1e0a871abf", "comment": "Malware payload (Formbook)", "value": "c516116fe61221dd8d318f1245803438", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985746, "uuid": "e83bba46-a9e5-4867-b7d8-9480eac59546", "comment": "Malware payload (Formbook)", "value": "4f97be86fd94c84a31cd8aa9bdb4310a6d251d0560e23eebb93d84596df72dfd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985746, "uuid": "94fb77f4-5b36-4981-a298-700b110dc689", "comment": "Malware payload (Formbook)", "value": "2abc7b500dab24f627983868b38bcd4339ac5185", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985746, "uuid": "26ed8c74-0a4a-4c47-92d5-1ce479a20beb", "comment": "Malware payload (Formbook)", "value": "9777ed7e011d06b85a67481101fd9a4fac487f344983acc2b43ab5ec1a9b304bdb71a486a12c33f42fee9d1fc3fca155", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985746, "uuid": "5b393fc9-7d54-421d-bc81-dbcbba8aeccd", "value": "T16704AE32DA41C035F2B251B5F6BD1B7B883D4D353294A4E6A3E216E06FE09A5B43931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985746, "uuid": "cbcbe7f0-a5a5-4f2a-8960-197557e0d9be", "value": "3072:wBfukkpsKtV73CliVM5Zal1ZGjAmvsGk/XpwM0yjZzHPoz:3HTCkSZal1ZGhUGSZzHPoz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985746, "uuid": "fa2b6b79-91ca-4eb7-9699-e51a2438cf83", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985746, "uuid": "618d641d-94f7-4d9b-8041-b7a7134391dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985746, "uuid": "de016934-96a6-4df1-9170-ed0f77e4e436", "value": "4f97be86fd94c84a31cd8aa9bdb4310a6d251d0560e23eebb93d84596df72dfd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "808780f5-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681985826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985826, "uuid": "0d4535f9-b4dc-4c52-973d-59c3dc034b2b", "comment": "Malware payload (AgentTesla)", "value": "24a89977403150a12cc80edfef8cba76", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985826, "uuid": "de3cb79a-db16-417b-90e4-c4182038fd34", "comment": "Malware payload (AgentTesla)", "value": "506b482e8d326b6c5b603061768faa782cd3992f42fd13635405565ff6e438ee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985826, "uuid": "a6e16ac5-a954-4e44-8f64-0326c248e8a1", "comment": "Malware payload (AgentTesla)", "value": "2ab1dbaf5a43dbfaed3f9c007f6ba2330674e1a1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985826, "uuid": "38124f5b-46a4-4917-b993-bd1f9888f1f5", "comment": "Malware payload (AgentTesla)", "value": "408d2920d89933d48b3ec22fdad53c09f94965fd2da503e1816894d0a07d6a97783c8a0cf558a9ab5f4ea25d188e0b85", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985826, "uuid": "405a0cec-9088-4a49-bdc6-b3fc42d0f7b6", "value": "T1E0B4BF873944C59CCF7955F36317854433AACCBFD518A7096BC83357AEE6BA20822B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985826, "uuid": "97f22e22-507f-4610-be97-c6883df17ab7", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985826, "uuid": "bd63bb42-9ef3-4e31-968a-0a4442075a84", "value": "6144:yYa6shAp081nNxvOjqKoeKZJL/P7SlRl7EYO886VEqWfWPF61X93:yYS6nvmjqKoeeVOlRlwfT6qfuI1N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985826, "uuid": "ec1b40e7-6105-4ae3-b8b8-c099845afb16", "value": 523832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985826, "uuid": "a5291805-ff07-4578-b58f-dd02078c4aa7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985826, "uuid": "2136ccc5-d224-4aa5-9717-9b6fad9dc589", "value": "RFQ#86533-UNITECH STEEL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81479f37-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681985827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985827, "uuid": "f78002a1-6e23-4ce9-a249-c10b6d5635d3", "comment": "Malware payload (AgentTesla)", "value": "064cfe036ae6952ef2ebb211740a9389", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985827, "uuid": "1c5e3844-9b54-4f9e-b0f8-460baee1acf5", "comment": "Malware payload (AgentTesla)", "value": "514be543f4e307be6133a891b83720ec896a19fb44a57cf3df0b9717848fc040", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985827, "uuid": "eb650d82-0b2b-4dd5-8df2-3a61367287b9", "comment": "Malware payload (AgentTesla)", "value": "d0bc03a72fc3099c62fdaa96aa33003aa7a61bc0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985827, "uuid": "772e5398-1e99-403b-ae0c-9413926113c0", "comment": "Malware payload (AgentTesla)", "value": "c484186df21309382d552bf200357413ebf3bfb84870525c20bfd2d57efdf0370eaab5935498d1ac704aa72415c533b5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985827, "uuid": "1cbedf1b-babc-4614-b337-e959c354dec5", "value": "T10905F126C276AEF2E6E90BB6001435DDCB74A5D37423C63C4F9678C9ABAEB505C841C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985827, "uuid": "f133d924-777e-43fc-91d6-591787bdae67", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985827, "uuid": "4263c6ee-5bce-4b86-b51b-086ab98a307a", "value": "24576:uJ5U/2eJS+QIVJPMmsIZKgEtUqd6udUk53:uJ5teJSaVhMm9ZKYqdRZ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985827, "uuid": "eeef5f27-3807-47d7-acc2-32ed14ebf23e", "value": 797184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985827, "uuid": "c38d3b01-df81-47f5-b25f-0ea83f0e7683", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985827, "uuid": "b5d15e30-f39b-486f-82a1-95cbd63ee3ab", "value": "RFQ Ezz Rolling Mills - Air Motor & Harmonic Drive - PR#36700 - PR#36738.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9d550b9-df85-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1682000069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682000069, "uuid": "b9b3da9a-4908-4333-968d-e49de970e88e", "comment": "Malware payload (GCleaner)", "value": "5a029d51c54c8e8d1a4ca5bae1584508", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682000069, "uuid": "d31662ec-c3fa-4d47-952d-ec9c055b6619", "comment": "Malware payload (GCleaner)", "value": "51c73c975fb8f689444ef3210709a5b3cff3f69b59abde806ec6fc143ca8617f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682000069, "uuid": "20ecfd2b-7c3c-4718-bea6-08413cc79a69", "comment": "Malware payload (GCleaner)", "value": "9cb16a95bc6736fac5c26a3bb640637f551500f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682000069, "uuid": "9d8f0523-43f6-47ba-b43c-a1e52c3b699c", "comment": "Malware payload (GCleaner)", "value": "7e8191ce6e555207064c1a759a29b652f587ed22645f210832263d7725ac34c40d8db1c86587b5b25864704172a3f39b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682000069, "uuid": "2dd1c957-1772-4997-b73d-be25fae94f6d", "value": "T10BC53302F2968038E2E66F705207C459C5B7B62EEA7C912C20EE467FDDA7E567DC0253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682000069, "uuid": "5f11d11d-5278-481d-af35-0ea1bfcb9d58", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682000069, "uuid": "10e8398d-4ca4-458f-9cb8-83980281fb62", "value": "49152:zGlJfsuieV4u51+yD0eJkFuukjHUJkqB1sAJj/owBT0cXWHygU:qKeV4u5z0kkwuF26OQjwwB0cXWSt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682000069, "uuid": "e1e19a6a-0733-4383-aa8c-a2b749365eca", "value": 2716995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682000069, "uuid": "5077d51e-2588-4986-9ab0-92ae77a584b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682000069, "uuid": "e7349ce3-d3cb-4e79-bae4-77222d38e355", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2acee243-df28-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1681959912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681959912, "uuid": "c7f5b39c-a047-4c76-aa82-87d6301b2435", "comment": "Malware payload (Loki)", "value": "d32670bafc2ba20b92b84ce9e44b62f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681959912, "uuid": "371a5bf4-a706-476f-bdb5-82f381ea7562", "comment": "Malware payload (Loki)", "value": "51d167499771b51338ce81d945bb083dbafbacb8256a910af55575a8f506f3e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681959912, "uuid": "b9c06d32-c05a-4284-8440-1f25a2687b33", "comment": "Malware payload (Loki)", "value": "25fea166a9cc4d86e7463230a3548256375dd037", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681959912, "uuid": "64c60317-81a8-4bb2-be99-76e482abdf5c", "comment": "Malware payload (Loki)", "value": "6599a5869a6df315a1136a01db6609f120a7d7fa3fbf0f78079d16c5fd92fc76dccbdee6c68913292a1fc6ed2feee375", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681959912, "uuid": "fafd0530-127c-4f89-9a6c-7416dc766135", "value": "T113E4E1C5B766D751C2683D3D82EA61282BB099C7F916C529FDC811987F27BC91F8038B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681959912, "uuid": "817e4f89-7d66-426c-8f5a-f10bafae4eb9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681959912, "uuid": "19b84e37-9457-416e-bf70-dac2e0605ccc", "value": "12288:Q05jYW3HMH91DzZQlHk/u8TsjzP/a32nCFh8vPNwRNbD21lVh+t:KMHMd1DtQlHQTO/wFhqwvYlVhu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681959912, "uuid": "a2e4ae69-e88f-41cc-ab69-66a03eddc4ab", "value": 670208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681959912, "uuid": "a5edede2-e865-4f11-94a6-49a32c3eabaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681959912, "uuid": "c07609da-491d-4a5f-85bd-534f0c00b5d0", "value": "d32670bafc2ba20b92b84ce9e44b62f6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a78273a-df5a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681981440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681981440, "uuid": "9c715e92-d472-43a4-97ed-be44ca247382", "comment": "Malware payload (Mirai)", "value": "316668e55af63222bb512520abbf5143", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681981440, "uuid": "b17a2097-a087-479e-b97a-1a6a375e8e03", "comment": "Malware payload (Mirai)", "value": "51e319709e798c74b2faa2ad1072746db1db8ecdabab44c277ea2979cecbd06b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681981440, "uuid": "5bd15d85-dd3a-4511-b436-509b5e9dda8a", "comment": "Malware payload (Mirai)", "value": "7b92c0997dd3d443360fa91c813da6abb0c543d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681981440, "uuid": "9b874c35-bbfe-4175-9667-3d27b072b416", "comment": "Malware payload (Mirai)", "value": "842316435b615e966ddb85d36f05d9ff36e134b1cd4ed417f47cb5a7c3c01a0d42d3443db1aa9a4a8f52e86668b3cec2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681981440, "uuid": "440fa571-d9e1-4e2a-a00b-9151c4a271a7", "value": "T1B293C54DFA64AB29C3E232FEFB49128E33271BA8B3EA7015DD315B5533C8B965535120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681981440, "uuid": "9c9b1571-9806-4ea3-9389-413e04a51968", "value": "1536:/0n0sAXihPtqimOFif5fZazr11+MxYZh7d9NjGPLec2lIyC/imNUDTbAnv:v9ihk8yux5xwh7d9NjGCMZUDP4v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681981440, "uuid": "b6b617a8-dc22-4208-b787-2d3c8aa79551", "value": 90724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681981440, "uuid": "556ebed5-f619-4f80-ba89-d7fdb53f7f50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681981440, "uuid": "4f7346b5-7ac3-4efd-b6fc-dc32a688e9c1", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f651b83b-df8d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1682003633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682003633, "uuid": "d692c129-b84b-4830-a272-1dbe87b6ad2c", "comment": "Malware payload (Formbook)", "value": "2691d24ffd466643e8e3b34c49c10659", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682003633, "uuid": "0810bbca-e079-49c2-a28c-552fc29ad04e", "comment": "Malware payload (Formbook)", "value": "52582001ebe2883d2f5b20f0de69b42c27aef25ec30e09e1a294b9ae2c8131c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682003633, "uuid": "24d8bf0e-bd61-4293-88e7-6cad23e38f65", "comment": "Malware payload (Formbook)", "value": "bc6afd18de75ee22fb8dfe68fdf47da085b06320", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682003633, "uuid": "d1b05158-9511-46b0-b61b-1c6594759baf", "comment": "Malware payload (Formbook)", "value": "e4ebeb499a01bc2bf2fa8d330ecada15c0716faca297f0aadd9a8da7e4416a9cf1101c002db4c80478aab5e9bd3d540d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682003633, "uuid": "f6bdcef1-b79e-40b5-b970-ad762129351e", "value": "T1FFE4F1CD5719D792C6643E7C222B72793F7048DBEA66DA37FD89509A3D32BC40B40289", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682003633, "uuid": "50a16ec0-34e9-4991-a2ee-3522d059794b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682003633, "uuid": "566ab98e-05fb-431f-8d3b-57754f6cc6d5", "value": "12288:j2iNpmMdcvlx3UMqlDmTdS2GLT1cmJvbp9NakNgvyOFGkvIx6QG4:j1Dqv3zd3GLTemJNLakNgZvE24", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682003633, "uuid": "c66b1b0d-b9c9-44dc-a674-ab01037b8dc3", "value": 694272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682003633, "uuid": "64c54ea5-5a6d-4ef9-a5e6-1aa89f5cec62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682003633, "uuid": "999a47cf-94be-415e-aa9c-b0cd93825e99", "value": "CADEE_SOA_350167_349705.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b04348d-df5d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681982783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681982783, "uuid": "abc21090-a9b9-4224-bbb6-fcce163bac81", "comment": "Malware payload (Mirai)", "value": "efb4b2f10bf72c62e9ebce6c086aa9e0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681982783, "uuid": "2106e5d1-1527-40aa-8fa2-b2a275063738", "comment": "Malware payload (Mirai)", "value": "529c9dfa00485de0496f0c1482975a628eb17bbca18e93b42e2367fffa8c07e3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681982783, "uuid": "78fa5a86-2b05-43f0-a1be-efc9d2db7d93", "comment": "Malware payload (Mirai)", "value": "7dd8b8dd7ae85e7db4cfdcaf78223b778571190e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681982783, "uuid": "91991964-4d5f-4788-897a-e4624cdf9753", "comment": "Malware payload (Mirai)", "value": "ff2f61a741cdd07fde5ece32f9184e8f9e1a70bad52b60a62a5833041f8bfa6e47918607e632c867b4c6f44410c60f42", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681982783, "uuid": "f20eaea9-7487-445b-981c-bcd7faeda47f", "value": "T118231741B8818623C6E4137AB66E46CE372563E8E2DFB3179D221F503B9682F0D67F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681982783, "uuid": "c2e286aa-283a-4e27-93c4-5fba8bf4e11f", "value": "768:p9T3kFvFsOvIZg3VevqKxpn9m+/8K/UfPoVs//N+WX7JTzLgw1:L3kFvqOv0Q8lgbfF/z911", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681982783, "uuid": "cb01c9ab-44b8-4b20-8e76-8ddc08493bf0", "value": 46864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681982783, "uuid": "ef01500b-accb-4cbc-a82d-60dc43419d3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681982783, "uuid": "8b9d3c8a-5d82-45ec-b637-7b7700bd6157", "value": "efb4b2f10bf72c62e9ebce6c086aa9e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e079209-df80-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681997660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681997660, "uuid": "13f193db-b136-4b8e-8138-24e6f1e5db0b", "comment": "Malware payload (Mirai)", "value": "5e913c347bbaa87ab423c0e87945c33e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681997660, "uuid": "47a4d68d-0212-4ffe-8bca-3ebf04dbbfe4", "comment": "Malware payload (Mirai)", "value": "52a6f0cadb9f3ac1137575ca7f00a498e1bf1cb0044ecda0e84986e68adf7fb0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681997660, "uuid": "0cb49c28-301f-4153-8710-e43cfd9d95dd", "comment": "Malware payload (Mirai)", "value": "7cc0bb82197c9f312c5a56e8d361b793516ee98d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681997660, "uuid": "3be762ee-1949-4790-aef6-511f5760cc49", "comment": "Malware payload (Mirai)", "value": "72984c7e0cba12ab63170176ff50ae498b1a99e87d3ea3a046510e6a3c516953845ce013e34b30cf449fbe2ffe886121", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681997660, "uuid": "ebc3114e-9f0c-41e3-9517-0a8bc34b6d5a", "value": "T1A8F2E16BB146F59EEA3C563F01FF54EB16AAC74B7525601B088F0F682C55B82212F3E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681997660, "uuid": "48ff52aa-96d7-4bc4-ac2a-79a210b1189a", "value": "768:+HOSVu7hN9rl1CuyY3VLoHc38CAJS6PXcNuEq3zrB9Xm47+7M9Lt:+WhjK+Lo87ghsNuEeB9W2d5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681997660, "uuid": "1888a259-eac4-4213-a877-129464f451b7", "value": 34504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681997660, "uuid": "b9e38368-606e-4e0f-9ebf-06b59a4d53c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681997660, "uuid": "3562fbaf-22fb-4e50-acfe-b8bdb8f8334e", "value": "5e913c347bbaa87ab423c0e87945c33e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ca546e4-df29-11ed-88f6-42010a9c006e", "comment": "Malware payload (AZORult)", "timestamp": 1681960506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681960506, "uuid": "af26e287-30b1-454f-804d-7106131f000e", "comment": "Malware payload (AZORult)", "value": "d926d3be32d7a16cf4f1462842737777", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681960506, "uuid": "dc44db6d-8d9c-4f3a-8ed5-1e2a54daf018", "comment": "Malware payload (AZORult)", "value": "532717e680ee5fa664cff745c8bc21636873214c3b16953cc6e3114344111050", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681960506, "uuid": "844e1f29-7277-4eef-ba94-49104af0f2a1", "comment": "Malware payload (AZORult)", "value": "2d4ac64fa124d826b13c35cced19364089978396", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681960506, "uuid": "8c5e6340-e66c-424b-8c3a-16ab4df13109", "comment": "Malware payload (AZORult)", "value": "edae2e3a31009c5d366553a46eab70646fba3ec28d93c332b764dfc1445b70038e9c9f648bd8a996fbfd731b84fe085d", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681960506, "uuid": "4d4e09bb-5a33-4c78-b652-97ae680adb8e", "value": "T13D141215B3F1C6BBD8D54B710B762A49AA79BE0418B4A60F3B519B1C3D372D0250EBD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681960506, "uuid": "752782e4-97bc-49ff-b489-91b7da24af99", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681960506, "uuid": "2b710eff-a091-4388-9634-767593bc215e", "value": "6144:PYa6dY//k+5HArvWygDvSLvMjk3q4qcG58D9Wgn:PY3YXk+srLMcqNl0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681960506, "uuid": "35ee9207-402c-49b0-8d84-1127695051bc", "value": 203241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681960506, "uuid": "14490149-39b6-4195-87ec-0f461338409e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681960506, "uuid": "f1aaa233-34b9-43a9-87ff-94a002c52a4f", "value": "Swift Bildirimi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f130a4d5-df7f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681997611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681997611, "uuid": "5e515e61-cd55-4387-a0b1-662a8afb6f0e", "comment": "Malware payload (Mirai)", "value": "774df297f2eb970d0dde04ce741c8695", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681997611, "uuid": "e42106e5-1022-451e-bd57-492cb6da7100", "comment": "Malware payload (Mirai)", "value": "534fe285af0276766a479e3e4bf15965e131348d34b14610baf9b0e2d972cb8a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681997611, "uuid": "17a75c42-6b34-41e0-b6db-4d2bb9381302", "comment": "Malware payload (Mirai)", "value": "5980f06743627b387b208fef14d354edf253b198", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681997611, "uuid": "d146ca44-35f3-4a57-a1c6-228b6cf3b450", "comment": "Malware payload (Mirai)", "value": "7806922420517c7600e483ac5c9b260b4e038781360b94fe10c1538bc44a90f13d4d5f6c603dba453e90a88df521734f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681997611, "uuid": "6399f75d-2e20-4bd4-8dd8-696da2f99f1b", "value": "T11BD2E18F3752E13BD112883007AB03B36F6F8CD790ED2975A827DC916F4A0535DD9AA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681997611, "uuid": "8bab3eff-4fef-4382-8f4b-3ab37c90e612", "value": "768:0rLG3HYbaAgjYWMir7yut0z6YrNdVHA0Wau7:gq3HzAxifvts6CdVHAyu7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681997611, "uuid": "e3dffa52-c511-48ed-aea0-d442fb40387b", "value": 28740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681997611, "uuid": "79b08055-f96a-4f93-adc6-b092b6677718", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681997611, "uuid": "cf51a66d-761e-48c3-8c44-db5117c20137", "value": "774df297f2eb970d0dde04ce741c8695", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22899a9b-df60-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681983950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983950, "uuid": "0b75fc74-2563-474f-af06-11d14845990a", "comment": "Malware payload (AgentTesla)", "value": "716fc97b18c314063411773cfa96e40d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983950, "uuid": "4a5432d3-ea11-4d92-a73c-98839cef7027", "comment": "Malware payload (AgentTesla)", "value": "5355439e9a0c11a25ed02d0e8e326a84e1631fc7fd24662982e808179cacef6d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983950, "uuid": "0c444393-cb14-438b-97e2-19a34570b5bb", "comment": "Malware payload (AgentTesla)", "value": "0082e99212389a3f2863cd95f4c9ebc74d11c94f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983950, "uuid": "a42cfea2-c94e-485f-a441-e6f1107a3de7", "comment": "Malware payload (AgentTesla)", "value": "5ddec761e8b05e4462f473ebae6a91ab7d92d4e19a12d8cc64daf9bd31967d2a10f6c05fc7cc7de8f30f65f511938ab1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983950, "uuid": "063dca76-1de2-4cad-be05-eacf55fe82a5", "value": "T18084D03CFF0C5E63C16D09B9E4A25A5043B4C6AA924FD3CF6C961CF8AD95BCA0C8551B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983950, "uuid": "5e415fd4-3eb9-44b8-b7af-f1a330117295", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983950, "uuid": "cb28ae2a-f3de-40c4-8820-e6c2ceca695c", "value": "6144:gRFt1BvQuGVFraLk//k6BdwwpiH6whnUUUUUJUUUUUUEISUQ:mhB3Lk/c4dhpqDhnUUUUUJUUUUUUu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681983950, "uuid": "e34278c6-2b7a-4759-8cd2-eea18141b83c", "value": 380416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681983950, "uuid": "43012fe1-d649-400c-adff-2c0d6b93f4c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983950, "uuid": "8ac11665-8903-477e-9690-8832b78c12a3", "value": "IMAGE OF AGREEMENT COPY.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8630f708-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681985835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985835, "uuid": "6927885c-e456-41b5-a72f-5fbaf291b107", "comment": "Malware payload (AgentTesla)", "value": "47e2f33ba5785ebc5f13d3699761244b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985835, "uuid": "91a4b8c0-db9d-49ca-917c-29631e8ca60a", "comment": "Malware payload (AgentTesla)", "value": "54334ab99887bb68c804cbea4d9a976c5a0e9625bfb7d0a2d451e90dcd1f3e10", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985835, "uuid": "926a6089-79c5-4865-9ab4-b08a260320fb", "comment": "Malware payload (AgentTesla)", "value": "9ee99d808dcc1232d857f7570fe9badfda86fdb9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985835, "uuid": "5dfa4632-d3f4-4fcf-8a3b-fa8f57c77523", "comment": "Malware payload (AgentTesla)", "value": "315c62898f4cbad417838d453206b7b90400e531b9d78d625e73c0d99abdc33b74cfb26a15465768e9cd4d71f8abb625", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985835, "uuid": "b3e9e6fd-a0a2-420d-ab6b-134ad692e446", "value": "T15FE4F129A13A9EB6E6DE0776001436E9DF3466E73477CA3C079274DACB9F3112C9418B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985835, "uuid": "14445e32-a6a5-4b8e-9e33-cbe4ee3864eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985835, "uuid": "08760ccb-9259-4ec7-ad99-1e8b6a084ed4", "value": "12288:SHRJXJTxigN3PFpq4xlxpduGUwYoEyqf/TTaG/fcWnYtEB0t7kFDD:sXNxiWdU85vHqnSG3HnYo0teD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985835, "uuid": "04fe90e5-52a0-4ba5-9cf3-b121a4bf31d8", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985835, "uuid": "201afcb8-4008-4444-b25a-ca9896e1b669", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985835, "uuid": "7792a2f5-6381-48a7-8ff2-23458dd7cdab", "value": "transfer swift.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "901835af-df78-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681994442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681994442, "uuid": "6b6fb06f-709a-4f2a-98a4-2eb1029522d1", "comment": "Malware payload (AgentTesla)", "value": "497868c92b2ff34e3220398b236a01d6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681994442, "uuid": "462f53e7-e46f-48fc-a358-4427f6c197ae", "comment": "Malware payload (AgentTesla)", "value": "54a97b0833c81df8a0889289119e5662abdeb6eb35f98e38cb63f2acf5b36a19", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681994442, "uuid": "92370fdb-48fc-4a22-a15e-70e3b44f68d8", "comment": "Malware payload (AgentTesla)", "value": "6b483ae85e9bc0128ea6fc975a05f74992397542", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681994442, "uuid": "a51b5299-fca8-49d6-9a68-4cfd3229c93f", "comment": "Malware payload (AgentTesla)", "value": "ab04e057339d20042f4255946169a80a9046dd43ebaee65a7e54030d3d42a6abcf91d0b78b6211adb6f4a999826f60d1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681994442, "uuid": "5d337c54-0645-499f-b6ae-4acedc2e3dc6", "value": "T11703B25AE79F1264CF4102B3671B0E89AABDB23DB35054B1785C833433D9C7E46666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681994442, "uuid": "73329bc1-06a6-4818-a0bd-dec888e70bde", "value": "768:cFx0XaIsnPRIa4fwJM9u8oq45EmOFT7CZeyJ8:cf0Xvx3EM9ukwEmsyJ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681994442, "uuid": "326aac78-124f-4282-8aa4-0391a60120ae", "value": 39618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681994442, "uuid": "461af3f8-d0af-4217-89af-58b5c06e4898", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681994442, "uuid": "d51dd0aa-4ba0-4044-a59a-36d4521c72aa", "value": "Needed item.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d3f1da2-df7c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681996102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681996102, "uuid": "0d1f5aeb-6baf-4ff0-8200-ff6bb4986b73", "comment": "Malware payload (Formbook)", "value": "c1ec64696fd5605c0c5ce991dc745e9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681996102, "uuid": "5955366d-0b85-4fdc-882d-34b1d94d0967", "comment": "Malware payload (Formbook)", "value": "54bc8ad70bdd156ce345dc785b4858d2b47a69b74855f76a7016d1aae3b74e13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681996102, "uuid": "2b2822a9-ebef-40af-9d39-42e49340bdce", "comment": "Malware payload (Formbook)", "value": "540ef9ba5b441361034bb532013d2c8e5614b02f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681996102, "uuid": "ded48e1d-b6f8-4db5-9f63-a659d3e4084c", "comment": "Malware payload (Formbook)", "value": "6cefbc484a270c6993c9966f2a8387b0da36733cbe8340e868e2de9c13734f049f61926e28935562bf1038ba2b2896a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681996102, "uuid": "34c490c8-d18d-4be8-9ee4-f3ff99664b0a", "value": "T128441210B6F4D0A7D1AA66B44E33DBBD5679DE500618030B3BA0BF6E2935B77C60A348", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681996102, "uuid": "547ce749-80f6-4744-96d3-a5fcdd270d2a", "value": "7ed0d71376e55d58ab36dc7d3ffda898", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681996102, "uuid": "9d813bf8-95ca-4338-9596-52604f594eb0", "value": "6144:pkyacCTf78bzTXytStmOAaE0w8QUwe8AW8R:pkNTTQTXWSkY4e8AP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681996102, "uuid": "e809dc11-3295-4720-8cee-ac3f84973bd5", "value": 268056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681996102, "uuid": "f862d7f1-0ed4-4a49-afc6-f2e07f72e651", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681996102, "uuid": "791cae97-0d65-4f8f-89f0-c85566d14086", "value": "rKabelimpedansen.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4333ccb9-df5c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1681982287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681982287, "uuid": "d1e94c73-a972-449d-985a-5b9a4407100d", "comment": "Malware payload (RemcosRAT)", "value": "24bd1048408efe7a326e003263d43a1a", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681982287, "uuid": "195a676c-420e-437d-bb1f-06c9dcc2863f", "comment": "Malware payload (RemcosRAT)", "value": "54debb804583fd9c34128aa6b8788b3e8b083002419d46cfe481c7f41f3dc88f", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681982287, "uuid": "4401b062-868f-41d9-9df3-6d04b9b2715c", "comment": "Malware payload (RemcosRAT)", "value": "399f19b19f3c57dc33c942dfead4f950f6cc1f1d", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681982287, "uuid": "3617b2ef-7932-4c50-9a9c-c705fcc26aff", "comment": "Malware payload (RemcosRAT)", "value": "9960caae700b6dce8a9725d0d0e1dfbff5bde208f2d3f86891054885b59f0988bfa3bf1b3c49dd83aec38d63fba7c736", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681982287, "uuid": "f812d058-696a-45b9-b8d9-230d3fa71525", "value": "T1010523EC315486AC0EBD46150AAE11AAE56F47D6E355470F6A89FDDE3F5003A23CB8C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681982287, "uuid": "de048415-c24d-4e8a-a279-5dcc994bd7c0", "value": "24576:tmCPx42M9DgQVA+KyaPCcJDO9oCMggwL2z:P54f9DgQ6ea1JDXCywaz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681982287, "uuid": "1a870057-6064-4779-8096-4c65363729fe", "value": 870354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681982287, "uuid": "333531ac-137a-4921-a6ca-68ee19adbc39", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681982287, "uuid": "aae81b4a-6963-4dc4-906b-c8a0cdc03672", "value": "Purchase Order PDF.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c5cd3d9-df4f-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1681976719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681976719, "uuid": "583ec3a2-28fd-4207-83ca-7c3270e5d913", "comment": "Malware payload (AveMariaRAT)", "value": "d3876665ddfbe8c1fbafc916fbaf9551", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681976719, "uuid": "dd595ca0-834b-49f9-9e7e-6269776af4ef", "comment": "Malware payload (AveMariaRAT)", "value": "552685bd9d5668183267fa60f76af8584611e11d439085d660ae54147ca5f355", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681976719, "uuid": "cd0b04a7-a4ab-42d3-92bf-c57dedced8f1", "comment": "Malware payload (AveMariaRAT)", "value": "421e61bf617367290a652cb3b29e1b8c7305e4a9", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681976719, "uuid": "abb0baf8-6345-431a-959b-958605f7c0ef", "comment": "Malware payload (AveMariaRAT)", "value": "64a67f3509293d85cea3ff582326370037e7052e19bddd815516ef0d34ac9286b6296c05b65f8361c392794ee24a417c", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681976719, "uuid": "73946217-4a17-4f78-8314-923029b7fcec", "value": "T170055A21E9B2DC32F53E75F6CF8BE6586C2D7E601CA579093EF43A9C4D362422C1116A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681976719, "uuid": "a0aa0817-5458-487b-8cc7-0fa8c36a0b04", "value": "5ec088a572804506435e10fee7d0b30f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681976719, "uuid": "033909ce-521b-4d4f-b4c9-7f01bbf1b922", "value": "12288:Jwkt7fpbG7q2VrwFup9bAoxJHdDlvKRGXBveIcQgYRmfD+fJOAIW4Wh:JwkNnG/Pxxhp0MxmIcQg7DyF4Wh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681976719, "uuid": "b6155070-31b1-4f2f-99a5-a0aeefd90e99", "value": 824546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681976719, "uuid": "b25b6ebd-582c-40fd-bf51-db7f6e4cb6e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681976719, "uuid": "90e64ec0-cf5e-413b-98c6-58a683d499ac", "value": "OM PO(s) # 32749219-21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51612bb7-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1681985747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985747, "uuid": "127cabd5-a264-4fed-ab0c-de244fde2a54", "comment": "Malware payload (AveMariaRAT)", "value": "187be2ad5a3cc3d2781747e46945d004", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985747, "uuid": "1b059b11-b1fe-4a62-b5b0-430232d28b3a", "comment": "Malware payload (AveMariaRAT)", "value": "55a2eec0513b696b6d1fc0809842d355b25bed2d7cbe3eb9c1a95d8304ac53b3", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985747, "uuid": "881a5271-0eac-4339-a2db-e405506cb834", "comment": "Malware payload (AveMariaRAT)", "value": "a827911e717d05c656f23d9c7099f6d5ce9fc10f", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985747, "uuid": "ebd3dd5a-8c5a-4383-8f05-ad978f092ad6", "comment": "Malware payload (AveMariaRAT)", "value": "6d945d443249b71cbab078bc76b41696edf5fddee5e0e12e7265b3c56418bd0308a090cfd035b7ce05cbf425da47ea92", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985747, "uuid": "a130b5d7-3256-47a8-9c1c-96faa58f5128", "value": "T188E37D227BF54439F7B605301AF93E25D2ADBE310E31CE4B5BD4488658B1589E93A3E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985747, "uuid": "c65f5e35-c11d-4b37-85d9-39f6fa0af601", "value": "570db8ef63a92b7fa4b4955d1d36a178", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985747, "uuid": "7d3fb208-9782-4308-9267-6c10aaa7a162", "value": "3072:RARHROub6IiZktM+t4B6IZeAzaZyJ6QYzHHxgGT0Iw:RkxbQktMo4BRiyjYz6GTrw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985747, "uuid": "44a6da4c-7f6c-4875-8679-a0f6e6e7483d", "value": 144384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985747, "uuid": "a4ab6f33-b53a-4ab1-b2ac-7c413fb8ca2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985747, "uuid": "4badcbf9-484d-4b90-85ce-5df2502ee1c7", "value": "55a2eec0513b696b6d1fc0809842d355b25bed2d7cbe3eb9c1a95d8304ac53b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbdedea1-df47-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681973577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681973577, "uuid": "a4683dec-c74d-4492-8d49-df15d00666ac", "comment": "Malware payload (AgentTesla)", "value": "d8cc529116c690e80c5229ee9dfb4dbb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681973577, "uuid": "dfe81d80-07ea-4943-b75b-f7942ffb3c9d", "comment": "Malware payload (AgentTesla)", "value": "5700083ff831ff464c824000f015d29a39784ae0f8f6d2860aaadd0591f4188c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681973577, "uuid": "dc84ca5f-39d9-4452-ae77-fc8bce9fb6fc", "comment": "Malware payload (AgentTesla)", "value": "51eb1e0a1dee7e31e9888ac2c8a6a69adb7e9ad7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681973577, "uuid": "36194afc-1de4-4b5d-8e1f-9f644680db1b", "comment": "Malware payload (AgentTesla)", "value": "226746f05e6799bb9bbbb7d7df6e708b2e59605bd103e4713f71624eb9833c5c921d40480b59decb1e39bb1843926ee4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681973577, "uuid": "e661d5c8-cf03-45b7-a424-72ba2743b02d", "value": "T18945D0D563A5D7A2C2643FBC122A61693FB1599BE525C635FDCC50DA3F32BC80A4038B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681973577, "uuid": "62bd01bb-3df4-4b62-acd0-4a3bd200c69f", "value": "12288:pYaa3vqaaDYQWw7Nb9ej354Zi4LZNASbCQVIOapsH:eaafqzTNb807ISeQVIOap", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681973577, "uuid": "b55730c2-0d3e-4de5-9e59-1616e52fde47", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681973577, "uuid": "aa97b8ef-72f3-4e1b-beb6-9a6ecd6e5d70", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681973577, "uuid": "818c57c5-b22f-468e-b6a3-f6b8b5283bce", "value": "PO 5500505840.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbd4f665-df9d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682010407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682010407, "uuid": "244978d7-4f0b-4600-b44a-05f657940579", "comment": "Malware payload", "value": "de37ac8904220f419c2933bf64a87f43", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682010407, "uuid": "efb3ddc8-8925-4635-945f-73af83b053bf", "comment": "Malware payload", "value": "5762a173b3cb2512706a88b92d83fb46c28cc3cf8ca7404fd3d0e1ebdb7d7e22", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682010407, "uuid": "60d99fbf-9b03-422b-9641-f3c66f38679e", "comment": "Malware payload", "value": "28a2cee671e69590b37d2711ea091ced32fd7797", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682010407, "uuid": "8de31000-dcd0-4abd-b1c2-bb0f98e3653d", "comment": "Malware payload", "value": "8184b030b6c023686219eaf0d627547122ec47e1ecdfb1cae0f89f6f8489caff081f0d1051f4b2f036a4072749dfa841", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682010407, "uuid": "25cffe0f-5c5f-43c0-b459-2424c0c23de0", "value": "T19A94F0033108CF8BE145D3F8BFA3B98D020EBF667AC235D72541770FAA35A67548A659", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682010407, "uuid": "0aef79b6-ae31-45ed-9c1d-36f5d35520ed", "value": "12288:flaFiKXKAWQmmme6v3QLQuEF9I9PIQ/K:ILKAWQmmav30xmeBI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682010407, "uuid": "65c056f3-9ef6-48ed-94c5-cd9459cefc5c", "value": 423936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682010407, "uuid": "44eae3f3-5450-4900-bafc-bb21ffb0c893", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682010407, "uuid": "e4fc2cf7-7566-43bd-9808-412327697101", "value": "Proforma Invoice nr. 2300447 dd. 20042023.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdac10fe-df4b-11ed-88f6-42010a9c006e", "comment": "Malware payload (CobaltStrike)", "timestamp": 1681975218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681975218, "uuid": "8fa2bea6-09f2-40a0-ab0b-1ea65fe01a5f", "comment": "Malware payload (CobaltStrike)", "value": "c527e86a080d8a24512d7b236561f48a", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681975218, "uuid": "8f8373bc-d69c-429a-a576-d8785bcd5fc9", "comment": "Malware payload (CobaltStrike)", "value": "57cdb942491c853d3d303de9720f3165d2a0e0a1ec84e8c42b5ac41daf7bd12a", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681975218, "uuid": "eea9328c-9177-4fdd-a44c-4748909bb97c", "comment": "Malware payload (CobaltStrike)", "value": "1ce3703d587cdcde76e976b44f2f58082a84656c", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681975218, "uuid": "8049a8f9-2b0d-473b-8ae7-6b479c1ec735", "comment": "Malware payload (CobaltStrike)", "value": "a577a35a0b0e02f8c85a3a0c28dda6e2154e1c2446a0ccdce2ef4456c75aa8333f785022fe9ed013746b7cae8ededf8b", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681975218, "uuid": "e5127e09-de6c-4cac-9b2d-98ee75043020", "value": "T11154CF50843A44ADFC61F17F7A1015F7CA3D34625F98891DACBE6242FBA3CB0E452B25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681975218, "uuid": "e2ae399c-913c-4756-a4ff-cc0c33b7c95b", "value": "dc25ee78e2ef4d36faa0badf1e7461c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681975218, "uuid": "972bbf51-12a2-44ec-b69b-d5a1ab0429a1", "value": "3072:+RpAzrZWQ4kgXeYA3+GwHLoSgPZtp9LqVYyOnCHmYOfzXiAwi5JSM:+RcZMkgqu17A9LCYyhGDzSWJl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681975218, "uuid": "69c9541d-a3f6-44ff-9b37-af1785d72efa", "value": 284672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681975218, "uuid": "758999d0-c108-4575-a748-2ad82c707794", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681975218, "uuid": "33b57eae-99a3-42f4-b7f2-57dcb5ed7053", "value": "c527e86a080d8a24512d7b236561f48a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc9dbc70-df7f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681997631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681997631, "uuid": "3328c435-3469-4307-b2fa-c9e3269fa12a", "comment": "Malware payload (Mirai)", "value": "78931b773a4b54945f84a973074bb6ae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681997631, "uuid": "efe2a1aa-d998-4a5e-ae6d-2c0efa949689", "comment": "Malware payload (Mirai)", "value": "582a45de6ae4296f7f82951d0d546c05294351d3cbf06a5ad8ebda90a5f7450a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681997631, "uuid": "8c468477-bb91-4af6-bfdc-44a64f0f29cb", "comment": "Malware payload (Mirai)", "value": "d6a3bc538320b97ab5621e36da5d017be1da79f6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681997631, "uuid": "fb08d4df-0f05-4b00-8826-2b6b9cc144fa", "comment": "Malware payload (Mirai)", "value": "84921a018d0633ebdc751f50e925c2c623545ee27a08beae66efc226957cc3bdb52abdba196458e24012e5b1b01ee661", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681997631, "uuid": "4effba96-71fd-4a3a-b268-3681facbc219", "value": "T199C2E1954B65AE17FCC6657BB17E12AEE3CB73670217B4C90BD00B198C211C21C16EDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681997631, "uuid": "ad4d8157-d571-41a6-8fc8-db366e3d09b9", "value": "768:Y5xwphY4LQtyGcEVa97jE3aKTX/YwNhlZN1ayV:QxuhY4LKyGLVa9U3aKTX/bN3ZHa+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681997631, "uuid": "e7b0a031-a1dc-456b-b989-63cc2dc7427d", "value": 27760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681997631, "uuid": "fe1c0865-5657-4e63-b5af-2cc11e610737", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681997631, "uuid": "280fdd36-d1ee-4406-8853-142eb6944d8b", "value": "78931b773a4b54945f84a973074bb6ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5e1a129-dfca-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682029724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682029724, "uuid": "042a63b4-2078-4c2a-8af1-885f1b2bb64a", "comment": "Malware payload", "value": "b5964ab4cd4118dc2de3585edb0287c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682029724, "uuid": "7a2f4ab4-5235-4301-94c1-8a5ffa65d8ed", "comment": "Malware payload", "value": "58d436fdbb11d6f6165ca7580dfbe234932bd7d39ce4d4d3fdeed5cd0fab84a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682029724, "uuid": "69653355-950b-4cab-80b7-35385dbad213", "comment": "Malware payload", "value": "5036f7c8e7d9b19458364d48e9ac501534fda686", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682029724, "uuid": "bf5fa4e8-2967-4637-82c6-b6ab9cd5ec42", "comment": "Malware payload", "value": "8ec839256956c87be340f5a96cf041558071c26d8564c29caeadd1ef0d819c1bc4a40b00572f1bf621f422c7e0436818", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682029724, "uuid": "e9f19644-ace6-4452-a332-38db6a56399c", "value": "T18BA4AF1222D1A871E522DB728E6EC6F4AB6EF4608F557BDB27595F3F0A301E1C236305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682029724, "uuid": "85554fc9-659a-47ad-8447-87f421690a06", "value": "2128cb5ed16bb6d1d4fbf54766560683", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682029724, "uuid": "37a23e0f-d5c7-44b6-b872-39cf8fd9a7ca", "value": "12288:HJxrHzbO7cuwVdbppU/eUnhviTE7yhDlDYvR:HzrNuwXbppUdZ4DNYJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682029724, "uuid": "7523e5c7-03e9-4049-b7b4-69aaaf01375f", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682029724, "uuid": "38c9c4e8-92c8-4824-9c3f-335632956d30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682029724, "uuid": "c248b37f-e0b8-42ef-b23b-d6b8ee68273d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b816bed-df3d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681968906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968906, "uuid": "ac127f14-faa0-46ec-ad2c-87fb8512ab2f", "comment": "Malware payload (Mirai)", "value": "2a1f047792a2cedb37b8801f2d4e24b3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968906, "uuid": "a87ff51f-27a1-468d-b37e-e9325d89d26b", "comment": "Malware payload (Mirai)", "value": "58db65d0ee4b7ff1b49bc159bfb470c2381de25a1c1004142cd0262e2e1f8028", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968906, "uuid": "3c243823-a79f-45b2-8874-7dc63d8d8d33", "comment": "Malware payload (Mirai)", "value": "414aa3efa12cc8a67b8a233474fc4ffce3a40119", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968906, "uuid": "83c703ee-9067-4dfb-ae53-35c634450ab9", "comment": "Malware payload (Mirai)", "value": "1dd328a81eeaee4eca0772e47f8ba66ef34a88b5ecc06d09c701337c127be49a493cf3ee683cc1df57c9e0d6b94dcf36", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968906, "uuid": "6c2ff34e-dc48-4cb9-a45d-824943d54134", "value": "T1F5632851BC819A13C6D1127BFA6E028D3B2613E8E3DF73179D225F2037C696B0D27A95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968906, "uuid": "c0acd1dc-cbdd-40b6-b1a8-6780440f558d", "value": "1536:mN6lxMmiioB1k5WO//kWEzKUioUbgo8DNRu9AvHWp:mNbODk1+UioUb3ihH4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681968906, "uuid": "7ef0f048-272a-46a7-9811-adb0c76b3a08", "value": 66912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681968906, "uuid": "5e7e32f9-8e82-43b5-80cc-f8801d558a7b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968906, "uuid": "76372ea9-2893-488c-bfc7-b247a14d731d", "value": "2a1f047792a2cedb37b8801f2d4e24b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fd85078-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681985771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985771, "uuid": "8b53abf7-9b64-438c-a233-a2ebe3a4a0a6", "comment": "Malware payload (Formbook)", "value": "b5c23568b717b212e11db239401fdcf9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985771, "uuid": "610b7bf2-5702-45c3-942d-c4b652e8948c", "comment": "Malware payload (Formbook)", "value": "58ecce96d2c317095677b0bd1d5bac716129626042ce71e5737a4368799dc861", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985771, "uuid": "3ff00c4a-5b40-4363-b569-028b98936977", "comment": "Malware payload (Formbook)", "value": "8bf63cc1d046833f81719551c99fdce7f4f01f1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985771, "uuid": "cb3e5a8d-9bff-4dbf-9e3f-be231b3abcd7", "comment": "Malware payload (Formbook)", "value": "76c8c35e9f4ec0a823260266e35120652b8a6bcd3f10835a32897869424378731ec9f2086fe94c5bf0d171c194f4eb0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985771, "uuid": "39883df6-26a7-40bb-b3b0-47da9d8bf842", "value": "T173D4F1A572C0978FC8053FBD5A04584827B34DF9C4D8CECED966B48B4EFE7618144E9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985771, "uuid": "4422922b-8294-4df3-9872-574d2f49d590", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985771, "uuid": "aefc743a-75ed-4c7b-adf2-4eed3866ab20", "value": "12288:sYMaGLzjp3IBs4LDVI+y1/JMeGUSEDs+F8T9:XMaGLzjp4m25Hy1BMeffD9G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985771, "uuid": "30e0a10e-814e-4c72-9c7b-b56cca222d19", "value": 608768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985771, "uuid": "36da59e0-286e-4da8-a0b8-3c8834073001", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985771, "uuid": "32f6859f-71fb-46a1-ab85-b55ae8a3ac68", "value": "ALKAN Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3d26e9b-df5a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681981617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681981617, "uuid": "d84d627e-23a4-4c66-b122-f1429a1cb60e", "comment": "Malware payload (Mirai)", "value": "86221fb4c284b77aedef17dd8fbefda1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681981617, "uuid": "5b2e180b-1472-480a-b7a7-27add3941884", "comment": "Malware payload (Mirai)", "value": "58f1c4674f851c51ca69543aeb080d0c734a9bc280d942bebe4cf0daa7dbd558", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681981617, "uuid": "c5e4f612-ddf5-480d-9413-84215175f242", "comment": "Malware payload (Mirai)", "value": "4eb2008fbc0230f8c7c8f071d3fb9049259f7df1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681981617, "uuid": "f8f3c694-d3ae-4947-ad6a-89f91141afb5", "comment": "Malware payload (Mirai)", "value": "ad02a5c84ba4a6e7f01080457eecb7e7ffc832762cb9fd32c1ad1fae200bba18aa90cd1f5a52d19e6afed34aaab21715", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681981617, "uuid": "58da0b34-ec73-4205-a390-8cad6f5302c8", "value": "T195935C27F552C67BC08752B42BDBEA615833B4BC0B32724B33E47DA52B219C91E6DB01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681981617, "uuid": "74bafb60-2aa8-4075-8584-95c1fce341b0", "value": "1536:W7uJtxMVEOVbazlvhE1hmkJ0S36W6bWjK3Y6ZmA+KWOXFseaZYxe:4SMVEOVMlpmXJ0O6WpjKIWm/KWOXF7aR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681981617, "uuid": "f1e8a28f-8dbe-4748-96f5-934f37dbbbda", "value": 94676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681981617, "uuid": "90528c21-bc16-48eb-88a8-9edb24e9af7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681981617, "uuid": "0b756987-9c33-4b05-b41a-878bdba426d6", "value": "x-8.6-.AXIS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb35130e-df97-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682007936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682007936, "uuid": "95d41aac-ec79-498b-8bd4-c5794d36f9fe", "comment": "Malware payload", "value": "3589559439ebc39a1d00bf47339a039e", "object_relation": "md5", "Tag": [ { "name": "obama255", "colour": "#9A8BFD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682007936, "uuid": "44597310-f40b-4656-94eb-48ad0ce5e371", "comment": "Malware payload", "value": "5953c7090a51b5b53d2a58ebdf99e1d6a453be7216a0b8ba11793d7fcbe6f27a", "object_relation": "sha256", "Tag": [ { "name": "obama255", "colour": "#9A8BFD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682007936, "uuid": "77563478-342c-447b-8b2a-4ebda6694772", "comment": "Malware payload", "value": "de27a3b134ea030e5b88a13f52b81f329571e3a3", "object_relation": "sha1", "Tag": [ { "name": "obama255", "colour": "#9A8BFD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682007936, "uuid": "2e13ecb3-c459-40ef-9060-0aed71db05e4", "comment": "Malware payload", "value": "e2f451b266b81beaf593fb3ab05eb3cd4a97d53dc096b198f3fe2d39b07add5c1170b209d14e4655146e036d8b3fcd92", "object_relation": "sha3-384", "Tag": [ { "name": "obama255", "colour": "#9A8BFD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682007936, "uuid": "098f3be2-060e-4123-99a1-3a5387a5564f", "value": "T149F2E112DE1DE4E8B0F245A617DF01FD2574A56A38016ACB5A6DCC9C9772F93ACEC007", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682007936, "uuid": "be211b2b-dd97-4184-bbd9-9e0f92be095a", "value": "768:79VcRxVHE9Jzk+sipGZ6jSPo6ko7sOZaJW2CLpiDcVXIdeM8V8:7yxYQ+BEZ6jSYgvJ2cBVYdGV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682007936, "uuid": "52444e40-96a2-4c61-a607-9e1ebf499369", "value": 35550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682007936, "uuid": "63b097cb-7a5a-40e3-ac03-c2c179e75514", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682007936, "uuid": "60519a74-dc9a-4685-b3e3-aeb930d83f9f", "value": "643ee0e4e8e39.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f72c2ee1-df31-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1681964121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681964121, "uuid": "4b5f3a71-9d78-44fd-9ebc-1bfe8665d8c8", "comment": "Malware payload (RemcosRAT)", "value": "55e9b392cbecff0e2c2ee4326f86b94f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681964121, "uuid": "52d0e68c-140d-42cd-83b6-1785afa1fba9", "comment": "Malware payload (RemcosRAT)", "value": "5967b2774354c77c0fcba2c4e0551adce7f0836f7bbb7ec59efe8d7fbf5b1404", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681964121, "uuid": "cf07510d-7937-43d6-88a9-b4331f83a29f", "comment": "Malware payload (RemcosRAT)", "value": "177623822a27023bb5acd8813a27ed417e1e9817", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681964121, "uuid": "4bc5cb85-997b-4956-8785-9b91962a5411", "comment": "Malware payload (RemcosRAT)", "value": "cb6d9a08c7cd71399af96ea6e55176213719158ad82fa879fa477061c7d57bb882bf82ce1e33ebe20808315645fe2bca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681964121, "uuid": "ba8f94f3-f549-4515-828a-3e689ba4855b", "value": "T13BD4E0C6DA808695EC256B3524372D3553A7BE76BCB8610E9A0CB5B43BB31C34437E87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681964121, "uuid": "7c83c14e-0e96-4981-a98d-1fc208164cd0", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681964121, "uuid": "2d7eafb4-3e0f-4355-8e87-757131c5dc6d", "value": "12288:wYMNuWexBQWDBW6bgQs5IPBrugywIYh85kUtN89Lws:wYMNuhBQWSKPBrPywklqLws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681964121, "uuid": "88749f03-27fa-4ec6-90e6-a08dbf3cd6f8", "value": 620130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681964121, "uuid": "f7ebb869-02e0-41be-96f7-f011d6c196e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681964121, "uuid": "eadf6120-b3d5-4e02-9f01-441a78f906af", "value": "HUUG2336ED.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fd41802-df54-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1681978899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681978899, "uuid": "23e0cbe8-06b1-477b-9383-384d6180c6a7", "comment": "Malware payload (Guildma)", "value": "2b921b9716efcb9b452ed9ac579931ba", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681978899, "uuid": "9683d407-7deb-41c2-8220-0aa38545bd82", "comment": "Malware payload (Guildma)", "value": "5aa4cc5165196bbc393a637e346664423760230e0925cb2cceae672d09c4626e", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681978899, "uuid": "8196c972-8493-4c07-ac4f-66473f5315bb", "comment": "Malware payload (Guildma)", "value": "d8dc1cc4d3df42154849a22e8bcdf25d3808dfac", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681978899, "uuid": "920c2595-fec8-4984-bb05-e3b471816b56", "comment": "Malware payload (Guildma)", "value": "29e45def892a7da3eeb378102723de0cd3c7e021ac4e16b7fb1c9e4532031c6093b4dd8c95efaa9f59039bca74589ea6", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681978899, "uuid": "8f85394f-e487-45ee-ad31-86b975b36a09", "value": "T115110CB693680EBBD4724375CC34AD0C98B6DCB30F4E909EE5233084C9796A52FC5B19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681978899, "uuid": "20c6c850-e894-4600-8561-c7b6c90ceee0", "value": "12:8D28OBE6ZGagkjueaTASDVIKVUaVuRAVIz87KZIxFIiVn0iWvqLpn:8loGaFjYTfC9a8p40u44Lpn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681978899, "uuid": "3055add8-aa0e-498c-beff-590f5a974f4a", "value": 999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681978899, "uuid": "68709ab9-4441-4394-a206-bcaa5d6f8125", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681978899, "uuid": "24f93347-06da-4969-a54c-172e262ae4fd", "value": "S61665430.328768.28472.lNk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0de92e07-df91-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1682004961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682004961, "uuid": "b47485ed-55a0-4d13-848d-e26989123229", "comment": "Malware payload (RemcosRAT)", "value": "fc4bef70dbd745248227567659e01bc9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682004961, "uuid": "7e46cef7-e32d-41d4-8181-bf0b3efb1fba", "comment": "Malware payload (RemcosRAT)", "value": "5af982e3e7bfb72f09c58c942243bda454f917bc5e0a5b048e579b2c5faa1085", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682004961, "uuid": "efb5fc04-83ec-4d63-beb3-7111a9da3b1c", "comment": "Malware payload (RemcosRAT)", "value": "cb0769bb48a4b0de4249bd214d289b05be1bd8fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682004961, "uuid": "261acdb8-4a6d-4657-8b00-bcf090984aa8", "comment": "Malware payload (RemcosRAT)", "value": "c3cdeef243a539658d4cd90c3f6fc6c594877a62e44f948f9cc3803ca2638db63e75f050153b9051f2b22ceb9d9bb039", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682004961, "uuid": "d50b506d-17ed-4891-93c7-74f44db475c1", "value": "T1D22502C95351D7D2C6583D7D222A71793F7044CBEAAAEA26FD89609E3D32BC41B403C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682004961, "uuid": "725ea85c-0418-4d6d-937a-6b89d4ed1a81", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682004961, "uuid": "3ecb0e3e-e020-44c2-927f-e53fed1b24db", "value": "24576:Y1xfsuJFYnWWd9Agg4lqK3gKmi5Tb7io0:Yzfsfnj9AgpwKmATbWp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682004961, "uuid": "f501c48f-ddf6-420c-8747-fbe8b2b8b9dc", "value": 966144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682004961, "uuid": "9aa581b5-a4f3-4eed-aba9-6809ccd126d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682004961, "uuid": "fc537a73-a3d8-4252-9433-556746c86805", "value": "Purchase Order PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1384d877-df5f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1681983496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983496, "uuid": "75ee4a0d-6766-4d21-beeb-f2c78e68ddaa", "comment": "Malware payload (Gafgyt)", "value": "0023e27e780fcea853ed7f6548fdc7ae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983496, "uuid": "37d99954-11ff-474d-b227-dca6133d039b", "comment": "Malware payload (Gafgyt)", "value": "5b572f791e4f8356b1436e5394c0aa92393c096d9d790ee1160724a039a9237b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983496, "uuid": "986307b8-68b5-44e7-b5fb-c9253210b3fc", "comment": "Malware payload (Gafgyt)", "value": "90e2b6a4634268677a57b00273b72a2171dc3431", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983496, "uuid": "3fc97315-5808-4b02-9015-ca6f0bda61ff", "comment": "Malware payload (Gafgyt)", "value": "9c805b33c7112a33315963cf1ec3805e61b0ac8e4d4e8b23535037c2136c18bf21e83fd1292e5a37947066c77b7b23ff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983496, "uuid": "2155c9d1-c517-4347-afe1-3106631c8cd0", "value": "T13A34C448ED159B7BC3E237BAEB6942CE36391EA4B7EB71211D30797433D8B54623A110", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983496, "uuid": "4f137c31-74f9-4634-bcdf-462cd2c60369", "value": "3072:QYG3VHfl8jXYqGY8EdRicYKZ5fThJj7vJ2emAGjpiDzmOSgGfP8YcT:brzNzOn41ThJnJ2emABDzmOSgGfP8YcT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681983496, "uuid": "a906edab-6632-45a6-b456-9fb10162ee71", "value": 251709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681983496, "uuid": "344cf1aa-6570-44cb-b5fe-e8fb9fcfa2e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983496, "uuid": "1d2f773c-1b21-4a09-8b53-1cad7a1b6919", "value": "0023e27e780fcea853ed7f6548fdc7ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3526cfde-dfa9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682015335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682015335, "uuid": "168bcd4e-8c0a-4db6-9f9d-8b8dec579af1", "comment": "Malware payload", "value": "518fc2e647ec1a068d96699a7c81f09f", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "mc1904", "colour": "#71A344", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682015335, "uuid": "af16dc43-916b-4ad6-8053-05b75841bac8", "comment": "Malware payload", "value": "5b7dfd88fcbbbb7e3d1b4b6606c4fdd10397dd5c00e18cfe83cd9a94ed136246", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "mc1904", "colour": "#71A344", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682015335, "uuid": "8fe7647a-9277-4c81-a734-f0d8ffd2c034", "comment": "Malware payload", "value": "2f1852128b1797ecb20557109c503197992d5ff7", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "mc1904", "colour": "#71A344", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682015335, "uuid": "8b60994a-f044-4960-a298-0df98aef7a2c", "comment": "Malware payload", "value": "9366eeeb7d0642565d65c8971b5c6a577be45c7047da7f71f19558a873c4d440c89490636fc8d09c4e54be35db3eee8d", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "mc1904", "colour": "#71A344", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682015335, "uuid": "7ab8b4ed-ede7-4ebf-91c7-f216df87e963", "value": "T1E7044AB0EB56163B5A83675B9C1149D2DA3CC2445202015CEA8FB38E47479EC53BEFAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682015335, "uuid": "498be954-1e7b-4f2f-be52-5415c5bbbdaa", "value": "3072:1eULHHO+zbe2qOX/w+A429OutoWjVM8kgCRreRlW+Q5HUJAWo5hiaPJhO5Q51lJO:Y8SOXY7txjVM8kgUeRlW+FAWo5AaPjCb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682015335, "uuid": "7911122d-cfa9-4420-81b9-1080c496f2ba", "value": 182663, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682015335, "uuid": "7ff6b004-087f-4213-af7f-65a8279ec7bb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682015335, "uuid": "ef705a85-115e-40e5-9503-5f3d4c8b9be8", "value": "doc_12QICZ_85.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64fe51ac-df71-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681991363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681991363, "uuid": "2bbb0965-2b82-424a-98f2-b034c52327e8", "comment": "Malware payload (AgentTesla)", "value": "4a4d706c0200b1781969980ee017e5c3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681991363, "uuid": "dbfb86b0-5aee-4d20-95ec-ed71494ceb00", "comment": "Malware payload (AgentTesla)", "value": "5b9c490b7630d7ab856521839af4dac3790fac16c96a275f8f261604d4d231ad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681991363, "uuid": "19cb7b12-f5a6-48ad-a258-ebbf4f44b36d", "comment": "Malware payload (AgentTesla)", "value": "551aabc1d883a563d9addb072d218e03f4e757b2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681991363, "uuid": "60b94ad3-afc1-49b5-aff1-47155a3d58e9", "comment": "Malware payload (AgentTesla)", "value": "4b8f2f93f9cf1d50cd5268cc1ea7e5879e51b485dd8b061ee5ca2eeea4040eae53b01ab57f48f27d0082be8a796d0927", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681991363, "uuid": "852722fe-826d-4d67-8a6b-270e34a47d34", "value": "T11E54230DC3F54FF9A084BDA727C0ACAD7EFA6915871C00D1584E6CAF969B7A05680E73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681991363, "uuid": "f18ae9a4-1545-4ec4-9f57-54f002ba5ce8", "value": "6144:l14WaCm3Fr6FYWGzURlaBLebZtDIIiPmUzn78BCeUi8KP:oWsZIYB4RYBL8ZtD5iPPzoCvi7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681991363, "uuid": "6c13f42d-8d5e-43f1-bfab-e68c1f3ff24f", "value": 299040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681991363, "uuid": "0994d35b-3112-4483-95d3-9a0f613df0d5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681991363, "uuid": "0a450367-faf0-4ffd-9a7c-4b444711f1a6", "value": "PO23032517.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "752997bd-df3a-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1681967768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681967768, "uuid": "c33c9c27-ceff-4d61-ba47-bd3af256c431", "comment": "Malware payload (GCleaner)", "value": "14430499586d3110f25a8255298d528b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681967768, "uuid": "5247781a-467a-47ce-8218-b1d073f7a0bd", "comment": "Malware payload (GCleaner)", "value": "5df5d338fcd2cf967c08d5d50aef81f7e27ae868b94f1d0d8bf1aeee86fdcda3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681967768, "uuid": "54f2317f-d6f3-47f9-a07f-bdbbb049ed00", "comment": "Malware payload (GCleaner)", "value": "4ace601c5366606ca04c016be8d5a8f5242165a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681967768, "uuid": "21312db8-d2e5-44c9-b9ed-8b9c76ad4ed0", "comment": "Malware payload (GCleaner)", "value": "e48c1fcc681b894ecb35e79e8f438fc4a1864ed06592f51c30f0ac3f4e8e721456f6a4d3c116c13295a0fc075771255d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681967768, "uuid": "fd4228bb-6398-4bf3-a584-c31d8ffb8829", "value": "T19064F1A179C0EC72CEAA65745475DB571ABFFC6106148247BA383BAB6E323D10B32317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681967768, "uuid": "b8b41275-9aff-4684-bacf-ddee2bb11ba1", "value": "6d86aa147518c9f783875b9278e5ac78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681967768, "uuid": "c87d018b-1584-45e5-a5d1-a997f0c76e68", "value": "6144:CO6uaS6uZ+oU/L4/GdBnL6Gh9hTqGnaEWOs35ggg4/ve:daS6738/GdhLVhGGaEIg+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681967768, "uuid": "7c83eb44-9cc3-4d60-9b3d-99575c051436", "value": 312832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681967768, "uuid": "4a3c6281-d143-4a44-8f57-5f36ffe35dd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681967768, "uuid": "f6261b2a-6667-4291-9cd0-0d115fa0c4d7", "value": "14430499586d3110f25a8255298d528b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8159b11-df3c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681968847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968847, "uuid": "ef4e444b-d39f-4345-92d8-a9742770a471", "comment": "Malware payload (Mirai)", "value": "ffa378015ae9923e8bee91c8a5cb7f91", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968847, "uuid": "83f47a12-7f7b-403c-a9c2-bb83ddf44298", "comment": "Malware payload (Mirai)", "value": "5e60c47178a5558cb9078ffe3d3858e04f0c27ceed8cd8762708d9ce4535e186", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968847, "uuid": "ba098854-b89c-48b5-bc92-1bede1a31ca6", "comment": "Malware payload (Mirai)", "value": "5ca0532891a529bbf6639c5f2bc794dd6bd50e31", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968847, "uuid": "876351a9-36f0-4d03-90ef-deda3bad0c07", "comment": "Malware payload (Mirai)", "value": "7172081ed237a12b34175a190a24eaf598a288604b30b819a15455b3a621c600eb918f5f4b636dc8e9092a34e84ef5c1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968847, "uuid": "fb39a83b-f1a9-4361-b55c-0a708e2e459a", "value": "T18DE32B56EA418B13C0D61779B6DF42453323ABA493DB73069928BFB43F8279F4E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968847, "uuid": "86dc3454-9c7f-4cc0-b1ce-d2bf06749529", "value": "3072:qJLce3pC5m57ltaLHbz4NhCQJctYJ1F24mXkkTM/9MxMY:qJLcetltaLHbz4NEQJJH2nXkYM/9yMY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681968847, "uuid": "230ea40c-0a0d-4e1f-91b0-fad5f2c5a3a9", "value": 150594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681968847, "uuid": "b95092d3-4936-4af6-bf79-31fc0702185a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968847, "uuid": "24d49391-97de-41e9-8f94-96b4e85489bd", "value": "ffa378015ae9923e8bee91c8a5cb7f91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22485ca8-df7e-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1681996835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681996835, "uuid": "0a7578cf-7e9c-4fb6-9c18-ae4556cfe0c6", "comment": "Malware payload (DCRat)", "value": "03c30495885c80b82f92612d362a55c4", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681996835, "uuid": "4a7b1ceb-e6bb-49c2-8fd5-ff4b7cf37279", "comment": "Malware payload (DCRat)", "value": "5f144ee04e584f5fa8d1dfcfc3ce696ab114484698e430b82d8f6d87cef07d3b", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681996835, "uuid": "02b03329-3f88-4a3c-8f7a-933807b13904", "comment": "Malware payload (DCRat)", "value": "fc454a992e11ba23210e77b49daa8f3e70c7d2c4", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681996835, "uuid": "4cba0183-d7cb-498e-9568-8c7b7c77fce3", "comment": "Malware payload (DCRat)", "value": "5ce34f7fc8f4f0f9135d66135cd39ac169d2ede3331b6877d057765fc0f348f101cac65fb1e5003bfdeda8a310dcf8a1", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681996835, "uuid": "9ed7e93f-bf1a-442f-836d-eef3479ceb2d", "value": "T162757B017E408E61F0182633D2EF454847B4A9116AE6E32B7AFD337D65623933D6DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681996835, "uuid": "55b33a87-3f6b-4638-9a07-546bd85076a1", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681996835, "uuid": "901c9327-c19c-40de-a49a-15523c29db4f", "value": "24576:r2G/nvxW3W2I3G47kOaFbkL5vYNYbu/hWg3Rvcq0uxK3AM9m6aTbPCNlassl+jqJ:rbA30GqlaGL5ruZWixVr/KDasaFr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681996835, "uuid": "e1528436-1bb7-4897-9813-4965c748085f", "value": 1618075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681996835, "uuid": "7b6b9223-26ae-4935-9f4f-0268ee6a09d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681996835, "uuid": "864bcc93-abe9-4306-9d79-92b624ec01d5", "value": "5F144EE04E584F5FA8D1DFCFC3CE696AB114484698E43.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08e90d42-dfb0-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1682018267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682018267, "uuid": "93394636-a2d1-4b5a-8c0e-f2391e45fc84", "comment": "Malware payload (AgentTesla)", "value": "2f06620bcf61066f91a2a38b17d86d60", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682018267, "uuid": "d4494f46-0f61-4291-ab08-46bf3fd2d613", "comment": "Malware payload (AgentTesla)", "value": "5f60065f39cfb14defcad05927bd60aad0f5dbca0977a88cf0afe78ff31d5c63", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682018267, "uuid": "feb69e22-508b-47e9-9631-5e1abfcdadfe", "comment": "Malware payload (AgentTesla)", "value": "ed14f48f726c04b52ab7b5bd3a118640a7ad0484", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682018267, "uuid": "c1344c4f-8668-4aea-8c65-2b46a32ab2c9", "comment": "Malware payload (AgentTesla)", "value": "f554b39400ac3fd20bf13d4620994c245c5c0aeee108901d04a663caf15284b09fcd2bfcb1c454536ea846d6db96dee0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682018267, "uuid": "c452defb-39fa-4217-bf85-f35733a0efc7", "value": "T132D4E029D136AEF2E5AD0B7600043AD9EBB0A1E3B877C63C0B9674D5DB9F7042D84587", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682018267, "uuid": "8312777c-0016-4a0a-accb-48c4a30f5fb9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682018267, "uuid": "79f60447-0286-415b-8124-ad5d1856e159", "value": "12288:aOnbqjcx/1USHSAacJIIM8SZvhStsYZ6A/NC+oqi5hr/dzhAS7QSy2PYxJ:aJMNpSvS3VSysi621oqi5hr/dzR7Qt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682018267, "uuid": "4c8b4eb0-59e2-4bcf-a901-6c3a909cc550", "value": 601088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682018267, "uuid": "eab6cd61-bfee-47ab-bbf4-f4af238bd86b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682018267, "uuid": "16346dee-1a96-4d3f-8341-63dc6beee602", "value": "Quotation_2200001635.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f95f2af-df28-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1681959974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681959974, "uuid": "7d32f8d9-bb03-4cb3-a03c-b0e8b26c22f7", "comment": "Malware payload (AsyncRAT)", "value": "15b1e4daf575c9048aea3bb18b21606c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681959974, "uuid": "aab86594-d79a-4dd7-9a52-179280aee7f6", "comment": "Malware payload (AsyncRAT)", "value": "5f69e57505862bfe9efc097de17ffa99c93eedb60e86b073cbe494b00a2d9a37", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681959974, "uuid": "8698056b-644d-4d9a-8033-9f76cefd6b26", "comment": "Malware payload (AsyncRAT)", "value": "ab9f3e0c167fcc4270fcf5489333a652c6cff041", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681959974, "uuid": "eb1b29c3-ed1d-475e-a013-ea91d3895b43", "comment": "Malware payload (AsyncRAT)", "value": "e3af27dc48f7d22b0944ef73fe65b4f7e6d21c00ad34f636431c8fb1882eec231b010e63967e177abea50717584a4749", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681959974, "uuid": "3689a228-c6a3-41d8-aced-964d9ef1d233", "value": "T147536C002788C965E2BD5AF8ACF2950146B1D5772102DB5E7CC804DBAB9EFC64A137EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681959974, "uuid": "cfd3c40b-f6ef-4822-8640-82a330c614cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681959974, "uuid": "6cb45be7-6426-41eb-a0fb-dbe6ec384f3b", "value": "1536:HhYBLTM3Ufc4c7VGeeiMl8GbbXwoZHtGZZVclN:HhYBLTM3UfcVVfeFmGbbXzGzY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681959974, "uuid": "9e7db4e9-73f6-495c-b4b9-2ea82676b42b", "value": 64512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681959974, "uuid": "4a7278a6-fcc2-42b4-bdef-16545aa96db9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681959974, "uuid": "beea04f9-838e-441d-84ee-2d9d87d8a40b", "value": "bLLa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52c75211-df47-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1681973294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681973294, "uuid": "167778ca-95ef-4906-8583-89a3acb1965a", "comment": "Malware payload (Loki)", "value": "94e40dcc20268833e52d5fca2941cce2", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681973294, "uuid": "e7faf903-d605-4d65-a232-5a07245f0909", "comment": "Malware payload (Loki)", "value": "600c9f01bea23d261107e44b1d24dbd238bed9d07850bb0d47f3ca961583ca62", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681973294, "uuid": "a9283cc6-814d-4289-b432-3b7b70b00edb", "comment": "Malware payload (Loki)", "value": "c2ae82c73f88e6e39620ce3113e54b437eb43796", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681973294, "uuid": "ecd80e23-3b45-45e8-9b96-1be240838a5a", "comment": "Malware payload (Loki)", "value": "d9052455544bf834f81407c7ad6c5852874820be6f6bfb4e71e499fc10e8d42edb96d4e921d5de7c03bb48be0f44532e", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681973294, "uuid": "8a1985b5-2195-4309-a99a-ba948e222340", "value": "T18C44239B8C5C7C705581338529EDBAB1D77BFFC22F0A46339BC0A19A6C6D8C95E1D250", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681973294, "uuid": "458b8b0e-92a8-4bb5-91bd-53fc5a815dca", "value": "6144:KpU8PLrQkOZZMg19ynVjqYkhQVGX5oOYT5ppiE1pY4x:UPLrv64nVjq5JcT5XpY0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681973294, "uuid": "74b233f8-92de-4b19-b1e7-aaba5e8e00e5", "value": 266759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681973294, "uuid": "e0c2bcb6-346d-42c1-a38f-3a1fadefb5ce", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681973294, "uuid": "e118721e-b9f1-4d08-84cf-192c0ab91079", "value": "ENQUIRY -BIOMED(T110HMA-23008-0000).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77155e3e-df9b-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1682009432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682009432, "uuid": "e879eb72-8743-4914-8b0a-68ba31054af6", "comment": "Malware payload (njrat)", "value": "0ce6d9e27053e0ace6871c8793892896", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682009432, "uuid": "b861cfb4-a452-4555-80ac-b63b0ce0e0f7", "comment": "Malware payload (njrat)", "value": "604d084961e31f52c85d67bbd290e8922a73f4c5036bc842ae98902a1c5c269e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682009432, "uuid": "50155a1e-77f5-4dc2-9525-11c1e8772d71", "comment": "Malware payload (njrat)", "value": "e48283c89df2383b804039025e06ce85ae138d03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682009432, "uuid": "20e93fda-72f2-4f13-9c15-8aa895befd9a", "comment": "Malware payload (njrat)", "value": "082c365c14b4f042536b4736df988adb78520b3b8480c7e6796a896ded4bb3d94f7fe6e13ed13569462dda476a314514", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682009432, "uuid": "ba6afa88-fa6c-4cce-9095-1e2fd189c40d", "value": "T1AAC2E72C37B68232D2EE067E4562EA5043B5D44BE237FB0E4CD958E94B5B3C60A41FE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682009432, "uuid": "d6ea5586-8b8f-4a49-96ef-d810db9c2ff1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682009432, "uuid": "acf7ac17-d033-4450-be32-a3e0edefe0ad", "value": "384:iLplYHHeIYTzRRcbg8iEPrthZMVAQk93vmhm7UMKmIEecKdbXTzm9bVhca26Br6s:8fZxRm8VA/vMHTi9bD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682009432, "uuid": "2ba2f9e4-5994-41de-b3f2-a366a2afe5a4", "value": 27648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682009432, "uuid": "d551c414-b7b5-4f39-b58a-e244d3561d1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682009432, "uuid": "d330d833-0dd3-41ce-adfa-fe122b463b0a", "value": "0ce6d9e27053e0ace6871c8793892896.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d90b9a6-df71-11ed-88f6-42010a9c006e", "comment": "Malware payload (XWorm)", "timestamp": 1681991431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681991431, "uuid": "4175bf2a-052c-4077-947c-d8145f394b89", "comment": "Malware payload (XWorm)", "value": "1817e46e5a422e9132a04db8fec73a0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681991431, "uuid": "f51d761f-e0ee-4ac4-9217-865945073d58", "comment": "Malware payload (XWorm)", "value": "60969a9175951613f2c83eab67e31887eaed9429e5d03cf8ab135131a2b47054", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681991431, "uuid": "11e749fc-671d-42a9-a447-262d578337b0", "comment": "Malware payload (XWorm)", "value": "31c2f9de7b5b05cc322512fd9beadd7c7e525f6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681991431, "uuid": "01cb063c-b11e-4764-944f-fb0479a8dbef", "comment": "Malware payload (XWorm)", "value": "307038cc68228646bfa319e8d8507d1f4a4b428f6d761ab8be664e42d7592eb8f5ba3b4296c883d19aa731ebd8a7a691", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681991431, "uuid": "cea91ae5-2f5e-4258-90ae-652319ff65dd", "value": "T1E105492439FA502AB173EFAA5BE475EADA2FB7733B03645D1051034A4723A41DEC163E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681991431, "uuid": "c3afc490-a573-4d30-b0d5-e367b6d85e6c", "value": "12288:oWmaQfFJeDYFPQC1nOw6/iZyubeDmFiFVVfHVpNtrjb+Vf7SJo7lfELkNCCtPzMI:NTCfJnGbDwKNd8H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681991431, "uuid": "42c5728f-96e9-4d16-8c38-ba70f9aca288", "value": 836096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681991431, "uuid": "c528250f-bf22-4fd1-98ae-6798b4e78789", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681991431, "uuid": "b12e5fb2-8164-4791-8bfe-5de5d83c5dec", "value": "IMG_2031.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "168c9972-dfd6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682034611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682034611, "uuid": "2b117726-3eec-4376-978c-4e0348205ea9", "comment": "Malware payload", "value": "86adca248b92b9882997302aebe26624", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682034611, "uuid": "15822094-bbea-4710-929f-c864efe0a981", "comment": "Malware payload", "value": "62de3d3bf07c3574fe6c9497526a7c097e2d4384d345f18c8b07edd11716333a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682034611, "uuid": "93806231-23ed-4774-ba5f-f8863cc83972", "comment": "Malware payload", "value": "90092e8b4e12159150a376dacdd0214c2117c12e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682034611, "uuid": "038b7e85-fe4a-4864-b0fd-78ae1d0d6667", "comment": "Malware payload", "value": "ece0204142c06eafd190b38c00db19b7b1ebfccd13149812dc1faea8ea9922f8259dae0758b061d023d663ed63688562", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682034611, "uuid": "3b03f835-5c1b-416d-9e49-49a45bd88053", "value": "T18AE36B21B18AC075E5BD153D0574A7750A3D7AA09B84DEFB7FA8C8B90F341C1AE34C6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682034611, "uuid": "8378ca13-a1e2-4068-8bf4-542114abc554", "value": "2511b827fe0865ffe3740ca88c76393e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682034611, "uuid": "c71558a9-517f-4d93-b2ac-6671ed88e2f0", "value": "3072:qXRb4ZX9LeFLHySbZT8A6gBVzPvRND1Y4BPiq+tMxSd77hq+VXbebCGcD9NUfB58:MKUddb1meVTvRpJGGYM5d3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682034611, "uuid": "af603fcb-f517-4d6d-8d7b-2399cc844b45", "value": 150528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682034611, "uuid": "f678db12-a739-410d-922b-700db9d56be9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682034611, "uuid": "21795afb-bc47-4b97-9d6d-71e7b265161b", "value": "62de3d3bf07c3574fe6c9497526a7c097e2d4384d345f18c8b07edd11716333a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88badcab-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681985840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985840, "uuid": "51dba9aa-559f-47c7-abf4-d22f6ef24128", "comment": "Malware payload (AgentTesla)", "value": "45dd1f627c7cce579d69dd3bcafc130e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985840, "uuid": "18d2da63-ded4-4704-b199-67ea7c57c475", "comment": "Malware payload (AgentTesla)", "value": "64f7160a149eb98340872f6bba7149c4b654cff413acced11d4c7ee14f3a7ad5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985840, "uuid": "38859830-6f17-4b34-a614-a08a8d35000c", "comment": "Malware payload (AgentTesla)", "value": "e0d722cd5ff777dcd608b0ac97c08a81b3a56c62", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985840, "uuid": "638c1a33-a02d-4779-8897-a81a798427d9", "comment": "Malware payload (AgentTesla)", "value": "39fd39a4c987ef165a871e235c07daf5c8f8354e1b6c7715d9fbc2c93e5c7c8b8c893c3a40d5f9c425637f47d0d62fc5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985840, "uuid": "d7f5a9c4-a550-46f8-9abf-8cfc15a16684", "value": "T1F56412C4A156C423F0F31B779D3A97AADBD6FD1115604F2F2354AB4EBAB6881980F702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985840, "uuid": "ebacfabc-802e-43d6-b785-da5e8c771e84", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985840, "uuid": "8eee927f-96a0-4310-be28-d6be45af927f", "value": "6144:PYa6gb9sjomRQpjrvMcka3E85CCPW9u88biaD4RCkG12u7rSq+n8yHQl:PY2b9zGeLka3E8vPWibd8O1pP2HW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985840, "uuid": "a3db599a-f632-42b8-a760-b56e6fb9321d", "value": 312204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985840, "uuid": "adf5b1d5-90e2-4329-88dc-617049e4a1a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985840, "uuid": "70ac9347-ea33-4310-a2d6-40e41b4c12d0", "value": "xerox scan 000042216692400.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d978f65-df86-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1682000317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682000317, "uuid": "fa62e56d-4ec8-46ad-83eb-b91574cf1045", "comment": "Malware payload (Mirai)", "value": "362e39fb0a759a5326bf971d240f75cf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682000317, "uuid": "955282ca-3d9e-4a86-85f5-6077745e51e9", "comment": "Malware payload (Mirai)", "value": "661037accda8139511c921087143cc333206140cdeef2dc846e1f39f4fef1f18", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682000317, "uuid": "5861d3fa-5d5b-4c4a-b14a-37d13bf04b72", "comment": "Malware payload (Mirai)", "value": "81dec77de7d6d70a3c0718f5e5f53d3be0d2ef80", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682000317, "uuid": "16da5750-c974-4e7e-8490-bd0e30a9d8bb", "comment": "Malware payload (Mirai)", "value": "7038fbd89050dbc4690cd1db9f5b3719a6775494bd9420072fffb6e4d7b36a80e7fe4a8e8eeb3cb30624377f5dd19201", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682000317, "uuid": "5c8596e0-e5de-4d25-8576-1bccddf6bef2", "value": "T123633A92BC819A02CAD412B6FE5F518E331623D9D2EA3207AD15AF2037CBD1F0E77251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682000317, "uuid": "16106d89-6712-4c8f-b71f-42bd3c9f669b", "value": "1536:/WloK05nJ7xkC0ztNrB28k1EWwq04zVW84lx1RVvH:/WNY7635qlEfXIVWp3dH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682000317, "uuid": "59e8807e-f099-412a-9e68-a6b0aa36a1d0", "value": 72004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682000317, "uuid": "62654ea0-6591-4749-8e72-5a00fbb2df50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682000317, "uuid": "a75ed114-c123-4d08-a67e-556e5c6e51c5", "value": "362e39fb0a759a5326bf971d240f75cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "604ef6c0-df7c-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1681996080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681996080, "uuid": "2ea62cdc-d3ca-4da0-8088-1d7ec148b8ae", "comment": "Malware payload (AveMariaRAT)", "value": "1adb0b5e9d6292dcf815b21029e28cab", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681996080, "uuid": "64fe86a2-188a-448c-8e25-99f6c988a77c", "comment": "Malware payload (AveMariaRAT)", "value": "66e29e6155b040672ab7a4951754f5fe310a70e05292e7a391ccfa7c95c0df4f", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681996080, "uuid": "8aed5960-39de-4e36-8928-65ef8bda2124", "comment": "Malware payload (AveMariaRAT)", "value": "b0643eab3a3a096a8637fabf2c3ea5768aa2a585", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681996080, "uuid": "f55c2a7d-d3db-445d-8155-a8e5f76682ac", "comment": "Malware payload (AveMariaRAT)", "value": "0bb4bdaa24bc586d498f6e144f983b463837410e93efc5dd93fdbf425a5a2e21cdbd3aad4d3645b67081120bb990cb4a", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681996080, "uuid": "7c365c00-b2b8-47a5-b219-cbfbf478c3c8", "value": "T12D45CF7115C76C39C62DB03C3EA283E5DB3965AC1EB50FE390637F395648E919AA3E01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681996080, "uuid": "a9521836-c034-4a6b-8396-5899e5a28709", "value": "a071544d2d96133c79715479e1b1e0d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681996080, "uuid": "d56ca470-5fee-4fc3-afee-b5ea19ea1ffc", "value": "24576:AwYjsBX8MwFlc43dul6vGIcUFqxtUQYv/xWC8/Cp08D5r:AhjsCMwYmVvGIcQqx2PJW3/I5r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681996080, "uuid": "2d2963fd-a7d2-4205-8b6a-5b1b9ad4bb36", "value": 1251232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681996080, "uuid": "08f4e389-7f30-447b-a921-6ac691feacee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681996080, "uuid": "be96312f-09d0-4233-826b-6d0e9d91b4fc", "value": "Purchaseorder1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c814c879-df26-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1681959317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681959317, "uuid": "58a76d7c-38e8-4e7a-aadb-ed38d3e82ab2", "comment": "Malware payload (Loki)", "value": "49efdea03a2e26a3b13cd6e62a6760ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681959317, "uuid": "ce25e6cd-de0d-4cc2-bfb8-4beeff9fa4ed", "comment": "Malware payload (Loki)", "value": "67c073d1621a49c3cdf63410b8bf159b02ae6a8fc7738f4a9dda27638d40c43c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681959317, "uuid": "b107c4f3-0369-4909-b4bf-9a613ed7c8d2", "comment": "Malware payload (Loki)", "value": "2f4cb650df7e8a0643ab58b95345f11c7d6bbe4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681959317, "uuid": "3da70b98-b59a-40b9-8ead-dffb02749267", "comment": "Malware payload (Loki)", "value": "7daa9c6f7879b6e0600190d7747c39a399dec9ceba323bd1d1efaf4f55debee8990d10b31755a88164fe11b4f2355004", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681959317, "uuid": "1af58b14-e9b5-4ffe-a325-fcad40aac6e7", "value": "T140E4D095B766E792C2687D3D51EA60282BB049C7F427C92AFDC8115D7E277C90E803CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681959317, "uuid": "c0b8d43f-fdd2-4ad1-b60e-f86f20d5d9e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681959317, "uuid": "971a3fc2-7b1d-4489-bc27-eea2d220865e", "value": "12288:mG+aRuKskHMH91DzZvVMETfieUBOho3QKQXSnzy0mx4M3odkTDAKBwoL:mGzRjHMd1DtvhTFUohCQSzJDoHDXF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681959317, "uuid": "ae84fdd6-0b9c-4bb4-9ddb-a3ea82f97841", "value": 674816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681959317, "uuid": "e47185cb-1bf8-421a-95a0-7126ca8386ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681959317, "uuid": "5f567d69-a7c2-4479-870a-5b05568135f4", "value": "Q213345788.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6882dbce-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1681985786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985786, "uuid": "4e2ebe79-6336-426b-b560-0444c6181569", "comment": "Malware payload (RemcosRAT)", "value": "ad4235de290eec15ae7cc40dc850155a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985786, "uuid": "0670562a-da2e-47a0-940c-2bf154232cb5", "comment": "Malware payload (RemcosRAT)", "value": "681eec3d998271cd22e48502907ed4d1946ebab8068daf11c280e1bedec51eb9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985786, "uuid": "7c1105b9-8db5-46ba-804e-84e0fe419b56", "comment": "Malware payload (RemcosRAT)", "value": "607ae524330f7166aa849764e16901ccde84837d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985786, "uuid": "5a1f3951-6555-4a68-927d-5ed03af1b6a0", "comment": "Malware payload (RemcosRAT)", "value": "52286bbe00ff6b97773d29f525f7a0bca14379b52920c111b98b6efeb24fd0beffc9ae5848b4412f48a4b9c1157690b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985786, "uuid": "3677695d-9724-46a8-8b81-6d74e9e9df76", "value": "T1E094EFD1F254C8B9F99A06B29C76DC6520A77E6DDCB4901F349A731E59B338300ABD0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985786, "uuid": "07de3442-c27a-44bd-ad32-49c8ec9b6e7f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985786, "uuid": "b3ff6e08-6c5f-4f86-bb97-adea2c14237b", "value": "3072:+321SmP2HKgdYUPiXSq7xSy4iQsVnUhgzwPffWJ1gIsKp0:+m1oqON2DUELs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985786, "uuid": "5c117d20-54c2-4667-a376-1d669312fb50", "value": 434688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985786, "uuid": "02fab5d3-be41-45f3-84c5-74d7829010fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985786, "uuid": "4fddd9e3-a27e-408f-86b2-1008a5bcbbb6", "value": "COPIA DE CONFIRMACI\u00d3N DE PAGO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52121ef1-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681985748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985748, "uuid": "ff4e310e-c8b9-4def-8c76-8f75bb3fce15", "comment": "Malware payload (Formbook)", "value": "908ad9609d795587a7da763e83069cc1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985748, "uuid": "be05f68b-9c9d-4bd3-b022-96b614ee75b1", "comment": "Malware payload (Formbook)", "value": "6897ca7f3962315c76170bfefa5d57b98a9c1ae93a4264281c59460ff87b880e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985748, "uuid": "5c2e1c31-a0fb-4586-ab83-a641bc4e4705", "comment": "Malware payload (Formbook)", "value": "5790d7b7181ec192ecbe35c515163c43fd3a50ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985748, "uuid": "ff174f5a-3560-46dc-ba8f-bfde0ac7474a", "comment": "Malware payload (Formbook)", "value": "101e2061dec3dcfc3784fa05af11a608d503ccd68d94691c205832d1f388aaf8587e283cb2dc74e23e83388f1465a185", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985748, "uuid": "57853d1c-f4aa-4163-b4b6-c2ed7718eee4", "value": "T19404AE32D602C071E2B251B5F67D1B7B883E0E343694A4FAE3E115A16EF0995F52A31F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985748, "uuid": "48d5f7c5-90fe-4ab9-8272-00b7f3fa46fa", "value": "3072:48QnUQwBFKRujtBxb7ZMcR0j2jg8GYFsh9h2mQlufoRR84gHy0QtHnqkQ:kNFuHl7ZMcujGK9CufoRVgS0SHc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985748, "uuid": "f1025094-85bf-4ee6-b15e-7c225815f0d9", "value": 186368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985748, "uuid": "a6084b9a-eb60-4054-9052-f4e7a3e75871", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985748, "uuid": "57ed6e58-a543-466b-aaf1-0d6f43bf788f", "value": "6897ca7f3962315c76170bfefa5d57b98a9c1ae93a4264281c59460ff87b880e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b7e9bd7-df5c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681982435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681982435, "uuid": "5e4b0554-86c9-43ed-827d-11349dfaa10c", "comment": "Malware payload (Mirai)", "value": "1c1756515e24eb3b3e7810dc0304dd34", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681982435, "uuid": "d40c0d0b-a3c9-461c-8c25-3274bedb30a1", "comment": "Malware payload (Mirai)", "value": "68ba2c2e5703c8e5123fba66618184ef1a20804e6d5a0ecb092d6dfbe3ce097f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681982435, "uuid": "9f7c4a54-59f4-4743-ab7e-a8983deb7fba", "comment": "Malware payload (Mirai)", "value": "b6d77cc9ed5aa260655566c2cb344bbe48f1c254", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681982435, "uuid": "a35fbcdc-8d6c-4f10-8cd8-86328d0aaaba", "comment": "Malware payload (Mirai)", "value": "e45a1b9ab2fdbca9ae5237c8ba0528a1e1e69b192fb25b1fe22bcc94f7e346767b2d0a30a9d70af6937ad94df9f7f7ce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681982435, "uuid": "2e3cd360-fcba-4f68-bf6f-a38a75ba2351", "value": "T15BC32805E5508727C2D3237AE79E865D37325BA493DB33215A34BFB82BC278D1E39921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681982435, "uuid": "cc97f477-d21e-4ff4-b700-49978bd99286", "value": "3072:WkYP4WY4noL8xOa4/F39fDJVHl+mTQOY5NX3cn:lYP4WY4gIOak9fDrF+mTQOY5R3cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681982435, "uuid": "2a51997f-cfdc-40de-a448-8cf8318393b8", "value": 120996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681982435, "uuid": "dfb4d097-1f06-4d94-a0c3-37e1395ba8c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681982435, "uuid": "d2f9331d-51cb-40ee-9447-d0839903cab3", "value": "1c1756515e24eb3b3e7810dc0304dd34", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "182d0f55-df50-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681977061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681977061, "uuid": "4017ef1c-3bcb-415f-9598-07581dce1fd9", "comment": "Malware payload (AgentTesla)", "value": "ec58728926edfc364c17b4fd94f79c44", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681977061, "uuid": "433bffd0-c535-4dc5-9920-0181c15851af", "comment": "Malware payload (AgentTesla)", "value": "691a32cc1816cfb890ccb79252b511b6e66b296ad382bf64871f41e3d0d860e3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681977061, "uuid": "2478366b-0b83-4975-b2bc-76a91a688893", "comment": "Malware payload (AgentTesla)", "value": "70dc16c7735eef96852dac7587146448e8136559", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681977061, "uuid": "7edaec0d-6a0f-4e4d-8bfc-5a07bd92d662", "comment": "Malware payload (AgentTesla)", "value": "68e2fdb2f8f5c1d2b2e4eef3c34a3bca474287c50b1e8d780c33624bf062eec7ea42556e38d95c6354c64145bfa4419d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681977061, "uuid": "645ec08a-cf68-4f63-9d82-ec5f437c3bfe", "value": "T156D4234C4CDD5C7C2B7E7A80229446D9AD920F4562FCA03DE61AB3C67B6E950E52BC3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681977061, "uuid": "ec7f7088-a3df-446e-b4b8-fd6d7dbf188b", "value": "12288:YFaQpdAzTEjQ7DVYA987DhNPXUXSD5naHPcDxUI+piBbV91Y/OHMT:N+m/IQ7DVv877p5aHPcVUi39WmHs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681977061, "uuid": "198472f7-931d-4edb-b0dd-e90f079f673f", "value": 604252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681977061, "uuid": "f931d0e1-712d-479e-b7ab-f11143c64a15", "value": "application/x-xz", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681977061, "uuid": "a5040746-b89a-4a4d-a8d2-33414b026fca", "value": "SHIPMENT-INVOICES.tar.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d278b4d-df60-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681983968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983968, "uuid": "bb83448d-e349-467f-91b7-ab236deaf149", "comment": "Malware payload", "value": "a8391484ece0b5eca2128738ff63d200", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983968, "uuid": "98a94d8e-036b-41f9-a107-39ffef24af09", "comment": "Malware payload", "value": "693f4ad5fff2c9a297b872a1d1d7dcb04e7b9c5fcd8eeff329b57932ab92096a", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983968, "uuid": "bcdf0877-8260-4022-b55c-471cdf230ec1", "comment": "Malware payload", "value": "5d77584dbaf4a8bb9553f54592d8f020f7ed18ae", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983968, "uuid": "07613280-2a5a-4702-9fe8-f94c2c4d24a2", "comment": "Malware payload", "value": "04f9d65248cac56e92e641cd4ebbebd3a1e41da94a9c7373589acb4e3eeff64d404969b914044f971a81ec4b3b7fe4c6", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983968, "uuid": "40272c47-d348-455a-b818-e0d33dd284f8", "value": "T114C62325A3C78636C55D013BE928FE1E0539BFA3473140E7BBE83D6E98F08C152B9656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983968, "uuid": "6f7558f4-52b2-4020-8905-1d351d3c93ce", "value": "196608:+knYwWeMhHnN9k7LD2SNnWYLuNwZdB7ZkXqIAH+KLj1nDZN0V5vtsAaEU4aJCy63:+kYwWFN9eLzbLuNwRaweMnDb0Vc/BCy6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681983968, "uuid": "b8dbbf47-6555-46fd-9f28-354dec3ca737", "value": 12139008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681983968, "uuid": "f132fa8a-fa03-4ece-850a-0d03180cc3bc", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983968, "uuid": "88df8eff-76a1-4d97-9aa4-c3a69675dc44", "value": "Pedido_Faturar.HWXBU.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "167b6e16-df8d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682003257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682003257, "uuid": "887cb8ae-f006-4bca-9c9a-afcb331d2436", "comment": "Malware payload", "value": "17e36437bd558374106622b7327a2aca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682003257, "uuid": "5bbf57ca-aa7f-46db-96b7-954e6f72cf9b", "comment": "Malware payload", "value": "6966f92616bae9252b96f666136667076c6368f00778670c530708648631443b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682003257, "uuid": "451fded2-00fb-4eb8-918f-80c3e3d1c706", "comment": "Malware payload", "value": "1045c084017277b8991e41d29ee101cf962f620a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682003257, "uuid": "c03a8c06-4d9d-403d-9a83-5143c5169fe4", "comment": "Malware payload", "value": "d57642ba50ac85ab48732f0b4890bf36bb04fb6d722403826dd3e9f8773f80fc13950bf790521ba7b3782083962b0c59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682003257, "uuid": "7aa0c2ac-e9bf-4d6d-8fb1-192f26687a73", "value": "T1729423A183D2E89FE18029B02437FAB4DF795E8D54815A5743D9CEFB3E326930F191A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682003257, "uuid": "c294831f-dddf-4541-a651-3802edd8e0a6", "value": "e160ef8e55bb9d162da4e266afd9eef3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682003257, "uuid": "20bb3077-9df2-46f8-aed4-b46c16a42108", "value": "6144:Q8dNXSEmZt3bs5f7krvBM/0XuS+6JJ+dYiaxRt7b6UGQXifRAB10GTgjyBk:zmvrsyrvNeiyYiaJfZzxB1qyO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682003257, "uuid": "464d87eb-beee-474d-af04-c1be01f7fc10", "value": 433216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682003257, "uuid": "e0cbb862-e9fa-482f-b118-71e41385ee0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682003257, "uuid": "83b40aab-87cc-41d9-ab7e-dff7eca9caa2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5fbfb34-df47-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681973568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681973568, "uuid": "5eed4e78-7917-4e1c-93ba-0524ca3ef791", "comment": "Malware payload (AgentTesla)", "value": "13cb74a7b9cddb111793a5d7f11d5240", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681973568, "uuid": "8da88354-461b-44df-b9eb-ab5b9a208027", "comment": "Malware payload (AgentTesla)", "value": "6ad0c5f603b0eebbba05a4f1c7500021f4ba9acee5b8e6405bff973d3fe99c1c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681973568, "uuid": "a9d99fb1-51e8-4b0f-801e-8b728eb67f86", "comment": "Malware payload (AgentTesla)", "value": "bb9c3d9f8fed9e6ac7527e67c6a83c129b71c176", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681973568, "uuid": "684facb5-5a99-4ca1-89d8-94e3d8065111", "comment": "Malware payload (AgentTesla)", "value": "9ca7ba0f8eff6f57a7afb690eb28b3a16e1d5e4be2a31f44660df84e81de4b44f16639c9c7abf80e094ac4d4fcdac66e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681973568, "uuid": "39858cda-1166-40d5-afc7-3fbaa2501d2c", "value": "T1B6D4D0D563A5D7A2C2643FBC122A61683FB1599BE525C635FDC850DE3E32FC80A4039B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681973568, "uuid": "80b77ce5-559b-4438-b8cf-ff6d7a8778bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681973568, "uuid": "3e4fdc3f-bf17-4f6c-adaa-f0e2989f6ac5", "value": "12288:RYaa3vqaaDYQWw7Nb9ej354Zi4LZNASbCQVIOapsH:maafqzTNb807ISeQVIOap", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681973568, "uuid": "3be706c3-6868-4ddf-96e6-915656dcb840", "value": 634880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681973568, "uuid": "756c6bbd-8a81-46da-b314-5c438274e548", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681973568, "uuid": "e2bafc26-7693-4165-a2b4-cf5385d40172", "value": "PO 5500505840.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52dac45f-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681985749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985749, "uuid": "75be6c6b-5035-4b21-a7f6-e285d989bc33", "comment": "Malware payload (AgentTesla)", "value": "2daef28d475a4a352d9fc7ac0e9c95d8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985749, "uuid": "5163616b-4b34-4324-bf1a-179b0d311612", "comment": "Malware payload (AgentTesla)", "value": "6bbe3a700a330b0e92807179be930e40f86857f0162ec3dcb4167f184487565c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985749, "uuid": "11efb2d7-46ef-43bd-a5b5-f7af369809dd", "comment": "Malware payload (AgentTesla)", "value": "65e929a362abc23a3ab53198302fbd2c99a611fc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985749, "uuid": "f6ef418e-c915-4d20-85ad-f7e6ca6cd7ff", "comment": "Malware payload (AgentTesla)", "value": "dd109088422d9e9076a1ebd60c2c9ae55032591636a835c548cd0f0a0ea31ff8a86e8f77fba41f051ae9e80e1791595d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985749, "uuid": "a77303a9-49a2-45f6-a335-7e25903e983d", "value": "T10F042A6892CB9D12C32D0178C4F0734806B2A1475667E7AD0EE098F6BF467CB772F866", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985749, "uuid": "24a92796-6251-4085-ad2d-1f8569d67101", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985749, "uuid": "421677a7-1c4a-40db-8896-b0fc8388ef5b", "value": "3072:9RxNAI/XqL9t5EztUNkoLXgkBycVHOdBdGBDHijFw3TiC8sv8:9RxOIPqL9t5EJpoDzyc4BdGBriUTiC/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985749, "uuid": "9e8ea72f-33b0-4223-8e11-7bc73c13c333", "value": 173568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985749, "uuid": "dfe2463d-8b9e-4bbd-a32d-fbd41e699367", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985749, "uuid": "eb1e3718-ec8e-4f83-8857-892631224f5a", "value": "6bbe3a700a330b0e92807179be930e40f86857f0162ec3dcb4167f184487565c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ca8c92e-df7d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1681996530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681996530, "uuid": "f42affaa-39a0-43fc-8b81-19f2755f46b3", "comment": "Malware payload (RemcosRAT)", "value": "94835aa27de43b07d5e2368057aa0dea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681996530, "uuid": "89722c70-56ec-4ebe-b281-6a14ae656f8a", "comment": "Malware payload (RemcosRAT)", "value": "6bd0c6927f47f86fd07cdd93c42582d6657f751d5abe87fb171d0df6758463f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681996530, "uuid": "ffd981e8-cee0-40f7-b01b-41c9ecff028a", "comment": "Malware payload (RemcosRAT)", "value": "b2721f7fbe3140d6b1e895467965757f53d3e3af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681996530, "uuid": "46a0f6d3-71a7-46a9-b3e4-02ac4d59e961", "comment": "Malware payload (RemcosRAT)", "value": "daec10a9aa3c1d84b400483f4d16984080b97500d72519b3d4c98e8f96ac2566956d76d5287bee6da28b8ab570c85758", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681996530, "uuid": "a6787333-5f06-4164-b67d-f0646ff6ac6f", "value": "T10BE42350B750C73BE2DD5470899AAABA8FF5B462E9F40E3313841F0FB8A05809D5E5F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681996530, "uuid": "a58c022f-ca57-457e-8d53-1854d7b3aa94", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681996530, "uuid": "fd836626-729b-4101-8d27-173108182fc5", "value": "12288:JT5Fz4pNMZ0tpyZGEjdWjqcnf2ASLCbEOO16tcXHCojpaX1wHZ+0lDepfJMoEV+:JT5Fzu2Z0tMBMj2LCoOY6qnA1OZ+6Dez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681996530, "uuid": "ad234de1-dc9e-4065-a4a1-5f4d791f4281", "value": 695544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681996530, "uuid": "35ff4cc9-691e-44af-832a-4c5e16f7a160", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681996530, "uuid": "5f695879-9de9-4d05-b507-cffdd3bb3a39", "value": "rOrderList.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53a98264-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (BluStealer)", "timestamp": 1681985751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985751, "uuid": "d51d27bc-4d7a-4018-8a2e-a693cb7e5c8b", "comment": "Malware payload (BluStealer)", "value": "15ecb5efcdd1da60edf5920c2fdcd515", "object_relation": "md5", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985751, "uuid": "f92f8de5-f296-4b2a-b9c8-5091beec50fa", "comment": "Malware payload (BluStealer)", "value": "6c922a791609e332501e499c78283d9d98a413c8a16cebc66603c917eeb9e3bc", "object_relation": "sha256", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985751, "uuid": "bc03fdb1-84eb-4279-ad0f-df2d8e0cd3b2", "comment": "Malware payload (BluStealer)", "value": "8e2fa7988cc4a7afa34e8d2e3268ffa76bf51e4d", "object_relation": "sha1", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985751, "uuid": "ed9bed6a-d651-4501-a243-11ff3062581d", "comment": "Malware payload (BluStealer)", "value": "a683e5dae286fe0f5adb823689be16ad2864beb4788f9bc4022ef19798f633f1e11f254e2b88bd32d485331934080a8a", "object_relation": "sha3-384", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985751, "uuid": "41d75720-eab4-49a3-8ce5-dda51eb091bd", "value": "T11A94011167B6F309D2148BB513FB835401A0FB325EA34E0BBB0C7B5AA636D96E1B5317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985751, "uuid": "aa060a30-478b-496a-8812-01a3bc80baea", "value": "691613e5f161aece5d00ed0359fb7732", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985751, "uuid": "0ff711c1-103a-485f-a679-ef67d976e9d6", "value": "12288:obWnxfgsRL4u/1AlLK6FRY2n8OPKxGvYmB:osxgsRftD0C2nKG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985751, "uuid": "baecdd30-0d54-468a-803d-fbe52a7fa067", "value": 437248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985751, "uuid": "661fd4e0-c33b-40da-9306-77baf185a4bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985751, "uuid": "1db9fd96-d227-4d2d-acc9-113c577409c8", "value": "6c922a791609e332501e499c78283d9d98a413c8a16cebc66603c917eeb9e3bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "249e5911-dfb0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682018313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682018313, "uuid": "fbd7e5c4-39f0-4142-a3d3-09129f8576c5", "comment": "Malware payload", "value": "4d15f28ab76398b3b9db892f23aed6e5", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "mc1904", "colour": "#71A344", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682018313, "uuid": "be1db900-7e1b-4c48-bf9b-1a00a85a5086", "comment": "Malware payload", "value": "6cd1385131c6f1a0d3e8ec158155a666c1d77319a20c04ca1afa876da5da5d4e", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "mc1904", "colour": "#71A344", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682018313, "uuid": "013f509b-9dff-4d69-a67b-47e5372b668f", "comment": "Malware payload", "value": "43011ca0c15f268e4b720a47241a8c8f6e4bd057", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "mc1904", "colour": "#71A344", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682018313, "uuid": "de92ee43-81a6-47f2-880f-2147214d99bd", "comment": "Malware payload", "value": "f237a08a4c9a6016cbedb24122d9c5a7e3cbd12d2e6aba301f588118c36c0bfd4e7a0d50f4e9d4d7af6b992398c47c16", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "mc1904", "colour": "#71A344", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682018313, "uuid": "e961d66d-4b54-4fef-94f2-372ee7c1b7cc", "value": "T1F0E0C2B1B189171279963AF32B72E9CE4F81899046DACC01C82ADD64A6238735C55282", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682018313, "uuid": "fe474bd5-4976-4c1a-9b92-2edc31addedd", "value": "6:qsm3+h4UnXFcz5R0K3hQkXQQbvWbwqrYgCFWjYnNItCdNIA1wepDIwzgpD/smI3:S3+TFczP0K3iWQU+kqsjFWjYnNWYNt17", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682018313, "uuid": "7bd142b4-8c12-4b41-9713-db26e34ae7ec", "value": 304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682018313, "uuid": "f41a9c5f-40ad-4246-b802-abc8b0ccf371", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682018313, "uuid": "db395908-df9b-428c-be1e-9deb122b0c54", "value": "lIMew1Q9.ylw", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "397a8930-df3c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681968527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968527, "uuid": "a0eb3625-dfbe-4376-8e79-693238500807", "comment": "Malware payload", "value": "16e4344f6d14327304c20ce1bfc911cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968527, "uuid": "d1d1e997-df03-4030-8547-6af904334605", "comment": "Malware payload", "value": "6d033a66cca66b4c7277d9ed8bf0dab6028d3131e9c2dd78eacdfbdaecf443e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968527, "uuid": "666ac910-5929-4001-9fda-170df3fe06e8", "comment": "Malware payload", "value": "a0bec3ae75a3cbca9aa405f4018e4e5aa1a9e25b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968527, "uuid": "102c62e3-92e1-4205-a623-b1a91e0e7e70", "comment": "Malware payload", "value": "061041f4f2fc67bd5d23128310444315825bfe3873ad7accbcca6b9fdbf2f97c3e951437f2abac435840374d18ba2fa5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968527, "uuid": "b42df22e-7722-4b67-b3f2-3697d3afa76b", "value": "T1EA26EFC8D73C7643B16BCF8D7F7565EACBA51AC82D08D9760139808DDAF4080A4E6B5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968527, "uuid": "b00532aa-8aec-41ab-947a-bc888fa2ca58", "value": "98304:ShgQngRT+ASQVw2NjdKe721IVYz33Ogs13r3:ShgQnqTfrVw4JK6BS33413L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681968527, "uuid": "03eeb028-7380-4105-a1c2-34de2d237bcb", "value": 4791035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681968527, "uuid": "6db03f47-957b-4402-b94f-4b321f130a44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968527, "uuid": "f90aff2f-7a82-4340-9415-15e86f4ac810", "value": "16e4344f6d14327304c20ce1bfc911cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad8c2ec3-dfc4-11ed-88f6-42010a9c006e", "comment": "Malware payload (LimeRAT)", "timestamp": 1682027133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682027133, "uuid": "72bbf4d8-6aa8-44c5-a889-e4a57481b5aa", "comment": "Malware payload (LimeRAT)", "value": "22c74adf03e49db1dfab9216566d4ed9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682027133, "uuid": "9093ab16-74a6-4902-a022-910c0447d346", "comment": "Malware payload (LimeRAT)", "value": "6d28fe68df58ab9121992fdcfba660bac50108c9ea9fd786a8dc3611b4f60289", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682027133, "uuid": "ed9a8806-eb3e-4bfd-b17f-e88751b1b734", "comment": "Malware payload (LimeRAT)", "value": "7b0f06fe3512717632b943be8ca3445e915f62d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682027133, "uuid": "947f76e5-9967-41b1-ad56-507d32367eb8", "comment": "Malware payload (LimeRAT)", "value": "0c66abf5933fc88fb9cfe028aa833d26f1cada0e2f140e41327e8874a0765c0c1bd045e815462f5ddce1105ecef78c6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682027133, "uuid": "f8d17ba9-e652-4ac5-b90c-dfca7fa7d9fa", "value": "T1A5D26C0477E19345D39C1AF50BB162550FB1DA0BA93BFB2D0CC954830EABED18B94BE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682027133, "uuid": "12d6ed01-0209-478a-8e2e-29a36161cab3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682027133, "uuid": "abe6ec60-7ddf-4861-b09c-a9e97e494326", "value": "384:7B+Sbj6NKZYvR62u3AHtIEUqDXOe+y14vDKNrCeJE3WNgPe5FtosBAzQro3lcBGQ:lpZYZ62u3wtzOe+2W45NdisBeuj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682027133, "uuid": "fc1cc7dd-ab26-488b-a791-08957076d77b", "value": 29184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682027133, "uuid": "d38f67c7-d667-414c-b883-4691cf0fe423", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682027133, "uuid": "1e1b6209-5a9d-4fbb-8df2-e68f7cb28f6c", "value": "22c74adf03e49db1dfab9216566d4ed9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1474f1f5-df80-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681997671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681997671, "uuid": "f6892839-aa4c-4c63-a045-c628387d4171", "comment": "Malware payload (Mirai)", "value": "6a58a90c829150fa97a7c0263d40135b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681997671, "uuid": "c1b77e8e-234b-494f-af2e-72afb556f9d2", "comment": "Malware payload (Mirai)", "value": "6d5571336c4f91a085bcec9d383504e341fa9d7e2cc5e516a3fedfaf9ae203f5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681997671, "uuid": "7b089961-ecbf-4f13-a458-33eac5ef80db", "comment": "Malware payload (Mirai)", "value": "50dd8d7eb8327d15e0d71ded74fef7e5cae846d0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681997671, "uuid": "8a85d4c3-a547-4242-a631-5ba4cc146572", "comment": "Malware payload (Mirai)", "value": "11fc8cedbf5b4404e779ed7993b46b80689b05ac588dd590eff99139ec25d28de36e527ccc61608739ecce6d8e00d00e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681997671, "uuid": "4cc1420b-828d-4525-bcc9-983bbc8e5e19", "value": "T141238DA6C8796DD0D1588274B9248EBC1B23B405C6A33EFE5E45C66A4007EBCF62D3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681997671, "uuid": "1dba1369-5e03-4499-9d58-fc59f1aa49e1", "value": "768:Fa3wtkeojMWeqUyYPnek1iBGruCynnkrC9oNibz+CGIN:Fa3wtkZbxQnelGekr5Ns+CGI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681997671, "uuid": "a1ce361b-c227-480b-94a3-d8af9491a0d1", "value": 47700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681997671, "uuid": "e726cf04-4c56-4c3a-a1f1-737ef057550d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681997671, "uuid": "43a5df42-e6a0-4748-901d-8c4fb7ce84b0", "value": "6a58a90c829150fa97a7c0263d40135b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "200e8c22-df47-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681973209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681973209, "uuid": "80744c1e-2918-491f-af51-6fe42e06ae40", "comment": "Malware payload (AgentTesla)", "value": "535341d5717ee41e739d26603e3e4185", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681973209, "uuid": "62b8db64-2a65-4fd9-90fc-634bd96c0725", "comment": "Malware payload (AgentTesla)", "value": "6d576a1dd20b2d226a66ed1c983a977c161dc315ad82b41bc0c4b96e5249cdc5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681973209, "uuid": "18082079-6d96-496c-b84b-dc58befeedd1", "comment": "Malware payload (AgentTesla)", "value": "157605bde97d0b948a7e289dd3fba93dbaed6269", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681973209, "uuid": "6662126e-ee1a-4180-a410-cc3166a0f555", "comment": "Malware payload (AgentTesla)", "value": "cc1478ad65db370c7a76480a5cff38ce91d1fff724ff86f8c25d1c56f9b2e77ad0da92d0d64c558527ebc77677c4431d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681973209, "uuid": "4a949f18-e932-47f5-bc67-d66f7dc8abd4", "value": "T13EA422C0BB7816B3EFAE9F75318695E0BBBA64F94841C72D5C96518E0E113770382B63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681973209, "uuid": "739dc03e-698d-42ff-a5aa-6e7e3eb37196", "value": "6144:1reO1qgJG5xbmA8y+id8mraGgXz1nmrgwDlD2FeplX12GyL+rvyVqMJKca1fSDnF:35JExHz/2Os1uiqURL+rvMKc/Dn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681973209, "uuid": "77becfb5-96bb-412f-8b59-77d86d036b0a", "value": 475040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681973209, "uuid": "fffa21c5-2435-466f-bd51-efe0587ba008", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681973209, "uuid": "143f869c-5399-45d6-84ac-17aef4811d80", "value": "RFQ190423.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "929153b4-df7f-11ed-88f6-42010a9c006e", "comment": "Malware payload (XWorm)", "timestamp": 1681997453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681997453, "uuid": "19e86b36-0bb2-4afb-b5c0-a3f2c3c95cbc", "comment": "Malware payload (XWorm)", "value": "076fd5122925ed14d20711b912f79112", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681997453, "uuid": "e587cf12-40e1-4bd4-a829-2e74f14da37f", "comment": "Malware payload (XWorm)", "value": "6e116713f7dbf7001384a4aa15ba193cf9f9f4e2e6685ead326317a78623a57e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681997453, "uuid": "46be7278-c2c6-4ca8-b3c3-c929c61b0f06", "comment": "Malware payload (XWorm)", "value": "69f0d0a82616fa4cd8a294a90418f94f614f877a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681997453, "uuid": "350a3928-8105-441f-a259-719ef70aa365", "comment": "Malware payload (XWorm)", "value": "92068842f403d4525ddf8c572c97e407a5ad11bfc936b994618a2936e25c511d2f0906139bb5d1b73a481d3815f10f7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681997453, "uuid": "6ad8148e-5671-479b-b52b-917a0a0a2576", "value": "T166638D1837F9452AF0FF6FB51DA57252DA39F3235903D75F2889024A1A23A88CE417F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681997453, "uuid": "22a5e816-01a5-441c-a605-4b8196b77cc1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681997453, "uuid": "5bc2d5ae-c0e8-4640-85f5-922e108b94e5", "value": "1536:i8QQ5i1NvQ4IwNdVrZTE1X/iXxwWZbk+VcYXjDn6Q8OETLwKDNxSr:qQ54IwV10sxZbk+cXOqpcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681997453, "uuid": "a9dc61a1-bdca-423f-b7b6-5b0ae92366c5", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681997453, "uuid": "ffbaea3b-091b-4971-83bf-309d9c53f7c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681997453, "uuid": "9c619a23-13d4-4e29-bf9d-f94834e0ff7d", "value": "SecuriteInfo.com.IL.Trojan.MSILZilla.25346.4610.29794", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bba75346-df75-11ed-88f6-42010a9c006e", "comment": "Malware payload (CryptBot)", "timestamp": 1681993227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681993227, "uuid": "88fab971-f7e3-46d4-b0f1-d3fbbb0700d5", "comment": "Malware payload (CryptBot)", "value": "66c79a76985d9a042eda6535046facec", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681993227, "uuid": "f2835082-5a63-4657-ab4b-ed47bed2a5ad", "comment": "Malware payload (CryptBot)", "value": "6edd78f3fea0c0981a1ec2756046e3b2f872a0e825ace0416f63f267188ed32c", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681993227, "uuid": "f7caae87-d088-43c5-bb99-e1bd682607fe", "comment": "Malware payload (CryptBot)", "value": "38344d1a2caf5b84f2ad83bffb2871c4bc1d6d74", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681993227, "uuid": "064ee55a-7275-4431-8696-bbb5a1b2815d", "comment": "Malware payload (CryptBot)", "value": "f57d27beda5f88520ff0efc29998d8442caf8a8c04c8401a36a31f558ae2ecd0d902425d4ed7ed6c558ec4675000f8c1", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681993227, "uuid": "0bd5430d-13d9-4d04-ac93-1f887c1386b6", "value": "T16D065A38C0378F3BD859627CE495A2811C880F99035B9A752EC9CF16F17EA971E4AF74", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681993227, "uuid": "535334bc-52bb-485c-8972-2709d65622b6", "value": "d57093b1df31c39974f3f351924783cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681993227, "uuid": "8dbd0517-6f7f-4f98-ac7d-75d31779c3a6", "value": "49152:zlf6Ni4b37vgMeDnoadA6n2mdBfQeQKjkAugZF41iv4xEfNAiBxV+VhLPIV2:l6NbrxN69dBPQKjlfva8OhE2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681993227, "uuid": "8f29899f-9ea3-47a0-9258-ab1eb2bdfc78", "value": 3661312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681993227, "uuid": "8aeeddef-a884-44ec-bf52-75775e55867c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681993227, "uuid": "095c3611-51b0-4ba0-9a8a-2d2176d4ee21", "value": "66c79a76985d9a042eda6535046facec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25e30466-df4d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1681975795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681975795, "uuid": "71de78a4-64e8-4702-a3c3-ffd4784c1b2f", "comment": "Malware payload (Guildma)", "value": "58ddaf977e23a1b3305cbaa958f2f8c7", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681975795, "uuid": "f0bd5bed-75eb-42a2-a068-d8eda1cb1139", "comment": "Malware payload (Guildma)", "value": "6ff069df0998db6be5e4e09bfeba878eda2192141d4ed66a67737f4629cce21f", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681975795, "uuid": "c3740d3d-ce94-48f3-a270-6f1fbb2e47c3", "comment": "Malware payload (Guildma)", "value": "9b59e71b9003a5d3335371007253ffbc310043d1", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681975795, "uuid": "c64830c3-aa62-4667-a302-acd4b7b37788", "comment": "Malware payload (Guildma)", "value": "23945bc5d86b18fbc441fea6647ea38a6277888758bc96ce9dc7f8eea37f5080474ed4663760bedd9f15b82005b7de9b", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681975795, "uuid": "ffab993e-d38d-453c-9668-1e765d9e47b8", "value": "T14D1140BA537A1E7ED8B302B6CC389D1C58BEDC730B5EE05DDA373584C5205951F94618", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681975795, "uuid": "58f0ef32-cdf6-4105-af2c-07f03507b4f1", "value": "24:8loGAFdolzj3BTfjdALa8CB40ur5w5zeUoO:8loBFdolzLBTfJcalLoO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681975795, "uuid": "9ab68e2e-7704-41c6-9006-aee1e4ccf890", "value": 993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681975795, "uuid": "79d4df4c-0c05-434c-bc42-7e0982528c0d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681975795, "uuid": "7eb136b6-bf63-4d2b-ab82-5dfae50b5f75", "value": "normaescolapaulofreire.com05839098.637350.88866.lNk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a278fc5-df43-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681971454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681971454, "uuid": "a39b57a1-25b2-4fe4-b1e4-59d1ef1ad5fc", "comment": "Malware payload (AgentTesla)", "value": "24e006f0cce420cc01fc6ade4279ecab", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681971454, "uuid": "623216a9-865c-416c-95ae-67ffc61d6fec", "comment": "Malware payload (AgentTesla)", "value": "70309d9a9a6bcf60631bc111f5cc469e93833816754d5622a629653c18a92035", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681971454, "uuid": "96bcd2dd-ab45-4e1a-8cba-fadcd0589158", "comment": "Malware payload (AgentTesla)", "value": "e0be21024f815bb98dc867146ab9eb57ef31a2d0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681971454, "uuid": "f1133a55-0f1c-4219-bd9b-c7419045be57", "comment": "Malware payload (AgentTesla)", "value": "220d54342dd1b504cddb8a7126b3db2b047eff488dadfc71ed0e3c0355f8e5c5690a93123bce59593a9ab6bb8a5337ea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681971454, "uuid": "e8c0a3bd-5268-4147-bd5a-3ad4d1fbafec", "value": "T178349D9AB382698EC407D575C4DB4C205761A2976333C24B7A4B3B994E0E3ABCF447A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681971454, "uuid": "56093d77-f0d0-47b4-b112-3c5705c4a662", "value": "6144:2v/HQiKxAfyE6CXUvfShEz72bGS/sp2ZVPQyfGbQSUJm/n4:K/wiKMyE6CXUv0WsGgscrQyfGclJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681971454, "uuid": "7b5511b4-d061-405b-ae12-a805df74e6a1", "value": 253000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681971454, "uuid": "a85b6eec-a7fc-4035-8460-d605763a2e9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681971454, "uuid": "f211b6cc-8a93-4018-8146-1336b0a76e1b", "value": "hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22594606-dfb1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682018739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682018739, "uuid": "28e25d03-ca15-4369-847a-c6128fe28e7d", "comment": "Malware payload", "value": "6762bbcbc3e23a6006e8dbe978b8b85d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682018739, "uuid": "d33fe729-d3aa-4c41-be10-99d242f050ed", "comment": "Malware payload", "value": "7042b9a81eaf1ddd3de522f40e80a915e0e44c6843320013daaa8ee2a842a9e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682018739, "uuid": "f33aa999-0832-4230-841e-6777a2e92875", "comment": "Malware payload", "value": "9e60d67c8dc70667d6a04e302fdd9165d55443ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682018739, "uuid": "adb3d717-4c37-44ba-8a93-9fc8fcc7a0a5", "comment": "Malware payload", "value": "c2a4283bedee8b85af4abf24ba363af315b9020d8c302a7663aa9030795fbe3e3c473002ca2634c5e7757b4ef6c4fb87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682018739, "uuid": "7d295df7-4c0b-4ff2-8a7e-a245a0d509de", "value": "T1CC15022892729EE3E6ED0776400439E9DB7096E77873C63C4B8274C6DB9F7492D98087", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682018739, "uuid": "b17d6972-e4a0-4d7a-9b11-2beb317094bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682018739, "uuid": "3b4b4ab0-ea4a-4bbe-8924-c38e842e1e76", "value": "24576:tJqrxgV31OsCcNrd8vK4mMX+kYrj98O4AqUmhZe:tJqtgt1OPYrd8C4vX2jv/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682018739, "uuid": "616065cf-7f3f-47ca-baf4-d24826addd39", "value": 878080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682018739, "uuid": "8b061b86-7422-49a6-aba4-d3b87e3237b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682018739, "uuid": "0fcbd144-35c4-42ec-b56b-bf0975aa178b", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "546c43ce-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681985752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985752, "uuid": "6cef636a-29c4-44ed-be96-b237b4f2c0c4", "comment": "Malware payload (Formbook)", "value": "67e5c96dcfd6408f62d89402910b24e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985752, "uuid": "3df4f8f9-b544-4abe-97e1-fb632c14e085", "comment": "Malware payload (Formbook)", "value": "70eb12fb44e4b07a126e2e899c191fcaa482864709a5123dea76795bd2ee3008", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985752, "uuid": "27c542d2-c13c-4f7c-bd2b-2025a4be9273", "comment": "Malware payload (Formbook)", "value": "8cf0e0e30d7046780b59cfb086c1d3e4a38f1622", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985752, "uuid": "ffa35b9b-7bee-4b16-84cf-f9084465ed1e", "comment": "Malware payload (Formbook)", "value": "92577521f2c30b9fe9b18d600b809fc606ed141ec470762bcb2801d803987cccabf5263df2d6d1dab2db7ee4ef2c2bb5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985752, "uuid": "a06544a4-6859-4244-9b32-787271040a4c", "value": "T14004AE32D641C031E2B212B5F6BD0B7B883E0D347295A5BAA3A516E06FF49D5F16930F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985752, "uuid": "a877dfc1-8e09-4171-904d-224c8e6709c2", "value": "3072:+wJFEh7A2hy+b13/R6r6Kj9uWcBeKIdo0Z56zGDX+SGj2g9v:e7NZ/EeKj9uWdKId7nBX+z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985752, "uuid": "adb9f9b8-8caa-419e-a3cd-c1349b040943", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985752, "uuid": "c4a30f7d-7633-4ac4-bfa3-b7ff7f3bd278", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985752, "uuid": "61c0b593-56fb-4b0d-a3cc-5fba60df4f59", "value": "70eb12fb44e4b07a126e2e899c191fcaa482864709a5123dea76795bd2ee3008", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38788f29-df5c-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681982269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681982269, "uuid": "291d08ae-b4d2-4fe6-854d-6c3faa78a006", "comment": "Malware payload (AgentTesla)", "value": "32cf9ae9928b9f638a3172ededc1a00a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681982269, "uuid": "07f0f04f-265a-416b-be1e-78d46d1ce076", "comment": "Malware payload (AgentTesla)", "value": "7197cfed2cff1f8c3191d46ca165b089cd7d1d46ec91d5536a70da23b361c03d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681982269, "uuid": "055df014-873b-49ec-a10d-3f4ea0a28783", "comment": "Malware payload (AgentTesla)", "value": "94321e3183d9c031d8e93e47eb58d8d65ede3a13", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681982269, "uuid": "dc8879c6-93f2-4473-9357-8b73d8fe794f", "comment": "Malware payload (AgentTesla)", "value": "62991b38a77810f8bcca7109c0eb4c77826decb626dc192c62173d640843c4737eb46a28a4627c646b5f02c290879cf2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681982269, "uuid": "5ddceffc-6025-49cd-bbed-a1d9479597a5", "value": "T103E47B2D2D5F4222E178E7B587E18024F2ED8553375BBE6B58D622C04B12A83FCCD66D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681982269, "uuid": "7acf6ec6-464a-4cf2-b5f9-5ad658fd3e7f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681982269, "uuid": "9c7f7306-f0af-4abc-ba1d-2ed901d61c87", "value": "12288:tkYmaI0pW48+hNknKT7GJejOtysczjLdhys//HzrgML3OEfKvajdC8Qi4fliadEX:tvmp617GJrYvXLdhys3TrgMrOEff5C8J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681982269, "uuid": "95cac313-b350-4b34-a616-0712a83e5296", "value": 666112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681982269, "uuid": "d7b6b6fb-3718-4060-886e-b12c1a295d00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681982269, "uuid": "dc7a8f09-0721-49f6-8420-b778deb508bb", "value": "Payment slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feed61ce-df4f-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1681977019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681977019, "uuid": "e8427b8a-64e7-4d1a-a80c-cc9ddeff4c84", "comment": "Malware payload (NanoCore)", "value": "3098c5c62761b9de91830615768a3d77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681977019, "uuid": "4e6043be-a5f4-4ba2-b6b4-b0b1035bb5ce", "comment": "Malware payload (NanoCore)", "value": "72b951386354b88643384922d28d653f8a1b6c43e5bd9211316c94dcae9b87e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681977019, "uuid": "6ee6200b-3370-4ae7-ac78-51b2d9d1c80f", "comment": "Malware payload (NanoCore)", "value": "db11259176249176e63f44478ee9d9f55eb5a6ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681977019, "uuid": "dcf64744-cb26-4f6c-8eb5-8e333695f608", "comment": "Malware payload (NanoCore)", "value": "92c2d816b42bb03f0bb48ed821de0538f9a1a524268558b2d7cb7879df83d57b8897ff53fedccd85ccfe2fd0a1114974", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681977019, "uuid": "6e0a0eb3-00e8-4cac-96b0-e3fd89b02c79", "value": "T1E2A386D3B212C9D6FA3843759D23C88915A7FDAEB8A4256DB096F7740A7B3C30412937", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681977019, "uuid": "44b9de6f-e7bf-41b7-9f73-8c4ead253c64", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681977019, "uuid": "fcb73c4a-a7d8-47b0-aabf-8bc5a1cb6b82", "value": "768:WS6SRmSTY94dWN2P7b1IzPrXMkN336DX2:WRSDY94du2PmfMkN3KDG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681977019, "uuid": "9077135d-506f-4456-baea-e6960cdf2d6c", "value": 103936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681977019, "uuid": "76b038a7-8e14-460a-bbfe-7a6028e5989a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681977019, "uuid": "618057f0-359c-475a-9fd5-130a40d31b63", "value": "SUPPLY CONTRACT ENQUIRY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2efc3d80-dfcc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682030357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682030357, "uuid": "805999ce-2fe8-4e1b-87cf-783776901cb0", "comment": "Malware payload", "value": "1105c76f32ff9ccadadfaf3160d474bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682030357, "uuid": "9c41a7da-818d-4707-8af3-c12ae8af4293", "comment": "Malware payload", "value": "7390a2d1ef6016bcd21ece157cfd4ba0efd772ad2cd23b1dbab45491c0b719b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682030357, "uuid": "10980e77-ff07-47df-beb9-aae9ae83c22a", "comment": "Malware payload", "value": "d9d1a9922d62788f29af2992669bb6249e658588", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682030357, "uuid": "7ddf0369-ade2-4fa7-bb0d-e9f845e20670", "comment": "Malware payload", "value": "22ac2cdc593ad521ddf44f9923c8687a0497918aa5881e1a988019f63c203229be8b8a88092d66c5655d012d6180c4e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682030357, "uuid": "20b19806-d039-4107-a8a5-32c2c8199895", "value": "T13474AF133294E0FED015E0B88DE48468B61C50F63BAFA9D77BC61E7D47292E5B3A4217", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682030357, "uuid": "3d9c4844-fac1-4559-8351-4a8c65808274", "value": "7ab88a2560b399bb2f4b089a0ec1f31a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682030357, "uuid": "f504e95f-0425-4a32-a355-fdd8115d0220", "value": "6144:z67xBKhG2+NfJZemEKCPcuyflTX8deh8I5jAriUze:z6tIhGlNnemZCZolT+I5Urh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682030357, "uuid": "4de6f2fb-ce0d-4d73-b347-f8b22b30b9b8", "value": 352416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682030357, "uuid": "67315927-b6db-4fc5-98ad-2ed629352b5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682030357, "uuid": "8a508fc7-059c-4a23-9d19-ade47611a3a2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d0d159a-dfd4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682033897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682033897, "uuid": "e1af79ed-3b6f-47ee-9456-2852f59b3959", "comment": "Malware payload", "value": "bbfdea754865cab6327eb17b38467d62", "object_relation": "md5", "Tag": [ { "name": "1681985211", "colour": "#1A34F8", "exportable": true, "hide_tag": false }, { "name": "BB24", "colour": "#CEE0BE", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682033897, "uuid": "2d137034-59c7-4673-865d-ef1d401f9c38", "comment": "Malware payload", "value": "743b05fcae982c813a78a049b5b1cbd8861f8113f34813e8e462c4a44a164c52", "object_relation": "sha256", "Tag": [ { "name": "1681985211", "colour": "#1A34F8", "exportable": true, "hide_tag": false }, { "name": "BB24", "colour": "#CEE0BE", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682033897, "uuid": "1b5b3eb9-2567-4a66-aa7a-25e54c2f8733", "comment": "Malware payload", "value": "bcedaf850b86e0a8ebffed08208ddb2a4c4c7c97", "object_relation": "sha1", "Tag": [ { "name": "1681985211", "colour": "#1A34F8", "exportable": true, "hide_tag": false }, { "name": "BB24", "colour": "#CEE0BE", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682033897, "uuid": "38c2438f-79f1-4d56-8a8e-d6db6e137073", "comment": "Malware payload", "value": "16bb818c8baece301eaa98a10b6e6b9d38ed78b11f83ffeac58b0a08eedde7143a7d69c57a1371c18f977524e1e4daf1", "object_relation": "sha3-384", "Tag": [ { "name": "1681985211", "colour": "#1A34F8", "exportable": true, "hide_tag": false }, { "name": "BB24", "colour": "#CEE0BE", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682033897, "uuid": "f43575e7-b2a3-4016-b503-a2c343e8975f", "value": "T10043BF1E1819C06F82316407FE419B0D15E839F1A9FD73E831640D9167A7DE6EE1ECAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682033897, "uuid": "a95f0031-df91-4cf1-82f6-2f487a83a52a", "value": "768:6owmuEynJP5vNPMyLT9xR67cKheTPiPBXjkNvTAJGwmwelq8WoqB2JB1Hjs4hdIE:SrJh1RxslejMwFTAQ3hJ62hs+dI7Xyqc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682033897, "uuid": "5d7c6db1-5ca0-41f7-9ffe-3badb373f01e", "value": 59778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682033897, "uuid": "52eac994-0b21-47b4-ade6-3cd23a9c6f93", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682033897, "uuid": "10daac22-5b3c-4645-a0bf-8790d14cceda", "value": "Magni.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "239e171a-dfb0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682018312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682018312, "uuid": "26d9ac47-8ee6-444f-ba69-571b734a0aa4", "comment": "Malware payload", "value": "9649dc391b1afbf9761428929498338d", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "mc1904", "colour": "#71A344", "exportable": true, "hide_tag": false }, { "name": "pw - 1310", "colour": "#8C5961", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682018312, "uuid": "6dfd9654-767a-485c-8c03-99101fcddad5", "comment": "Malware payload", "value": "781a2dadce2d9bfa4478b39551373bc903a3cbee601ec88ffc090974422d966e", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "mc1904", "colour": "#71A344", "exportable": true, "hide_tag": false }, { "name": "pw - 1310", "colour": "#8C5961", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682018312, "uuid": "5aa27dbf-d560-47d1-82de-d8791b0f8a8d", "comment": "Malware payload", "value": "92e025389d0a479c15119a9e7009494f6f27328a", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "mc1904", "colour": "#71A344", "exportable": true, "hide_tag": false }, { "name": "pw - 1310", "colour": "#8C5961", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682018312, "uuid": "8eab7902-57a3-49d3-a09d-3edeef931db8", "comment": "Malware payload", "value": "24aaabb6a5bfc02537f726d535445ce65fe14f420b66e3c80003c4aa3ab31f06c2a73f4d7a75cecd78fc01a71703d267", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "mc1904", "colour": "#71A344", "exportable": true, "hide_tag": false }, { "name": "pw - 1310", "colour": "#8C5961", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682018312, "uuid": "b497cb68-99f2-4e47-b3f2-749682f452a0", "value": "T17E8312DDEC530523C06DAFB4CDAC4068BA64B381FB89267DCD74C31958885B659CF9A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682018312, "uuid": "2475885c-7057-407b-ba6c-c205021489a3", "value": "1536:UV4nx6s0q9hyFJ+QTeaaEbNQFvpdU3omjM7OjsCd+RCb7G5EboBL98:k4x6sr9MFzTeubNsdqiOoCMMNU98", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682018312, "uuid": "bb2b2607-1231-42eb-be1a-84e5f57fef2d", "value": 85411, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682018312, "uuid": "f55d7b8a-bb6c-42cd-91b5-efc7892aa8c0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682018312, "uuid": "5d5a867c-faaa-46e7-b6e9-6eb9f029fa7d", "value": "doc_12QICZ_85.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "552fa175-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681985753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985753, "uuid": "42b2e866-65d9-4545-91c8-b3fc82fda47d", "comment": "Malware payload", "value": "d206daa7d7e15810ba0bed9c9d116b2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985753, "uuid": "e7abfbce-13f6-4954-9299-81f730c8bed9", "comment": "Malware payload", "value": "78d9519c1e94790ab218c38b7447bdac5bd2ac2f792dba6d9b2e3e56180c943c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985753, "uuid": "a152c1bf-5b2d-436a-b0e6-97bf1448fd2b", "comment": "Malware payload", "value": "10e882a5cc0d9519cf2a0b55a53f91853c61e1f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985753, "uuid": "fe9fc157-16a4-4633-b51d-e6d797e8d50d", "comment": "Malware payload", "value": "f23c9c9e8a00361434f3068dbedd92faa257cb68af8335a25a71d1f96d1a7a323eb85f179aaaea767ac8430b707f0fe8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985753, "uuid": "ee639417-030b-42d3-b32d-07195331135c", "value": "T18D83CFB1F388A402E87C41715437AA369BA7FC259E6D0317309DB46B2E733C75862D9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985753, "uuid": "4db1b680-41b6-49b9-9a81-46bee2bb2865", "value": "1536:lBIPfSbS9vMBN7rQOJ7CFToTCzhcRguhwxTyPCb3lZpdym4dy7p:lyXlvq7jSP1cR2prbpdCY9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985753, "uuid": "cae83375-ff71-49b4-99e6-95eb038d7259", "value": 85504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985753, "uuid": "d17f41c8-d289-4bba-a54d-b6f78b62429a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985753, "uuid": "b08f7c46-e66d-4ca3-9869-e56aee582f1c", "value": "78d9519c1e94790ab218c38b7447bdac5bd2ac2f792dba6d9b2e3e56180c943c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6162c2ec-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681985774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985774, "uuid": "f351f59a-f64b-4aac-8462-7ee9ccdc4231", "comment": "Malware payload", "value": "7c7c62669858768f840d303d55d031bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985774, "uuid": "b4c5fb9b-bed4-4f9c-b2d9-9de24b0b02ba", "comment": "Malware payload", "value": "7a165139da49e77acce0dbc343963c4a5b6a74cc652ea0ccd476a97ff276d30d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985774, "uuid": "835f27cc-e2a5-4b4d-8c03-6006390f7606", "comment": "Malware payload", "value": "2389644164775c5e0fb8804af5b0a548e3c7e6f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985774, "uuid": "4fc095ea-f8e1-4bfa-b18d-764ab8ca1003", "comment": "Malware payload", "value": "1f640447388b3576ec045d6b3b3b657f40d0db122689fe704df05422b4841828f098241ed4d4131e75f2319b02448dc0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985774, "uuid": "d855559a-a113-42cb-b487-d31920c3d9e1", "value": "T141D3F404253A73D9D01A6336C6E59B1415A0D97FBF9EE30A0BA3F225153F3CAC66C98D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985774, "uuid": "14c7d2c3-72ba-4602-aff6-fd484015b55b", "value": "a808411a04557309a9c41f351b379c88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985774, "uuid": "026ce97a-2eb0-4c04-a43c-ba110ddd4e04", "value": "3072:p2Gjbcos3tQyFhFunRtglrTJsyiT7IEreszI6x9:p/bcos3KyjUnRWTJsyE7Yszn9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985774, "uuid": "c1091ec2-afc6-48c6-9c87-86aaab5819c1", "value": 133632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985774, "uuid": "5f733ebf-0380-419b-ac3a-8e6d1ed31c0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985774, "uuid": "f7da405e-08c9-4a71-9ae2-f4a8ee2352c7", "value": "altamirasantader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c027068d-df6f-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681990657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681990657, "uuid": "468177bc-4b04-4e36-a7e4-85c4702fc7b4", "comment": "Malware payload (AgentTesla)", "value": "e6af4c7ddba25631037f1b428c764005", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681990657, "uuid": "f444d37e-162f-4c29-8328-83d17cdb72e8", "comment": "Malware payload (AgentTesla)", "value": "7a7d8c676ab65f44621626f1bf02e4f149f12746e865d41b85ef482351dad41e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681990657, "uuid": "5154fb12-3907-430c-ae68-65eea9c40915", "comment": "Malware payload (AgentTesla)", "value": "090ee864b86215b2eec2b720028b9ca408ce6619", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681990657, "uuid": "54243576-2fb9-41c3-b170-4ee106e116df", "comment": "Malware payload (AgentTesla)", "value": "52861868653c9ec82726383363bb3cb29afc27f031b6b006f10a9d6278eccaf84763d943000df300bd5809d7db7f988b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681990657, "uuid": "37bebb61-58cb-4b2c-a798-1bc95fe76254", "value": "T13DD48B7E799F81A6E139C6B3DF9BF420F37D852B701D792924D7190046CA94BB0C86AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681990657, "uuid": "0892216f-e8f3-4e96-ba13-8e5b8966b726", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681990657, "uuid": "7d8f3ad7-275d-4777-8d4d-9b46f0402a5b", "value": "12288:zssxolENV0cik7Wg7QroZ9ZY7XPyUl4TUmrrwI2O7:zFb7ckZCfdmZrf7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681990657, "uuid": "f085d14e-9b9f-4e8b-8f84-308ee3e89502", "value": 619008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681990657, "uuid": "eb167dfa-bdb4-4e6b-b3a1-716f7f080374", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681990657, "uuid": "dab6cc80-fe0e-45fb-940b-92a00c004239", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "707bdb03-df46-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1681972914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681972914, "uuid": "9ad18a3b-b919-4735-9498-b6de6a856526", "comment": "Malware payload (Loki)", "value": "431bf5c920d4067b412b412cad4960f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681972914, "uuid": "310d8557-69ef-44bb-8db4-439d3132b99a", "comment": "Malware payload (Loki)", "value": "7a8d290bf6d1b3569c07e682b03577896711f694c165b227bcf9e4510060a993", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681972914, "uuid": "65fdc4a1-4ca5-42ae-8e0e-9e43e0079fae", "comment": "Malware payload (Loki)", "value": "d8eb59e81bf2761746ea4aa6b019b400c613ae25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681972914, "uuid": "cea5042d-f666-418c-9721-53f4d671b79f", "comment": "Malware payload (Loki)", "value": "d0a5580c386c36eaa1ad98ccd71a1f9ff7b0f50f77db98697d90a22e957afb7f38a72935d22ce884a515a8c377330be3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681972914, "uuid": "790f870d-37ab-4fdc-b1d6-78b0e5f652dc", "value": "T1A7E4D1D5B726D752C2683D3D52EA60282B7089CBF916C566FDC811993E33BC91F8078B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681972914, "uuid": "3ad0b0e3-9023-4b3d-ae92-a50552340f5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681972914, "uuid": "db19a433-ed6c-4488-a527-c8ee312c17df", "value": "12288:BywImHMH91DzZ34TLEGFVWn4SFCVFhDgQh4jgj/ak9x:ByAHMd1Dt34EcSFCG24wakX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681972914, "uuid": "0d031ef3-a036-4f6b-92f1-0362bf37900e", "value": 668672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681972914, "uuid": "be94f823-b4e6-4213-9275-f6677c6d7066", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681972914, "uuid": "34df4bfa-a057-40fc-b427-d241ce58a533", "value": "DHL Express Receipt_AWB8114704847178.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a4723d6-dfcf-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682031718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682031718, "uuid": "579d1e1d-c3c7-4474-84d1-e04fb33831ed", "comment": "Malware payload", "value": "2f9e75406ad073eed271b767a05d2620", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682031718, "uuid": "a74c888d-b677-4f02-b1ae-26137e9d7b49", "comment": "Malware payload", "value": "7b804c178099c2e30b2cdd7016336fc98fde3ece959c97df92d8328dbc4a848a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682031718, "uuid": "62a4d68e-23a6-4db2-8659-e505b61cfc97", "comment": "Malware payload", "value": "8dc0639005f31039e2cb7ea193f351a95767e5e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682031718, "uuid": "2d177a88-a258-4af3-a7e3-6ab082d2e50e", "comment": "Malware payload", "value": "d9eeccb36d7ba130d00a45b191558e49263bc33d85d6803800b7deafeabffdac8dae777c66f75d34d28ccef6740a17a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682031718, "uuid": "ab0b93b5-82a5-4f8f-80d7-2881b72822bf", "value": "T1EA151243B9D6C4F2D56219325A19A765647CBE301F248FAFB3D82E2CD9340D1B231AB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682031718, "uuid": "e76ad58d-1cd6-4625-9ab6-9de95099efd5", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682031718, "uuid": "16289714-29ed-4577-80f8-045e9677defa", "value": "24576:0NA3R5drX/WiqpOID15sXUX4MaeYh3i+Sc:V5OFVDjuXlt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682031718, "uuid": "2761fff4-3445-474a-8ae2-68469ff30c3f", "value": 890370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682031718, "uuid": "828e42ce-adbd-4325-9bd0-6b53dc586000", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682031718, "uuid": "52f9e15f-46ca-4fec-8b85-9e8203514f63", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55f48d3b-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681985755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985755, "uuid": "fe7d8ff8-a39d-4b84-8dc4-c3ea9a051b7d", "comment": "Malware payload (Formbook)", "value": "419ddb97dedce3d23268946a35ce6a82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985755, "uuid": "0878915a-85b7-4848-939b-b494115e4cc3", "comment": "Malware payload (Formbook)", "value": "7c296f01d5bb0546228e7ad3979ab27045517175658c2fb945b23ab09c7174d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985755, "uuid": "148c588a-5060-47aa-bf91-13d670bf209b", "comment": "Malware payload (Formbook)", "value": "831d85d712ded1494dcbfe878b98d444a8fe826b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985755, "uuid": "6b4d51b8-53da-41b7-afcf-82497b840efe", "comment": "Malware payload (Formbook)", "value": "4ac88e9373a48e2d1e6ead7ec682099071f1419d848014de0336c63363e20fd2aa0b2e2f2623d7a9b4ae95b8e7cc380d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985755, "uuid": "b930c4c6-38c3-4f35-aaa1-8ebc13c46c18", "value": "T13204AF36D641C030E2A352B9B26D177B843D0E342368A1ABE3E51AE56EF05E5B17D31F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985755, "uuid": "ebf150d9-5509-485b-913e-c9f0502285c0", "value": "3072:HT1ChlucTVwYrZFgQagtl5ak0x8Bxwsli7G+s4l1in6jFXFhHqxzT:HkqWVw6Z2YLD0ixI7G+xjin6jhFhHqxH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985755, "uuid": "acf31960-70ad-49d9-97e9-093738cb48b0", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985755, "uuid": "8b2e2f57-7484-4386-9fa3-6149870bd3e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985755, "uuid": "112b7839-a250-4f2d-ae72-8fa66dbc5f86", "value": "7c296f01d5bb0546228e7ad3979ab27045517175658c2fb945b23ab09c7174d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56b6f033-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681985756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985756, "uuid": "aadcef09-e5c1-49b6-8d6d-203ff8f18c05", "comment": "Malware payload (Formbook)", "value": "f6539d7ca43dbfbb04697341fa20898f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985756, "uuid": "1c6dd274-2ced-46f7-86d6-804a53e7ebc1", "comment": "Malware payload (Formbook)", "value": "7c48a124d89ed4d182eb597d7fbae9e28a5862eadfffaa6aaafa560b8031bd87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985756, "uuid": "3a290f69-50c4-46e8-b69b-493dc5e2f8fe", "comment": "Malware payload (Formbook)", "value": "d4c7de1648560c421402525d663bbcd042df7da7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985756, "uuid": "12e32a2a-a5bd-4789-8703-69ab4050c44a", "comment": "Malware payload (Formbook)", "value": "6f3e49f4e60618d1d69aadce6ee233968c0778228c420970373333b4e44d8a10d5838a22c29e85b14ef0d240b62dea36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985756, "uuid": "f9857901-4022-4041-8185-faf81b7cb526", "value": "T1C404AE36D602C035E2B251B4F6BD1B7B883E0E347294A4E9A3E516E05EE09E5F17931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985756, "uuid": "e5d47d5b-d078-4cbc-83c4-b26e0a2f96a2", "value": "3072:mI6AykP9vB8U23ArxkkZbxsrv4PBlr+1ZdZPZ0+D:dbgAdkWbxsrv4PBlr+1Zvn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985756, "uuid": "a7e3f2ce-add1-4ff7-80a1-c64b9a344b30", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985756, "uuid": "256f4646-6e60-4cca-a2ca-820bedd09e94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985756, "uuid": "857e7e7c-623b-4eae-ab4b-6bc46f0e0a6c", "value": "7c48a124d89ed4d182eb597d7fbae9e28a5862eadfffaa6aaafa560b8031bd87", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "577d124e-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681985757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985757, "uuid": "cd28121b-cc29-45e4-abd9-75bd48c7bd65", "comment": "Malware payload (Formbook)", "value": "d74904ff4bf13e6ff9432eeb924bacad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985757, "uuid": "fe05f5dd-b81c-426f-9081-0c7f5ed53c68", "comment": "Malware payload (Formbook)", "value": "7d0802716538acdbba606f1691225b66910af4603aaa096f3a84776c1e5b40d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985757, "uuid": "01780819-21b3-4ffc-90a4-96e9ea022c1c", "comment": "Malware payload (Formbook)", "value": "20c4c52a00bdea0172e12c1fc87b551ddc7c9f72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985757, "uuid": "1cc59e76-5bc6-46ae-bc43-0b7fee3aac69", "comment": "Malware payload (Formbook)", "value": "399ee985f500c5453100b2121a23cc2b4a5ddba25b47642e5996e5644c4b3239379baff318e8989909dfa0029d7902ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985757, "uuid": "ce8bda74-9e6f-4924-8eab-b81b71023778", "value": "T1DF04AE32E602C035F2B211B5F6BD0B7B493D0E353694A0EAA3E516E16EA0595F13E31F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985757, "uuid": "009fd1ea-b1e9-4f60-9591-7065251c1086", "value": "3072:zgYsck42QU6Ob58c3cK7WY1YLsiL8XO9XCSCpPtrJR+OCqJ9H7S:7g8ScQPWLsiL8+tCLp52OL9H7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985757, "uuid": "1afc573f-76d1-4fc5-a51f-4d7fba456bb5", "value": 186368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985757, "uuid": "16f08bfe-92dc-4849-b697-888bec91f284", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985757, "uuid": "edcfabba-a7d1-45eb-bd1b-492705008fec", "value": "7d0802716538acdbba606f1691225b66910af4603aaa096f3a84776c1e5b40d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b8e99ca-df86-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1682000286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682000286, "uuid": "f7c013e6-167a-41d0-bdcc-9cd2df6c8836", "comment": "Malware payload (Mirai)", "value": "9ab9ab627ca48689cfc8a29cd5849318", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682000286, "uuid": "8582044a-21f8-42ac-b006-b2e27cfc53fb", "comment": "Malware payload (Mirai)", "value": "7d70d71d306368c8016ca4e5501b7195f9d4d8e96bd8c4674dde784491b22ed9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682000286, "uuid": "4b5e6012-7495-46f0-be2e-047a71f73793", "comment": "Malware payload (Mirai)", "value": "134547606c0f141db0d3a97e53f70b4dd278ff6a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682000286, "uuid": "51f5313b-9812-4451-b6a8-16be30b1788e", "comment": "Malware payload (Mirai)", "value": "c338f993b9f541724ba3173e0115f91f7c0b36d2554ba464884c7ae7c26e34825266368ca3ec84330b306b0a49fa23b1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682000286, "uuid": "cb98a084-251a-4cd5-a91e-47eda07992a6", "value": "T113732ADAB800DEBCF40ADAB68557490BF531A3518E930F36662BFD837D720A44D27D86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682000286, "uuid": "0702aafa-4e4b-4e6a-8120-9abad5fdcdcd", "value": "1536:awW0PKt9cwxjQ/8IXIdZzN3eD8Utia84GLf84Eo5WOK+7c4R6yN:awsgudZzNSFtijjESWBryN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682000286, "uuid": "0c790845-6a73-492b-a6b5-1cc0bb180620", "value": 73524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682000286, "uuid": "7bd844dc-5860-4615-946c-c676d840d712", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682000286, "uuid": "db8b4608-c12e-4c18-8049-9a2c3e47e3c8", "value": "9ab9ab627ca48689cfc8a29cd5849318", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d22f8913-dfcd-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682031060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682031060, "uuid": "0ae213e4-068f-450b-995a-49bad4960c4f", "comment": "Malware payload", "value": "aa9945f12eff29d8efb240233948e471", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682031060, "uuid": "b970dbec-2fa5-4969-b24d-8ee38c9ab7f4", "comment": "Malware payload", "value": "7e3779036c59dd757943e9f62f1b964e2d877086479c05630db0a71c4bf948fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682031060, "uuid": "393f04d2-3c7e-4fe9-a142-620bd60d8174", "comment": "Malware payload", "value": "af34edf62200698c5961122411cfe6c8d5b4e059", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682031060, "uuid": "e5b356aa-d41c-476f-9877-2342b31b5117", "comment": "Malware payload", "value": "733d85f8622ff27d6bb72695d199590a0698f2e1109d86fff264e4e069cf941edb09c312ee39cb32c80162e7e06d7297", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682031060, "uuid": "b3768b86-b559-49e3-8153-653a9db984cb", "value": "T19C648E12319490BDD026F0B89EF894A8771C24F53BAFE5C7BBC50A7D47296E1B3A4217", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682031060, "uuid": "ded03ff6-b82e-46cd-8894-d3dd22233d4e", "value": "4e54daa91eb371c1340f2a6338663dd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682031060, "uuid": "492c62ca-581f-4c2b-859c-8689be800267", "value": "6144:6TQVtox8CTuq36TrXcjBFME8iNUzuJyGjS7lBKaXB04G:6TQVyx8CaTwjBqEhOzHGSBvB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682031060, "uuid": "debf8fd7-b53b-4582-bfd8-ff2fefb3b3ef", "value": 321184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682031060, "uuid": "f158a25b-f5d7-488b-9c5e-5f1f0423b87f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682031060, "uuid": "6e59c15e-a54e-4474-b847-e61068647bf4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c2c3531-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681985792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985792, "uuid": "4dc88870-2c0a-48c0-936c-879ddf69a182", "comment": "Malware payload", "value": "6d67e084ff8dcc790bd9f72fc33eb4bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985792, "uuid": "3b1c360e-7f74-4a85-97ca-16c426ad27bb", "comment": "Malware payload", "value": "7ee13b7091683d852251826bc3e7d5880fa877da4e855bad6bd726df963d8ea1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985792, "uuid": "5405c98a-0c8a-4bbb-b278-e79163ba1d39", "comment": "Malware payload", "value": "510100babb4f3858b3b5cc652ba88ecc1d37e2da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985792, "uuid": "3e7d638c-e610-4a50-b857-2ef86dcf40c1", "comment": "Malware payload", "value": "cbdc45cf9d9b190799d527394ce0c33c56350caed0b97f9bfc2ea14f5a7760a1d6f068090c9d5c4e43f31f1af52e5f4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985792, "uuid": "3592fa66-1702-4519-9df9-fb91fb96f6ca", "value": "T1DD042955A9AF6C65EE4CF8FF7F9B73F191367643870ABB53882172318D08A68244131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985792, "uuid": "dffc30be-6147-4d35-8d8a-01678206d0d9", "value": "a808411a04557309a9c41f351b379c88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985792, "uuid": "5501fd8c-456f-45b1-a42f-604d994a94c1", "value": "3072:EwLuSL7NMtteKUsMdLFMwMaOyGufLIAwsqTKN35mY:bp+U3AatGujZwsqTKNAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985792, "uuid": "33c77c17-7a54-448b-a266-368203c57110", "value": 184615, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985792, "uuid": "fb866124-3e6a-450d-ada5-bb20890cb003", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985792, "uuid": "1c5eeac9-618c-4f5c-bfef-404517619b26", "value": "edrling.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d2bcbd8-df7f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681997470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681997470, "uuid": "47a15108-6dcf-4fb1-bb45-df2f35270981", "comment": "Malware payload (Mirai)", "value": "1959372829f352dc37d7913f3d4e03fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681997470, "uuid": "4aae6ee1-12f3-41df-8039-e437e5df760b", "comment": "Malware payload (Mirai)", "value": "7f5b495564b4d4cce05d405e07b4f2709ab060e9fa16ce9f1269988fe97cab41", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681997470, "uuid": "545d8212-7216-4116-9042-6d5679b82e77", "comment": "Malware payload (Mirai)", "value": "6e25bd268adb30d0bae2428b6b4e2d1caa416f5d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681997470, "uuid": "633ede04-064d-4912-89a5-51caf6383dd1", "comment": "Malware payload (Mirai)", "value": "ef67f8125a0dfbd01589442d77647784706919f271c699f137ee3bd90f9dd4d66fb1c72fe2bb029d3baf4e6f27f7eba7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681997470, "uuid": "bcf5049e-b5dd-4aec-88fb-da3eb43343fb", "value": "T177536DC9E5C3E5F5EC110A71313BEF3286B7E67D2069DFA7D3986432AA11602D11639C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681997470, "uuid": "dfa6b646-be9e-40b1-8c72-1580a5060ce1", "value": "1536:Z7qARubgzY/bEJyYRcpb80LDHhklv4JQC9DSW:NP+eY/bEJKpXBk9AP9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681997470, "uuid": "97893f1b-95d5-4f06-9397-5abedc33266b", "value": 62864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681997470, "uuid": "81c2a9b9-60e3-4352-8a6f-59278de5a342", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681997470, "uuid": "a84e3f87-edea-48b7-952d-2dec9a1b3385", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83fdc157-df7a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681995281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681995281, "uuid": "30723321-5521-4f26-be0b-fde46ff5fd3e", "comment": "Malware payload (Formbook)", "value": "22b365e10dd635468212251994b194bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681995281, "uuid": "0de11f10-6841-4c90-a833-7bf2014d145e", "comment": "Malware payload (Formbook)", "value": "7f9b8fcc527d02e66b49d76ff52297d69dbf237a8dd4342fdf3f49a2189c67d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681995281, "uuid": "308c4b33-7f72-4a23-a397-3aa73d8abac9", "comment": "Malware payload (Formbook)", "value": "069d6d2395ec518d0156b6d02519d3b8e896e5b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681995281, "uuid": "f8578077-a606-4c54-b1b0-6191c1dcc6a5", "comment": "Malware payload (Formbook)", "value": "234a8e396880d88bcb9a46d3edf1a5700a32667ae52b97de1801efe522dc68efdadb52d822e07809d44fc6142605753e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681995281, "uuid": "c371bd99-4c58-46ce-b423-ccdf647bc925", "value": "T131B5AF370EB2FEE2E7A44A7FED4235941DACDDF74B1DB206388C30A90DB865499059E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681995281, "uuid": "46c13fb3-7055-43ff-a322-f2947661d8f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681995281, "uuid": "705fd7db-7273-49d5-ad27-8c58a18899ca", "value": "24576:iB26eZ4fTPkhZ2PAG0pMn6+YZ8IOxSD68Q81Zr6kNefAd/YK2HzQX9Kub+YSgrBK:Zhhj+EbjDE81R6iY7O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681995281, "uuid": "323cc6f4-59dc-49cb-ae04-953d99b51924", "value": 2341888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681995281, "uuid": "54492621-9f2d-4f72-bfac-785acfd2b280", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681995281, "uuid": "7443b5d0-50ba-4aa8-823a-11ae1726227f", "value": "FEDEX TRN 771893954554.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "896d95e1-df71-11ed-88f6-42010a9c006e", "comment": "Malware payload (XWorm)", "timestamp": 1681991424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681991424, "uuid": "9f590154-3677-4975-8f8d-0fa373316888", "comment": "Malware payload (XWorm)", "value": "edb79859cc0e91143bc1ccdd33f07710", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681991424, "uuid": "92b4858b-2328-4138-ae7b-bfe5f21e1436", "comment": "Malware payload (XWorm)", "value": "805e0ca3893a53aa5086b2f0ea2ab4f49a6d60efc575836e93c8f70035740d1b", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681991424, "uuid": "746dc1e1-0c53-4054-9581-b7f2158aeebe", "comment": "Malware payload (XWorm)", "value": "798c10e23943769af45f568599d9a2ffcc11dc63", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681991424, "uuid": "2e1ab20a-bb2d-4afd-8c5f-f70b43ad2b25", "comment": "Malware payload (XWorm)", "value": "dcb2e59c6451a9d19aeb0c5015a3e320d78dff35054b00ffb868b7ac3a3de4e4b45ea7ce4bb7236403b25ae0865f7aee", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681991424, "uuid": "bd19ee58-56d7-4fc2-8c52-146186ead7f8", "value": "T11C65382439FA502AF173EFB65BE475AADA2FB6733B03645D2051034A4723A41DEC163E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681991424, "uuid": "4673c365-b9b6-48bb-af19-366c5b6cae59", "value": "12288:RWmaQfFJeDYFPQC1nOw6/iZyubeDmFiFVVfHVpNtrjb+Vf7SJo7lfELkNCCtPzMI:GTCfJnGbDwKNd8H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681991424, "uuid": "adfa44b1-8563-4d2a-8661-576c5fa63f3a", "value": 1441792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681991424, "uuid": "01e372c6-ad66-4324-b234-1daede794f58", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681991424, "uuid": "e418cb0d-b26f-4dc8-b198-befb5ebd414d", "value": "IMG-203110112.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "408fbffb-dfc9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682029098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682029098, "uuid": "5c77d32e-4266-488a-8298-fead869a1a3b", "comment": "Malware payload", "value": "c22c553359d46c266729940bd8dea561", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682029098, "uuid": "936abe8b-78ec-4d9f-a866-c974092c1008", "comment": "Malware payload", "value": "82525b7fb07353504ed00b007c5d2e277be9dac0c9de3844427d7ef2ece4d802", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682029098, "uuid": "e5d15519-a88c-4259-8df8-2ca5c728e433", "comment": "Malware payload", "value": "59ca296983c03a45a821d6dbc40177220fb1311a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682029098, "uuid": "751c86d8-3352-43bf-99b1-f38a2d877ca1", "comment": "Malware payload", "value": "2013fec9e167b2bbc3a7c34179c139008ff2c6d8f71bdcda37f94deb04e808096901c98235640aa6448a3a3be5feeb33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682029098, "uuid": "9abff14a-0932-463d-8bf2-4fdb9cc1efbe", "value": "T13A552327F6D464B6CEF517B115FE13634A3B3D909AA0879B538678CE0CB26C4B835362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682029098, "uuid": "652a5f3e-143b-490e-ba02-fb020efb9271", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682029098, "uuid": "e838f645-9a4f-4529-9f3e-590683d69882", "value": "24576:qyxwMhwi7afK8WuctMiKtKHEjvhFSXqzs1UCB+63f0cuEIYhokIl4:xiMhwfMCFpg6zs1UCVPluErokU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682029098, "uuid": "c990c8a4-cdbe-4dbc-adcf-46d0ca75eb96", "value": 1285632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682029098, "uuid": "50b14622-e2a1-4816-9e0b-a71bec216a5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682029098, "uuid": "22c00ff7-6f77-41e7-9526-943db874fa98", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0e5cd99-df72-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1681992027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681992027, "uuid": "d8fabe4b-ad14-48bf-aedc-9f962ca61347", "comment": "Malware payload (DCRat)", "value": "34c3253e7cc59128a0f174b1a384977b", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681992027, "uuid": "2857db87-bd92-4df1-b358-0194357f4ca1", "comment": "Malware payload (DCRat)", "value": "82c83438147aaccce979ab64992f3332595e440b3c2500b945d5d35fd37a188d", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681992027, "uuid": "8bb99937-9ff2-4a7b-a29b-d6be224487e9", "comment": "Malware payload (DCRat)", "value": "9ca262ed0510f6dcac6b3d5883da067b2ff673b2", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681992027, "uuid": "d5882c69-daa8-46f6-a06c-46eac84c0964", "comment": "Malware payload (DCRat)", "value": "f71ded0d23c60190e472064d6dbaf6e6a3ae8072bf897d092e3fad34482f70b249fd4e58bd986623fb4974ecca507c01", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681992027, "uuid": "03bee54e-78d3-4ea9-a192-5a050d808330", "value": "T18F05E7017E44CE11F0099633C2EF455887B4AA556AB6E31B7DBA337D66623A33C0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681992027, "uuid": "18c7767b-5ae9-452d-bb35-784998ff38d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681992027, "uuid": "cd92a527-547a-42d2-ac9f-0efb4f91e3d0", "value": "12288:vcfQoPjENlIK2gjnMRfprKvHMTGT7LAsGaCk9K:UfNjENlIK2hzmBLALaCz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681992027, "uuid": "ee759141-0282-4428-b919-a59471154968", "value": 847360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681992027, "uuid": "5ca1932a-25ef-45d5-abb0-2bf1cd113011", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681992027, "uuid": "c22dc89f-2018-4f9a-aedf-2f246d48c70f", "value": "34c3253e7cc59128a0f174b1a384977b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bd8bf37-df5d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681982758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681982758, "uuid": "595c4113-4289-4c84-ae65-d9202f6b5d5d", "comment": "Malware payload (Mirai)", "value": "eada249e1c78c556040acfd00605d182", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681982758, "uuid": "49a7b3d0-63ff-454e-8dd3-36862c426e74", "comment": "Malware payload (Mirai)", "value": "833d46dbfdcb801d9ee155b287c1315ac877b721a622c356ac36219742b6b92d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681982758, "uuid": "c895e23a-9616-4a92-8446-cb2ff349f2d5", "comment": "Malware payload (Mirai)", "value": "9f6980c99c1ebe473ab0584848671b82c1941afa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681982758, "uuid": "093c4a8e-02b1-4981-8ca2-ea6ad6f44f7e", "comment": "Malware payload (Mirai)", "value": "669b9fe5aa06684f42c4d744f6ad6290f03eeb2fa91aafcd59c4b29f2798f1cff0aa8adf53855942106cbf9cc4f629da", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681982758, "uuid": "888e7c5a-7c49-468b-90c9-2d44bad380e1", "value": "T1F8232B25B9761F17C0D1A8B521FB4B68B6F106CE26E8CA4E3DB20D5EFF619405503AF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681982758, "uuid": "f1525bf3-1487-4e3f-b58c-d764ee363980", "value": "768:nxoZ6yf3xx1DEmtrBy1ZBJcv7s8yAIQjCO+AW31WwM:nxEjf3xPjrBy1/JcvA8BIQjgjBM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681982758, "uuid": "6d106c50-7f59-40d8-bbfb-61db05d80dd0", "value": 48856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681982758, "uuid": "094f18f7-ae03-4026-b6ee-f024fa281bf1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681982758, "uuid": "5bfd9fbf-6e8b-48d5-bf97-0c5eb48d5c83", "value": "eada249e1c78c556040acfd00605d182", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7454a948-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1681985805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985805, "uuid": "bace3799-c143-4c9a-a371-7b6745547897", "comment": "Malware payload (Loki)", "value": "ee2666609d96f4e02e16f12ec337889d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985805, "uuid": "2693055b-3a0d-4503-9eb6-38b4a184b881", "comment": "Malware payload (Loki)", "value": "8369ce1a15331b2f48d66ddcf76e2af50f24ce4edb099c661e17b6be37a76b4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985805, "uuid": "4a5c03d4-a991-417d-bed8-d7c338859b9a", "comment": "Malware payload (Loki)", "value": "5c5534ccde680bdecaf1f438ec8857d39fff9f9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985805, "uuid": "5dd394d4-a346-4297-9f2e-51a223bf01ce", "comment": "Malware payload (Loki)", "value": "96254f63953560d8b96286f1ff0be6bd00505d1bf2e8cab373325832bfe60878e751c2fa9ddfbaea0737bc02a5392987", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985805, "uuid": "d62d71dd-8a3a-4c94-aa48-d33cc118674e", "value": "T1F1B41246A2DD0B26F47E4FB7084B291047372A1FF571EA8D1CEC60E52B86B550B92F4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985805, "uuid": "ae0a706e-1738-40e1-85d9-f04c03dee9a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985805, "uuid": "edd38cb2-7152-42a2-b042-8f9ab50579c9", "value": "12288:lVizrRXocgN3Z3cEOOrksw1t/JZeX7OGRYGf:lVi54cgN3Z0s+tSX7l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985805, "uuid": "9bbfa05d-dbcb-433d-89aa-5e46bdb1b656", "value": 494080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985805, "uuid": "98f2a070-5eb6-4a8b-ab46-d09f889b0a3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985805, "uuid": "2c9bf23d-ff54-4bb1-9e5b-93176f718a11", "value": "MT103Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e6adcc4-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681985796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985796, "uuid": "f8e2ac9b-4ce8-4943-80bf-6bbec58531b8", "comment": "Malware payload (AgentTesla)", "value": "27daf202e0fd0f56afc7aeea49bf7509", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985796, "uuid": "849d1b14-de8d-4431-a052-f7de64f08365", "comment": "Malware payload (AgentTesla)", "value": "8516f3d042a25f937470c84c1200b96a2834b68886ee7abb0439e2894c835f1e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985796, "uuid": "ce4c3f63-7bf6-4b65-8efe-dbeea3a99d82", "comment": "Malware payload (AgentTesla)", "value": "4c39e0d6c51755674cea13a44fdf0e638ee4abe3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985796, "uuid": "35d69867-3ece-48c6-833d-8567f157e885", "comment": "Malware payload (AgentTesla)", "value": "e8df60c46bc35e539310d666d4ee167dea51e9e7a0972499b1e388bb3918ea19d2793920d97064b53ca7a4786b95274b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985796, "uuid": "cdcdcd3d-30ee-4d3d-ad7f-c1ee6d030446", "value": "T1B124E1673BF4583FCA87CE7EA14119A49931E0637536C38218DADA1E19883DE6F4D353", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985796, "uuid": "79070d7d-eba3-4a1f-8daf-27eff9f95507", "value": "3072:ZibeRAsPv9MmgtdQpYRbg4lSd0kowAtbLN8pcyXqVg9zInARuI80V8NfxvXX4:ZwepPv9MmmRsgS6konw6IsNn4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985796, "uuid": "eb03cc6e-855e-4ec9-a7ae-5955ad264db6", "value": 211528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985796, "uuid": "1c7c8532-9ff1-483a-aa40-05ae9245a8f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985796, "uuid": "f9f7c247-afaf-448f-984a-debfd191f687", "value": "HBVPO76.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "850cace3-df47-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1681973378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681973378, "uuid": "5e7b3d3c-27da-4d45-b84c-cc2fd7a3a07c", "comment": "Malware payload (AsyncRAT)", "value": "932e0bbe62ba1f8583b93678a17684ac", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681973378, "uuid": "deb5d95e-a0ed-4269-943e-9ed9beea31f4", "comment": "Malware payload (AsyncRAT)", "value": "86947a85ff117cbc4a55240f58d33cc90eaffb83d1584b3991bc33c5ea44495c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681973378, "uuid": "eff004c7-4e67-4d9c-9e94-0613450f7bb2", "comment": "Malware payload (AsyncRAT)", "value": "355a0891c847d4d9f84d185578639d0ecae96d4b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681973378, "uuid": "9fe0803a-4f47-46fb-adaf-cf1ac0e39523", "comment": "Malware payload (AsyncRAT)", "value": "e90b5b7fbb215403ccab94b7686d64c23dc91be6f79a65c2ed5460b87c68c32e68b82b5a000838cdbcc3c264cb5f3281", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681973378, "uuid": "fe5ddf24-39e5-4991-b486-6783276385f3", "value": "T106C5129CB5757D46F4A0937FC9452CBADB2C1B80C2917DAECF25069B7DC306E2B2A901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681973378, "uuid": "a0cbc43e-175e-4ff7-9cc8-83fb0004a2dd", "value": "12288:CnQoqtv7ohczUzCPD6qu5m1xAsupAJ/YApdLib:CODjfeyesMAeedLib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681973378, "uuid": "349796b9-4461-4ced-8e67-ed223e9c75f2", "value": 2534055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681973378, "uuid": "f749fb0e-f57e-43e1-b33e-a37a823766dd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681973378, "uuid": "95677c01-cf18-4ed2-8b8a-3d8c030c82d8", "value": "Ta.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "061551d5-df3b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681968011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968011, "uuid": "9e27aa17-0da9-4f37-a8d4-5644dff8f3f3", "comment": "Malware payload", "value": "b29c2c439c71a3767edc2c8f07f832f9", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968011, "uuid": "695ba254-8e45-4fc5-877e-29f1f3fc0ad9", "comment": "Malware payload", "value": "8694c0e0ed86064441cbaa9888482bdb7a0e96314344d4f50a690d17453e10df", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968011, "uuid": "65af38f1-3a9d-4469-aaf4-c7304564fd92", "comment": "Malware payload", "value": "c6d84a17a7fe01e6ce5a8ff94204f6d3e10c3a37", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968011, "uuid": "f3412fed-a521-4484-b370-be53ea7dce65", "comment": "Malware payload", "value": "f91be3b5fe364e4d4005f09e8df1576f949b2e20057befa8e392acb70c34811d22c5b1080e9d324cf110c53dbb79d6ae", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968011, "uuid": "aa6576d8-39a2-46f5-920b-3a67ff1151e7", "value": "T14574E618CBA48A13DB9E5672802692B409F7E591A1CAF737774C3FF23D15309BE13296", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968011, "uuid": "98241e77-854e-4010-81ce-744a765f8044", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968011, "uuid": "688b6015-a55d-4347-9ee8-92575e9e5568", "value": "6144:GhHfPhfYoP3vVNB3zkw+y7LuCtMiul5puoLSFk93:CH3hfYoPfVT/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681968011, "uuid": "d7069354-4e1b-4e17-bd91-debb14304dea", "value": 340480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681968011, "uuid": "81f35b26-15dd-4e43-aea3-13255811e00d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968011, "uuid": "2d6f5fcf-d31f-4ab3-ab4e-4bac7f9bece5", "value": "DHL-AWB_INV2023041756GTH.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e540ef47-df0e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1681949058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681949058, "uuid": "ae25d1ef-48f3-4e0a-a93a-18d58a83071b", "comment": "Malware payload (RedLineStealer)", "value": "e68f841675e386eede2a185491f3f62c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681949058, "uuid": "a9eea1ce-0d3e-4090-87ef-44041d71c8b8", "comment": "Malware payload (RedLineStealer)", "value": "86f597b3ce3f625eecba774b8ee67dc534b9adeb4472393357d61319274e1f9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681949058, "uuid": "a0e5ba56-4710-4fab-85d8-cd964416a445", "comment": "Malware payload (RedLineStealer)", "value": "9d4a1c5c1998ee096cdbfc02804e29265fe66a48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681949058, "uuid": "b4c8e407-3c86-4be7-bb03-5ba5ee3ddc75", "comment": "Malware payload (RedLineStealer)", "value": "636f9080bee4ff7ee21659183b302de8d2e74e299de8cfa9984a6581bfae6bbb9f5c4fdd51da071f88a0dd72c0420e88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681949058, "uuid": "92694def-8f3f-48db-90cf-128ad4b4299f", "value": "T16D458EB874C6CD30C5D0323507E0856782EDBE2547E579BBAB894FE9CA7B010D6ECA94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681949058, "uuid": "c243793a-f1a7-404a-a0ed-72a63a985496", "value": "2ad0bbe7b488ccd9b02faf0349f3e503", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681949058, "uuid": "4e09f0f9-b94b-4d1f-83fa-4b7cf93867eb", "value": "6144:mG1dDszSc/wXmkAOoPN1dgj1Gmr1SnpGu014Ohrxdm:n1dDsqiPNDgj13SnM513hrDm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681949058, "uuid": "b1d0bb9d-df13-431a-889d-447a673c1862", "value": 1257472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681949058, "uuid": "ea0945e9-1f6b-4c8e-82ef-546015fa13cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681949058, "uuid": "4b467652-11c7-4135-a39b-de1befbab7a4", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "583e5431-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681985758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985758, "uuid": "4a237e83-42ba-465c-add9-f8c42de1a417", "comment": "Malware payload", "value": "f2349763455469be19f26fa905d56669", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985758, "uuid": "29f36e19-20e2-46b4-9f3f-264c2e9b35fb", "comment": "Malware payload", "value": "875ab446791476b632ac5b90edf5b2b70977c4ef19c6e3cdd35632a92da8f27b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985758, "uuid": "43ca9a43-abf1-4a29-bfc2-0be76c264d8f", "comment": "Malware payload", "value": "f2c6b127ceb1cf30effdcf67b2ba449d80a34eb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985758, "uuid": "83fd83fb-fa1c-4c78-b1fe-04a36bba4526", "comment": "Malware payload", "value": "eb184f10feb41333cb0a69aeb7a465f0a9b1df8c0eb33c199d945bdedc7e8714ab5958cfbcc2142871c7bfbe473b5a94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985758, "uuid": "e112d22a-57c5-42ad-8022-602f362638d0", "value": "T171C3F91533D2D171D0F211305AAFE2B19AF6FD251E29FB4B32C4CB6E1A71641EA24F1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985758, "uuid": "2e05c8df-5537-4426-b623-7df9869c8b80", "value": "3072:xcpkVlUz+LTUA87SHrGXJHqG7Di3ogUnDEzsrnTxtGPXJtE:QkVW9uHrGk6i3HzSTaXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985758, "uuid": "3d5f4cc1-0f7a-4b5f-a9e6-6eba46724789", "value": 126976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985758, "uuid": "9c31ac9b-ae1f-4802-8654-04d52f678cd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985758, "uuid": "f1b66a5e-2d92-4ba6-9de7-6fc147791ab7", "value": "875ab446791476b632ac5b90edf5b2b70977c4ef19c6e3cdd35632a92da8f27b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bc14a25-dfcf-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682031747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682031747, "uuid": "a99ada97-520f-4af7-8885-a8c38685d96b", "comment": "Malware payload", "value": "43e70f076119bdcccf8d24494da4d6e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682031747, "uuid": "7ea5f9ae-f7de-4fd9-8aa9-0f6672fe5856", "comment": "Malware payload", "value": "880642df987a4970dfe06352ec4dc1f3f84729ff5c4279330fe3072eaba69ad1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682031747, "uuid": "ce2a1f78-55dc-4730-adb9-0deabe1bb14c", "comment": "Malware payload", "value": "aeff1930883cea6da996814c180fbc2f172b81a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682031747, "uuid": "59b707ac-5e01-4206-8bce-b5a751fdeadc", "comment": "Malware payload", "value": "1488a6eedfba4d5cbf20ef229390839b0b9f149fc213baae6f949814169be867ec2b2d577802b73fb4e7a12a80f50baa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682031747, "uuid": "015156f7-cf2d-40dd-a885-086065dfe606", "value": "T114647A9EB98ACC96D3EF0CB4794F63F50C6B1C13C8A696178AD4C8E5774614836BA307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682031747, "uuid": "b66e0ec0-a2ed-4eef-b750-5d9b349abff0", "value": "f6dc801830da9c49625d5b5ee3ba0912", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682031747, "uuid": "7923eef0-8148-435b-8d81-b3a4c62efbfb", "value": "6144:zagaBdNaDmzUpb0Edbjke02VwHyzOkRZZZ/ZZZZFux9/t7ZZm3:zagSaDOUpb0+VwHgO5t+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682031747, "uuid": "2eeff832-19ec-48c7-910a-bca2f24fc0b3", "value": 319488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682031747, "uuid": "863c6eb7-4475-40f0-9fc2-f46c37481aea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682031747, "uuid": "30d4150d-0780-48b9-acf8-9082db106df3", "value": "880642df987a4970dfe06352ec4dc1f3f84729ff5c4279330fe3072eaba69ad1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63e0fa08-df98-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682008112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682008112, "uuid": "1d7987bb-9198-49ba-95f9-237df148773c", "comment": "Malware payload", "value": "45f241fd144ec617a7610cb4edc51f30", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682008112, "uuid": "70d7b6ce-3bca-49e8-b50b-f83efc6d3591", "comment": "Malware payload", "value": "88a2725a387dec6b5402c3597642c6085aef187aad75f241915445adfc99263d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682008112, "uuid": "0eedb789-7d15-491f-955c-0cd07d1b28e4", "comment": "Malware payload", "value": "2e72fecc72365b0082f589ff3825addc7e2cecef", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682008112, "uuid": "e67e7eec-e7c9-48b7-87ea-6dc90551a96e", "comment": "Malware payload", "value": "934f921ba7d9aa300634c4b573efb39c798b51ff1be925db53fa87574d941a39e78fc61cacbc2522cce958c750bded8d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682008112, "uuid": "99356d97-2740-42e7-b7f2-a586482222f9", "value": "T133059F22F2D1847BC1B32F7D8D2B52649C2A7E422D38A4497BE44D4C8E796617B353B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682008112, "uuid": "6a497cc1-ff3c-430b-93e5-0535b14e3a2c", "value": "c15a54624d085ba27d57cf89089f742e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682008112, "uuid": "546cff4a-9f52-409e-bd23-0ab1c5bfae2d", "value": "12288:DSzKApsXlCgKu33OA5kXnLiu+quwbubFDY8/Ck0FL2kd9IVJpfnEoHuHe/pEj:o1psShG8rmLKG+FqkQpP3HuHe/pEj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682008112, "uuid": "088b2efa-04ac-4dad-8cdf-5e6f6653c924", "value": 822784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682008112, "uuid": "4a905028-db2f-449a-8b1f-ee3d93637d0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682008112, "uuid": "bea2924d-46ac-4994-9942-b5fdee971a8f", "value": "ayjbrprbkbxm.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb0c14c7-df7f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681997601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681997601, "uuid": "f58f2f64-289a-4efe-909f-1880bbb23bfa", "comment": "Malware payload (Mirai)", "value": "c1f330ddc2c89a3fc146b974748b0bdf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681997601, "uuid": "8cd93082-0777-42d5-8d38-6de20c766b6e", "comment": "Malware payload (Mirai)", "value": "88aa65d75060f78cd1c4157f42e0d2ee360158ead3bbdbb9367623c9f9977acb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681997601, "uuid": "a2ed7a47-8e09-4cdc-936b-c029de440369", "comment": "Malware payload (Mirai)", "value": "c4ad3ddc3a1438d296b0feddaf44f36c89831fb0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681997601, "uuid": "5c61802e-2efd-4681-a99a-ffcba6b510a5", "comment": "Malware payload (Mirai)", "value": "e44fcf4c190f4577c4cc8c29e3fca9d9ae5a2aae9fb8ec7938ff37a03681b6645b7483b5ac89645cc9a05305dfbb13fa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681997601, "uuid": "bdf28478-7d55-44ec-a625-ebbadbc00546", "value": "T1A1C2E1CA9BE2926EED709174513965EB10367CD40308FD53061CA9812BFB73CD2A8E87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681997601, "uuid": "b6f9f978-99a0-4652-aaa8-e821ba08f7e2", "value": "768:FguH9e2Hwc24kiII91JK25pXblsDpIFI73:euU1cXcI/A25pRsDmFA3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681997601, "uuid": "2b812979-b2ce-42e8-b66f-fb2d0c2cc02a", "value": 27140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681997601, "uuid": "0aa7845b-d4a9-4052-a149-91f5fe42d43c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681997601, "uuid": "f012e47f-404d-4fe8-bc6a-d966426a9c68", "value": "c1f330ddc2c89a3fc146b974748b0bdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4100cbd-df24-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681958398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681958398, "uuid": "3e1e0983-5309-4a6c-b1b5-ada3636b904a", "comment": "Malware payload (Formbook)", "value": "6e60a79960d3dfa24761ef5f22e54a34", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681958398, "uuid": "391b5ee5-49c2-49de-8517-d56abfab8508", "comment": "Malware payload (Formbook)", "value": "896d0711b287b0914d88b93ff8d06623c60f45b405e12cbc34a406e09942a577", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681958398, "uuid": "e9f7c943-d418-4423-9b53-7698b6742787", "comment": "Malware payload (Formbook)", "value": "1f13e4d1e7cb98226cf60976b3637e7931de76b2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681958398, "uuid": "479661c5-8d53-4049-aa26-ea56ec2067b8", "comment": "Malware payload (Formbook)", "value": "66985c40fd4bbf50d5d8ef6683f744fc15f10355454322371bbc1e0c82f4a793da74d44969d7a46ffa045a6703201956", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681958398, "uuid": "1a41bdd1-6673-471f-b9e0-b6d42f3cd3dd", "value": "T10CF4E1D5B366E752C2683C3D929A60382B7049C7F857CA69FDC911997E277C80E8078F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681958398, "uuid": "a8228fda-b443-4f24-aa08-0148893e20ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681958398, "uuid": "3b99522b-3348-42f3-a99e-5e8a2cbd7078", "value": "12288:42peSMq3HMH91DzZ6TbYT+SNtTaeY3tyvQuojH8BZDVFmxcYYf:42QcHMd1Dt6ANFNY3ty4xr8PrZff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681958398, "uuid": "b66c72bf-8f78-4325-9c5a-cf69b965afee", "value": 749056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681958398, "uuid": "09e7cc8e-cae2-428c-9d65-21440f590d90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681958398, "uuid": "06f42a1a-55e7-4a77-be30-bf78170047ed", "value": "6e60a79960d3dfa24761ef5f22e54a34", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00205f01-df80-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681997636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681997636, "uuid": "235d4fc5-8d7a-453a-8216-6c71a245ceb0", "comment": "Malware payload (Mirai)", "value": "acae59677bd6f46a6c9b8886f688f5b1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681997636, "uuid": "944f51b3-d7f4-40e7-bae6-39121341de43", "comment": "Malware payload (Mirai)", "value": "89b767820fab1e73fe772aaf39a391fa3b82b5752a899037aa3ef3cdc1e087b5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681997636, "uuid": "c4d6d531-46ed-4a33-ae19-04ee49d37226", "comment": "Malware payload (Mirai)", "value": "4578b9e56d7b80f16a40357005264ab7bfffd2ee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681997636, "uuid": "eb83a287-8a20-4509-b394-d6d2329de45d", "comment": "Malware payload (Mirai)", "value": "785f7591687f750aa2814aad57d0c3f371d7dfd536abf1e811f445189b0e047020212a4d11de92e0c402a30a5d8c7244", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681997636, "uuid": "a3640e4a-1ba8-4c8d-b550-fc4ac91623e5", "value": "T15BC2E170B601D07BC06BE27869242E37F6A3CF136279FA01FA6EB557355293E9E20091", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681997636, "uuid": "7a64bfc0-3c39-4a49-9ada-c49615c99846", "value": "768:xFpEYl6Sjf0qPfZFa19Ot2htvIb0ongIO:l92102rbongf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681997636, "uuid": "cd959e90-d490-471a-8d02-fb2ea9c8261d", "value": 28124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681997636, "uuid": "80fa4cb6-77e5-4f09-b1cc-b2b44e1363e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681997636, "uuid": "c0a58a4e-30d2-4f4d-b97e-3a3be43522b6", "value": "acae59677bd6f46a6c9b8886f688f5b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca07ef38-df93-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1682006136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682006136, "uuid": "c58df92b-ad03-4cc4-bb76-cac3c4aa030a", "comment": "Malware payload (AveMariaRAT)", "value": "1588da8440b3fbdcb47cb59ffe878375", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682006136, "uuid": "8cf6302c-eb36-4c36-a9b6-57113fc46c62", "comment": "Malware payload (AveMariaRAT)", "value": "8a5e19573add3781a34714103c8452490e482569d22afaf8c2e86cd92c9105e0", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682006136, "uuid": "9b1745f0-dc67-4dc6-be91-f671b4167d8e", "comment": "Malware payload (AveMariaRAT)", "value": "ed0b0ed8854b74d7d0a768291f61977996382e23", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682006136, "uuid": "4fbb5ba3-ec70-4beb-88a0-4217b2137fa6", "comment": "Malware payload (AveMariaRAT)", "value": "6afb1165531755384324f3471dc27aae4f3c16f0fb781521afa6c94b0900aa3291d85acc643d272f6dff3cb4f6d69a40", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682006136, "uuid": "38043e86-9792-412b-b956-d25ded7f3dbb", "value": "T16A75E0B5B3E85333C1B2583DF9AA9484D615A41B1BA87F0623DA843F9539452C33F9CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682006136, "uuid": "ca82ceef-62d3-42e7-b26d-e8aae6e94ee8", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682006136, "uuid": "bb4273b5-1308-40e2-aef4-8d9a24497e60", "value": "24576:wNA3R5drXdNrkk6dRQDC5ENdRGOiKM+i8ydJwKVq0Rbul3wq5UaUlQ7pHPUR6RH:p5dgvOiT+idzjBRKiWpHg6R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682006136, "uuid": "a437d081-545c-4156-853d-4a086880f550", "value": 1627911, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682006136, "uuid": "e103c22a-3b96-4ced-bd83-c53fba76e4fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682006136, "uuid": "04f71728-55ec-4160-95cf-eb6fd106df87", "value": "Pago.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7bef8cc-df56-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681979959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681979959, "uuid": "6a45e96e-d8bc-47c7-9fde-dda8589b455d", "comment": "Malware payload (Mirai)", "value": "f0bc4943cb1f36f1802299b689ec5159", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681979959, "uuid": "7311b95a-a4f3-4c7b-9ec6-732cad7f4339", "comment": "Malware payload (Mirai)", "value": "8a929b10b7cd9d4086dd04b3d8386abf4746be4a39af028add9ebb9523f6c8d1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681979959, "uuid": "632749da-c8ef-43aa-89e8-2b5b6847b72c", "comment": "Malware payload (Mirai)", "value": "098fb1a7a588adda52292fa4c8a0f2e9f6961709", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681979959, "uuid": "1cb0a902-9fc4-4fc1-be45-ad55ffcb33d5", "comment": "Malware payload (Mirai)", "value": "572a200c5f2335a2b9b2b56da0e801d5b2aa36c36f77206c5b928487522d73cffebe25c255c0d761d38207d0ce1c4eb6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681979959, "uuid": "52770e5e-fca5-4dbb-a3bf-14e1dc237450", "value": "T11FC35E86BF903FFFD81ECD3241A4DB0A129C590A2395BF7A1B78D408B65B11A59D3C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681979959, "uuid": "ce0de5a7-68ae-4261-8346-e07602d35c9e", "value": "1536:mpdzaAiDymlxtfNwziAbDrHQWTee8QDncElcwXrQ:mpdzeGMhdVWv1Dlb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681979959, "uuid": "78bfb43f-b331-4e8b-b0be-a6dec7a1f5b0", "value": 128580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681979959, "uuid": "e9e90208-fa4a-4f04-bc78-26a0edb80b40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681979959, "uuid": "f3f50b8c-7fa9-4a53-8c47-cc2fb787ff17", "value": "f0bc4943cb1f36f1802299b689ec5159", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59003d79-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681985760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985760, "uuid": "0fc306de-e28e-47f7-b6e1-1ed25d773603", "comment": "Malware payload (AgentTesla)", "value": "02b175b487a1a4e11bb512b5208c4422", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985760, "uuid": "9a63f236-1bb2-4d9c-85a4-83ad2c5852c2", "comment": "Malware payload (AgentTesla)", "value": "8ac901d185b2e8c76a53ab4c03216f5994446c06fc7c62d903871a444687400d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985760, "uuid": "0a54b51e-9900-421c-a730-c91d93857ecd", "comment": "Malware payload (AgentTesla)", "value": "910849fefd19e15e4b422fd9d12871685428ab34", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985760, "uuid": "7699ac71-db72-4b9e-a26a-632b3fe703fb", "comment": "Malware payload (AgentTesla)", "value": "73986094941d518baa55e3b5216f82b505dc09e9cf55444c39a33aeafe408a228e511b1bce0b02a1cd51798102fe8f2d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985760, "uuid": "b96fb301-d6b8-4473-9b7f-9a140d161bd5", "value": "T1A2F32A2CBED98E56D72D40B4C4A051580AB3B2439617EB5D0FB09CFA3E967D3362EC61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985760, "uuid": "3d96d436-ecf6-4bfe-b79d-30d623d4fdf4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985760, "uuid": "b0bb8c6d-4f9e-4f3d-b5d7-ecdf417f98ec", "value": "3072:2/XnYJPxCXAtxtT9xtTyP8hUg63aCfC+pJyQzSOgqI50WtQ3I8lK:2/XY/4ADHxVy0hUp3a+n/zT9IDW4U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985760, "uuid": "c7323cb6-d0a2-4f38-9fa3-5856f91e3509", "value": 167936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985760, "uuid": "0575fa9d-35e7-4d14-878d-a25f9015f872", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985760, "uuid": "8acbf4b6-e971-43da-8b34-8b515d41d052", "value": "8ac901d185b2e8c76a53ab4c03216f5994446c06fc7c62d903871a444687400d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d30a876-df5f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681983592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983592, "uuid": "bf8c273b-37eb-4857-a4ab-dec90ee231e3", "comment": "Malware payload (Mirai)", "value": "efc4bd33e956e5d3013da1176c8ffe26", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983592, "uuid": "e2bd0a01-dd49-4fd0-b35e-6a2d89d4f8ff", "comment": "Malware payload (Mirai)", "value": "8afedd7c7c2b31f8d09630d90d7fbdafe5d658d0f28e6f7fe7e67cbfc07a557c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983592, "uuid": "c908005f-f19a-4db1-87d9-c2edb6d588fc", "comment": "Malware payload (Mirai)", "value": "c5c6916423a8d1de31806d4ae3ff4461ea33d387", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983592, "uuid": "3aa1c5d5-dd2c-4a41-b12f-a286587dce73", "comment": "Malware payload (Mirai)", "value": "f13fc878886306ac82fa73d58a8115c6658505d569309b1dd7e6f8acc4a3996900b7252e76945fdf962b8953dfa2132b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983592, "uuid": "22e5863a-edcf-4d4f-90eb-517233c51957", "value": "T179133C42721C0F17C4A35A70253F5BD087BEAAD032E4F285665F9BA68A75E371482FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983592, "uuid": "54f47d45-9f45-40eb-8f7b-de488e9cb58b", "value": "768:g40J4bzio9RfQRW0qRGQ8Jt8hTVsvWltn2susHzFuMtdW4dLFrw+:70JOC+QqhTrxjEMtdFLK+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681983592, "uuid": "0abd8303-ad65-43e5-8093-ded757b3e94f", "value": 43780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681983592, "uuid": "3e3b3ddc-73f0-472b-98ab-70b5b6d3a8c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983592, "uuid": "b3439655-56a8-426b-af33-9d762e22ee35", "value": "efc4bd33e956e5d3013da1176c8ffe26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f96d171-df5a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681981422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681981422, "uuid": "001fbd9d-aa9c-4a8e-990f-cdd57cef7937", "comment": "Malware payload (Mirai)", "value": "8dc1aa9d990aee3a9f0cd33f56d49cc5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681981422, "uuid": "f15e77db-9357-4e9f-989d-a2cf16a02848", "comment": "Malware payload (Mirai)", "value": "8b406facd1c9d97b982aadd0b1bab041a46f0cf6db15e3d3dcd22540896d79e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681981422, "uuid": "69bd26b4-5077-45ae-8840-eebf6e58232b", "comment": "Malware payload (Mirai)", "value": "69b63d338746934149aabb676ce6b13d69587bf6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681981422, "uuid": "9ae76cf9-9a76-48d5-abb7-0fa873caea60", "comment": "Malware payload (Mirai)", "value": "825a110c681cd5ac945064622c5e406bfbee3fe797f96b8715b63242a2d1c81db4dace98576570d0cb9ccd15f6779e9f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681981422, "uuid": "99fcd074-2cc8-43df-9837-d4b0e2ba7b71", "value": "T115E23BC2D943DDF5EC2142B1187B67A28B76E47A2A35DB57D3AC2735BC42720960338D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681981422, "uuid": "ced5165e-6b1f-488c-b732-2980467a5253", "value": "768:609/LxmaOLqS68b1gtXc68Ku6MiipCVtIgvMEycqupX:609/LxmacqSX1gO9KuyipatfkEy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681981422, "uuid": "ce78bdb2-3450-4822-8fa4-83b7ea2a6680", "value": 33776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681981422, "uuid": "4d3d400a-75c3-4ae0-9d13-47a3321a86e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681981422, "uuid": "87dc7faa-c474-4796-82a2-ae59baf10c32", "value": "i5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe987fb0-dfc9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682029417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682029417, "uuid": "f1878a9c-7ed7-4962-9283-bfcfe5cea8cf", "comment": "Malware payload", "value": "3f00bb5395c6b7e22e68d53eb01b41da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682029417, "uuid": "71f7643e-3d24-416c-837a-316fe2dd65ac", "comment": "Malware payload", "value": "8bd9b24e03c9b937f202d1d4c411bbfe31488a66b99912c741e5e32e8f29dc88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682029417, "uuid": "0907595d-e3fa-4588-b57f-2d689024ae5d", "comment": "Malware payload", "value": "dcc76c12658a6f17460fd1ec7271fe0f9f73900e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682029417, "uuid": "a5b5a506-debe-4002-bf68-81311aab8f49", "comment": "Malware payload", "value": "48fb476b43fe3c66094f571fb4b2c0f337aaa383d80c4259029c85fb6e949b39fd10fea5f4cb4975c45e85dc4f7751ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682029417, "uuid": "f5514242-8b6b-4f54-8453-7fff60acfbc3", "value": "T1F3746C1222D1A870E523DB328E6EC7F9676EF5608F557BDB27595A3F0A701E2C232305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682029417, "uuid": "fd08f30e-eeca-482e-a635-ea4a3dedd7fc", "value": "2128cb5ed16bb6d1d4fbf54766560683", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682029417, "uuid": "5a51726f-1e42-4238-a206-799e087442d0", "value": "3072:o6+9wglxvHe5W64hpgy2eHYiLcA/uF3/03ntbls9cbXSxepAkRDNNnUsuKUbz9OK:od9/ewZrpYs/UUlsK7pfvnUs205", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682029417, "uuid": "46fef574-c49d-4a44-8bed-1c21e29a5943", "value": 345088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682029417, "uuid": "03a43eec-32b7-4cf0-bf6f-9a420582e1e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682029417, "uuid": "97a115af-b1ec-4a1e-9964-02f20cfd5e98", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81e56b73-df50-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1681977238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681977238, "uuid": "773907f3-e059-4ce7-9d53-d499a167db79", "comment": "Malware payload (Vidar)", "value": "295d168271a2ac16dd17c7b5113876e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681977238, "uuid": "53a6c48d-d9b3-4c24-ad7e-1936bc64c301", "comment": "Malware payload (Vidar)", "value": "8d98fe5bd21e49af44f2623573708994b548b6e6c019736544474dd81569014e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681977238, "uuid": "8f56f113-e3b7-4021-b586-9a1dbaec8730", "comment": "Malware payload (Vidar)", "value": "3b22f411c250b1803d7e962257af913250cc7b68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681977238, "uuid": "b8bddacc-99fb-472d-b50d-59fcb7a1da86", "comment": "Malware payload (Vidar)", "value": "939c3725dd1158aeb284e1504a0c55af6d691fe7ba49f3690458d3c07087d8225e59bccc5c19d0fec7ccbe191d1c2bbf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681977238, "uuid": "38bad34d-fe49-4807-b0a3-b4f2e29a6698", "value": "T1833623616AB1FA21D51C2A3C847386EC6E273E6575B7D60E0B803F8FB1FCB59121D606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681977238, "uuid": "84a210c1-544a-4a8d-a9ef-9c471db3a4ba", "value": "98304:RfSvh+qyzjND3SJDUPU2FhdM61ZbdjND3SJDUPU2FhdM61ZbdByA:R6vhxsNjwJebM611djNjwJebM611dcA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681977238, "uuid": "9025f2dc-595e-4369-b26b-dc13a1c26331", "value": 5346672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681977238, "uuid": "07b9d1df-43b9-4e82-89bc-b54526b42147", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681977238, "uuid": "aaa6f4a1-3bad-44ab-bf82-72525b2e73ad", "value": "295d168271a2ac16dd17c7b5113876e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "664572d6-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681985782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985782, "uuid": "ac474ce2-0b75-4f22-882b-a11efdc112c6", "comment": "Malware payload", "value": "a54a91bb96d11e0a4363fbbb76d21bd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985782, "uuid": "2b270071-70d2-46cf-8fea-5130f34c3fd0", "comment": "Malware payload", "value": "8e022395a0ecc137ef9c76cbd5c6b27899cd2995427e972a5379c6ab9811e12d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985782, "uuid": "2d2097a8-0452-4f90-9148-3458e4017ae5", "comment": "Malware payload", "value": "24b4ae1566896c0884d106f9b223c501a883f193", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985782, "uuid": "67ede6ea-81a1-48cc-8833-c05aa54debf4", "comment": "Malware payload", "value": "f28f397f34741330f554d3120bc0951330096dcea2b9d156e4735c1a8d692d3ac7d93ce3c4cb8637d61820c0bc748f06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985782, "uuid": "33e3bda3-4fc4-435c-b5bb-1842920b9237", "value": "T1250419BC27942866E5B9E53D40EFB3211538F3E09A1E6FC30A345F39C65B9602CD265E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985782, "uuid": "bf47d314-a565-461f-9dbb-820c422a55a2", "value": "a808411a04557309a9c41f351b379c88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985782, "uuid": "90c46197-7dfe-42ac-b404-f573cc7c9974", "value": "3072:5vLFzxjhk16RZA2fEWse6dBzQXPZ+7v7iTKNiX+Y:Htjqv28WsekzQXPwziTKkOY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985782, "uuid": "3262cb58-46fe-457f-ae66-0bc7eb3c5baa", "value": 181543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985782, "uuid": "5270f4c1-286e-44b9-bcbd-10c605f31305", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985782, "uuid": "4ca994c5-ba3a-4f57-911f-fa5d768c73f5", "value": "caritasespa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe1c6f47-df11-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1681950388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681950388, "uuid": "b1d1462f-7844-42f3-a73f-63fb0dbc407c", "comment": "Malware payload (Amadey)", "value": "9efbdd30531ed90d26e1a1dc3d44c075", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681950388, "uuid": "cf04bb50-dfaf-45d3-93b5-43d59a3b6c0f", "comment": "Malware payload (Amadey)", "value": "8e234e47e83299f40b955cee4e88baf9f715f1214c8c6152899447898ba93bd3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681950388, "uuid": "a393b992-ace2-4ff2-9857-bc70c88f9cb1", "comment": "Malware payload (Amadey)", "value": "95144d2aca44bdf92356f290bcab1d75107a356d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681950388, "uuid": "9730ccf9-7f3f-4b30-b2a6-f8abb7783514", "comment": "Malware payload (Amadey)", "value": "cb7dc61a2b78820b5167f70e093d40ce9a4af361b6632b70b627bd9c88e0310c8149bd1a007a148b13454776041bbfb6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681950388, "uuid": "df84aacc-0784-48f4-9f51-f1cae9b01932", "value": "T11B252293B2E88437DDA497B106FA22871F367C6257B946E726573DCCACB26C06430763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681950388, "uuid": "9377d6bd-8f86-48d0-9246-81e154288c99", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681950388, "uuid": "aa20676f-66e2-4239-9f07-3777cc771d70", "value": "12288:ky90rEGj69w+O3q7cOWUtQ/3toii5ldz3KX7C0h8JBpij/OtwcApZHrPFUqrVL+X:kyuEGjNxaDWU6/6PVbKX7mJBQsAmg+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681950388, "uuid": "84286d20-9407-4212-b19b-c4ed669c718e", "value": 1057792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681950388, "uuid": "b8370333-822e-4a03-b3d1-0bd809c550b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681950388, "uuid": "b24f4a4f-0530-457b-b2c1-62466f4966f8", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cc08f0b-df3a-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1681967781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681967781, "uuid": "123f2ea9-a91b-43cd-9f74-b53b9d669ef5", "comment": "Malware payload (GCleaner)", "value": "01f2f6e443959bd4ef444d01381db97c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681967781, "uuid": "61816df8-860c-4cf4-804a-e3ad8276e193", "comment": "Malware payload (GCleaner)", "value": "8e32b2687a885a24983a14bf0ad0408bdd972b2c6bc8baee21b61dacaf6627d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681967781, "uuid": "01c94adc-f69d-4e00-9846-21c46a4742eb", "comment": "Malware payload (GCleaner)", "value": "bc86a9eb8798e864671e83256ad31fd017fa6816", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681967781, "uuid": "3e71727c-dbc7-4abf-89f5-5a7a42fe5286", "comment": "Malware payload (GCleaner)", "value": "9a70539574be4d9f7f30cec02abf0d166e28453b5b0494681c78eb5d597211aec9ff4815a1f8232febd7b4c2b1a58326", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681967781, "uuid": "3dd614bc-3387-408c-98b7-2a3b4dfc7c96", "value": "T19964F1227D40DC32DDA621748871DF6B1DBFFC661221964BB6793687BE223C1167238B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681967781, "uuid": "0ceef698-bb29-4227-bcbf-8f7e961ca5e7", "value": "fcefd95474e5b4dc39c6ed905cd56747", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681967781, "uuid": "0b92e5c5-2654-4e0e-9c83-d56ce3e740ff", "value": "6144:N90YhaAAkjSkuXy86xgpg5Bm5XZAMlEl7o4Cm3qbpSg4/ve7:Nlh97jtA6FB0ZAAL4CmQi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681967781, "uuid": "d0ca9d35-f66c-4bfd-aee4-edd5156d2dfd", "value": 311808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681967781, "uuid": "d2634202-f938-47a3-8877-af152fe5cb89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681967781, "uuid": "48faeaca-251b-4e65-8bd2-b12557999728", "value": "01f2f6e443959bd4ef444d01381db97c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01134f22-df78-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681994202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681994202, "uuid": "3034edd7-c0fc-44a5-bcc7-0f90a8b904eb", "comment": "Malware payload", "value": "7e6c6124bd06a2cd2280a2ae21080fb7", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681994202, "uuid": "86503bc7-7643-4ff1-b70e-04dfbbebd97b", "comment": "Malware payload", "value": "8f9bc3fccdeec5a952a95a6d34923ee92e45e77c3c8f20a9e519d44fe408b67c", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681994202, "uuid": "288a600b-2bc0-45d2-bae0-5581e48007af", "comment": "Malware payload", "value": "a93c15bb6cc8b3b8d02cbd0c2c72c830282ce66a", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681994202, "uuid": "81b12203-08e1-4d75-858d-102d9e8bb72a", "comment": "Malware payload", "value": "9d63479fd626d999ac8fe5c5b0e5eecaf69e2eb8ee5d71d54ca9b8761f85ed068a5bff7dee756c79c8d34e8b61cbd46c", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681994202, "uuid": "b081803d-4feb-4479-a61e-40b1050558fb", "value": "T1EF72ACB5743CB306095EDF7948C9480A680FFA453945CAB2A3A1DE44FC7D8ADC1B6CA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681994202, "uuid": "6387b341-ff76-48a2-be7c-0783dc6d68f3", "value": "384:g3zbXtaTuCpnbl6DU0i54soiVvmUIwb1X:Czbd0uC1ZuU0iVmq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681994202, "uuid": "0d4810b8-eda2-4313-a299-b59ce5c0f584", "value": 16860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681994202, "uuid": "8f8bf68f-ed05-4bb4-bd46-722dc24787c9", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681994202, "uuid": "7a081bbd-7cb8-4ce0-a4ea-a8339c356284", "value": "payload.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a44b834a-df0f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1681949379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681949379, "uuid": "39c22e03-8473-47c3-be69-2a5bac81e409", "comment": "Malware payload (RedLineStealer)", "value": "c49c8cbc484e4a0e45f33bfd0123024e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681949379, "uuid": "f727e3c7-cf69-4320-bed2-d4c0de513dc3", "comment": "Malware payload (RedLineStealer)", "value": "8fa21b38d86de4d302e10c2f57b04138032a89d89ddfa208ecfa39cd77866c6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681949379, "uuid": "a898be81-5a75-4528-a6b3-301eb0360e13", "comment": "Malware payload (RedLineStealer)", "value": "cbeadb47cab85a0474a4351d605567c0a3820bcc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681949379, "uuid": "ef90cbc9-6d7d-4a7c-8a9b-bdfb7003a531", "comment": "Malware payload (RedLineStealer)", "value": "f5195e1e286bceebc55ee12705ee6775ccc309ee159285da38e8951633046deac18063f8881fb3252693e853adcc3e7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681949379, "uuid": "3cb9143e-3980-4375-b651-6121ea426da5", "value": "T108749E33E2940232E0D5C9B41FC6DFB18A7CB43807FF51F7B3A64A6909246F9606A657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681949379, "uuid": "08c495f3-35ca-4809-b4f0-e25662788136", "value": "af2485d0095aa13ff8c5ef8a370c0565", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681949379, "uuid": "ee18ff11-5ee3-48f9-9bea-10ce82d30e8d", "value": "6144:aB9Vfsm1funBUga5eJ8FabZs83NPNAo1fr8SS9sDDbt8S18B1a:U9xswfCSga8JEa1s83NPao1fwmDDbt8H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681949379, "uuid": "b4b04dee-1be1-4215-8355-8d8ab1fa186a", "value": 352416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681949379, "uuid": "64a0d7d7-65f9-4fb1-b865-259b53486c45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681949379, "uuid": "4d83d70d-e203-4b83-a91a-bef7adc56d1e", "value": "open.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff7eba88-df97-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682007943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682007943, "uuid": "3fb12461-1732-434d-8d85-8c9b917a1811", "comment": "Malware payload", "value": "c1761172e5fb5e2db0ca6672a0967f0d", "object_relation": "md5", "Tag": [ { "name": "obama255", "colour": "#9A8BFD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682007943, "uuid": "a3e1c596-7c1d-4117-bc3e-136648c64335", "comment": "Malware payload", "value": "9036f9b1e55295e3cf93ba06e905e1aacefc7b115895a434492f8a83359ee1e1", "object_relation": "sha256", "Tag": [ { "name": "obama255", "colour": "#9A8BFD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682007943, "uuid": "1d99df90-8498-446a-b88c-8f00d8c26f75", "comment": "Malware payload", "value": "e596c209e8114f47edff21a9384be00546d8edb2", "object_relation": "sha1", "Tag": [ { "name": "obama255", "colour": "#9A8BFD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682007943, "uuid": "337de1b4-497d-4518-955b-07ceabf560df", "comment": "Malware payload", "value": "dd3492d0119c72ebbd7c473b11f54a36fe4cb8437e05eb488579d34a276da7734045d1b2f0f72c78a4aebaa224fe5ac9", "object_relation": "sha3-384", "Tag": [ { "name": "obama255", "colour": "#9A8BFD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682007943, "uuid": "cfd60043-2c34-4759-883b-74508038efbb", "value": "T17D73E78E9282276CFA250068144E7BD0A7F01D74AD62EBBCF44DC3993391968C9FD5EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682007943, "uuid": "7b2d073e-0c56-4831-a0cc-b9a17f74ac53", "value": "1536:Kj/tQlaC6s97mwoOvUGmIg1JF5r8S/p3q22r:Kj/tQ8Ds97QO8GmIgvP/ZqDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682007943, "uuid": "9c660875-9a95-46ca-be2a-95e89f0906cc", "value": 78879, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682007943, "uuid": "2e124e79-1844-4c26-a443-290a115c16b5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682007943, "uuid": "31ddaf66-46aa-413d-b95e-c3085c3950d9", "value": "Payment_330208.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f7d6b3e-dfd6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682034599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682034599, "uuid": "a5659651-41e1-4041-bd39-2a3221c40913", "comment": "Malware payload", "value": "2b5ebe5d7a9ceb1e03683176183fa9cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682034599, "uuid": "cbc10f06-def6-44b1-9996-1f39e417b061", "comment": "Malware payload", "value": "90474155b212711890e4f99cdaeab013cbfdb6936a61c75c8a5c90cbbe813c2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682034599, "uuid": "b1e7eebf-72fa-4bf8-b923-97040aa17338", "comment": "Malware payload", "value": "1cae5ee5788fb8c6de592c925162a708fd3fabcf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682034599, "uuid": "77a4fbf6-b603-4123-a674-4313e7ae5b07", "comment": "Malware payload", "value": "084d5aa001284438667792c9e1c9d1c54781ebe5aaaf00dd45f7c168149847671c187be7cf3a20364c02565c9811862b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682034599, "uuid": "d7a4a1c7-5a15-4195-9a19-c0529d56b49d", "value": "T187835C0274D3D876F97219316574D9A09E3EFA200F629EFB334C567A0F302C19A35DAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682034599, "uuid": "e926adf6-711d-4207-b19e-f3e9e440fb9a", "value": "a7874be41dead82aed3d3f4f4d35ea79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682034599, "uuid": "ea59ecdb-1e8e-4fbc-a4c8-866cd5c1cf31", "value": "1536:eV0QpjNdCHXaRAFyk6amqpdE7bIiP6nM3vPE7fLQ15OUPmZaHsWYcdhRuQ3A7n:/9HXJFyZaHpHnM3XE7fLQ/6Z6hRuQ3Ar", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682034599, "uuid": "5abf0095-f04b-4bb8-b916-4fb559dfb428", "value": 88064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682034599, "uuid": "8a01aee3-4214-4ce9-af88-2bb01ab6bad3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682034599, "uuid": "1b783c8f-a555-49a6-86dd-4200096c395e", "value": "90474155b212711890e4f99cdaeab013cbfdb6936a61c75c8a5c90cbbe813c2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aa6a771-df71-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681991319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681991319, "uuid": "c5479070-54a9-4ce5-aed7-31f6fcdb16f8", "comment": "Malware payload (AgentTesla)", "value": "2d0397bec0c74e7748d7e0e2c6bed27f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681991319, "uuid": "f751a744-2702-4707-a195-39d2cb5f87f3", "comment": "Malware payload (AgentTesla)", "value": "90cbf48cb050beb71174446beb615528bcc469e2d55672a879954bcd1abd9208", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681991319, "uuid": "0d508a94-b36e-4aa1-af7a-c17c8386b6a7", "comment": "Malware payload (AgentTesla)", "value": "862e04fa40fdcea838245561269c5368a486fbc3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681991319, "uuid": "833f5ddf-1348-4059-87df-6c420290127f", "comment": "Malware payload (AgentTesla)", "value": "89ba68bf189dcf763bc7670b2319413e03bd455c8b7881eeb5629c3d9467fb1c550be4939e3de7564b51be23e147c470", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681991319, "uuid": "8b215b54-66c8-4708-96df-2972fc3ae567", "value": "T190F46B7E7A8E6136D03CD3B3AA53F560E37D80276518F56C2CE20A4566CBBCB60C459E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681991319, "uuid": "f60e82c5-1ba7-4f04-a4ef-1b5062e3a436", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681991319, "uuid": "6d17bb86-38fa-470b-851b-be3b915728c1", "value": "12288:DFFaiFBoQ2iNDxolENV0cikuGzlEwR3n1TxbQqZM3PsZGzMRR6:xE8eQ17biUn1TxcD3Pz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681991319, "uuid": "cd4beb27-a5cb-4b73-8ff3-0be4f2e9bb8d", "value": 729088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681991319, "uuid": "de27ae58-2824-420d-8a5a-a9d9962d0999", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681991319, "uuid": "36445c1d-ec0f-4f2e-b615-2f2f610660f7", "value": "NEW ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25ef4b33-df5a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681981379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681981379, "uuid": "2df8357d-4c98-4255-b125-08b67c3c11c2", "comment": "Malware payload (Mirai)", "value": "7d7bca6e56eeedefba31d2fc3c0dbdbf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681981379, "uuid": "d73587ed-4b56-4313-971a-340b4113bf75", "comment": "Malware payload (Mirai)", "value": "933ee9a43f7ae29388d915802e87b0843ebe2536344379e4fb8e14402d2b3a34", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681981379, "uuid": "a3faab81-14fe-47df-8076-480028d5e9fd", "comment": "Malware payload (Mirai)", "value": "112b814b4b6bc54918af13d3e97d72ab781afea3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681981379, "uuid": "c6507d52-0270-41bf-be82-c11fe29fc76d", "comment": "Malware payload (Mirai)", "value": "ec496987800293f723945ea628be13b9efd28ddd0844b540c948fc62a36930930b0b1867bfb3a14119fdc6b465f70150", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681981379, "uuid": "ece76bdc-ebb3-4ec4-8379-ce18a804ff9a", "value": "T104130803689180FCC558C2709E7FB62BD973B47D2271FA4A33D57E26AD4AE201E1F985", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681981379, "uuid": "700c95dd-8f07-4123-b52a-f6b09f79698b", "value": "768:X/gL19PeaMTeknPLhNad3UhyZsnj7wgMZf0nl1pGEKi:oLgTzhNad37snj7w1Zf0dGEKi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681981379, "uuid": "09136000-9686-4f84-b05b-5088a2b255d2", "value": 42240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681981379, "uuid": "3c5507e0-3373-4425-92dc-e6921e56decd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681981379, "uuid": "6c47d689-2738-4518-a07d-44a006f0abee", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7aa6518-df22-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1681957572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681957572, "uuid": "edce0a68-8366-4b98-a059-473ed39bd8d0", "comment": "Malware payload (Loki)", "value": "0455be9da54c7231fea1f2fae056f36d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681957572, "uuid": "5e532221-a35a-423e-a806-60501a8589f6", "comment": "Malware payload (Loki)", "value": "93cc16dfe8c10579f28d8d70196f5c64044493818861f32c9d3e8f15cc3b7aaa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681957572, "uuid": "ebc48033-d803-4c30-b0ba-060bea26ff9a", "comment": "Malware payload (Loki)", "value": "49d7a9eb258f5ee93c3985e38e4eca852c37dfef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681957572, "uuid": "9094f6d7-46e0-4846-9ba6-7db5257cc1f7", "comment": "Malware payload (Loki)", "value": "ae9833f248440575cb22e1618044747ecb7f8595074613d5a9803e86336c14c8dd2414270985ba824eb14f480592de72", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681957572, "uuid": "91939797-6730-47c9-8444-9354e0084759", "value": "T1A3746B3262D0A875E5274B758E1EC6B47A6EF4605F567BEB23484A3F0A701E1C6B230D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681957572, "uuid": "bc8d4f0c-a90d-4f44-84d8-47e3493f60e4", "value": "e690d90f10792337897b6f984bebcd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681957572, "uuid": "6111ccc6-a8e2-45bb-8891-84f65b85a691", "value": "6144:g2euhqu9r/bsW+ERywB6v01RfRmI0Hn20:g2Dhb5zsW+jwY017AP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681957572, "uuid": "c17bb545-8159-443b-9c4a-b0e088f2e065", "value": 361472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681957572, "uuid": "e0087e97-2888-48ca-9e5d-45d800e2e157", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681957572, "uuid": "e3c614db-6269-4a04-b437-4108c54dbf74", "value": "0455be9da54c7231fea1f2fae056f36d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28138a33-df89-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1682001569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682001569, "uuid": "6a399174-201d-4489-b761-d31677d9b76f", "comment": "Malware payload (RemcosRAT)", "value": "fc8e96f1d9986d40288e271e507f40eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682001569, "uuid": "34a20b24-241f-4eaf-8442-e09b50fbb3e8", "comment": "Malware payload (RemcosRAT)", "value": "94af8e52ba7f318340fac9ad628cc865901ba2825d7a609ce665f36c6258cd71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682001569, "uuid": "572ac994-5808-404f-9b13-50039f2de5a7", "comment": "Malware payload (RemcosRAT)", "value": "98c90cf808372750a9ca6497e2b124ddb7fbcd1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682001569, "uuid": "c9e83083-8224-4eac-a8bb-33f587860d16", "comment": "Malware payload (RemcosRAT)", "value": "deb190ab19ddbdde55fe6a5a67d5ea704feb6abbd8870faf216b5d36e19d20ffd5c9f7f540b14c0609deee6f169b6863", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682001569, "uuid": "29338b0b-90c6-4c6f-8118-583f299f206a", "value": "T130B423089AB4C861F5E118F52D3B1B1B67B05C1164768A8F53A1771D7F2A082FE6E3A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682001569, "uuid": "5f6b98d7-8bec-42df-bb33-bfc5bc1845c3", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682001569, "uuid": "179d5d2e-d8d2-4311-a05d-63e4984c1dcf", "value": "12288:JYC1CBhCkSqAGbl9HeopsWt/fgiLu3GEWtBYJBjEvLrmTZK:JYmCCkxJreoCWOMuMbwsOA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682001569, "uuid": "00061d14-bf5c-4a52-9fd9-09aff25cafdf", "value": 526091, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682001569, "uuid": "d6775d54-407d-4434-bfb5-23431e7c0c0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682001569, "uuid": "b40ed865-6ede-4df2-ba08-29b2683f652f", "value": "08654345678900TE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "718bf3ad-df3a-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1681967762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681967762, "uuid": "62be339f-2766-4723-b3d7-d4305e2e20c1", "comment": "Malware payload (SnakeKeylogger)", "value": "9655a3f46b32a3a84fc88c57a6c44413", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681967762, "uuid": "b67441b0-251b-4502-8f97-f99958566dad", "comment": "Malware payload (SnakeKeylogger)", "value": "955c0ad9d9932e3717b20c5945c202fd72fd115d1bc86a0ba43ddbac19abf7a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681967762, "uuid": "52d2fc9f-9304-450b-b69c-28926b657574", "comment": "Malware payload (SnakeKeylogger)", "value": "005c3aa4fd79100c472fb99438b23674361dc8fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681967762, "uuid": "a46b387b-62a8-4c54-aa76-fdcf41aa7583", "comment": "Malware payload (SnakeKeylogger)", "value": "f6dcd74bf1bd1a9b998cf1c21e7a35cb94e943538eaf32ebc22573b65d19ab36cfcb15ef42505a24c2599929d35ae366", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681967762, "uuid": "81c1ec52-da6d-4872-8523-6d87af383fb8", "value": "T1A6E4E1947377D692C2683D3D51AA60682BB089CBF557C929FDC900497E2BBC91EC078F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681967762, "uuid": "ab85c053-4223-41ad-8780-07ae60c62e5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681967762, "uuid": "73733df3-538a-42e9-ba33-1e75e8482bfb", "value": "12288:cQ7Q3IjHMH91DzZziAaSg5ZaSwJH1Bb6qCpVz5UV3NsZKck:cQ7WcHMd1DtzySknwr1CpVetNWk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681967762, "uuid": "9f5db9e9-b3b5-44de-889d-b6afe244ff9c", "value": 705024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681967762, "uuid": "f5dec590-c1fc-4405-94f2-16951855937e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681967762, "uuid": "8aeac3a6-b08c-488b-857f-6fd125ba6758", "value": "PO42024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59c0a9b3-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681985761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985761, "uuid": "67d42352-5fda-4341-b5f3-7298c766dfae", "comment": "Malware payload (AgentTesla)", "value": "b66b1368a250aeae2f1435020691b9dd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985761, "uuid": "9d83ddb8-9b85-4fcd-aaf9-b9a2483b1ac6", "comment": "Malware payload (AgentTesla)", "value": "959676cb6fe2a6c267ed731c12ec4e5bfcc6320aae7aab6524d4c3dc6f30f595", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985761, "uuid": "5688cb1d-eeb0-4dc9-913d-879d78516c97", "comment": "Malware payload (AgentTesla)", "value": "0070676b098e356dc7e08609b22aac735ad2b022", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985761, "uuid": "3e69c4eb-5232-49db-8e35-7766290173fc", "comment": "Malware payload (AgentTesla)", "value": "909c1322cd56e10328dc4c6e9a0b77b2489a39bd1172f17b204e5a8f08f437f900a3bf9293b4813e8571510f21f7f685", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985761, "uuid": "68c7633a-29c7-472c-bdfb-6609eaca514c", "value": "T1E4F32A28B2999DF2D32D4174D4B03148CAB2D1478217E6DD1EA16CFA3F867C7362E867", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985761, "uuid": "397dcd2e-4020-452b-a780-78360fbb1420", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985761, "uuid": "5ca17b34-ef2a-4a74-8c44-c099fe247944", "value": "3072:lnQ3o1qRge1BpZzW85i0tXqgcPxr5OmFTLwEJFajvf7E:11MAeTtrG5LfJkjX7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985761, "uuid": "7764a6cb-54ff-4785-8bcd-9b7da96f5cd3", "value": 168448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985761, "uuid": "4b7e6ef6-7afe-4a14-a6e9-831f797ace76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985761, "uuid": "3dc9e29f-f805-440e-9bc8-0a307ad9865b", "value": "959676cb6fe2a6c267ed731c12ec4e5bfcc6320aae7aab6524d4c3dc6f30f595", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "973f9c01-df4b-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1681975127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681975127, "uuid": "de0a2ee4-4be9-4e1b-94d9-a5dc4fe5c75a", "comment": "Malware payload (SnakeKeylogger)", "value": "704f8a072e32818ffe6946edc2f5cdc9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681975127, "uuid": "92d003e1-02b4-4058-95a2-1fa7d44bfe19", "comment": "Malware payload (SnakeKeylogger)", "value": "95a4f31cf9b3c1876798edc24aa9323d84e35a3c6d0fccbdde059e4062e50f78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681975127, "uuid": "aa5d982f-9d74-4048-9ada-4a562e1f4c80", "comment": "Malware payload (SnakeKeylogger)", "value": "16ffa983c59f65555d228d7001e025291eb4a99e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681975127, "uuid": "629e2de7-c387-4466-a301-b4104b47279e", "comment": "Malware payload (SnakeKeylogger)", "value": "f6adeee8a057ae0c54170af638a5e1db388d79abd40d8a939fc2427ac8cce4a730b374e1a3b33f6329bec0a8fad5de2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681975127, "uuid": "9441a591-bed9-43ab-824f-30a50083b621", "value": "T1D9155DD1B250C9D6D95B29F17D2B653024A36E9DD4A4810CFA9D771B3AB33C2209EF0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681975127, "uuid": "7b6c1682-8cb4-4e4c-9158-1dedf8c58340", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681975127, "uuid": "8204e028-7219-4fd7-8fd1-c29fa14ae01a", "value": "12288:V2iN3Z1FQCzmOEjtf+0YFMWasJUFumqp0aGjq:V1hfFdmdhfmNmqp0aIq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681975127, "uuid": "65d1149b-b4aa-4135-a9e5-2daa6e511963", "value": 909824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681975127, "uuid": "6ccef771-6118-441f-959a-7e11fad0acb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681975127, "uuid": "25940ff5-cd8f-44e0-9818-9af28df689de", "value": "\u00d6denen Faturalar.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c891ad59-df3a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681967908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681967908, "uuid": "eab22afa-7be7-4ec8-9075-38bc0fb334f8", "comment": "Malware payload", "value": "28c7aee6bfe15f9a4315593e0b5ab302", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681967908, "uuid": "9427fd45-e013-4f41-9133-5b56165dd782", "comment": "Malware payload", "value": "95dbfa33af8d805f7fa3edac0252f43e8e6228f3362ed221159401f0d0bfa4d3", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681967908, "uuid": "de1ec4bd-659c-47bf-aa47-f5e0cc98cb35", "comment": "Malware payload", "value": "c1ee53a3f90c27c97b42f87d4f12b5ae1e4f6289", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681967908, "uuid": "1a9b5980-b2c2-405e-af2d-4dddecb90833", "comment": "Malware payload", "value": "217bfa89290e25cea67c1c450b8ff222d0e6c6f0a59f106c2e73282bbf794f5e7dbc1048d95eec7c9b05624f40964c47", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681967908, "uuid": "a00776bd-8a17-4e8b-8b60-f9a009c81f98", "value": "T1B3F2075AE75F1268CF461276271B0E88A6BDB23EB35051B138AC933433DDC7D06666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681967908, "uuid": "ac1f38a2-30df-47ef-a1b7-9a002ae2ff50", "value": "768:SFx0XaIsnPRIa4fwJMeHfkHSd79kzfd7c:Sf0Xvx3EMeHcHEKVo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681967908, "uuid": "6550e2f1-c652-4067-a8ec-cc7bf715adc8", "value": 35281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681967908, "uuid": "9b7f4147-8e3c-475e-90e4-98ad44965b40", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681967908, "uuid": "18514af4-dbcc-42cd-89ab-d6cfe5017c4c", "value": "PROFORMA N\u00ba 178 - 23.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eecd539-dfcb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682030035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682030035, "uuid": "d2eb68f7-4cd6-4df7-875b-5ca54156ad96", "comment": "Malware payload", "value": "2b3e31379a294e0fc4c79aeda508df0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682030035, "uuid": "7ad92352-e19a-4d67-99f9-da5213deb011", "comment": "Malware payload", "value": "960a06e77056fcb5c52f4e87f39fdfeb31ad646d52b429ba8acc91d8288399eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682030035, "uuid": "58a07d17-12b1-4f82-910e-17ffc2681937", "comment": "Malware payload", "value": "daa73d9e7e1e739e1c97216b7dd768f55a25d885", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682030035, "uuid": "8c6963a2-333c-49c6-90a9-fcde292e5488", "comment": "Malware payload", "value": "f7e4e341c2d0f097c9108acd883fbf2af15363a23b1e9d53d7e3cb279904665de3c201a748b6d1a24126e6e55c172221", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682030035, "uuid": "f0f5c815-506c-480d-9ca1-18ebd4288dde", "value": "T1E9748E123294E0FED016A0B88DE5C4A8761C50F23FAF69D76BC61E7D47293E5B3A4217", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682030035, "uuid": "c82c4a7b-66a1-4cba-b085-e669b3d1fef7", "value": "7ab88a2560b399bb2f4b089a0ec1f31a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682030035, "uuid": "6d12cceb-f27e-4747-b42c-b31ab252fc06", "value": "6144:p6EjBK5G2/Ng5E8ZEWTXkx6gf25R9o+Bo:p6EI5GUNgm8ZZTXkw225RW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682030035, "uuid": "05e39f96-40f4-4169-b658-a2b908a0c643", "value": 351904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682030035, "uuid": "98a459a0-d94a-4538-aaa0-398c3e4b06c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682030035, "uuid": "cd9ce937-b59d-4c3e-a68d-59d1c2bbe1ce", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a803eb9-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681985762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985762, "uuid": "e7cce8cf-19c8-427b-bfef-011a86de1c60", "comment": "Malware payload", "value": "42bd0c54ac73f7029627727ff8947c14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985762, "uuid": "baae1458-923b-43f7-b96d-0a2244fa404b", "comment": "Malware payload", "value": "96941c98c7fbc34a2541aebeed4483112ec431a3a3e8f8c9aefcfba48d9ef6f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985762, "uuid": "03d75fd0-19f9-410a-a789-20f1654eda7f", "comment": "Malware payload", "value": "6ec99cc98e98ae938a83c673f5f6a8934b920c1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985762, "uuid": "21fd51ab-6857-4da7-b095-a64f2254db01", "comment": "Malware payload", "value": "ef1fcebe9e0e1d63de9d17790d1c058f4fe5efb9a807b77ab07787c6db457b9f68ed483783a567731af0603aa3666e1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985762, "uuid": "1b29133f-2322-4b37-8d33-88df47a0ee17", "value": "T171932801F2B490F2D0A3D6305A6AB731EB75FE286D09BA4BA150DF4E34B4C55CE74B4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985762, "uuid": "1c44267a-30a2-4011-a6d7-b495d5643417", "value": "1536:q2jLC3D7fgMRcB2xOgZ9wjZu3/WVqzsCXNdziZLBu/cVU2n:j3cHflTnouuVqziZLmcPn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985762, "uuid": "e5f3a0ba-adb1-43e9-bece-a6839c171433", "value": 96256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985762, "uuid": "63317256-d62d-4288-bcd7-1f905be9c1dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985762, "uuid": "cfc8f974-3f95-4ca8-b63c-cd4b2d643e44", "value": "96941c98c7fbc34a2541aebeed4483112ec431a3a3e8f8c9aefcfba48d9ef6f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72ee3fcf-df51-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1681977643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681977643, "uuid": "c100e5cc-7400-4fc8-bac5-96676dfd12f6", "comment": "Malware payload (Guildma)", "value": "0da6536e754f08a157c4d3b7aa3b088b", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681977643, "uuid": "11e0dcfb-d8d5-468d-8522-6987be92cbc4", "comment": "Malware payload (Guildma)", "value": "96d41f752238377c3209ca2af867e90ebdd7ea5366142fa09c78ccab3d3cb809", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681977643, "uuid": "5823cc8a-ffd7-4d9f-93a3-50d2c2f4299f", "comment": "Malware payload (Guildma)", "value": "2f729525a31099698198bb2a0eb41025d4280a7d", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681977643, "uuid": "879b588a-5d0a-4724-84b1-9d20880c155b", "comment": "Malware payload (Guildma)", "value": "9a9ba18ee270339faf7f33e567b44bd041d41c729756b4c207676b8855838a3f2aa9beb05040055312d6fc7ddb561c57", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681977643, "uuid": "e4749098-24f4-40a3-9c35-b99dc680bb35", "value": "T150629DDE22A1F51C2E609B502DF060D4C1C9C53B40F6D782FEB194C5A3EA85DB9EE66C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681977643, "uuid": "54d9c3a5-2d9b-4543-a212-dac800ff6482", "value": "96:RoAOlgfRoVCr4lPTIVDHYlxCrGXBS15P4Qxx7D6P1UZ9w3FTsbjERRhFOR/RbZ2x:WraJL8l8HIuu6XNeZuFnfVOlrIJ02ElH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681977643, "uuid": "ca28a751-032c-4f88-9ae3-b46ebea4b17c", "value": 15599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681977643, "uuid": "7af518d0-7a80-440c-99c3-8ecae819096e", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681977643, "uuid": "47226607-d064-414c-9c95-324835489629", "value": "payload.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f2fe18d-df5f-11ed-88f6-42010a9c006e", "comment": "Malware payload (LummaStealer)", "timestamp": 1681983596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983596, "uuid": "e9fcad0e-b56a-4ff6-a3b7-c1ff615b3f19", "comment": "Malware payload (LummaStealer)", "value": "f43b81a1338524b1d58992ce2f82b7e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983596, "uuid": "9124b3e1-76d7-4bbc-8950-c520718bbbbf", "comment": "Malware payload (LummaStealer)", "value": "976671946ff6f75662ad1e8945d3cffd6f5cdfdc4a675a6ca50c6030d589ef46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983596, "uuid": "605b1ec9-ca75-49aa-b85a-e0af39bbdae0", "comment": "Malware payload (LummaStealer)", "value": "7c6c0c18ddace558a1c8cfb0c9325b1c4eef3d54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983596, "uuid": "827f01e5-5b31-497b-a5a6-b7f8f16183c0", "comment": "Malware payload (LummaStealer)", "value": "f28e24584e50eab92f23b515fb16ba363e5282a16c3c7b459ccf23f0b62c654f4feeadde05748019d18eaafd78c42c78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983596, "uuid": "83af9751-70ba-414a-a6ff-56283327411a", "value": "T1D0E5E09C726472DFC867C4729EA81C78EB6078BB971F4247A02716ED9A5C897CF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983596, "uuid": "d9bd1466-2528-4ed2-99e1-8a08cd058cba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983596, "uuid": "6c1cf818-73d7-4392-84c0-01d307d68a37", "value": "49152:ruY8ck6k7cO4qnfXqbqLMw2k0iw1XHVVvJxJDbGmpt3otbv+yZcXz5hWVRwYTz:aY8Ok7Lvs410iwBr/HYv00RwW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681983596, "uuid": "0543b645-36e6-49bb-a023-8d27ac83d671", "value": 3210752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681983596, "uuid": "bcbf14fb-f5f7-4c9b-ac3e-871a4a93c476", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983596, "uuid": "eec2373a-b60d-4fc9-8d01-b3000d0f4bcb", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b4cae0b-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681985763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985763, "uuid": "1d846bdf-0f84-40ad-9c1f-66c123d5cc52", "comment": "Malware payload (Formbook)", "value": "65fc3963aa66fc645b259909ff20fafd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985763, "uuid": "f27ea3db-9590-4807-a3e9-cb5114547696", "comment": "Malware payload (Formbook)", "value": "97ed764dcebaf5d2aef6e34f294e8933d5aca907754d7d4989c7985402660b0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985763, "uuid": "a68c811f-ac02-4f9f-8103-fc03ac7e6326", "comment": "Malware payload (Formbook)", "value": "efaa1cfbec6612aaf3da7549412700269b816dae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985763, "uuid": "bb051fb9-4384-4333-a68d-e5cc064b7d66", "comment": "Malware payload (Formbook)", "value": "097a7825794058d268804c2848364ab185c997c06563661642cfc5180869681a21bf2ede7b04578a35d770087a755c3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985763, "uuid": "75f0efda-100a-4749-aae9-792749cdba33", "value": "T17C04AE32DA42C431F2B252B5B2BD1B7B883D0E353295A4E9A3F115E06EA19D5F43931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985763, "uuid": "7e9f7b92-cffe-48f2-bd06-5b6915858b00", "value": "3072:1GcUkxSHP3Er83AYT8NGSYW67OycepITU+ucNRPvCwlUKw:rysyAq6x6KycsUucNRP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985763, "uuid": "fba55167-cf1d-48b2-b8b5-7e72e5dec904", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985763, "uuid": "8a86d65c-3688-4bf9-bf60-7dd3db465135", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985763, "uuid": "b6e9bb4f-e451-4804-bbb1-698341b9ec50", "value": "97ed764dcebaf5d2aef6e34f294e8933d5aca907754d7d4989c7985402660b0f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb92eee9-df3a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681967994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681967994, "uuid": "379228f7-b556-46dd-834c-f7a53dad1fb7", "comment": "Malware payload (AgentTesla)", "value": "813cde91a2add539ae8ee2b52ebf0c22", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681967994, "uuid": "9d821d74-f19b-4fc7-923b-020b84b778fe", "comment": "Malware payload (AgentTesla)", "value": "9889d1eb31d43028e89ee3881d3f4e2a46baf14552fb9c5edc4bca8b6678befd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681967994, "uuid": "db7459ef-5d58-4855-8f3b-cf6b7d700bc0", "comment": "Malware payload (AgentTesla)", "value": "a0dc1d60220b9bf0dcf3e28e13e40fbdfaa36514", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681967994, "uuid": "312af614-bda1-426f-933a-ba35bd5de5d7", "comment": "Malware payload (AgentTesla)", "value": "bed647dd962f346a0a3e5a604bd6bb24b01ccf20ef7ede2afd83927b8809dafee48803e66e9d4fef21bb11bf2432d4dd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681967994, "uuid": "19061e72-da4b-440f-802a-47c45635082b", "value": "T14EF4D0D8B367D762C1687D3D41EA61282B7099C7E967C929FDC401897E26BC81F807CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681967994, "uuid": "3d671298-7155-4f69-bfd7-8c42ef3f461f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681967994, "uuid": "869753bc-60aa-4a70-9223-4e316a99b3bc", "value": "12288:DiUHMH91DzZtmOKbgQWFbhnBmschLzj6W0o:2UHMd1DtOFWVzEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681967994, "uuid": "81487f7f-ebe2-4f4a-b362-2375aa48533d", "value": 723456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681967994, "uuid": "ad2b35dc-57c2-41a7-8b9b-ad9a1df8e14a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681967994, "uuid": "8ab7c787-d2fa-4a53-9c51-317fa1c96122", "value": "DHL-AWB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c0402f3-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681985765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985765, "uuid": "831c3716-6c59-4b91-be6f-16f237a05971", "comment": "Malware payload (AgentTesla)", "value": "173dca1136f18febdf8370b171eab365", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985765, "uuid": "0eb0318c-23dd-4317-8497-d986b5f94920", "comment": "Malware payload (AgentTesla)", "value": "988de5533ea7c98cdc0974eeb98cc650bdc4f991df9c8f0f85c5a7d4e7611b45", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985765, "uuid": "4e85b50b-bec6-45d3-a177-6690640c2dc9", "comment": "Malware payload (AgentTesla)", "value": "74528a60287cad71165c6c3fe2fabdcab9fa0f10", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985765, "uuid": "65e31ecb-e106-41ed-bff2-5d9c70f0b34d", "comment": "Malware payload (AgentTesla)", "value": "38af9f78c32f5ff233ce1965fe8e3efa3277105b131692292c793a2fd053d7a981ff175b45346fc4ed8ac77092315dad", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985765, "uuid": "a70cfb07-94c4-4376-a690-7dea347a2d0d", "value": "T14CF32A6892C88DD1D32D4374D4B31258CEB29146920BE75D1EA16CF6BF4A7C3722F8A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985765, "uuid": "354a81eb-345e-46a9-9c1e-162176a42f16", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985765, "uuid": "eeda9bbe-193e-4711-997e-86bff17cb817", "value": "3072:iyzTK8f3F+1pzml3eK2lB5rY8PDP5oYBInBc1AXG:i4Spzu332r5F53mc2X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985765, "uuid": "349079cb-ba16-4a2b-ba0f-b36762f7d1d4", "value": 168448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985765, "uuid": "63543010-e3b6-4caa-abd1-11ef1c0314ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985765, "uuid": "142d6bda-d355-4fc5-a373-81ab46089b7d", "value": "988de5533ea7c98cdc0974eeb98cc650bdc4f991df9c8f0f85c5a7d4e7611b45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41bc2081-df47-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681973265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681973265, "uuid": "a9805c7c-bc3d-4c4d-a842-9e41ec1ac1d1", "comment": "Malware payload (AgentTesla)", "value": "0d61df769e87fae8d83c001b9c015762", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681973265, "uuid": "1c13b05a-a464-46c9-a82d-e919187ff3d6", "comment": "Malware payload (AgentTesla)", "value": "98d4406e8ee40991fc7008774e833e0b6cf758ffedd7e06023a926a06646591d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681973265, "uuid": "586bf047-c49e-4612-a205-326405f90877", "comment": "Malware payload (AgentTesla)", "value": "987a1eb11b8f55e8ea42f6a23e144af9f0624b44", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681973265, "uuid": "0a9dcc58-4b79-470a-a0d4-571662948211", "comment": "Malware payload (AgentTesla)", "value": "31d24d420bd6e1cca8c0e49969f112753a251555f6d625cc6339a04d5d3b98a94a098750c434d65341f93453c43bc875", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681973265, "uuid": "574af9a2-1a2f-48a6-b05d-d3747737c703", "value": "T147D4E0D86765D792D2743EBC127A20383FB0559BE526D935FD88A0DA3E32FC8194078B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681973265, "uuid": "11d7260a-8467-4e08-9252-0ca9ea122d95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681973265, "uuid": "ed9d58d1-bd57-47e5-acf4-5d5a74a0c348", "value": "12288:fdkWzUJGUWdlWGlhVXAhrMDMHKdQhbsFGNQU:loJGUWdpX51QR4Gt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681973265, "uuid": "c1b7046e-f438-4604-84b0-2b7e5dab0db3", "value": 633344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681973265, "uuid": "ca183fa9-f5a3-49d4-8678-76e3378b1473", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681973265, "uuid": "7e0e1722-5efd-411f-b71d-cac3c7ddce93", "value": "DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc45938f-df77-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1681994194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681994194, "uuid": "c5e6366d-c3b9-4231-91b3-69fddf2e29de", "comment": "Malware payload (Guildma)", "value": "6f7cc28acdb4c9f84f852e349a19509e", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681994194, "uuid": "5486b87a-4c6f-4237-be5f-f62304a9be6d", "comment": "Malware payload (Guildma)", "value": "9996dfe66ac05195650beeea8a39bb5202f10909fe60c71367a9f13477e919fc", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681994194, "uuid": "98aa1d54-5b51-4df6-bff7-956f7e15952a", "comment": "Malware payload (Guildma)", "value": "0ec93dd1acccc4235929a34864e2871422f4565a", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681994194, "uuid": "fc10ea6f-1632-4593-976c-f3cc41227826", "comment": "Malware payload (Guildma)", "value": "f8990a160afb48a8d674ba12b9d04eb6fd1549fcd0679d5cb6a0ba37f80601e26f8fe0b7c5717b078c1c04dd5ef2a337", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681994194, "uuid": "53a9708f-643f-47cc-aa67-7ecfecf86069", "value": "T189017D6953B90E7F88B25684CD356E0C94F6CCF20E5FE49FDA133448C9255E10FC0A15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681994194, "uuid": "98627c1e-c270-47f1-bcc7-ef9182b86c21", "value": "24:QFbrUTfz7aaG7a6a8s7aw40u77aS7ap7a4AtAtaYaRaDz:QFbwTfXaaga6apa2Iacada49aYaRIz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681994194, "uuid": "a379d074-0c1d-472b-849c-f75df357e72f", "value": 799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681994194, "uuid": "5001f564-6baa-40bc-acda-0f4a18a2074b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681994194, "uuid": "2780f644-354d-4a09-8a96-74451b57d63c", "value": "Factura_Archivo3203222918.805847.51941.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0593f4f7-dfa4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682013107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682013107, "uuid": "f97d1339-92ea-4927-a4e2-4708077e753c", "comment": "Malware payload", "value": "ff06e555f156b7bbf80ee56098446bae", "object_relation": "md5", "Tag": [ { "name": "1681985211", "colour": "#1A34F8", "exportable": true, "hide_tag": false }, { "name": "BB24", "colour": "#CEE0BE", "exportable": true, "hide_tag": false }, { "name": "pw-671", "colour": "#91B373", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682013107, "uuid": "f8c656fc-5683-44bb-a510-9ef8d64d1d09", "comment": "Malware payload", "value": "99d2b53d460beba30a2c8cd715985bbab3358ddfea9cb135a3ccdf59fe258d1c", "object_relation": "sha256", "Tag": [ { "name": "1681985211", "colour": "#1A34F8", "exportable": true, "hide_tag": false }, { "name": "BB24", "colour": "#CEE0BE", "exportable": true, "hide_tag": false }, { "name": "pw-671", "colour": "#91B373", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682013107, "uuid": "16c2d347-efdd-4c3d-8696-3a11558a8a79", "comment": "Malware payload", "value": "8703916bd9f58818d315b6a6fbb010fd96a66640", "object_relation": "sha1", "Tag": [ { "name": "1681985211", "colour": "#1A34F8", "exportable": true, "hide_tag": false }, { "name": "BB24", "colour": "#CEE0BE", "exportable": true, "hide_tag": false }, { "name": "pw-671", "colour": "#91B373", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682013107, "uuid": "1cd3d013-e506-4494-9499-95a7d244040e", "comment": "Malware payload", "value": "6c787d836429ae91daae54013d50a642796da34f1a178126437831508e2eb8754649c84e975839f735b890c874605ea2", "object_relation": "sha3-384", "Tag": [ { "name": "1681985211", "colour": "#1A34F8", "exportable": true, "hide_tag": false }, { "name": "BB24", "colour": "#CEE0BE", "exportable": true, "hide_tag": false }, { "name": "pw-671", "colour": "#91B373", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682013107, "uuid": "a1186950-50ed-4870-8758-5be0ecefc58a", "value": "T13AC313E787660E34DB1C827FCD5BC8CDDA2AAD712B22BF0ECE47C58575844AA1D0D216", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682013107, "uuid": "cb6fd8a4-941c-4067-bf7c-a4aecd96e833", "value": "3072:/UUSpYYT9uuDZmM9eoQUE8q8bNcUGvFnzxmwblNLY:/ayO59eoVbNcUoFndn3LY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682013107, "uuid": "78e0caf2-67ee-47ef-bf7c-b55e29f41656", "value": 122345, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682013107, "uuid": "0caae499-cc7b-4359-8afb-59fe9201f4c5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682013107, "uuid": "a9be56f7-4dbd-414b-af69-503ecbc0640b", "value": "I.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f75ec46-df12-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1681950525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681950525, "uuid": "a9f00192-3e60-4213-a70a-aed5900f7f3e", "comment": "Malware payload (RedLineStealer)", "value": "46c0581b214039de3fee2ee86fa93129", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681950525, "uuid": "d9f4dd04-93e6-485e-8836-e80bb80c5690", "comment": "Malware payload (RedLineStealer)", "value": "9ab695229439bdc061c913dad750de0641ee3692c782b38478c3ee460a241bb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681950525, "uuid": "e202606b-6fce-462f-a3a9-15ba9fb996eb", "comment": "Malware payload (RedLineStealer)", "value": "87391d2f58a1642e49d846329cada5c420cce67a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681950525, "uuid": "f0364733-06b7-498f-8a45-f04317c15b47", "comment": "Malware payload (RedLineStealer)", "value": "bc6434fa371e4f37b5310689fbd71c7a51180d631dc45accaaa9a6a3a6b007d9e59023ea556679432455bcb25029c489", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681950525, "uuid": "724d3d75-1663-4383-96ba-3dc2d187b467", "value": "T10235231363DC8866DEF907F058FA03C30775BDA34BA1C7A7268A5A8D49F26C86931717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681950525, "uuid": "1e627c7e-6ced-4baa-aedc-06559ec4a1b2", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681950525, "uuid": "23056eb3-fc20-4157-ae4c-67b17a3a75ce", "value": "24576:xylQPMkTox2EdxHvEQNu62bC++4wHqAVifheBX8XQQZ:klQPMkToNxHzmC+1wHqnctQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681950525, "uuid": "f01ecd95-b12c-4a17-b1a0-8e5fa87fc5bb", "value": 1138688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681950525, "uuid": "043a7ed4-ea74-480f-ae5c-2ae4cdb8d795", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681950525, "uuid": "60c8534c-dc9d-4e60-8297-be8185ae6945", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56a51e9f-df54-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1681978884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681978884, "uuid": "7921fe66-d516-4ebc-b491-9f84317c3a71", "comment": "Malware payload (Quakbot)", "value": "64d0eb04b56ec4f561a1cc02138042b9", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681978884, "uuid": "6b5948eb-feed-4c59-9094-87dd871991f0", "comment": "Malware payload (Quakbot)", "value": "9b80ee46ee2d14b1e2644207165d8f63bc2c8646a5d03289c937b6d5235d2623", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681978884, "uuid": "51ec7bac-d26b-49e6-9718-24c4e6caa285", "comment": "Malware payload (Quakbot)", "value": "09ade622ef4f853002441460e72990908ee3d714", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681978884, "uuid": "fb59a001-cfab-49dd-a484-1b9d670db7d2", "comment": "Malware payload (Quakbot)", "value": "82ace6cd7d5d28328864d231a53d359df5ef170de0463ed4c7f3b66e2014f460bbf81f1d0a4cc672ebf6aeccbcadd537", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681978884, "uuid": "f196da83-4bad-4c22-ae28-0f1f8e4206c7", "value": "T17072751BA38A1375757B01A066ED7AC5D335B0B833E596B0506ED06CA3C2EF40E765EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681978884, "uuid": "cdfaf3b8-aaab-48ec-92f6-998101a518b3", "value": "384:AZwOuqQwE5nyzqcqHTapEaQRCfK9wV/bJmUtPYZWxD0:ATumX0TapEaQt6/1ZOWS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681978884, "uuid": "282cb50f-c2d2-43d4-aef4-023ddefd11d2", "value": 16986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681978884, "uuid": "5e81b148-89c6-47d2-bfbd-4bd1329cebeb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681978884, "uuid": "098aa47c-df8b-4c97-bfcc-f61f45bdbf9a", "value": "Complaint_Copy_463913.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d3d30d2-df86-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1682000262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682000262, "uuid": "5b2f8a9a-3e9f-4022-8123-bcae2ebe17b6", "comment": "Malware payload (Mirai)", "value": "b29fdde40c48a4e1dd953c3565a41976", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682000262, "uuid": "aa26c959-2c4a-40c1-9872-f0ce66ca6548", "comment": "Malware payload (Mirai)", "value": "9bb3a06de226e3dfb3ce9a124fa6fddee0d429b02ab1a1c494a8f64f8aae153e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682000262, "uuid": "064d65fd-3baa-477e-925f-0f628caebca7", "comment": "Malware payload (Mirai)", "value": "422eb66fd443167297a99244d7977b1e1d8311ac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682000262, "uuid": "33460839-76d2-469d-badb-61e0d9e2708c", "comment": "Malware payload (Mirai)", "value": "12c02ec54b5efded8680c3037219dce83c31b6d5c95ac2c3f4efb5ff8fcb0a31a7f50d252c839abd5b3e2ec8714fbdcd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682000262, "uuid": "403f7246-4c84-4ce0-8178-44f2837d064b", "value": "T1CA634A01775C4E43D1A61EF8293F27E193EEEE9021F4F5842A0ED6465272E33994AFD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682000262, "uuid": "502d94b3-ec6e-42c3-83c0-1904148b47ac", "value": "1536:ZjVO2KsrO4zb5BdotBpTaQnQSe1ECj5ds:CPsTHdo5NQSe1bjrs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682000262, "uuid": "d62cbb73-9d49-42a7-b64e-09934271f411", "value": 67576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682000262, "uuid": "ad6ba030-ccd4-4b38-a7ab-791930e01b54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682000262, "uuid": "2adde2a3-5097-41f7-9951-ace8549fc9f5", "value": "b29fdde40c48a4e1dd953c3565a41976", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67cbaa10-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681985784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985784, "uuid": "73224487-c108-40c0-adfe-dbe7e9c7180e", "comment": "Malware payload (AgentTesla)", "value": "3088bb32b972b7f9382cf484558ec84d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985784, "uuid": "a59b8917-0ac7-4897-9346-2d213fa5b43d", "comment": "Malware payload (AgentTesla)", "value": "9cefc5f1d6bfd34ee5e77486266a02f077a276fb2cffd1eec3b9e19c79d823c1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985784, "uuid": "bc358a87-2b81-4c03-b0f3-bcd29b70171e", "comment": "Malware payload (AgentTesla)", "value": "adc30572882ec442f1449e95fad448bfb7bd7e6a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985784, "uuid": "54307897-ee4e-4f4e-89ff-d6df417075a2", "comment": "Malware payload (AgentTesla)", "value": "cc5c74376b3731e5dd812f5ec1a6907496ffafbb0c565ba9a3c2bfb9afaccd5cf5c57f4c199b109f2c867e03af7a7cd3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985784, "uuid": "adf0e742-20dd-485b-b02c-b0402bdbdf89", "value": "T1F4D4F129A170EEA2D6AE0776002436DCEB7152A73473C23C4ED774DAA76FB191CC4987", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985784, "uuid": "f1372e86-a685-4f06-adbf-0ccaeaffed16", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985784, "uuid": "f5cba3d4-8da7-4015-ad9d-0bb4f33dd13c", "value": "12288:FPGKNniHsLoTDi30Am+NjMWJcY5rR245hrMaUyKRU6EIHcAeishJPY:FBiMoakGGWJcz45hrMaU7AIHcPL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985784, "uuid": "31b3ca91-504e-44de-9f0e-7eed3e23255f", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985784, "uuid": "98a99121-fd8f-412b-b78f-7d5d4c0d736c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985784, "uuid": "cfe2d01b-f7a4-4a00-8292-7eaec9e28ee5", "value": "contract.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5cfbdb1-df56-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681979956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681979956, "uuid": "87424aeb-9db5-4c9d-8a8c-3d042468ad6e", "comment": "Malware payload (Mirai)", "value": "812fbb0847197d25a6076ddbdfd9c782", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681979956, "uuid": "471a3520-aad3-4787-ab02-ca0887c77a36", "comment": "Malware payload (Mirai)", "value": "9ed75805eb8caf40d01909b531f9d84f91e49d2a766dccfcf0d58f4298f7887f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681979956, "uuid": "90d6b8b1-bf44-472f-a296-245f554d382a", "comment": "Malware payload (Mirai)", "value": "d853207eb600d2607fa268cacfd05d442adeb565", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681979956, "uuid": "0fb4bd5a-8785-44b9-b70b-5894ab534041", "comment": "Malware payload (Mirai)", "value": "98d8b95af4ad5c7d85daa7dd87772b6302ef663972e04f6f3c1ebcbe2645689275f5fc69f9fe6fb0310b3ca1b09cf696", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681979956, "uuid": "09555325-23a7-412d-a007-9d3b81ceaa46", "value": "T1031318C4F553D8F4EC5A06703076EB365E36F1FA222CE553D3A5DA72BC82602E60699C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681979956, "uuid": "aabb3de1-d588-4714-99ba-0b1a788d0920", "value": "768:xMlB2zs8ssGfrRI6aQ2NEenz0q8uDOycN95VlVs:YYzs8ssGfrRI6aVNEeIWOrNrVla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681979956, "uuid": "9ed91a57-ccb0-4db4-b131-65c627b0fa4e", "value": 41776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681979956, "uuid": "71537134-b7f7-484d-a220-a280acc432a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681979956, "uuid": "92ecca2f-0087-4de9-a773-a9ff86f7dd64", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "169ad338-df43-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681971475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681971475, "uuid": "49a039ff-f5d5-4067-82c4-77eeff676f13", "comment": "Malware payload (Mirai)", "value": "ea50b41726770eac99da72438832bc59", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681971475, "uuid": "e5676a35-1b5b-44a1-bba3-d1ce2c0a71f5", "comment": "Malware payload (Mirai)", "value": "9ef919d419ed05f5ce143d2a55f3ea874a3a722a4856bea926124a1d6bfc2b2e", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681971475, "uuid": "bca474e3-f622-4535-8506-49ae50e40f43", "comment": "Malware payload (Mirai)", "value": "69d170ac840c0e9e89ba77e992f1735bae9799ee", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681971475, "uuid": "630ea2e4-bdf1-43fe-bd2d-6606f3a580fa", "comment": "Malware payload (Mirai)", "value": "3f24b3ada7c3bcb483e61c4daa6c9bd6bfbea32b682c892e6343ab34909fe999b9dc5d512ca1b890bf497d51c66999bb", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681971475, "uuid": "292e24bd-153f-4832-b988-8bafa6d49057", "value": "T153534B17B58280FDC09AC1744B2BBA3AD93775FD0378B2A677D0EB262CA6D211E1DD44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681971475, "uuid": "a7694300-558c-42ca-a7c0-dddf5d868beb", "value": "1536:dpmbSQ6U3q7cCBT/lZsK/0DiQHLiKimfFoktCe3fYRMg:WShU3q7cEDlCK/0DP9i8Fok06fYRL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681971475, "uuid": "04e22ae9-22d3-4950-9fe1-939e6eaf393d", "value": 63296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681971475, "uuid": "d6c8e936-098a-4f64-97de-3a21dc52ac7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681971475, "uuid": "3c688b75-4f8c-432e-881a-c2aaec160104", "value": "ea50b41726770eac99da72438832bc59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1521975-df22-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1681957561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681957561, "uuid": "2f976caf-3b6a-455e-82ce-d1404962e78b", "comment": "Malware payload (LaplasClipper)", "value": "20974e780438e87cf0fab2e4c10aa72a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681957561, "uuid": "1f1b0929-4978-4f26-b994-3ec7f99dc1c3", "comment": "Malware payload (LaplasClipper)", "value": "9f35ecf414df4f8e3d0bfa41cea9ebf0827a271941555cabaf22530d774bd999", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681957561, "uuid": "43e035b0-75d1-4946-9fa5-cd03d7ab532b", "comment": "Malware payload (LaplasClipper)", "value": "577e4d37c6897e550abe430d58577b595ed6d2a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681957561, "uuid": "bd7150f1-8468-499d-bce6-430b938a6904", "comment": "Malware payload (LaplasClipper)", "value": "2f199d0b0966b6eb6aa0272e95a814181b5136dc060d2db0dd46aa0a42e893284af3e22b56737b5413e85124a37fa1a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681957561, "uuid": "0e223666-d990-482c-bd3d-11b1a4ca0f2d", "value": "T17CD533AA4E34158FFE5A213F6C45F899572D53E06F064614AE2C0736B210A3FC2B7B65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681957561, "uuid": "b9f09c8f-e116-4a60-9d65-8eb229b9c3a8", "value": "79b3362178937bf9559741c46bb9e035", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681957561, "uuid": "1aad494b-f9dd-4a57-9d82-8276f726f7a3", "value": "49152:izUKp+KxzGMns8LyGuD7wdwrYvihsZqkWo9pG7XnkMcfWzE65Gl9R/4xEozse:iYKpbxZDyGuDkdRiOZRd9e5KW4aGd/6N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681957561, "uuid": "7508280d-bacc-4d7d-9152-b79311a87c65", "value": 2819072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681957561, "uuid": "1690c7cf-9b40-482d-bc81-4cb11fe88004", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681957561, "uuid": "599ccb89-524f-46be-96b9-3aee6c899bba", "value": "20974e780438e87cf0fab2e4c10aa72a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed27cd6b-df3a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681967969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681967969, "uuid": "ed443d40-f2ae-408c-9807-d5ca7c4895eb", "comment": "Malware payload (Formbook)", "value": "57bdffa5ada380fd8ab677a2148e4e7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681967969, "uuid": "a82c96c6-67a6-4218-a83d-f28ad6f9bf43", "comment": "Malware payload (Formbook)", "value": "9fa9491a8681ec5a9037a9dd27f8e80e74b23a5518ac7c5891ce0d7114bbd95e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681967969, "uuid": "cdb64fd7-6bca-4c71-aa59-d4c7a40135a4", "comment": "Malware payload (Formbook)", "value": "1c8474d9896899465cc7a4ed4ea39115f25fc55a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681967969, "uuid": "7b6d4cde-bbf3-4747-a8ca-8964669345c1", "comment": "Malware payload (Formbook)", "value": "0457325ffbe031ac72405307f5eb8e5f616c95d9c13d7664d839743b3053918c854159bb0aa0451ee62f0134db713b8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681967969, "uuid": "36804e48-5de9-4eff-945a-34fcab84df2f", "value": "T1F0D4F13C7BA9CE7EF06A16FCDC53A8514AB16E00F125C55FB74DB972342A30480A4B6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681967969, "uuid": "efb93f28-8e54-4518-8cda-d008b776296c", "value": "12288:DUakRlhu/SyP01gGZ/lYWkQ8uCUQzB9gyIQ/R7ZPc4eDE+k:gTXhu/Pc1gGZ/lYTQa5zB9gYRRcY+k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681967969, "uuid": "691ee269-15b6-486c-9ed3-ab8bde742474", "value": 649568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681967969, "uuid": "c7b91b7b-7c6b-4a22-9d18-96a656afc2ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681967969, "uuid": "2569dba8-8c54-4a2e-8af8-74fc8536c96f", "value": "ZAHLUNG170423.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9999464-df79-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681994968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681994968, "uuid": "d73d26de-ebbe-4b6a-91b3-fbb320b1baef", "comment": "Malware payload", "value": "f87b03be50eb25962e8af1e206ee2e94", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681994968, "uuid": "81f7ebf9-3b4a-40b8-8e2c-cd9a6a629189", "comment": "Malware payload", "value": "a14dd2dd4a653dc927c4ba64d7738dc0256c5fb495a44ff58df542f5c1d672c8", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681994968, "uuid": "eefb9895-1e80-44c5-8a0b-aad11bb79836", "comment": "Malware payload", "value": "a30ed9337a572d1c6226014c5483a7301226b99c", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681994968, "uuid": "c16a8469-88ac-4af6-9188-977fdd72aee8", "comment": "Malware payload", "value": "9abd66be453199f7b5f09bf7b9e1f02bada51f99dbad914d678932bc3faa30d082a4c31a85a8dcaee6cc1d215fea29d1", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681994968, "uuid": "fb140e1f-0884-4fbb-9c56-5a2feb2a1a22", "value": "T159E0EC1AE44C3142C7DAB6D284A453C4B115D34759C5A9C195CD153947073ADC283A38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681994968, "uuid": "66cf01b2-5882-408f-aa8b-04c34d64b8ac", "value": "12:QwZYVJ22Vyk7G8pGuYBN7QugrZQ98QArZLero/rpu:Q72lk7UnN7Bg9yA9Lek/tu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681994968, "uuid": "1c5a91f8-46b1-4ec7-9f8d-9867c6be7e78", "value": 414, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681994968, "uuid": "11823725-f7a3-40d2-a22c-9efce55bb2a8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681994968, "uuid": "eb331d60-24f4-4ac4-9c8b-6dc09deaf975", "value": "\ufffd895,7948_Pounds.pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08de6482-df75-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1681992927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681992927, "uuid": "ec862975-7d86-44e4-9116-76ecce2056d2", "comment": "Malware payload (RedLineStealer)", "value": "58dbc709c09abceac1becfe2ff10b430", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681992927, "uuid": "e9f8929f-36ef-4c71-8042-38140efa06bd", "comment": "Malware payload (RedLineStealer)", "value": "a17f901cc5beb227d3619c18a9997555852aca101409c5dc504cf25f4729262f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681992927, "uuid": "655f0888-6363-4f42-82c5-126589faafd2", "comment": "Malware payload (RedLineStealer)", "value": "dd996d90820a8b75a865739933dd871c77508c32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681992927, "uuid": "d0dcb064-28ca-48d2-8cd4-9fa255da5967", "comment": "Malware payload (RedLineStealer)", "value": "6a63205bba4106b205475eeb75d2ce300e8777b5d47b654343d7f09326d3f3cdcaa3a0601c767b2f4df5b851e74422ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681992927, "uuid": "120955a0-d246-4043-adb8-6578fc0d8f6a", "value": "T11E84BF12A1818071D22BB5306CD9AB5B927EE2413770F9EF3387193B9E7B1E758311E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681992927, "uuid": "060486a1-c3c3-4eac-a322-169019b06571", "value": "5a938367ff1218e8ce81e8bf10050a38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681992927, "uuid": "cd9d467d-9aea-47c3-9bce-a2576ae78a46", "value": "6144:yYSOGk+3NmAO6crcgIfKrbSlHyLK6SlOkNx+uQl/d:VSOD+3NmhGKry6SlO5uQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681992927, "uuid": "76c9cc9c-0153-4402-beb8-80f7d70282f5", "value": 373920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681992927, "uuid": "5193e60a-d058-425e-ad3f-6dda6ca523fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681992927, "uuid": "5812e115-d628-4a3f-8c79-a793650f49b7", "value": "58dbc709c09abceac1becfe2ff10b430.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cccc254-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681985766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985766, "uuid": "329258a5-7344-47a2-817c-c6f53710395a", "comment": "Malware payload (Formbook)", "value": "83a2431addc3e06a8f50754bc08a0d21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985766, "uuid": "9711709f-96ad-4ee4-9b59-d7731f29abe3", "comment": "Malware payload (Formbook)", "value": "a2ed07bb61747f46086f07900e698d552f1a36ac21bbeee313894743aeb1276a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985766, "uuid": "272ec92c-86ce-4c90-82a8-051a0c737ba1", "comment": "Malware payload (Formbook)", "value": "a281a0e8bb907a4748a5f662a75de9cdce5b0a4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985766, "uuid": "6c3f4e15-9b39-406d-bfc7-f6e018bffd50", "comment": "Malware payload (Formbook)", "value": "31807706189d1abaaca0e5dc8296c7ce9858a08bf7874557457f98e16150bd0e77d322ea31c1a9b2fdf5d9388f1a074a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985766, "uuid": "c60e669f-d19a-4da7-a168-a9341e4197e6", "value": "T15D04AE36D642C071E2B211B5B6BD1B7B483E0D343255A4A6A3F216E16FE09E5F12D31F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985766, "uuid": "ce7f673b-893e-408f-8809-3721c45d7894", "value": "3072:MbBFkc17pO/Jq3oBkFaubB+Y1VetNa376DKX3pPTqjAue9uBN:s1wsoOgubB+Y1Y/aGSPTnunb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985766, "uuid": "9f7d905d-6f86-44f8-b81e-facca214d0d1", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985766, "uuid": "7b716d2c-0d00-4001-b822-8420502d9a7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985766, "uuid": "5259f418-05c5-410a-9187-a500e6c64530", "value": "a2ed07bb61747f46086f07900e698d552f1a36ac21bbeee313894743aeb1276a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "459c65c6-df5d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1681982721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681982721, "uuid": "a5dd8b80-0bef-4195-8e47-570fd35a5bdb", "comment": "Malware payload (Loki)", "value": "fce1fae1d64cd676e2b84304ec75d284", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681982721, "uuid": "dd43cc97-2af5-4093-b317-1e44b04309d0", "comment": "Malware payload (Loki)", "value": "a3a76a33a4641ac3a8b6ebbc137ecf08c69be86d7a1d810754be57dd1f5baac9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681982721, "uuid": "ef091da9-7e0d-442e-aea0-afffea202727", "comment": "Malware payload (Loki)", "value": "6620b5431dc60d05565d0d5c430358600afc079d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681982721, "uuid": "34069df4-c687-42e3-a88f-7507e0a08395", "comment": "Malware payload (Loki)", "value": "2bcae875c606becefcddd2d05eeb885aec9101027158cbd69d74f9a31ef82d8222bd1c43e6ac3ffa9daafb954b0455e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681982721, "uuid": "5b581432-5d2e-4eca-bac4-08b7c541c144", "value": "T18A04027137A4C597EAB26BB25EF32E179FE6E60234400B6F43104F59BA5A741E40F362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681982721, "uuid": "720157e4-55a4-469c-9f5f-99174e117543", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681982721, "uuid": "865ac168-5959-441b-9643-aad244043ae6", "value": "3072:XfY/TU9fE9PEtuyb2dX2vHLySgEXwwwXc8XeWP1sZKSN0+m7IBVdIzVf/Nx5BT0:PYa6qMX2vr3OXc8Xj1sZKZ40FlvBg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681982721, "uuid": "f2a67994-cb6e-46dc-a2de-c8c94c3e3de5", "value": 188942, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681982721, "uuid": "0ec3f34b-7bf7-4ff9-96d9-ce417c0a1531", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681982721, "uuid": "041bbc2e-2328-4b6f-a0b8-1e884abccec1", "value": "fce1fae1d64cd676e2b84304ec75d284.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17b94f10-df3d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681968900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968900, "uuid": "fa1edc1a-62a8-469e-92f6-666de6e44e18", "comment": "Malware payload (Mirai)", "value": "7376ef50ce0584773fab674fc0df9211", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968900, "uuid": "baad4ba0-fcea-4cb9-a9b9-457d4207ef2c", "comment": "Malware payload (Mirai)", "value": "a3b38863b6606e2e4eac08398eec9ebc304e8636be43965355958485da480a75", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968900, "uuid": "4069e728-51d4-48c8-bf7f-945bbafb966b", "comment": "Malware payload (Mirai)", "value": "faeb32f9ee59d494771a62a21a0dc4449e4364f9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968900, "uuid": "8836d6b1-a416-45a3-a80b-404f14a3b7e7", "comment": "Malware payload (Mirai)", "value": "41adb3f3d8b5f501220659211f8bd7982241a3b8669e05865e92537022ec1413b231a307711cc5b558305cf5d2ff9848", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968900, "uuid": "79399695-d3eb-4199-b8e2-5338bbd6cff1", "value": "T11903F751BC829A77C2E1137ABA6E5A8D336163E8C2CF7217DD214B207AD651F0D23F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968900, "uuid": "278803a0-2328-478b-ab5f-950ac32c1179", "value": "768:YglxkCbXsG5f0OhnlUl0O9FRA1wAob9/7WVuv+boy77zkXoTR/NkwW:YyZb8G5fDlUlXjwmqkv+PkKvW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681968900, "uuid": "38a3a35d-10fb-4f13-bdf6-77b832104e39", "value": 40744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681968900, "uuid": "1f157120-d4c5-493c-84d3-4a99ec7e7f1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968900, "uuid": "94a78f00-4fad-4fcc-9407-9af532d1fca2", "value": "7376ef50ce0584773fab674fc0df9211", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "011387c0-df3b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681968003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968003, "uuid": "66a2756f-4011-4fe6-a4f0-dd50a47b76a9", "comment": "Malware payload (Formbook)", "value": "89068c8d0adf2f6040a2d88883a93d54", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968003, "uuid": "a244038b-1477-4d10-a2af-f667b0432539", "comment": "Malware payload (Formbook)", "value": "a41428089e0fd95d1cf4da904f30af4338bb9b1d5cee1f0f857dbeb25c897881", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968003, "uuid": "c849e59e-0844-4e5b-895e-8346b278b0f2", "comment": "Malware payload (Formbook)", "value": "23f2120707e9d5b7fdc2ad3fe1de2dbada31dbfb", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968003, "uuid": "1ef8c5ff-fa0f-4c52-80bc-d5dd463d6ef8", "comment": "Malware payload (Formbook)", "value": "ab187395e3a9517d2674eedee8e33f56270e8e462da37f32188378768b2bde628ac24804fff34f25880272fe77b103cf", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968003, "uuid": "4f26bbdd-541d-48c4-87c3-53e5cce28f3f", "value": "T12994E00895F588FAD1B8C5B20CA4FD8D76277C599C244E425E23F9E9E4331822673E6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968003, "uuid": "9e507f6e-22d5-46f6-8b0b-dd2e96272bcc", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968003, "uuid": "dcb04574-b561-4538-9257-455f30c5865a", "value": "6144:SYa6k8Ixhl2JiD9tXgjny4BOMamr79Zon6JVjla+xtn:SYu8qhl2oRtXgjVUONjNtn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681968003, "uuid": "721db2ac-45d4-4753-9289-ccb9f093042a", "value": 410677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681968003, "uuid": "9123be81-514c-4e28-9c36-9dca4d526e76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968003, "uuid": "2103a355-e91a-4ea7-b064-91f6d31e082e", "value": "DHL Receipt_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f9f4e24-df3d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681968913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968913, "uuid": "ebe577eb-39ac-457c-878c-ee0cbabb55bb", "comment": "Malware payload (Mirai)", "value": "d56e8df05bbea1002e33815f92eed6ed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968913, "uuid": "93ac6948-3f77-478a-8b4f-693b5863c5ca", "comment": "Malware payload (Mirai)", "value": "a447ef785bceb0bce0f3c26071707062177103443c30f17e28768b48882758a5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968913, "uuid": "4f40bb58-f8b8-4644-b92b-118fa63e86b8", "comment": "Malware payload (Mirai)", "value": "124bf3d19f3275d6221842f01d00c0294e5a8988", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968913, "uuid": "015bf0b2-2861-4341-a1be-98f205e8c5ee", "comment": "Malware payload (Mirai)", "value": "bdf324ffb07f0509c572666bf84ec1fb0c26fb79e4e22855a0fc159edcdcec7514421b5c951b6cb7098df57777bfa4b5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968913, "uuid": "a17d8525-3c04-4cd2-a25e-d74b1dd19720", "value": "T145632921BA761E1BC4C1947621F74B25B2F143CA26ECCA0A3DB20D9EFF71A446543AF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968913, "uuid": "a0ea0179-595f-4da6-b706-89c02f622f60", "value": "1536:lGBVg7AOotXhGIAsQXt3AkQKQm75YH/tatFV:lSCzxBZQmVNHV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681968913, "uuid": "6c0fcf22-4c9b-4a55-b3da-408bdf1eda5b", "value": 67312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681968913, "uuid": "42dcfd46-03e5-4096-bb0a-4ce2a4367159", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968913, "uuid": "0636b8fd-8452-45ef-9bb4-1340e3755717", "value": "d56e8df05bbea1002e33815f92eed6ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cdaa475-df11-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1681950118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681950118, "uuid": "8658fc73-1b16-4b72-befa-29c5f8eeca19", "comment": "Malware payload (Amadey)", "value": "52c59814f9afe3100717fda753e7b449", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681950118, "uuid": "c1de0a2d-4c8b-4189-afc7-ababf0cb33ac", "comment": "Malware payload (Amadey)", "value": "a523ace3b13fbdc8f474e6272c4044882e8da73c3ed1a910a5e5adfc14ce2827", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681950118, "uuid": "414b6b57-9ad6-4de1-aa61-93d5ff080e55", "comment": "Malware payload (Amadey)", "value": "0b794308d4c33a28eb7417167465bedf7c3e72da", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681950118, "uuid": "3d4e4d26-dd85-4a1a-b50d-bfde4a3d5429", "comment": "Malware payload (Amadey)", "value": "7d16f651c88d478aa7f60b8cf293aa22a6080b12d9747051411424b98ac0c3eb07db961120c3fec1add5d7364fc6f976", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681950118, "uuid": "0d1fd7dd-236b-4907-8ab9-da23356977f4", "value": "T1A0352343A3E49031EDF427B149F561434A7A7CA18F68A3972681994A8CF3BD8E630777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681950118, "uuid": "035aefcd-e44d-4023-9eb4-87ed083907bf", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681950118, "uuid": "61ac40ff-b5ce-4163-997a-df88bf5e287f", "value": "24576:RymNnOdSVaslhHC61sKXkjzIQp77oVE9:EiPlhHDiT/I0CE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681950118, "uuid": "e33491d0-bd78-4e28-acf1-bab00f545bd4", "value": 1073152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681950118, "uuid": "2ebe52cd-e01d-4dd2-963d-406604dab619", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681950118, "uuid": "c060f0c6-1066-4da7-801d-ece26d604034", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27accb9f-df11-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1681950029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681950029, "uuid": "c32c3e31-b131-45e6-9821-d815e0cc034a", "comment": "Malware payload (RedLineStealer)", "value": "4382b0c31f4c6eba5a21fbe88c69fb51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681950029, "uuid": "e6ac6480-0a67-46d7-8d48-7e408d8a777c", "comment": "Malware payload (RedLineStealer)", "value": "a587da4bac281de7ad580d061dac4fdd9ef3c3e76daae4d06f235296b2d235bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681950029, "uuid": "562473e8-2fa0-4e14-a52e-14f3aca35b3f", "comment": "Malware payload (RedLineStealer)", "value": "7222568b6b989621ccd4836eb56c6c6162b5d46c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681950029, "uuid": "c38add34-280f-4ab6-9dae-55befb11de0d", "comment": "Malware payload (RedLineStealer)", "value": "3fddb9ee96a35f715fee557aff689e40b72cb33c567c8671facde9a23dfbadbca2719d3da5d6392505e3a5b4954be1d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681950029, "uuid": "c7b76c3d-e571-49e1-a1ba-c0b34d2f090c", "value": "T15D352382F7E95132EDF42BF059F5164314367CD2AF7112A763629D8F4CB2A90A63037A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681950029, "uuid": "5eb373c6-6eb2-4275-a8ec-1af4eba5dad3", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681950029, "uuid": "5125b10e-48ff-42c2-9b5f-6d869b39732a", "value": "24576:eyn/mx0J2SlMHv6JHkX7vHv8F4TAudbUl:tOtSlIvQWvHv8FMbU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681950029, "uuid": "a5d07412-4a71-4a74-a11e-64ed48307dde", "value": 1073152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681950029, "uuid": "52b3d2be-cb52-4d5d-a864-e625a909bdf9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681950029, "uuid": "7db2280d-8e42-447d-b510-59a9fcce2497", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec68cd6a-df3c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681968827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968827, "uuid": "d6e829ef-b73c-4e5d-975f-208d9e391587", "comment": "Malware payload (Mirai)", "value": "b9b8df9e9ac1a7f2c1fc249e85a81163", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968827, "uuid": "a720b0de-4c78-49af-8343-8aeda311783f", "comment": "Malware payload (Mirai)", "value": "a5e3347b77f50ebe1bb2ddb7ba32fe61f4f12a87f421108db21fb78f6aa0b75d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968827, "uuid": "481909c7-cfe1-4c0b-b8c6-9eccb5c747ef", "comment": "Malware payload (Mirai)", "value": "175a62c3e8b118176ea77234bf8a6fe717bc53ab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968827, "uuid": "fce470b7-9a36-4712-b8e6-760e7a421016", "comment": "Malware payload (Mirai)", "value": "01171d576002468be5e470efab18721b923f50dc5138fa36e0ce9c2c170db3aa3b2efa6288d60c94475627a1320a7bfd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968827, "uuid": "89d018ae-419a-4c94-a117-ce71e8b22969", "value": "T1C3438C36E96E1E74C08641B074748EB56F23F5C883972EB61AA9C2795483E9CF504FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968827, "uuid": "7178e497-e1a4-4cf3-924b-12e7d7b2899a", "value": "1536:1aa0brW/Od9hlCRfKKpKoXA6Ep/DCMt2+Wh:1v0brWGd9XBKQoyp/DE+w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681968827, "uuid": "e7b1ce68-a94b-45a4-a844-938a7bc6839e", "value": 58740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681968827, "uuid": "ff5e8501-809a-41ed-8cb1-546023f661fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968827, "uuid": "a69cc81d-e3a5-4c32-9139-5378627eef73", "value": "b9b8df9e9ac1a7f2c1fc249e85a81163", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fa2ef67-df94-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1682006440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682006440, "uuid": "a27e151f-4a46-40a6-b080-00f6fc4a7d80", "comment": "Malware payload (AsyncRAT)", "value": "fd50b51ec0532a3594b8fecd6749f85d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682006440, "uuid": "50c478f2-bf72-459b-baa2-c1132030ab72", "comment": "Malware payload (AsyncRAT)", "value": "a628293a166a77aed452276e34d68ea8dbd2e53d5f0457a2a670d77e4e49373a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682006440, "uuid": "085b8845-00e8-4827-8599-fb54c2ec647f", "comment": "Malware payload (AsyncRAT)", "value": "04d0121062893e2204c7f5d9c2e28974d4dd5b89", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682006440, "uuid": "8090dbb8-2d9c-402f-ac9c-85213524ede7", "comment": "Malware payload (AsyncRAT)", "value": "ed4da652877921e7db055336fbc2e871d40e13b456d13b6a72c9ce1c3636b24b6dedd54d36148274507c651f090c41f1", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682006440, "uuid": "bf183569-e619-4a0e-9409-60df1d093c3d", "value": "T1B6254A4BBCA040B5D0A9D23189B651917B31B8591B3227D73F50B2F82FB2BD95F39368", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682006440, "uuid": "00845f7a-1918-4675-b429-7a56f27005b8", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682006440, "uuid": "ce2850be-a9d5-471f-8289-baacf21b749d", "value": "12288:m4mT/RcXtvyJdBQhXVQp+Dv4alfZqby13caYgd2DKOhUeM01:m4C/6XtvWBmQp+T4gcaYgdq91", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682006440, "uuid": "1bfde18a-feaf-4112-8788-3e9038591b12", "value": 992768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682006440, "uuid": "c953bf45-a254-401c-9f37-f3fb8775adc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682006440, "uuid": "9bb71b51-9f4e-4719-a762-abea54588135", "value": "microsoft runtime x.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "438072ca-df86-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1682000326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682000326, "uuid": "09e03142-a883-4591-b725-821ac83619f2", "comment": "Malware payload (Mirai)", "value": "5e8fb4ab2f28abf74a1367003085512c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682000326, "uuid": "1be27cdc-1a68-4f38-9f1c-b79f47ad11b6", "comment": "Malware payload (Mirai)", "value": "a6bdc12363bbcaedacce7803424db75bf90c28c2f3717fe424554683a12f9048", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682000326, "uuid": "626594c0-44b8-4e30-bb12-3f696fac3c71", "comment": "Malware payload (Mirai)", "value": "4dd14da516421466153bc7271881af5894be62f7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682000326, "uuid": "8439fa3c-7838-44a2-9c57-7b6c5b13f191", "comment": "Malware payload (Mirai)", "value": "e4dc3028b73d3ff7d17fe84d5f70ee8442b4193ed67f321c0770f3fe43faacfa15cd394c3c4267f4c242abcaa03ac102", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682000326, "uuid": "59490a0b-f192-4216-b588-415c938ab71e", "value": "T1D4E35C46EA808E03C4D61776BAAF424933239754D3DB73068D28AFB43F87B9E4E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682000326, "uuid": "1e8e2851-9536-4cac-8bb2-586af77f5fb3", "value": "3072:zv77jfmI47aSDV2u4AUDjNLPMvEn3ExYM/9QzjTf:73aj7aSDV2uJUDpQEn3EmM/9QvTf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682000326, "uuid": "75128048-e481-424f-8fb3-2ad217248968", "value": 151771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682000326, "uuid": "42947544-2f3e-4039-b0bd-f021b981614e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682000326, "uuid": "bcaf7a87-8b31-4d30-a818-009aa98405d4", "value": "5e8fb4ab2f28abf74a1367003085512c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f59a07d-df50-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vjw0rm)", "timestamp": 1681977046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681977046, "uuid": "158fc8a3-e5cc-4c34-9e5a-cf6b724fa5e9", "comment": "Malware payload (Vjw0rm)", "value": "fd287d81dda92b5cd5b92fd19b5a7c9d", "object_relation": "md5", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681977046, "uuid": "47a9c6db-6b99-4ffe-92e0-0c5dcc5b8f62", "comment": "Malware payload (Vjw0rm)", "value": "a71299692434556a06c5bc37082b91bf7736311070556390fa34cedcd44cd976", "object_relation": "sha256", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681977046, "uuid": "08ae716a-0d7a-46cf-868f-795ea356eb02", "comment": "Malware payload (Vjw0rm)", "value": "02ed3360d4c4cd54834c251807589a52ff8eabba", "object_relation": "sha1", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681977046, "uuid": "59760252-8f2f-44f4-933f-a013d14475ae", "comment": "Malware payload (Vjw0rm)", "value": "1d3589aa1461145977e7f587963fac224fe204874c7893e6fb0ec242ae391b1d2e7cce49217c3d980d51fc7d90085c5f", "object_relation": "sha3-384", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681977046, "uuid": "b99559fe-0440-466b-a691-863c60027695", "value": "T112F1AE0C99983C68FD024A7272302CE6AFF827550889BA1F9C12FD6A51F1DCC15AA570", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681977046, "uuid": "b152a713-0a71-4144-bf9c-206a58900848", "value": "192:S13J00XveSNx3u1AQLrGV7PioGaBmujbheMo80P+KWT/:oJjNx3uTLCdixsjrz0mL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681977046, "uuid": "b9bf3c9d-4892-495f-a3f4-152c31de038c", "value": 8075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681977046, "uuid": "0eed831a-b683-46d3-9cd7-c633e2406e77", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681977046, "uuid": "a6a5352e-7db6-433d-8ed8-2a4bb4991855", "value": "ORDER_231804_List.pdf.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75e5c9c9-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681985808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985808, "uuid": "de64cced-675f-40e3-9734-8d956380b113", "comment": "Malware payload (AgentTesla)", "value": "7b87b9c1fea0bebbfa301ecafdc3171d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985808, "uuid": "f6aaf3a5-1932-441b-8d49-d3b536231de5", "comment": "Malware payload (AgentTesla)", "value": "a837ae769ea0f471be3e7cd90d5bd4d4b30b3362c64afdee70484ca7f9a79668", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985808, "uuid": "8021132a-cbe0-44df-b25b-8b1f5e98792f", "comment": "Malware payload (AgentTesla)", "value": "e20a9616bccf125e54091053bd5431e4b2112847", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985808, "uuid": "e7855de3-2fa2-4189-bccd-dcfa259424bd", "comment": "Malware payload (AgentTesla)", "value": "6205f2d1871859fda97930eba694bc67824fbdf70b2632227516d80ce0357a210ea08b808e3f3ba89452a2bc52d93d3b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985808, "uuid": "40e468bd-20a7-4c0c-834c-790b1024393c", "value": "T185C4F029D132ACB3E2DD0B3A041036D9CFB4A5E37977C53C4B9675C9AB9E7492D88087", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985808, "uuid": "0414e3ac-7a6b-4556-bf09-3ef0f8f21fe2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985808, "uuid": "c4c2d977-3e88-4c55-bbd6-f96c49219237", "value": "12288:EJxd6RISNeWvM5+IsxEyyk7p1NfMNFWv6zJH:El2IxWEsFOkl1N68vs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985808, "uuid": "143f4292-aefc-4bbe-a42e-25eaa0a22125", "value": 578560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985808, "uuid": "e8b442e6-29c7-4493-a7d8-460125f12b6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985808, "uuid": "565560d7-0901-42be-86ac-4d7bdce65651", "value": "new order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a586663-df5f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681983561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983561, "uuid": "05dfe42a-2859-4e3a-99ad-f29febb8739a", "comment": "Malware payload (Mirai)", "value": "13db1fe3d5b9783604464411d5e4c9ce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983561, "uuid": "455734ca-716c-49cc-9209-03246eb87c68", "comment": "Malware payload (Mirai)", "value": "a892c46495908065c7bc5f84bd82ab3a6cf1d7f6b66ee217e67d005147f57495", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983561, "uuid": "ed498cf2-1019-436f-8e22-73b5df8c44fa", "comment": "Malware payload (Mirai)", "value": "3742f8b472a82ec1e30fe68e7f00932969b86fac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983561, "uuid": "5c55cdf7-11d7-4840-96ef-0b6e50ba5228", "comment": "Malware payload (Mirai)", "value": "4512a847a260858ac33add2a21188cd74fa1eaefc17b01a2a22db40fc67dd5ce8f4ed9565ce9ee93155d7ee0e39a0dc5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983561, "uuid": "3c38f42b-db20-40bd-97e7-e34e72c6ed1c", "value": "T14023399AF8028D7DF94BE77E54164A0AB93063D152831B2B13B7FEA3BC731592D12E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983561, "uuid": "91f9aeba-74f9-44b2-a554-a5ef45bd6471", "value": "768:G4SeUp1dxT8dM2NX2gZjySxuqVsxLfkMYazQwq8DbqSdG9:ZS1T8d3rjySgquLfkMVzQr8DbY9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681983561, "uuid": "211a5701-b7ce-430e-8f23-de95ec69923c", "value": 46672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681983561, "uuid": "463a90b0-2688-416e-b47a-197214253727", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983561, "uuid": "02975659-d7c0-427e-8ea8-d76d7ee7944e", "value": "13db1fe3d5b9783604464411d5e4c9ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bc5177b-df7d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1681996448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681996448, "uuid": "e09918f0-3473-4c9e-bf05-008509903b34", "comment": "Malware payload (RemcosRAT)", "value": "73cccd4047778e7136529b8aa5f6d603", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681996448, "uuid": "5b5224e1-6df0-4dc2-b5a4-d1e81fab906e", "comment": "Malware payload (RemcosRAT)", "value": "a91b5b3e7fecc3165c0fe4ef988a41b6b99a825a1a40b22fde67ffae6e81db22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681996448, "uuid": "e9cddf03-05b6-480e-89ee-58c9947a99e5", "comment": "Malware payload (RemcosRAT)", "value": "84f1a13db54fae3e9bd36f5e9495eadf27a8c186", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681996448, "uuid": "9a93f9f5-358c-4e30-a989-dab08ce2e04d", "comment": "Malware payload (RemcosRAT)", "value": "a7dec5badb2e2d87463392ad0a4ff45aa4fc904ba30094a4939a26a98c2114042257cbc5dd69648d133a3c3a70ad8de9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681996448, "uuid": "30739edf-10f6-4c75-94a1-9a6ad8a310aa", "value": "T13CE423027B50CA37E2DDAB71886A8E779FF1F422A9E11B0363C42E0E79425549D1F2DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681996448, "uuid": "ad67a1db-47bf-44b9-943d-6502b3e33301", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681996448, "uuid": "9006bb43-ea7a-40b4-8c6e-ee8697fc3d68", "value": "12288:CT5tHp4biwfqthsyJ9+CIcnf2ASLCbEOO16tcXHCojpaX1wHZ+0lDepfJMoEVX:CT5t612sM9zULCoOY6qnA1OZ+6DepfJy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681996448, "uuid": "d8b7ba12-03d3-4519-8649-59bdb3ab27bd", "value": 697992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681996448, "uuid": "43c53af6-c947-4408-899f-2732281fd009", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681996448, "uuid": "811c0979-88e0-4e7e-ab6b-eaee25cd9826", "value": "Order List0420.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0992b7b2-df98-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682007960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682007960, "uuid": "8a510a88-382b-4e5b-a9d7-999106844260", "comment": "Malware payload", "value": "2e020a70248abae9b8ddcd756b6772bb", "object_relation": "md5", "Tag": [ { "name": "3CX", "colour": "#9699E2", "exportable": true, "hide_tag": false }, { "name": "3CXpocalypse", "colour": "#6A067D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UNC4736", "colour": "#19B477", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682007960, "uuid": "2bf16f9e-664d-41d7-8b07-735ec6435aa8", "comment": "Malware payload", "value": "aa318070ad1bf90ed459ac34dc5254acc178baff3202d2ea7f49aaf5a055dd43", "object_relation": "sha256", "Tag": [ { "name": "3CX", "colour": "#9699E2", "exportable": true, "hide_tag": false }, { "name": "3CXpocalypse", "colour": "#6A067D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UNC4736", "colour": "#19B477", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682007960, "uuid": "3a976409-5407-40db-815f-d95650ddb5e5", "comment": "Malware payload", "value": "7dfdee2681d138925a56d579b0e9ca569a5d0c3e", "object_relation": "sha1", "Tag": [ { "name": "3CX", "colour": "#9699E2", "exportable": true, "hide_tag": false }, { "name": "3CXpocalypse", "colour": "#6A067D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UNC4736", "colour": "#19B477", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682007960, "uuid": "81aba7bf-627e-4eee-bcd2-3df63bcc48bd", "comment": "Malware payload", "value": "cd61329be9a7db23a9b1222a2827951ed392831c18aa12c1ff0d35c9f3d7116c751c4ad69ad42f9009d9428c5f25746c", "object_relation": "sha3-384", "Tag": [ { "name": "3CX", "colour": "#9699E2", "exportable": true, "hide_tag": false }, { "name": "3CXpocalypse", "colour": "#6A067D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UNC4736", "colour": "#19B477", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682007960, "uuid": "424644f6-203d-40ef-9579-4d34b28b3324", "value": "T177A568357CB2A5DDA524BA6EB150DE084048BC8B16209F266C8CB7CBD7FFE91B1D244D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682007960, "uuid": "b6eb8e4d-e0a1-4696-8f89-fb29b9ac044d", "value": "c13d8ebd8d11064fc72e082337ff4e7d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682007960, "uuid": "be45259c-2336-4993-9ba6-fc5a5f8a071e", "value": "49152:/40niy8/68jwJFIhHu2ocFMRk9XW/osfPE:/liys68jwJyhO2JFMe+osU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682007960, "uuid": "00525312-87b9-418b-bd76-b6beb3d1467f", "value": 2094416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682007960, "uuid": "b683e9d4-cbfc-4c64-a0df-8329de6e9a5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682007960, "uuid": "8367d813-73fc-4899-94cb-0dcea2fbac1d", "value": "aa318070ad1bf90ed459ac34dc5254acc178baff3202d2ea7f49aaf5a055dd43", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d7f514c-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681985821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985821, "uuid": "8a6388ad-4172-496f-9c04-e4ed88f5f27c", "comment": "Malware payload", "value": "64292619185c7aaa54050832df4fc9e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985821, "uuid": "04a3a091-b85a-4d67-bce6-ff281c91fa2e", "comment": "Malware payload", "value": "ab5ef14a222fc571315361ea373336620b060e9915fbd2b22cdc93e1493b985d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985821, "uuid": "5816034e-74e2-45e9-9ef9-0559b6055a8f", "comment": "Malware payload", "value": "19ccf0315ffd9a39d65a9e73d6589b949ceadd7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985821, "uuid": "a522dc29-e191-4840-b20f-146873c5bb50", "comment": "Malware payload", "value": "f4632b64c3083a4147948dd1df1c6484322261476ac4154a24b2d5218aa9789ef71db9fc044b4bb4bf68685c6f86ad3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985821, "uuid": "bd7dfdb0-be30-4c25-8385-c016f4af0ebb", "value": "T1F7E4BD8A33B19A22F06E46B8901535CC5B7CB10736D5F2165F6B39E15221BBBF61CE83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985821, "uuid": "5d9a217d-5079-4012-b2d6-ea69f6c55223", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985821, "uuid": "e52a2a84-236d-423b-8809-984af70afcc7", "value": "12288:6Rry3ItEaI3IpvUylO2m2iWvjmXUuL72bUTBK3SaQqhydUMCas9b8b3Yan2q:Yr1vds2mrkun24JaMCPJ63pd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985821, "uuid": "348f02ad-294f-4608-a3f8-9c0a633e6bcc", "value": 693760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985821, "uuid": "98192dd8-9921-4ac1-8073-1268ef73b89c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985821, "uuid": "f5e299da-7086-48e5-ae05-b7be964877cb", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a6d7e9c-df52-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681978138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681978138, "uuid": "6100398a-112b-4205-8d6a-af618fc08c59", "comment": "Malware payload (Mirai)", "value": "474b1386c37961f894d0377a851e6fbb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681978138, "uuid": "4f934cdb-f0ae-4666-ad18-8d7673ee1c26", "comment": "Malware payload (Mirai)", "value": "ac25e7ea6cc742d0c1effb2f83f4bfea6ac51b1c6ed892ae3fae99536aa658bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681978138, "uuid": "4ed5caee-2fd7-42b2-9706-0860e8077b45", "comment": "Malware payload (Mirai)", "value": "051b669f6cad30623270c96e01925ba4bbc2c5c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681978138, "uuid": "d331bcfe-3c7a-4fc1-a106-be2c90ab5753", "comment": "Malware payload (Mirai)", "value": "b7799bf4e79c1f3767c79a8c06772fd2192a0298374da39d2a1c2b2a23174fb66983b213f25ead1550d2175fa21e50d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681978138, "uuid": "ad4c527f-3fa3-4c84-b2a9-24b85afc2786", "value": "T1C0434C12EA5181FDD58AC2758AAFD172D635B96C12346A1F3BD0BFA51E33D30272E384", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681978138, "uuid": "e67c5f78-f5a2-4ec8-9100-5ff2560250ed", "value": "1536:y4beqr6miS2W2/xwfQYmNJwqzqwVwtlLr:zwNmIY/qz5y/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681978138, "uuid": "7e498033-121d-4f19-b3b4-ddf904551813", "value": 58544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681978138, "uuid": "130700a4-beed-4d03-a6be-009b76010e10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681978138, "uuid": "3cfd47da-f703-4a31-a98a-2e9ca637f2ca", "value": "bot.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1bc10ec-df75-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681993237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681993237, "uuid": "479c90f9-afc7-49c1-b7a4-82bc87fa09ef", "comment": "Malware payload", "value": "f390d567bfebaecba7eb5a792ff6249b", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681993237, "uuid": "9a2ff6af-702d-4c47-8b53-c2b4df10da6d", "comment": "Malware payload", "value": "ac8ba32c27d3dc8fa0eef48f3d3de5032df74dd476cf0669f92fecd617c4e10d", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681993237, "uuid": "8b1e6b4c-7b13-4ccd-91c8-4be1267a9694", "comment": "Malware payload", "value": "02aa56247d63b6037e7adc4492d3f494fcbdf003", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681993237, "uuid": "96e78631-a2bc-4c60-bed0-dfd8ef0e6ac0", "comment": "Malware payload", "value": "d5392630a57b05638b525db81807660e601ad9f1e141399ed9de0cfa6e68c23160d7e950e4fdeee605df9d76148ef75a", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681993237, "uuid": "c490b931-1a58-43c8-a6ba-199c60e48761", "value": "T14465BE223386C233C9AE01B01A2AD79B5579FDB24B3154DBA3C82D2F9DB44C25779F52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681993237, "uuid": "9787e511-60cd-489c-a98b-047fd65303f5", "value": "24576:/DA+gxxN9Y5OcW7LIJ1MXCOJ05YbswFbT52d7xLZrudIAL8wiUYT:/DHW9YDqbCOJ05Yb59QzLZrudIAITUI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681993237, "uuid": "f6b2906e-1ab1-47cd-b0ac-bec6950dd326", "value": 1518080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681993237, "uuid": "d258e16c-34f0-4a65-96be-435d37e52da6", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681993237, "uuid": "b3eafbdb-afcb-4793-998d-a84f8ef4ec20", "value": "z1Mb_NFEmitida1.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c618286e-df30-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1681963609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681963609, "uuid": "a8463199-a1cb-4e98-b34b-9cae8f7dd49f", "comment": "Malware payload (RedLineStealer)", "value": "92f0c7b3a85ef9197660420990ab5041", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681963609, "uuid": "90ddd835-887f-420f-99c2-9bb202e8c200", "comment": "Malware payload (RedLineStealer)", "value": "ad2ea23994b32cb8f883ce3e83377b5c494fec4a210bd6b7f0013aa54409accf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681963609, "uuid": "c2d3d549-0a93-42b9-a3e5-669a4c9573eb", "comment": "Malware payload (RedLineStealer)", "value": "e4613814742e1c553eeb5ddf0edb4e2382b358cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681963609, "uuid": "c69414ae-4ecb-4193-8985-bda0e10f2bcb", "comment": "Malware payload (RedLineStealer)", "value": "76ed951191e6540f741d5d9e952bfbd18052279638e65b21851ad89570595dd451633b4c6ecddd41adc46fafc261aa93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681963609, "uuid": "17629142-65b7-4a41-82a5-e21bc1ee00f8", "value": "T1C6263312F4F284B3D66269324A15FB30B6797C709B10EA6F73D52D29DD350D2A2387A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681963609, "uuid": "66aa6296-4aa9-4091-b1c4-78cbdc3c8388", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681963609, "uuid": "03b1470b-c54b-459a-a303-cb83283accd3", "value": "98304:V532A6iMnuXeKim24RhVPodmNkd7BaelFkGq4oaxpChNJ/33g:VR2A70YVPodmNG7BaelRoDI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681963609, "uuid": "d2e65df0-cdda-43e1-ad1f-7d427f9bb603", "value": 4794633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681963609, "uuid": "cf0dfc48-9384-4ada-a79b-12790fa044a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681963609, "uuid": "536ff9a4-80aa-4a16-89a9-425227953825", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c35b982f-df56-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681979925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681979925, "uuid": "efd1dcde-4b93-40f5-a297-1c449030fc4d", "comment": "Malware payload (Mirai)", "value": "f10d4c56de913bd00d5bbb329fd54f81", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681979925, "uuid": "2734aa5c-17c8-4684-84a7-9e726b0b9ace", "comment": "Malware payload (Mirai)", "value": "aefd8f2ace71c78e859e0eea1e8655a271b3db661984d4153eeee89c82e1f6b6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681979925, "uuid": "4b904849-d6e2-4d24-be51-7fc5de89b372", "comment": "Malware payload (Mirai)", "value": "21152333d870f259f5baf63cc872fe7f498f4706", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681979925, "uuid": "e093bdbf-8bba-4c12-96a2-531287f64b5d", "comment": "Malware payload (Mirai)", "value": "97de535f5dc60d0f6a1e5735853f43c645b68815d91985fb974ac08578d38b09563daf9d52c5db9ee9cbdff73fa2f602", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681979925, "uuid": "1024fd44-c31d-4d85-93ee-a55193b16371", "value": "T1B9734B42F8C1A612C5C5167BFA0E128D332653ACD2EF7213DE259F623BE755A0E7B412", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681979925, "uuid": "7abcbe64-6e3a-4079-acb6-3dab4a67d67e", "value": "1536:yib708fC+zPj0azi9L8v5bdVVgovkFtxZjr2GcIedTvojB:Ht3f0a258vZby2kFtxZ32GcIgoj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681979925, "uuid": "0aea9409-9248-4db6-8ee8-71c1b4789a48", "value": 74964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681979925, "uuid": "1f844c54-a5d2-4079-abab-0bd0bc5d024b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681979925, "uuid": "e21b7ab5-3df2-4fca-94bb-20196a9bf8f8", "value": "f10d4c56de913bd00d5bbb329fd54f81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "272e0314-df4d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1681975798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681975798, "uuid": "32b793a4-a7ea-45c0-b562-a76561f97818", "comment": "Malware payload (Guildma)", "value": "8ede17e65532478b3f814aaa81e4f063", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681975798, "uuid": "551eedbc-44b3-4847-a26a-647572108b02", "comment": "Malware payload (Guildma)", "value": "af428bc84a44a488789c4c58ebc16fd44490afdb5601026277d209105854fbec", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681975798, "uuid": "eb8ec3b2-be90-4da8-8edf-52fec6dff26d", "comment": "Malware payload (Guildma)", "value": "1cad479cfeea7e32615eb130921750d53b355a1e", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681975798, "uuid": "0bde00d0-5d13-40ba-975f-c97cd43b5e10", "comment": "Malware payload (Guildma)", "value": "37a2858ef2efbf84734df1e70756c9fdf6f2c1b45364f18bfd5f4b6af9c6623d277c455138fe99b829193aca367fc409", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681975798, "uuid": "c03c5916-2471-47ea-bbe7-aea15852ffc6", "value": "T134017DBA577A0E7F98B70682CC38AD1C54BACC730E9EE45DDA333580C5256911FD4608", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681975798, "uuid": "ac2183c2-0aab-47cc-ac66-386317e92b63", "value": "12:Qgkdolzj37eaTASjh6VIAh6VUaVuRCh6VIz87KZIxr5wUEwbrsOEmxXQ5wrUu:QFdolzj3BTfjdALa8CB40ur5w5zeUu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681975798, "uuid": "31fbc53e-67bb-480b-bb18-3d88272a5714", "value": 775, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681975798, "uuid": "5166bbe7-a6a6-4bb0-a474-4ef1e97b92fe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681975798, "uuid": "5119a771-0497-4028-8831-f1cd7344abbf", "value": "normaescolapaulofreire.com05839098.637350.88866.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11c1ffc9-df1f-11ed-88f6-42010a9c006e", "comment": "Malware payload (AZORult)", "timestamp": 1681956005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681956005, "uuid": "a773678b-2aeb-4a60-89a5-c4feafbe41cd", "comment": "Malware payload (AZORult)", "value": "855a6247d9cdc3d7ef52c668a83fd26c", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681956005, "uuid": "503aafcc-f679-4b7a-9331-cf311ac5d20e", "comment": "Malware payload (AZORult)", "value": "af78d0a1124719528a42d9e9d271153bc2928d6e8b87847014e28937f5afd58d", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681956005, "uuid": "98433272-783c-4727-b166-7c9cc1d5642b", "comment": "Malware payload (AZORult)", "value": "f8d45c1b4107b46a0d676b3c5f1be7994789c8cf", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681956005, "uuid": "cb145403-cc96-4c27-8521-7a5a2ce4307d", "comment": "Malware payload (AZORult)", "value": "60edf9d215f0ef6166b2b23cf1d2233711857669cdca5e6c3479df2fb85f6f5fc91ac5ef5fdc659d5eec42c0ea37ad41", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681956005, "uuid": "3a1305c7-4a36-47cc-bcb8-b7afc164f8ce", "value": "T116645823A07CC0E6F89D3DF01A2857666AB16E820678F147E61FBED5F873213C5096D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681956005, "uuid": "66ebac7c-f082-48d7-9cf2-454d8160b09b", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681956005, "uuid": "66a58d10-abc4-4f9a-b469-385e39b576af", "value": "3072:qfY/TU9fE9PEtuNaNbze/ZNl1P7maRduiiGEc6tn+nDa7WH+Bm:8Ya6/aRze/ZNl1P7LRGHc6tn+nDDwm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681956005, "uuid": "9c9c17a0-97c3-4201-a376-4a2789f6dd00", "value": 314314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681956005, "uuid": "e64866b6-01ae-478b-a9d5-f1b3c56dbc7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681956005, "uuid": "d5de9069-8669-45b4-a6d3-8660ce74035d", "value": "IHR2022000120.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e9986e8-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681985823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985823, "uuid": "193a612d-b692-44e4-abdd-c4f55914e040", "comment": "Malware payload (Formbook)", "value": "da4ccea136a902c3539acf82d4b6d949", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985823, "uuid": "22cb8e5a-2c29-426c-b903-aad75c67dcad", "comment": "Malware payload (Formbook)", "value": "b092858c3395b85b3976cb6f30d505d15e66996e692b870fa20fa54b4737bd1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985823, "uuid": "60924ff2-83da-49d9-b2f3-0770fdad3709", "comment": "Malware payload (Formbook)", "value": "f224e6414c70f1836153ab5da6c475ce37ce2c35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985823, "uuid": "58beba82-5177-436f-8b78-32afd8399abf", "comment": "Malware payload (Formbook)", "value": "fe3ffe83ed2f3143c3bb204b79b9a9018f9e14ec7d0464e7202b73526678ac0d39aaf3f9bef60ff0b1515f3b993e2fe6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985823, "uuid": "47bf7343-89c1-4c81-8da1-ac8dd142beee", "value": "T1B4E412652817D8BFD8BF83F6442C39B4AA936C24980B154F67E33E4497782A0E53F752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985823, "uuid": "dca1644c-a198-451e-87c8-a9d0afafc374", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985823, "uuid": "dd96d1fc-22ce-459f-87e8-d272035ff223", "value": "12288:YYTNgVvOpFFBFUX3icL04QiZkeniyz3MheMyZ7j0XUHkb2nwHS:YYTNgVvmFz2H9kAMyZ7YUHoywHS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985823, "uuid": "cfc04950-cca7-4616-b1e5-83e7ea313958", "value": 681609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985823, "uuid": "a3dbdb05-b46b-4f26-be3f-11bb075dd4b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985823, "uuid": "49189cb6-ab43-4261-818e-f726049c39b2", "value": "Purchase orders.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5718a928-df5d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681982750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681982750, "uuid": "adf87817-dbcb-4688-9c9c-f370dc99b451", "comment": "Malware payload (Mirai)", "value": "d21096fd835b3faf7ec0887fbaf58999", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681982750, "uuid": "89342e9f-b331-4733-92d0-051f1e7152be", "comment": "Malware payload (Mirai)", "value": "b11398b620bf55a95606c96a996554133277fd8907d744085f326c4354ee6448", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681982750, "uuid": "e7052660-b917-4853-b592-78f0d9147fb7", "comment": "Malware payload (Mirai)", "value": "19faa91de14ca1472949ee0deb3733ee74c3bd8a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681982750, "uuid": "c215428b-fe99-4c3e-bf7c-566c8f62c34d", "comment": "Malware payload (Mirai)", "value": "6419482423908846e0a0adca08b4751ba3658a206699dacae3c56ea56db2580f85e6dc70035db9ef8a4075b1fe9a289d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681982750, "uuid": "036e593f-0aef-4df9-b430-8216324e270e", "value": "T176243CC2FA01DE79F01BB27904E34638E670AF654653C327732B35A69D362D2191FE46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681982750, "uuid": "ff71944f-1377-4c02-8e4f-2121acf66192", "value": "3072:h2fLmKSibQZE/v4YIbBEK8CXPz5AyZ0GJRDjhbPU+F2D4oMaifbUgHT:h2deaKjXP2yZVJRDdPU9D4oMaifbUgHT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681982750, "uuid": "ca579bc1-b00f-4893-a564-78ab56658191", "value": 212893, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681982750, "uuid": "288f8102-f5cc-4379-bb71-36d2e6dadc01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681982750, "uuid": "e5aab407-3eee-4553-987a-343d1cfb6c59", "value": "d21096fd835b3faf7ec0887fbaf58999", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b3d5d52-df7b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681995669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681995669, "uuid": "241730a8-a09c-430f-b975-ca19d50f4ae9", "comment": "Malware payload (Mirai)", "value": "0c1447ee19c8eee0b7d0f0f35690fa67", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681995669, "uuid": "09a3cc60-1b34-4304-b67b-65bfc8243f79", "comment": "Malware payload (Mirai)", "value": "b115561a1145c129a46bb6dd13878dad019ea0101bd57731a024012821946b61", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681995669, "uuid": "c721c04e-81a3-4ad4-a8a5-c76099fa3e89", "comment": "Malware payload (Mirai)", "value": "6fccea44763f72771b9de1b3bdb3aecd3ffe87a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681995669, "uuid": "6008a741-8d60-4a1f-bbfd-3ef197b3c8c4", "comment": "Malware payload (Mirai)", "value": "cc40647dde2f89c20fdef61c2613f5704ece5ca1b0eaeff780aacf1646dfc9cc079230b1d5b6b9ebec6e5997356939aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681995669, "uuid": "6448a963-0a3a-4c53-a107-0825df197702", "value": "T144C2E1B8301E5AFAE0F4A1BC2F7C5CB2E518B123C3A71503012E51D66C66D1FB1AD6D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681995669, "uuid": "3d47aafd-f6c1-4a21-a619-9a61a09cf842", "value": "768:Ywbr/0xHNIYxx/It3S4YU2AImTTm2advwIi:YygHNIYxxL4YU2Vmubd4r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681995669, "uuid": "9f92c036-de7d-422c-aef1-462c5c33a4a1", "value": 25768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681995669, "uuid": "2babb0f2-2fde-4052-9980-e5b3c7ed7d58", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681995669, "uuid": "d18bc57c-2744-4fc0-8c8a-9a3707f0a62c", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77cb94db-df11-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1681950163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681950163, "uuid": "42cab4c8-85f4-4bc3-90de-db025dbc9fd8", "comment": "Malware payload (Amadey)", "value": "2a8a86c948c0acf709963b4d97814514", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681950163, "uuid": "5e2a4373-234e-4d2a-a4ba-bea3167f068c", "comment": "Malware payload (Amadey)", "value": "b12ae3c279dc8b5f69f9a62f6424b182a0a61638289777a9e7ed8be839b9f6f2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681950163, "uuid": "8da42cba-7dc7-4c5a-9928-338ef32f7450", "comment": "Malware payload (Amadey)", "value": "0ca4a0926f1a6ef9627f315473471dd54b83b30f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681950163, "uuid": "f46c5462-3666-4a44-ba37-ec0ec691590d", "comment": "Malware payload (Amadey)", "value": "b0e4169ea14e876119c6f79e0a87506a563ec1fd9e3c2997249a8e94741dbd6cc09e66a09a7d19ed86739c85506da558", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681950163, "uuid": "de088e26-3fbf-4cf5-8bf6-844544a3254e", "value": "T19A3523A3B2C41426DEF023706CF502931A36BCE55E25537F3655D88B5CF2A98A530BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681950163, "uuid": "38485813-186c-4366-934f-ca03e0a649f6", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681950163, "uuid": "fd5ac262-ec9b-4707-addc-fbc89f4a2a2d", "value": "24576:TyiUmbZFudj62794he96EV6gn+X4vNkmjahw2FV:mibnuzz9CX4Few2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681950163, "uuid": "fc7d29f7-7863-4d0f-b71d-67031f37a216", "value": 1102336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681950163, "uuid": "b6c638ea-fc65-4f4c-9d89-4f33e508379b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681950163, "uuid": "daaa4ec5-f333-42ef-9547-014868037e54", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cc3be66-df72-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681991752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681991752, "uuid": "b5411637-c841-4108-a6bf-6b1737ee6b34", "comment": "Malware payload", "value": "df94e8dcb465aa3fb2a56476216cf295", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681991752, "uuid": "8b7cad8c-43cd-4540-9f6b-7483976c9d20", "comment": "Malware payload", "value": "b1ad669ad81f9391891b99a4955f2d4c8ce0e6dd998e9c437f964bc26774eea8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681991752, "uuid": "e3768dfe-954f-4870-936d-83ee87162e2b", "comment": "Malware payload", "value": "47c684175bacb98d1ad67e60cd2d84db21fdad8b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681991752, "uuid": "58a18948-3592-4419-ac78-87aaf03f4a06", "comment": "Malware payload", "value": "c4761a4c5de8fe2fc4644045f426d232da9717d2ab9fc7887814e9b6fa730407b25f30f0a6253b58ffe0d5ff9ee9b45b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681991752, "uuid": "9f6a3ea1-954a-41cf-83f0-8794a995b134", "value": "T1A023018623662FB2D13158F1E7FCEF85A14A7D94AFE6180A7C227698A07135C28C8C1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681991752, "uuid": "ca789333-3712-4402-b6a4-8cb8484c8287", "value": "1536:yYI0ARqw1qAEW67UIWi7M8gmfmJo0Wgs0:yYI0ARqw1qAEv7UIFM8oJorF0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681991752, "uuid": "ab47d0d9-65b0-4edc-8582-6f289887fa64", "value": 49368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681991752, "uuid": "247ae6e3-ce20-4ebb-b572-1006d3ca4482", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681991752, "uuid": "5beaa532-965a-48e5-9236-0eed3b5941f4", "value": "df94e8dcb465aa3fb2a56476216cf295", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf221f1c-df4a-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1681974791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681974791, "uuid": "e2bcaa8e-0330-47f8-a3cf-ad5790ade0eb", "comment": "Malware payload (GuLoader)", "value": "1cf5c3987db50b9f176ca2c774250c8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681974791, "uuid": "408b8c5a-cc0f-4721-9824-dfad03637870", "comment": "Malware payload (GuLoader)", "value": "b24b36641fef3acbf3b643967d408b10bf8abfe1fe1f99d704a9a19f1dfc77e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681974791, "uuid": "3ad7583e-f96d-4709-8482-a50243255214", "comment": "Malware payload (GuLoader)", "value": "16a9f2af2d643f3657a664520b946ddd279b5e69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681974791, "uuid": "88a16777-8ecd-4f5b-ad51-a819d888c49e", "comment": "Malware payload (GuLoader)", "value": "05935c71310ced333f04ac7953e4f4bf0c67c7772dc1d3932d8f955e669a61ea3b7663bf079f66d4daf5d933b0c4b69f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681974791, "uuid": "feec246d-6602-4576-82ff-895ba2175cdb", "value": "T1BEC412C50360D91FF5555633C071E7F5B2694E91C82ADB136BE1FEA33932AC3060AAAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681974791, "uuid": "c3f870c5-6878-4d27-a10a-644136727b28", "value": "e160ef8e55bb9d162da4e266afd9eef3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681974791, "uuid": "8e275014-17b1-48ce-a978-40f1b00f7771", "value": "12288:qng3VOqc35Tg4ur/V83ruD0J497PZpEJl/F7Uq9GqZPjf0oj8d:BVOqc35TubyCg497PKl/F7NdZr0oj6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681974791, "uuid": "83a4221d-d732-42ab-a02e-80e8822d1bc2", "value": 556072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681974791, "uuid": "9f111626-05ef-47d1-be4a-d5817afe3681", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681974791, "uuid": "55944e07-ddd9-47cb-8eff-4c12b3ab4576", "value": "zam\u00f3wienie 47001202746.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9491f380-df3a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681967821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681967821, "uuid": "57cd5037-beb5-4c0c-a2b4-ac994fbc6951", "comment": "Malware payload", "value": "e0fafd62665fcf8f5dc1713ee6ac81e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681967821, "uuid": "c7ec57bf-2f09-4bf4-8eed-446538864125", "comment": "Malware payload", "value": "b30309946ea7e99d0f96eface8122a3ec12b5bab2148f51622d86fa8f7095be9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681967821, "uuid": "7e9f08f8-8065-48f3-873e-ea926ce7016d", "comment": "Malware payload", "value": "e9fe182e08f26b0f72e681b6339c506060a1e695", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681967821, "uuid": "ea065950-71d2-438f-b375-3c30f82bded8", "comment": "Malware payload", "value": "39a57568d035ff4053b0967fd58065101aa14552220b0c9f2a5575cf8d4cad6c9a8b795a05294ece6250f3991040124e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681967821, "uuid": "82e3e178-3c58-4bf4-8374-3b5e0b534e57", "value": "T19D852338611960DF7FE349403B2A2EE1BA5E6329645591B833B850DFE25F76033DEB21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681967821, "uuid": "f54baddd-5830-45cd-ae4d-40d00eee76c4", "value": "24576:/6qBA2hTkngAQefm976GPud54HFPxxartiAkKUVkMJS5KukF6xVkegEijT9UVbQ4:/6iAgTkngAl+hx0s+rsub2nE7bQVTjm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681967821, "uuid": "4b96dc23-7119-405e-ad59-8e3610f04203", "value": 1854877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681967821, "uuid": "be76d8f6-1d6a-45cf-aa2c-cc3f4468063e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681967821, "uuid": "a879b22b-349e-43a1-b889-fa5718800e1a", "value": "e0fafd62665fcf8f5dc1713ee6ac81e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "976af977-df55-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1681979422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681979422, "uuid": "7953781f-a29c-4586-b4ca-e1a7df98c7e8", "comment": "Malware payload (AveMariaRAT)", "value": "19fb4678b4f5fbb71f4d1777d53b7348", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681979422, "uuid": "643fb91d-7db7-4569-be95-78386e7a2381", "comment": "Malware payload (AveMariaRAT)", "value": "b349759ad885c5dc5e2c7c09c438529284dbc4f50eca66ff6a31a79853aad9ec", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681979422, "uuid": "c89968df-3148-4461-a11f-d621ea86e4a3", "comment": "Malware payload (AveMariaRAT)", "value": "de76dba417b23b08879d8bc94cf9b35b983a52b2", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681979422, "uuid": "5e993a79-fba0-4fe7-925a-1525ebcf0300", "comment": "Malware payload (AveMariaRAT)", "value": "de4d47ebbde79878da6ba1ee74e0036bdac7856d980734c8796453c39d246c30543692b9e65d60d34eb9571f5eac5793", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681979422, "uuid": "e7634d25-941c-4657-bb43-5a06eed5efed", "value": "T1CBD4E0D95755D7D2C2683DBC226B717D3F7045DBEA5ADA22FE85105A3E32BC80E0038A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681979422, "uuid": "1450ba5b-baaf-45b0-877a-35eb48a0404c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681979422, "uuid": "8970955d-8206-4b13-8d62-e3b3929b4e34", "value": "12288:R2iNPpOyTWC3CwXrRN5kIrYs8KtL4yiUNXtkzXWD:R1pjRQGYrPsZ2WD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681979422, "uuid": "c0bcac7e-603d-49b7-92a9-a4e7c6230cb7", "value": 626176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681979422, "uuid": "9d6b7536-14db-45c1-bc7e-552989ef7dab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681979422, "uuid": "fa55c193-faa2-4a34-9a4a-b5f400ddceba", "value": "Vesco PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8baff421-df58-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681980691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681980691, "uuid": "918d6c90-20fe-429c-99f9-9ec75d2fd398", "comment": "Malware payload (Mirai)", "value": "773cfbe798da1bff851bbd10b43ebb35", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681980691, "uuid": "69836d74-49c4-448c-b716-0d5354e9fb33", "comment": "Malware payload (Mirai)", "value": "b4a54a8cc6e4c3daf10fcf1dcb4293defea3c16b43f1f7773b1f170ae9314c3e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681980691, "uuid": "c4f70afd-fa9a-4b37-a171-b360e7c82391", "comment": "Malware payload (Mirai)", "value": "fb18cc92308395eed6099bdfe15b8555dc73cef2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681980691, "uuid": "5e7be5a9-717f-40a3-b8e2-2cbfec863133", "comment": "Malware payload (Mirai)", "value": "78ed468c5eeae369ea90e140012367ff3f18f78f0b5be9384d9509015f0b56e099a3c856e6d4700060ae97ad0bf19f09", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681980691, "uuid": "458987af-9b99-4efe-b863-cb6f576f7ac8", "value": "T14F831A56F8819B26C4D1527EBD1E018D33131FB8E2DB3202DE199F317BDAA9D0EAB541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681980691, "uuid": "5857bf53-c917-4604-aa48-bbc3255df9b6", "value": "1536:F+nrXINgqYeLOO9xDsB3+Molxew/xT2XwEkGbvUVv4KO3FOW7HYIjPn3O1Ir:+4NgqYeLOO9xDslrE/xCXpuVv4w+Hhbx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681980691, "uuid": "2e9eaec6-d112-4804-b27d-9dd7137f871d", "value": 82852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681980691, "uuid": "34c0f11c-1043-496c-be2a-2e2e95e7c5e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681980691, "uuid": "7cbac8a8-728f-4a0a-951c-1c8d7d1811e3", "value": "773cfbe798da1bff851bbd10b43ebb35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdb2c9ea-df77-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681994196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681994196, "uuid": "3b598f43-af59-4f06-a3d9-33854abdd4d6", "comment": "Malware payload", "value": "77bd6b62cfd61a3db16aff6400f7f8b0", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681994196, "uuid": "ce80e8e7-cd1e-48c0-bee5-c1212bcaff34", "comment": "Malware payload", "value": "b54bed974b64bc6e3695af0333e973651cf7c2ff55a3ba97136daf8adfdc4543", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681994196, "uuid": "ec9d7016-3bc1-4bb9-9d2c-3cedd89dd9db", "comment": "Malware payload", "value": "67cb504c33b59a59e9a645e574f09702074ff1ea", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681994196, "uuid": "dfba0394-a964-4640-8ad9-2b8555be4896", "comment": "Malware payload", "value": "41a221ad26535edf24f1c11f6a657e387793e3bbdbcd23731cf58493d9a6d97f71161c4fbabc7296acdadebaa08bcb6c", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681994196, "uuid": "ef6c2708-a364-4759-a489-a671104a1a69", "value": "T10D11446993B90D7ED8B243B5CD359E0C98F5DCB60E5FE09ED6133048C9215E51F80615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681994196, "uuid": "34c877e4-e30b-4ef8-be29-df273597ff35", "value": "24:8loGDFbrUTfz7aaG7a6a8s7aw40u77aS7ap7a4AtAtaYaRaDRk:8loGFbwTfXaaga6apa2Iacada49aYaRN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681994196, "uuid": "7356bfb1-c2e8-4882-bece-bef948c29c14", "value": 1017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681994196, "uuid": "5428d2ac-dac8-402a-895d-4ecbe0c44df7", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681994196, "uuid": "4cba5a37-0fa3-4600-b654-e2599f37b7a7", "value": "Factura_Archivo3203222918.805847.51941.lNk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6227918a-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681985775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985775, "uuid": "78ae7d08-8947-45a4-88f7-05bb689d484d", "comment": "Malware payload (Formbook)", "value": "0fea715db2b5abe931b86a6350149dea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985775, "uuid": "6efc501b-99fa-4852-be46-6c564d3bd7de", "comment": "Malware payload (Formbook)", "value": "b58f50118bd65455bfa22aee6ebfeca5a1795dd61f3faef4a7ecf61910992fc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985775, "uuid": "671dbb41-337b-4352-9967-f8279e21a32d", "comment": "Malware payload (Formbook)", "value": "0197f7db4a5898728820bfac0fd8ad9ee579a075", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985775, "uuid": "87548cb5-f732-4ea2-b2cb-38f6ea35281b", "comment": "Malware payload (Formbook)", "value": "ba7ce827c36097aaca5844da227fa70deaa12dc2b7a5725ad967daba8f93570c480e1804f67e7cc52c400705f5bc9337", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985775, "uuid": "d8b660f8-05b9-46ed-ac53-bd9df3100b5d", "value": "T16F04AF32D652C030E2B251B5F67D1B7B483E0E343295A4E9E7A226A06FA44E5F53931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985775, "uuid": "b6e45541-e329-473a-97d8-1a4463ee5966", "value": "3072:lEdDDirkRm8jDuGY3WeAyfybU4ap1Hs4d/WcpvLccfISbk/k1yxEK/dTX:4wGWW3yfyQ4aHHs4NWBc7Po2+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985775, "uuid": "49274f17-ff1e-41a1-80eb-365bf8f74894", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985775, "uuid": "bee41769-3606-469b-8f1d-b0a5a7c8174b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985775, "uuid": "c6cd9499-4289-4f58-b116-25a528f406ac", "value": "b58f50118bd65455bfa22aee6ebfeca5a1795dd61f3faef4a7ecf61910992fc7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "530c5d25-df5f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681983602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983602, "uuid": "15fe28ef-e68a-47a5-b485-ff885100ac5f", "comment": "Malware payload (Mirai)", "value": "703cbd95273b8c28df01b5e4469af2d9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983602, "uuid": "b9984190-3ab7-4cda-83b2-99267a5fd6ca", "comment": "Malware payload (Mirai)", "value": "b5e3c50fbf9db061c697dc211ad8e9bc2f5a0dd88191af714a33ceccc7131a20", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983602, "uuid": "c3200ebc-97ba-4c96-9414-a4b3f40524d2", "comment": "Malware payload (Mirai)", "value": "b61f2304844a6dbfec3dc2e379cfa605eca7085a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983602, "uuid": "4fa39d30-f4c5-4de8-939b-9bc56c860e6d", "comment": "Malware payload (Mirai)", "value": "e6eaa0524cfa3623ba3178c8ebc9274d538982ab7ac852834499eef051bd5c8ff0617d96e4d15d38ff3630de80a0c2a2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983602, "uuid": "32724a0b-e783-4f19-985c-2aed674c5d1d", "value": "T1A5A32A45F841872BC3D327BBE78E479D3B36569467DB33116A386EB42BC17C82E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983602, "uuid": "6d600154-6094-4f14-b6df-2fe5404c0a8e", "value": "3072:1Sl+W6maaWnINcXPnWD1fmZuqQ4DPwXXtse:y6mBWnocXPqfmZuqQ4DPwXXtse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681983602, "uuid": "c5d77725-d5ff-4f58-b297-ea13d89ded1e", "value": 100868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681983602, "uuid": "1f7d1db9-2ae1-45ec-b735-270ccabcc991", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983602, "uuid": "4ced63c8-bba0-453d-8a38-14f215f588d2", "value": "703cbd95273b8c28df01b5e4469af2d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3884713-df6b-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681989025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681989025, "uuid": "9e073e26-ae35-4572-9555-b8958a9fe138", "comment": "Malware payload (AgentTesla)", "value": "da0bcb9d3e759e9a2debb9b8614d03dd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681989025, "uuid": "7eb80080-5b32-4b69-af65-1aab56f6f134", "comment": "Malware payload (AgentTesla)", "value": "b6073f0fe939a36e9147fa93626285d80d85bee98ba66b5238dea87eb4e4f354", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681989025, "uuid": "94b6e244-d7e3-4f17-b7da-18afc16926cb", "comment": "Malware payload (AgentTesla)", "value": "93572aca5790be40876bd885f9faee8abab3fc27", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681989025, "uuid": "658fee2b-1d38-4e56-b5e5-57b3ec4a1010", "comment": "Malware payload (AgentTesla)", "value": "7447dc541ee93f11e8b109f5794843615eb24efd8052bf977f9bdef201c228704ae86d6be8cd69d5fac0c7e64d66858d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681989025, "uuid": "25cc170b-6637-4622-95f1-f90d512c00bd", "value": "T1DBE4E1C95756D7E2C2243D7C227B32793B7044DBEA5BDA32FE85519A3D32BC81A40389", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681989025, "uuid": "8a86205b-c652-46ba-8cd9-82fef7dca380", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681989025, "uuid": "edab65bb-83b9-4224-8eb3-93030b2e2ae6", "value": "12288:W2iNPS5F5cQCXSBBHP08evs+jrE9CEEj0cXGpOiZ8WV:W1OFOZaBHM8evnnEmA8Gp1W6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681989025, "uuid": "6b5ce3c8-ab8d-4038-9507-5b8f81f873db", "value": 658432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681989025, "uuid": "37ad2e10-4ccd-4cbb-8085-b529c132a45b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681989025, "uuid": "44b29f7d-b820-4332-85dc-7bb7676ae969", "value": "DHL-AWB 429789887654.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b5c9e1b-df8f-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1682004205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682004205, "uuid": "8da56b5e-eca8-41bb-93f5-02d8acb69633", "comment": "Malware payload (AsyncRAT)", "value": "02d2b7825e7e3014f8028ce7536474b6", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682004205, "uuid": "cedd8c62-faf7-48c4-ad08-ea1bfa36353b", "comment": "Malware payload (AsyncRAT)", "value": "b65be0351a717f4440b29a61d206acf4457c4755693f5d68e8cb39948ec5c1cf", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682004205, "uuid": "cf0cd28d-0c30-47e6-9d73-7e8f081568be", "comment": "Malware payload (AsyncRAT)", "value": "f717c46bccc58f5a6b19083b6f00713cfce93b5d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682004205, "uuid": "a92f609d-f288-4a12-922a-779d0eb8960e", "comment": "Malware payload (AsyncRAT)", "value": "1f2cdb1f912a9c082e8ac67f86399bae677ffbce0aab7ea954b9975a7983eac8a5634503e9312fb83048769e43b804d1", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682004205, "uuid": "158dbfb5-5f6b-4899-8a09-8380a79aac73", "value": "T19FA4231322E97D32C1B377B61E6A13819AE3F0610D99065E385BD8B86F50A5C8B75FC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682004205, "uuid": "bea47ac4-dc7e-4a2b-adce-82bbc0d519c2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682004205, "uuid": "4443c920-27e9-4ab0-a895-f3d537eb1082", "value": "12288:eyaFTWoh1QNYGKvbkPsTpM+pt2S4t+m/0Y2Ya84lAy:3aNi1nPsvGS4d/tR74p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682004205, "uuid": "0cbfdbe0-a8d5-48b7-8f06-5fba9baa755f", "value": 492032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682004205, "uuid": "26de8e83-a921-4ac6-928a-082a6345f071", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682004205, "uuid": "fee16ba4-b4a3-4a81-bba0-8633bef19df4", "value": "usb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62e8865e-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1681985776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985776, "uuid": "15d125f6-fdc5-4dde-a4ad-f3def449e502", "comment": "Malware payload (SnakeKeylogger)", "value": "be431dba0ba422997a0e3d2cb30e7f8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985776, "uuid": "efacb557-967f-484e-ac50-67fa019c1f9d", "comment": "Malware payload (SnakeKeylogger)", "value": "b7a96333a6c25856272fe11630d560a2657e17adfe291f3fd0a0124d5b7cfaaf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985776, "uuid": "46a5aaca-b787-43f4-96f0-c2a0128062c7", "comment": "Malware payload (SnakeKeylogger)", "value": "4de5a3f0c52abdf440d80bf6d5faa3f0220209fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985776, "uuid": "f08e19ea-4492-4b87-8627-7d2d71a74816", "comment": "Malware payload (SnakeKeylogger)", "value": "8664230e78e92763ae69e8ce852ca62c277770342acf87a11c552cd11658c4e19c43945dc942c0cacdd7feab78757388", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985776, "uuid": "69a67137-db98-409f-a7ef-b05e72f2f826", "value": "T1D0C3285D2BF89900F5FF9AB305B16112C375BC12192ACE0D4AD1F65A2A7D690CD0BFA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985776, "uuid": "6bfb1236-4c01-496a-82b2-1dbe08da73dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985776, "uuid": "7aaef0e7-facb-43ac-8d76-bd42315eae3f", "value": "1536:NtMpEvqHEIsang0ly+G0/nE+vBUFrlY9DZKkAMFFORnT/G22C7kbKuzPjaQlBUpx:NtMKHE/tDZvORT/G4Qbfrm4B+wBjFbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985776, "uuid": "9c073cba-ac62-4ea5-952d-931de0674e24", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985776, "uuid": "d2b86708-aa03-4d67-9081-7f2fbf481e9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985776, "uuid": "05ec320f-2106-4e4e-a2b1-1e1e5088177b", "value": "b7a96333a6c25856272fe11630d560a2657e17adfe291f3fd0a0124d5b7cfaaf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "339f5d28-df78-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681994287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681994287, "uuid": "c0d02ad9-717a-4cb4-a1a2-fdc90726a1c1", "comment": "Malware payload", "value": "bf9732394c8838f20e95d8dc50220bc7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681994287, "uuid": "1e1dbf2d-de66-424a-b806-313ee7bb0118", "comment": "Malware payload", "value": "b7d9f37e382bbb34858885e08b72ae41a73e484a9b30f8f0e16bd3f546daa018", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681994287, "uuid": "56265f77-bf18-4f37-9e63-d9df44c8decb", "comment": "Malware payload", "value": "8d740a5fea5d43224bad35727888d0965d87c61a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681994287, "uuid": "b7e6a7b6-79c1-4ce2-bfe9-84faf7cc0c67", "comment": "Malware payload", "value": "beba166ffc82f5f8dfa74e2267e6d173fe9c8ab48f28bf91e4324aa4dce1156e9099233ba880c08ae2a75f1dd7bed457", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681994287, "uuid": "11d9e584-140b-472e-ae7b-6b56d0c74119", "value": "T1F6C57E31E242D02DF8E300F743FE567E9828A634571914E3EAC42DEAB7714E1B93665B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681994287, "uuid": "9f839bf6-a705-441b-8770-ec534f6e577d", "value": "ac2dad243f78a83a7e8d2e594338a3aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681994287, "uuid": "6b203097-5ea4-44c5-ae4f-e7c76410ba31", "value": "49152:qT74fg0tjLmVWA+8/pGyxe3ZD6a8JHaK0kiy:474Y6j6P/pGyOCH/0ki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681994287, "uuid": "22c84fdc-680e-4c4b-8db9-1fe48097ac1f", "value": 2615296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681994287, "uuid": "985b245a-267f-4615-88f3-d43b6eba1400", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681994287, "uuid": "5d4d2964-0b10-437f-ae39-a7e5148384b4", "value": "bf9732394c8838f20e95d8dc50220bc7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63ae3336-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681985778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985778, "uuid": "fea7743c-1fc0-4ab9-a7db-794c53340753", "comment": "Malware payload (Formbook)", "value": "aae17f9e16015fe70397d96189599006", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985778, "uuid": "b503e867-f376-49c3-aec3-7ce95a8305c8", "comment": "Malware payload (Formbook)", "value": "b818f5a62ced3a731fa73968051a1017aee199a324fe740c7bb14c488d1a670f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985778, "uuid": "55de5386-a091-4325-a70d-f17fb6363668", "comment": "Malware payload (Formbook)", "value": "9b16e267c8be7c03e399032ae0dcb1c9ad34d18b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985778, "uuid": "033837ad-971c-4385-9bcb-3d773b18fe53", "comment": "Malware payload (Formbook)", "value": "b63884e45ba3b35c024cb21f58686c5fe5832acd92dbb3f446119c5076bdee79bd295cb4e9a0844e5a60496a11939093", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985778, "uuid": "a8fc416a-fd00-470b-aa86-ae7d347c4b6d", "value": "T1E004AF36D601C071E2B212B5F6BD1B7B883E0D343255A4EAE3E116A16EF59A5F03931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985778, "uuid": "be599387-90d6-4d14-b783-aebed96bce31", "value": "3072:hahPEsB0bsbmL3Yl94meKhyZ9mYppThI9Byh6pq+ampXeSARZ+GE:ha2jYj4LKhyZ9vpThlh6BaM7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985778, "uuid": "52f2664a-19f9-4850-8913-342bec4c429a", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985778, "uuid": "067794d0-7cb2-40aa-b854-affc78664aea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985778, "uuid": "8b6fdd79-49da-43c4-9670-8d0f06861426", "value": "b818f5a62ced3a731fa73968051a1017aee199a324fe740c7bb14c488d1a670f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b46461c4-df45-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681972599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681972599, "uuid": "b6320fae-5427-4241-ad0d-588b3ad4bce8", "comment": "Malware payload (AgentTesla)", "value": "ffed3bad234f250da4509c44a9da6327", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681972599, "uuid": "13240835-9a36-49f7-8e63-19996df80ad8", "comment": "Malware payload (AgentTesla)", "value": "b828e57eb67420551529ae16c87e86a405a6805698df6957a45f409edcfa7733", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681972599, "uuid": "0c3e9bd8-dc81-43d5-81e4-d7ce6a6b141f", "comment": "Malware payload (AgentTesla)", "value": "46dda0382ca77eaca4b15b5d714f113c2c244f1b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681972599, "uuid": "6e57df8b-4deb-4ad8-a589-1ae8d0054a26", "comment": "Malware payload (AgentTesla)", "value": "ce82e59bb910a6d440c1db79d6976502ac769e5e00b535f331510f6a5d0e719649131039e094aa74947e833242e2ab30", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681972599, "uuid": "0018176a-a36d-4c3b-8442-0edc938e7576", "value": "T11AF4E1D5B366E792C2643D3D52E761282BB05987E917CA3AFDC801997E277C90EC0387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681972599, "uuid": "5b589255-4eb2-4b2e-8377-fc3351cc1c08", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681972599, "uuid": "36bc81c3-9fc9-4f10-b4d3-37194578a42a", "value": "12288:1XrrprTdyyoVHMH91DzZuSee0/2Uxo38kDRRa810sLRh/xx3GsRbE0dpHX0DwU8H:Zr/yyAHMd1Dtzk2h8kDS81tVh/xx2sR9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681972599, "uuid": "617b204c-e655-4043-aacd-3dbfc634d2d0", "value": 726528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681972599, "uuid": "a850917f-7b4c-42a5-a54f-211a86a8468b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681972599, "uuid": "7277950d-b996-47b5-967c-cd42e2fc5736", "value": "Scope of work.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07cf017a-df6c-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681989059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681989059, "uuid": "42711e5b-147c-4a44-abb0-55b35b619494", "comment": "Malware payload (AgentTesla)", "value": "9f46e6054df7faaae5e266e917d8494a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681989059, "uuid": "ce7a5a05-41be-4e87-b57b-75c76664315b", "comment": "Malware payload (AgentTesla)", "value": "b8ebf4c879d3231dab03c47776dc6c85a9c46ac60562c99052a6c29546c886f1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681989059, "uuid": "f6033c44-3aa7-47d6-a524-bbe5ce383c8b", "comment": "Malware payload (AgentTesla)", "value": "612427ac619422fc70f8f26902052b0614f0f047", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681989059, "uuid": "6edcec7a-bc5d-4a23-8a95-8d294bee8c52", "comment": "Malware payload (AgentTesla)", "value": "f3b901d7c3bbb604f93e488b781609460413734c44aa447a0b179613560a6e6dc82fa613415ce946f08389dcdd2a31b7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681989059, "uuid": "888de782-731a-424b-8146-070b90486e82", "value": "T11564126025F8C672F5A317717E3E6E0A6B85960164A44B8F7384BB8D7F92182D71E333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681989059, "uuid": "73fcd953-9880-45f4-998a-2eacb79ac067", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681989059, "uuid": "a2f00fc2-01c6-4476-b097-b5984feaed27", "value": "6144:ZYa6sXIN5XFv37EF7tKoe1pvgXOSIUXttATMzIDm+DCU:ZY+IN5XFv4FAoUgr9tATtm++U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681989059, "uuid": "abdec958-669d-4d9a-bd98-092b7705bf73", "value": 315586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681989059, "uuid": "b0801e19-216e-4436-8a84-0a62f1e8bf30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681989059, "uuid": "6507775a-8363-4f2f-8e61-8b59d17418c2", "value": "RE9865445009869.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd907c3e-df56-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681979942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681979942, "uuid": "268aa314-77d1-47f3-8bf8-efb742614a27", "comment": "Malware payload (Mirai)", "value": "e638f990a361fa34b96a565f33871ded", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681979942, "uuid": "0075f0d8-87a1-4e7e-bd2e-a502e9d3977c", "comment": "Malware payload (Mirai)", "value": "bc3d98d7d2556b70c4d0c0a633bf238bb6d9535346aab28f73a0212ea9c562ae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681979942, "uuid": "a41a8b1c-363e-4ca1-ba7f-9c8f44e33f85", "comment": "Malware payload (Mirai)", "value": "d804c8dc040971c71889dfc6bc05c832dc4bf336", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681979942, "uuid": "0455cf48-37fe-493d-9f30-226a9ac18683", "comment": "Malware payload (Mirai)", "value": "42f88c8b5ebfc3f94fa1f27bc7e521458ca20966bb749c1eb9513d0516912d2e0d076e957b27c76e9aceb01fc57344f3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681979942, "uuid": "fb8b44ac-0e59-4d1d-a99f-7c93c87fa4c4", "value": "T178438D22FC111D62C43142F6B0B0D679C3525EF642E65C766DEEDA4904FBE89B88E7A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681979942, "uuid": "6eb754e7-ef93-4202-b88a-9124be618c07", "value": "768:urJJ7s5LUkGDsIzHceVnuHAuTOssNuNH1MsuQ9B1W/wGKc6xrrSQwdIErT:IJ7s5PYyOuLcNyHLqYS/RBr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681979942, "uuid": "0db5b6cf-60bb-45e6-8827-1ca08ada2102", "value": 58204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681979942, "uuid": "dded2eb0-b39b-4a6e-8bcd-c30d21ab26f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681979942, "uuid": "7d5da2b4-4a4e-4b52-8bb4-7243aa720713", "value": "e638f990a361fa34b96a565f33871ded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87f6e3a9-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681985838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985838, "uuid": "6ce3ea3e-8efc-4582-922c-d2a02f1853d8", "comment": "Malware payload (AgentTesla)", "value": "ea4e13200dd72fe4dbbbe290179de6ea", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985838, "uuid": "5f6196b9-72f5-4229-8b52-1a238ca36c69", "comment": "Malware payload (AgentTesla)", "value": "bd1ac6c1c8344dc16abd4fd0ee8d770542fc834493e7a87d66d0bcff4e7c7c01", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985838, "uuid": "658dce13-deb2-4d6c-a356-9c2923798637", "comment": "Malware payload (AgentTesla)", "value": "e8bbdb6b315d3482b59a85463541cec1dcbe0387", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985838, "uuid": "87ecf7ab-fb27-4d54-92aa-00165e96551e", "comment": "Malware payload (AgentTesla)", "value": "73a45528a8ebea79d0ad97b880a9f4b7571d6aa5ed3479ba56a17edafe63bb26f39908d9af3653142a6eceeb6b44c9be", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985838, "uuid": "6e74c707-2165-42a9-a71e-54097af6e577", "value": "T1D9C4F029D126ADF3E2DD0A3700543AE9EB70A6E37473C63C07AA7896DB5F3152D84087", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985838, "uuid": "e84581a7-836a-47bd-aa5f-eae346bf674a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985838, "uuid": "6a1360ad-dea8-4263-83b9-2734ffe9ab7a", "value": "12288:VHB96kXdEba104kZVqVNxHMClhninc4YL/Mb3JiTuBLAJ:MwdhmZVU/JPtXM7JiT2Lk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985838, "uuid": "5d566706-5235-4283-99d0-3c272e325df4", "value": 585728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985838, "uuid": "85075c7d-07b1-48ee-b766-2387d7ea47df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985838, "uuid": "2cf74176-8b50-4ff9-8f3f-9a5fe04d4f41", "value": "WaybillDoc_7807431483.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd8903c1-df7c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681996344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681996344, "uuid": "da579009-84eb-41bb-9a26-2eca321dd39d", "comment": "Malware payload (Formbook)", "value": "daf38969ea84ef75b59a19518ecb825c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681996344, "uuid": "010483ba-034b-40e8-8e5d-74b65c46e335", "comment": "Malware payload (Formbook)", "value": "bd407e66453e00d96368122b1d8761c995aa3a9606995dbd46ec1629debb18ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681996344, "uuid": "7dc523c3-b59c-42bb-b238-8406000a8e62", "comment": "Malware payload (Formbook)", "value": "ffad234dfc77ff46bd7872cf469823cc33c719c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681996344, "uuid": "a253e434-ebd9-4d9a-9596-8efa8b2864d9", "comment": "Malware payload (Formbook)", "value": "b1e3abcb490455d1748bab191fd1c5302cf82cd0f2cdd3504e31ecf5d85964c94d1e210ba0d6b36a8f22a7d83217e104", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681996344, "uuid": "b11e83d2-ac43-4a76-bb71-c47f6d74970c", "value": "T1DBF4E095B766D752C2683D3D81D621282BB199C7F426CA3AFDC9114D7E23BC91F8038B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681996344, "uuid": "e717dfe5-e1f4-4adf-a84e-c811ac65e19b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681996344, "uuid": "0314fccc-bdc3-4cb9-b68b-adaf580b6f53", "value": "12288:uDiE3lkHMH91DzZZlEOfaNbv6dxx99WKvkdsua9cFcPVl/4A/pH:uDlkHMd1DtXANbvkt9WKusuhFcPVxVH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681996344, "uuid": "0355ae0b-806b-49e9-afda-46ced0bf3f53", "value": 747520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681996344, "uuid": "59192249-e291-4451-a8fa-4036d07e15fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681996344, "uuid": "e6caf264-3ee6-42bd-bdfb-31f5172d818b", "value": "shipment document_for your review_2543846930.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdaaf2da-df2e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681962763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681962763, "uuid": "77741fce-0f89-4832-b7cb-39a9e811c557", "comment": "Malware payload", "value": "eb6c9bf7937687f0bf84f17babc1f316", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681962763, "uuid": "0dd54d09-6c29-42fb-9c82-2b79e69943fd", "comment": "Malware payload", "value": "bd7e8f8ff2db3d253c799414c5c41ef046aecf5790b0b36a2f1eef4763aae16a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681962763, "uuid": "4c2622cb-5981-4e48-a14f-8aea185878c9", "comment": "Malware payload", "value": "e24b2e66ffa1e9ef984e75c879fb6d572763d075", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681962763, "uuid": "9cc02961-bb36-470e-8515-43f706dbe515", "comment": "Malware payload", "value": "ced0f41e6adbd0d4cb785c3734598e07f055df594542cf7a5a54e78f47ef477a42a355ba7519d2fde706082c12e2db24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681962763, "uuid": "5a892434-9165-4a79-b1a3-7939883b275a", "value": "T1BBC402B452D1A75DDC002FBEA600988823F74DB6D0C5DE9DCAA7F88B1DBD3241518FA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681962763, "uuid": "660a0f5c-01f6-43d9-a631-ae2fa3b63fd8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681962763, "uuid": "21be366c-11d2-4cab-b66b-c3afb0e3607f", "value": "12288:gRj9oj8+4A2GTde2NO7QMCEp30hZcVWYJ0hx+caGLt3:0ZrA2GRet7Prp30hZcVWR5aGLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681962763, "uuid": "8be5343f-69c5-4a55-a3ad-b718b926fdbd", "value": 568320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681962763, "uuid": "8b0fdc41-bb99-49e5-b5fa-b8d618b15e5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681962763, "uuid": "ea16114c-31ed-431c-8b8c-4d3fd6c5d6e4", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "611401f6-df5f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681983626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983626, "uuid": "97a757e0-c5a9-4add-bbdf-1453ca5a8fe4", "comment": "Malware payload (Mirai)", "value": "118b3d9512c0621d0000a25845a83588", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983626, "uuid": "7c09c4df-1bc3-4100-baf1-dd4da2d99c68", "comment": "Malware payload (Mirai)", "value": "bd959ad4f468a2d2d39ebf6953480172bf03dd3f4cdc34e980a7c5fb17464859", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983626, "uuid": "f73864ae-fd3f-4994-b619-5caa5ca81a88", "comment": "Malware payload (Mirai)", "value": "73f834c453464f2be95855d169421055574dcdcf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983626, "uuid": "a9d47404-d8cf-4b2c-814e-537cb806786a", "comment": "Malware payload (Mirai)", "value": "99b5c4ba8dfb0b7149f3fb36ab8d828e91bd10f9f46551467574a54872b75d4554dc5d36f23d241f1c51903c1cafb5ff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983626, "uuid": "e20b7fb9-e745-4b7c-ae10-264addbd6637", "value": "T17EA3189BF800DF76F40AE67604D34B24B670BBE54F531622731739A6AE762D42823F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983626, "uuid": "b76bbaef-148f-40bb-b5cb-6253b3ec7e29", "value": "3072:fprm1MLWnkyiYVL8fWTimuxVqDr78fz1e:fprm1MHyie8qimuxVqDr78fz1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681983626, "uuid": "5ec2df70-ef5d-4652-8e53-c013113c53c7", "value": 98912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681983626, "uuid": "95b3d07f-e197-496c-8ccb-bd5b140b890a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983626, "uuid": "d5af3f0b-890b-4c1c-8655-3fd7099b4655", "value": "118b3d9512c0621d0000a25845a83588", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d16cd30a-df44-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681972218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681972218, "uuid": "e0f7e657-325b-4a63-83ac-a3809b5dd14f", "comment": "Malware payload", "value": "dbeb50e145dee11cd6b4ac1e3fe2b210", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681972218, "uuid": "588651c9-cdbd-406c-8446-7dddcb8ea757", "comment": "Malware payload", "value": "bddb5f9d1a39feac03d6803d47f5e92f7df20ce4fd27ee83295021b2094c16a4", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681972218, "uuid": "31ff233a-3cd2-4341-9bca-7d447121e06e", "comment": "Malware payload", "value": "80ca2d9c3509cb8a594fe1f6690c46b3e02b1a31", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681972218, "uuid": "59f85875-0066-4e0a-bcd8-8e986051b25c", "comment": "Malware payload", "value": "086027d996609658232e18d28c29327acc2aa7d41bd10acc52a4f254b72a9d2b35408a9c921fa61f29f20b9a21efcc55", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681972218, "uuid": "b25de447-6073-4b90-b455-c38c6461e934", "value": "T1CE8533F0E5246BFE4F8831BA56A7C3B3A44157FF20C6786B2995EB4431B011E35AB4C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681972218, "uuid": "812de4d8-dd78-492f-9842-17341077b5dd", "value": "49152:EG5I52RHq+xxPqfBrAimWxtMRVlwnZIkEvvx4q:EMIKHqFftFQwm4q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681972218, "uuid": "6439b8b4-7277-4df9-987b-7d6ecfb0d6bc", "value": 1824803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681972218, "uuid": "0a634a9e-9c60-4758-9b55-bf8e2c95d5b4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681972218, "uuid": "2af8a44f-3899-4e69-a436-387bab94b280", "value": "PaymentCopyKdJnHFM.pdf.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3925c4cf-df46-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1681972821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681972821, "uuid": "27257035-ff1c-4211-a47c-313a3b7836cb", "comment": "Malware payload (RemcosRAT)", "value": "8ea26f13021b5e153ec61a997d7194ba", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681972821, "uuid": "1361e6d2-6843-4e40-a2e1-fb7064fa51e6", "comment": "Malware payload (RemcosRAT)", "value": "be7b11fabec08e963680ed060d79123661af4495bef8862228b71c50a1052581", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681972821, "uuid": "88c9add1-a56e-4f86-8b81-d29487b407a3", "comment": "Malware payload (RemcosRAT)", "value": "14e52e182d90fc889a557f591ba7d28f8f785523", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681972821, "uuid": "38ec63dc-ebb6-4083-9e45-66e0f903864a", "comment": "Malware payload (RemcosRAT)", "value": "f7e4ca07692a7e9caed84821ae8ae4aec07f73daa439a9b8e5c548be7125dca6676cae29957202aeddffcafd36503e09", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681972821, "uuid": "d3f6ede8-ac39-4a3c-b709-340a56dc521b", "value": "T1C415338B4D2C9ACC655FCD6A784698BE28CF8D5F91637D40FBC331D780E115829AB24D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681972821, "uuid": "1ccf522f-0ec3-4dfa-81d7-afc9b6c6508f", "value": "12288:PztVG04Z+Y71RNtiSVivaHWS7nwAAYDTlZHOG0QhgS596Q15Cfk+XrqdsBJgvr:bWz7iyQaHWYfAaTlYUJK+Cfk+bmGCvr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681972821, "uuid": "d9697826-9a08-41df-9bef-df4308cb3570", "value": 887443, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681972821, "uuid": "a6037890-d926-4740-a1fd-ef12ccec69b9", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681972821, "uuid": "aa9cd1dc-521f-44e6-8c84-a9f6797a73ed", "value": "Bill No. SFSAH24-23-394 PDF.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b12bb5ce-df46-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681973023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681973023, "uuid": "8d8d23b8-e6ec-48e1-ae57-3f53588684a5", "comment": "Malware payload (AgentTesla)", "value": "33f67941f6276c86898d9b6695a6111e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681973023, "uuid": "bc459efd-bcf7-4873-a6da-981c8a5460d0", "comment": "Malware payload (AgentTesla)", "value": "c02fc36e05f86bd7153b2ed624716478120fa715502c4a4a4c9be27c59c9bd14", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681973023, "uuid": "f4e30772-babb-492e-b1fb-1b711da9d404", "comment": "Malware payload (AgentTesla)", "value": "61f80213d476615639e51cd0b953ee97a35aeb14", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681973023, "uuid": "dd47362d-0d9f-4720-8036-ba3f6a69f2e8", "comment": "Malware payload (AgentTesla)", "value": "548cb31817be70c5e95797150be118478ca0f3e954677ffd4f1eda8ef4646fb936826a2162a313b1a5177791a6d13a98", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681973023, "uuid": "f28b3c32-ba9b-43c9-981e-bc87511b1f45", "value": "T117B423DAC55B63D1EE6AB36BEBCC96518696FE5E2367DB80552102C6E04380C504CFF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681973023, "uuid": "fdc3392d-c245-45b1-961b-e1c5d03bbc4b", "value": "12288:dtb6dawhcDUCgx+MYgNey8JefKq0bHnmywSMPxAJEGlDCKtbSeh:7r8BCvJeS16xejlDltOeh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681973023, "uuid": "a3ea907a-9498-40ae-92cd-3b3cb51e236f", "value": 530221, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681973023, "uuid": "651adf55-e3d3-4de9-a9bd-4bd09317f5ef", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681973023, "uuid": "1ce74ec6-4766-4e25-9367-75edd796220d", "value": "CDE_7576592575.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bef4055-df6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681989603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681989603, "uuid": "f7b588c6-3d39-46fa-a7db-c499fda27bf4", "comment": "Malware payload (AgentTesla)", "value": "1cf063099adda44ae796e1abbdc0c4b6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681989603, "uuid": "29036848-5cf8-47a3-a860-bc323421d9eb", "comment": "Malware payload (AgentTesla)", "value": "c086a5bf6d7f4586a1c1f03d6228efafe36e769910c60e01aa9b4fb63ba3f588", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681989603, "uuid": "ba9cf43a-6db6-4bdb-af1c-540ebe32c72f", "comment": "Malware payload (AgentTesla)", "value": "8d5091defe3bf7431e357079da14640a237716ec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681989603, "uuid": "8dcbb1ff-044a-4b82-a576-6297d2d59f39", "comment": "Malware payload (AgentTesla)", "value": "13764f6c83cc9be8f30890bdabf3093fd89b65c6fbfe6efa01f3a482b319eee40731e1989e45709fd3c9074faeb3f59b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681989603, "uuid": "bf3a9c48-7b31-4c56-9dcd-7e664d42aa1d", "value": "T147D2625AE38B02784F5112B6171E0BC99B7DB13E735155A138AC933433EDC6A4276AFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681989603, "uuid": "7159c708-7d06-496c-8d19-423bde8790d2", "value": "768:eFx0XaIsnPRIa4fwJMQF+by2nujzhfj5xzt+u:ef0Xvx3EMNXn6XJf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681989603, "uuid": "9a5743a0-6580-4998-9151-cb0740676ae8", "value": 28502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681989603, "uuid": "e4ddd4eb-db9b-4bc1-8f21-f8e2ed268a7e", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681989603, "uuid": "ec905dd7-a651-489e-b7fa-4727f9495bae", "value": "swift-04172023.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6581b2e8-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1681985781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985781, "uuid": "57f749b2-e210-42ad-aa0e-7bb8d33fe150", "comment": "Malware payload (AveMariaRAT)", "value": "38e9c324a6bebe650bc4f96e7b226abd", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985781, "uuid": "6606778d-4816-4327-ba79-393c3b1a0fe3", "comment": "Malware payload (AveMariaRAT)", "value": "c0dcba7500e8b17fa48c02a534a7c5f599525bf0f7653479bd5ed16cac2bba88", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985781, "uuid": "89868d43-afba-4578-b553-ac60852b29dd", "comment": "Malware payload (AveMariaRAT)", "value": "61b59e0375bdbf54ebfa1570f32f55f7959441ee", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985781, "uuid": "feeb1027-90e1-4f30-ad9d-2d30434de0db", "comment": "Malware payload (AveMariaRAT)", "value": "a31db962fd40e298e0ac28244957c84edf36407c273e289722d0282eb661cd9097de483ff102271b0817f9e3d1da1789", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985781, "uuid": "d959cc5a-77b4-4b41-865a-10f024b1a452", "value": "T1E2E37C227BF54439F7B705301AF93E25D2ACBE310E31CE4B5BD4488658B1589E93A3A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985781, "uuid": "9acbb20e-35a4-491e-8df9-a7b9b7482995", "value": "570db8ef63a92b7fa4b4955d1d36a178", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985781, "uuid": "c70126d9-18d9-4910-b793-534cf68eb829", "value": "3072:RARHROub6IiZktM+t4B6IZeAzaZyJ6QYzHHxgGT0Iw:RkxbQktMo4BRiyjYz6GTrw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985781, "uuid": "e67db576-c803-4695-affe-ad6c2a3eea29", "value": 144384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985781, "uuid": "908929f9-8e74-438c-96e3-e81ebac02cf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985781, "uuid": "ce4472b1-02e0-49fe-ae72-2020af2242e1", "value": "c0dcba7500e8b17fa48c02a534a7c5f599525bf0f7653479bd5ed16cac2bba88", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23732a92-df3d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681968919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968919, "uuid": "a835446c-d5f8-433b-a76c-9722b4a54f28", "comment": "Malware payload (Mirai)", "value": "f3abdde45d8c4631511fae5943e2fe37", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968919, "uuid": "9d47663c-68fe-475e-8d97-f5ac60818f15", "comment": "Malware payload (Mirai)", "value": "c10ebcc1270a01154b3801cf457e9e14b99416f75647c525054b411c1a9d62c2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968919, "uuid": "57666ba9-1233-4db9-b06e-6e433748bb7f", "comment": "Malware payload (Mirai)", "value": "f6924d7dcf17de07649ec958c92d0a39a55352eb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968919, "uuid": "bae6ff05-d4e1-416c-bd95-e1421cd2272d", "comment": "Malware payload (Mirai)", "value": "856f3c28b6bce5cba3dabd5fe34317a93a70ffa85b15ab61e479af25e9410b1731a169bcdd4c9d4c3bfc1f53c53fd458", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968919, "uuid": "39d43b0f-0fde-4fad-be1a-2e2f97a46609", "value": "T1C9730756B8814B12C5D5127AFA2E128E332317FCE3DFB2129E206B2477C696B0E37D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968919, "uuid": "cff64156-a2d8-4f2b-960b-500f45bf4953", "value": "1536:mln25xPBXk1wnnkL7+KE007wnZ86aSd0TIqidNzsvHTGsV5GYIWU:rxpXCMkM/sjaUNzsvHqsVERd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681968919, "uuid": "b9d4cb79-e078-4038-b392-af02c9568e18", "value": 79160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681968919, "uuid": "63e83a01-2ce1-484f-b8fb-7eeec7f96eb6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968919, "uuid": "9d7dfae7-34eb-4943-a77e-3f1704248325", "value": "f3abdde45d8c4631511fae5943e2fe37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "146bbe4d-df50-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681977055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681977055, "uuid": "099453a9-a810-475f-b986-bd020a9eb227", "comment": "Malware payload (AgentTesla)", "value": "397c47ede0b01a7145478c1c1ebfecad", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681977055, "uuid": "9d3212f5-a296-43fc-b324-29698b3b422a", "comment": "Malware payload (AgentTesla)", "value": "c14068b312c53040f23e40aca6a6251d2330b1ec6874061b50ebb7e6800fda29", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681977055, "uuid": "b26120aa-fc00-445d-8dd8-7563b645c109", "comment": "Malware payload (AgentTesla)", "value": "2f8398ddc426bcbaac364e6339b77b8e807c8fa4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681977055, "uuid": "96aa25b5-276a-4923-94e3-b9d5db47febf", "comment": "Malware payload (AgentTesla)", "value": "4f0bf8b7c49d74b426aac4a8a861a58e0cce8ba5b6887aa9d0df46fe782ac467fa8167bfd5b0dd789b11ff74655e102e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681977055, "uuid": "429ca073-3dcd-4d69-83b7-3e55ee2fd2af", "value": "T1E0226C2CC541F81FD220087EE01681F4E61E056BE712B92F2095B2DD4FA17D7C78AA75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681977055, "uuid": "c734ddf7-a2b3-4936-ac26-5c47a64b324a", "value": "192:ScIMmtPGT7G/bIwXOVORtKz5SEzBC4vNq6sM63SR:SPXuT+xXOVOSdhlqH2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681977055, "uuid": "bfead603-e001-4112-bcac-37d400fb51a1", "value": 10390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681977055, "uuid": "46ad78fd-b099-4f4c-bb8b-512c0ea8dc9d", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681977055, "uuid": "6c9a9704-89ce-4462-a4af-a9f44c651f4c", "value": "Overdue Statement of Account_1.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aa7f282-df43-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681971508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681971508, "uuid": "676942fd-3a04-4a2d-a679-b888d8e13cfd", "comment": "Malware payload (Formbook)", "value": "f742053cbdcec12c128fa08914285311", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681971508, "uuid": "1a93b4f4-a354-485a-8769-86881937a46c", "comment": "Malware payload (Formbook)", "value": "c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681971508, "uuid": "f5d8a058-d8df-422f-a765-99b6ce84256d", "comment": "Malware payload (Formbook)", "value": "317e8e0b0c60811810f1c2d50abaa4b481470eff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681971508, "uuid": "14317b48-e5b8-4bf6-adfc-7cf64862c0e1", "comment": "Malware payload (Formbook)", "value": "e3140fc7cdf0a8b18fab6aab815e9fcbb0a35189e42dcd6e5f4349fd22db5335a1e730e31d46964a9999d64dfa9bfa6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681971508, "uuid": "66661cea-d9c0-4bf4-b7c9-6e3a4b2902a3", "value": "T1A94522153AFA2E46C330A67D75E7009ADFB2392C4917DE496D4B10EA375A700ADF0B4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681971508, "uuid": "40fdf5fa-b063-469a-815f-d736af076a83", "value": "24576:lOgF4x4F2TyXJuJNPohQzhaqXnX+jdAFFXro72lL5rnX+jdAFFX:Fmm2T0JSNgakqXsYVSiLRsY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681971508, "uuid": "8fdfb216-a85a-486c-9d3e-06ebe309108f", "value": 1269760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681971508, "uuid": "86424e3e-c61c-4df4-8260-23c9b890a888", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681971508, "uuid": "06a3232d-6526-49ba-b619-9ccee9235203", "value": "f742053cbdcec12c128fa08914285311", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "596ec6a8-df32-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1681964286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681964286, "uuid": "d4f3c31e-8b4c-4eed-b0a3-c6c567b6d12a", "comment": "Malware payload (Smoke Loader)", "value": "398b63765408449bf54cf01542cef47d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681964286, "uuid": "3aca1e14-1583-4202-bd54-49b71bdf5978", "comment": "Malware payload (Smoke Loader)", "value": "c2d3c986be757b156dffef0eb12b4b88e5552c5fb0c546aa345590e932b7c4ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681964286, "uuid": "2ab7ceac-3ca9-44c3-b4fc-2cf590953c14", "comment": "Malware payload (Smoke Loader)", "value": "13491ed2e196aa412a469884e45fd84eadf3c3da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681964286, "uuid": "772f7000-f328-4b06-b189-5aa8e0f58bf8", "comment": "Malware payload (Smoke Loader)", "value": "b2acebd772ff6c8b56777ae6fec9ee61de7db7e13194e16400ae8dbdcffc7920d9b26816e2e8a83f484e2e02148e754e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681964286, "uuid": "7801aeea-0120-483d-b453-5698bd493ffb", "value": "T17334CF31B691C0B3E94B85B55434EEA52AB97CB18794879B335C3B2B3D703D14BAB306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681964286, "uuid": "af06da1b-f0d1-4da4-ae41-6ebe340dfd67", "value": "6d86aa147518c9f783875b9278e5ac78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681964286, "uuid": "c959dc96-d74c-449a-a1ea-766432245470", "value": "3072:xcH4HLoSG2TT/hCUXtjtulfYWdoIKJ2gca6y9cQZ5/Y+cjk4/oweZL:aH4Ed2v1vut6N9vYfg4/ve", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681964286, "uuid": "d2fdae45-9d28-4244-83c4-d92cc9dfdfd1", "value": 242176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681964286, "uuid": "e208550a-82a3-4f20-9681-f92afc854ffb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681964286, "uuid": "a15ee931-edab-4fb9-bb81-d268584113b4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac3b15e6-df88-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1682001361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682001361, "uuid": "6da43764-a15b-4368-854b-66aa363cbce1", "comment": "Malware payload (Smoke Loader)", "value": "f5ae514a8d297bb487919929b612a0e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682001361, "uuid": "e7d3ea73-30b1-4a66-ad9a-6f2242342546", "comment": "Malware payload (Smoke Loader)", "value": "c2dfe32086a0b4085c35fe0aee15e5a1d55bc0e61101fa69e7223da8c35d82df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682001361, "uuid": "3865ab74-d473-4052-bf9c-f4c9fb3b84ed", "comment": "Malware payload (Smoke Loader)", "value": "b4a66185558e9ecb7c705ab60d924fcbd5316948", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682001361, "uuid": "00d1c3fb-6e65-4f74-8070-351857795a93", "comment": "Malware payload (Smoke Loader)", "value": "04b53ad130a094223f205cf528fce1be1c64e030adfe016d3909e944194303b13571b65434cf3cc9a3cf31b582e82645", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682001361, "uuid": "c65c154b-353a-4a8e-96f8-5a038bdfd7ba", "value": "T1F6747C1263D0E871E916DA728E2EC6F9776EF4608F157BDB27595A3F4A302E1C232305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682001361, "uuid": "9eb013fe-5491-411d-a75e-f3580d6ca6a5", "value": "761da97ac2be4c1115573963fafba647", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682001361, "uuid": "a0ed2339-67d5-4714-8ff3-1f35720a32b3", "value": "6144:oanJzIhKqYl5QBW9wAg/9IKy1LE6ymN2TXB:1n5iKPl5QBEwtroY6X2Tx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682001361, "uuid": "8c48b897-3615-418c-a2ce-0631ef4087f9", "value": 363008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682001361, "uuid": "33d0a87b-5e9f-4aaa-b417-d6b8f1a3c321", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682001361, "uuid": "725908bb-266b-480d-a5d7-8b865fba5779", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72c13fdb-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (FormBook)", "timestamp": 1681985803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985803, "uuid": "e6f7557a-1dd0-4985-84cb-f98682fbecc6", "comment": "Malware payload (FormBook)", "value": "fe94db3dddb1cbf50762249cb8660f3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985803, "uuid": "895c8d6b-b8d0-4a98-bd8c-8ccf0d8476f9", "comment": "Malware payload (FormBook)", "value": "c35d39c896510b7dc65ebb37f3ab35837f0fe500c8f9927988feacd92d41eb92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985803, "uuid": "5bda63dd-af01-4285-80b3-cb0c796c6606", "comment": "Malware payload (FormBook)", "value": "9cf631ac4eae8b40b5170c9c4d2fdee87b887198", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985803, "uuid": "ac4a02b3-6ffb-4517-9600-0108df94a06f", "comment": "Malware payload (FormBook)", "value": "7db5401b46885c80f47b83b28feaedae33aa672cfe37b8308c79cd12c25f43eb56f947c81e207fe6347cf940524d795b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985803, "uuid": "103fc0ec-e86c-45df-8ebd-f8eda8746acb", "value": "T166058D11E1918476E672167CDC1BD2B9A82D7E206E28F80B37E95F4B3EF5650292D3C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985803, "uuid": "394b190d-733d-4294-adc0-88b13708f87d", "value": "3d3dfee0b73b800a9bca6b50b5fb8258", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985803, "uuid": "713dd8b4-4b2f-46ec-8ac5-2ec9a802f650", "value": "12288:T8rLgxLKQfJJuXFI3MU+oVv6G57D1llttQCMO+U1xldIuau/T2SAzCk1:wrLgO0023ZQK9CO+U1xldqu/T2SA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985803, "uuid": "7bc8d59e-9bf6-4fa8-b5da-cbfcb5dc11b5", "value": 856064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985803, "uuid": "5287eaf4-76d7-4b8c-8415-3c9b6bf8ce81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985803, "uuid": "227b75d9-97ed-45de-84a1-25b70649e493", "value": "Kvcyqchhbhkahw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "773a5cea-df4b-11ed-88f6-42010a9c006e", "comment": "Malware payload (BluStealer)", "timestamp": 1681975073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681975073, "uuid": "b61dd16f-40d0-4bf1-af02-4d983f09525e", "comment": "Malware payload (BluStealer)", "value": "61b7350c1d830391036bdf7ac96e7fef", "object_relation": "md5", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681975073, "uuid": "bb555b61-78d4-43fe-93a0-e4abd1d9d756", "comment": "Malware payload (BluStealer)", "value": "c37e211564b4d5b3447fd8be8526724a4193ac8d9a99efddc3d599f7b5e6af51", "object_relation": "sha256", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681975073, "uuid": "fe845bb6-0b16-4d74-a83f-30f5fcfd45a3", "comment": "Malware payload (BluStealer)", "value": "585c6f1f8c37b82154188733e97e3e1111f214fb", "object_relation": "sha1", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681975073, "uuid": "ed86543d-605d-4bfa-9588-3d992e742010", "comment": "Malware payload (BluStealer)", "value": "4e0482c8e116e9b7a31286d7fdb9f8860863545e80067a908d5533baaa8ff4f2990babeaef30e1ccb4e56cca7ddcd67d", "object_relation": "sha3-384", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681975073, "uuid": "0b7a3a05-ac79-4e16-a6dd-c16895f9564a", "value": "T104150229A1B5DFA2E5AE0B75001439D8EB3125E334B6C63C4FD2B4CAEB6E7191DC4583", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681975073, "uuid": "dc09cf95-d087-4337-a438-7869e4382007", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681975073, "uuid": "76495061-4f09-4251-a94e-45a3c690cef5", "value": "24576:YDB9nM8vHaTmly301VMB6PWslKEW7SsvuXe:YVytKA3mEiWBjzvuX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681975073, "uuid": "0ec5a799-f089-4cf3-b65f-70f63403d0dd", "value": 902656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681975073, "uuid": "af2f863e-2587-4109-83fd-6ae48d141d1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681975073, "uuid": "fdac64d5-ae04-4347-b677-1f2b82ba576c", "value": "PMI 22-8143_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7b24e13-dfaa-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682016037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682016037, "uuid": "477e08c2-a1d3-41f8-9559-d27a17715979", "comment": "Malware payload", "value": "e935d4ed5c17f173209767725f948730", "object_relation": "md5", "Tag": [ { "name": "1681985211", "colour": "#1A34F8", "exportable": true, "hide_tag": false }, { "name": "BB24", "colour": "#CEE0BE", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682016037, "uuid": "30e65d8d-0f92-4b00-88ab-db0f7ecae65b", "comment": "Malware payload", "value": "c3e04a88c1ba88055d30a9e78fecd7f1632af665e0b3b3fe0275f69fc4c0d963", "object_relation": "sha256", "Tag": [ { "name": "1681985211", "colour": "#1A34F8", "exportable": true, "hide_tag": false }, { "name": "BB24", "colour": "#CEE0BE", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682016037, "uuid": "d6099973-8972-4520-9784-f327a53f040e", "comment": "Malware payload", "value": "91ac10df87d2af05146a78b8fa66f689fe0eede6", "object_relation": "sha1", "Tag": [ { "name": "1681985211", "colour": "#1A34F8", "exportable": true, "hide_tag": false }, { "name": "BB24", "colour": "#CEE0BE", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682016037, "uuid": "d42ade9a-e245-4b75-aec0-65cf4f05e2fe", "comment": "Malware payload", "value": "0d309175863c86a99a4dad860166d955503413e575961f110ce61a1d4e550cfe691f6a9a45ee3ec92fc6d6f5369446a9", "object_relation": "sha3-384", "Tag": [ { "name": "1681985211", "colour": "#1A34F8", "exportable": true, "hide_tag": false }, { "name": "BB24", "colour": "#CEE0BE", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682016037, "uuid": "9f9f0292-290c-4c42-ae84-3e7446cf5996", "value": "T11F156B66EB4384F0E96715F1050BF7FBAA349B194020DCAFD78CDD94EBB2A12245D326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682016037, "uuid": "a58f7241-4db7-4d7b-876c-028bd0aa4f82", "value": "47c48064dbc000892407135387cfad7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682016037, "uuid": "a0603945-cc75-49ef-adc9-33579e06313b", "value": "24576:Oc04/rF9FAwxK6cDmKVamPmdsqFhQdBTu0tSED1L0CgJ4AcjvdyOuRhWZQi3Ws+i:+4/rF9FAw07DOBFhQdBTu0tSED1L0Cgk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682016037, "uuid": "9e199be2-b5fc-4a09-a11e-a4a18ad22778", "value": 903031, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682016037, "uuid": "57c3278a-78b9-405b-9926-7ce7ddc6f034", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682016037, "uuid": "cc15f4c1-414d-48c2-a5c9-c2c37d224191", "value": "123.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7f2f74f-df24-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681958431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681958431, "uuid": "9035bf45-f688-4404-a21c-7227dc6d528d", "comment": "Malware payload (AgentTesla)", "value": "901454073fbc77ac0854e0d7b9d37214", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681958431, "uuid": "0efa2406-e7aa-4756-bf24-1b47d31768b5", "comment": "Malware payload (AgentTesla)", "value": "c4412128ec553fc7dd04832d11ccd68c8db5f08729ac401b78fba4c022127625", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681958431, "uuid": "31566593-926f-47d5-b7fa-18b6209da7ac", "comment": "Malware payload (AgentTesla)", "value": "ac5a7399c36c9e2f9c49e8a2c12bbb3e3b82e9c1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681958431, "uuid": "2c96c37b-cff4-4434-bda7-8af13aca17af", "comment": "Malware payload (AgentTesla)", "value": "0adebaef1f39ab99c16c39287dced281999a30547a943727a38b23a386be71a69f49b5691eff77e8357d9d1121f5712f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681958431, "uuid": "f7c1ac52-8997-47ba-897b-d103f925f682", "value": "T199E49C7E798F41A6D239C6B3CF97F424F37D852B701D782924E71A0046CA98BB4C85AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681958431, "uuid": "cddf4ad0-31fa-4dcb-8ee8-1e0953f2d25f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681958431, "uuid": "66adaf21-909c-4024-8b7b-5bdfb3f261f7", "value": "12288:OsOxolENV0cikYIoXW+Mf/pUN6/q8qS3BZ/wxsYD:OnbYu5UVgb4xsY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681958431, "uuid": "9526d3e0-a2b2-49ca-9e43-3b8989f85fe9", "value": 659456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681958431, "uuid": "9549ae1f-607a-43df-9fc1-76cfebd1b1b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681958431, "uuid": "1f1f7673-384c-4371-8efe-e987a85bcfe6", "value": "901454073fbc77ac0854e0d7b9d37214", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d4556d3-df5b-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1681981821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681981821, "uuid": "69a8bd56-70eb-4d88-9f6b-ca2cb2c6b3c1", "comment": "Malware payload (AsyncRAT)", "value": "435d3d8b21459f2ab3f4df46dfeeb8c3", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681981821, "uuid": "f842c6a5-107c-410a-bb39-bbb7eef694eb", "comment": "Malware payload (AsyncRAT)", "value": "c48d2cb5d98dc746bc2dea4c2c4cf72ef1fdb18011e2bc46b3fcdb6072f2b896", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681981821, "uuid": "6deba5d0-a12e-4d6e-94fc-d14d0769d0c4", "comment": "Malware payload (AsyncRAT)", "value": "597ca39ea9f30997a282b908f29205a3ab06eee1", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681981821, "uuid": "15bd5529-68da-4bd4-9055-cf4b6125fec4", "comment": "Malware payload (AsyncRAT)", "value": "c1e2787fb51b6415cc676f1e2854e5ff133030590fb32db898583054ac1cb16ac8ed9f97ea40501dc20bf9ca855e251e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681981821, "uuid": "05aaca82-23c7-4d02-b27d-5968e7049318", "value": "T1CF253A4BBCA044B6D0A9D23189B651917B31F8991B3227D73F50B2B82FB27D85F39364", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681981821, "uuid": "bb89bbf1-cc0f-45f4-a382-9cbef057fb2f", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681981821, "uuid": "bfe5b4bc-b92b-454e-be72-3737b4cf549f", "value": "12288:Q4mT/RcXtvyJdBQhXVQpWDv4alOZqby13caYgd2Du:Q4C/6XtvWBmQpWTFgcaYgdV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681981821, "uuid": "3c1e67b7-3d79-41a3-ab36-b13fee3018ec", "value": 992768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681981821, "uuid": "8e7df05f-abdd-4fb5-b546-272b1ac4c95c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681981821, "uuid": "8799c8a0-3f66-4bb8-8c59-3205163c5de8", "value": "Ta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eacd6f1-df3a-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1681967757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681967757, "uuid": "f77022a3-727d-4101-a3c8-5a22ae129d92", "comment": "Malware payload (SnakeKeylogger)", "value": "ad6c5cc4034a0351aab5c3c101f9c490", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681967757, "uuid": "b041cb51-fcb5-4ddd-862a-5625703164b6", "comment": "Malware payload (SnakeKeylogger)", "value": "c5a9153aff97fd3982cba299d3b1fc114aee999ba0b0e39fd69b3abdeb846130", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681967757, "uuid": "cb1a1cbc-d500-4410-afb2-e6f47b35cf51", "comment": "Malware payload (SnakeKeylogger)", "value": "b250b65c62371f979a0fb585a92b277bbb13c4a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681967757, "uuid": "c486bd44-c0d4-4a0a-b46d-3fb7882999b2", "comment": "Malware payload (SnakeKeylogger)", "value": "59d50e1212a19ee0ef465ef013b27362418d3a5df57e7f419e46e2dd830e5388379ae707533b4eee19c3d2447114541d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681967757, "uuid": "00919275-c0ce-4358-898f-ceaf10b32615", "value": "T1FD255CD1F250C896D96B29B1AD6BA43025A36E9DD4A4C10CF59D771A36B33C220DEF0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681967757, "uuid": "426a1a37-ab2a-4a65-aded-e00e320251f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681967757, "uuid": "1bc59acd-6e0d-4dfa-953e-f8144f884ecc", "value": "12288:KdBgx/oI3JHMH91DzZ6Q8SfHMfGXhfbIjc8pyiZbxxn29P82y92fp:KdBCV3JHMd1DtRsfIbE5yiZPnmTf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681967757, "uuid": "1503d256-1846-4a22-9504-554226174406", "value": 977408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681967757, "uuid": "4f9e5173-7d48-45ca-b532-db771cea0d5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681967757, "uuid": "7e4972d0-a315-4e7d-b4c0-6ad9d43d456b", "value": "e-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4502c4b3-df5f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681983579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983579, "uuid": "3d1732dd-b46e-4075-9640-009bc494c9c2", "comment": "Malware payload (Mirai)", "value": "c2707c302689284b3394091fa52a4305", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983579, "uuid": "c72b61fc-48d4-4118-95ca-60a9e23309cc", "comment": "Malware payload (Mirai)", "value": "c65994f187d0f4632bdee7fb267f0c2729ed00c8be7269a42e1ddfab1d6a6475", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983579, "uuid": "afa0550d-a265-4dc4-a990-d41eeadc7dba", "comment": "Malware payload (Mirai)", "value": "dd77f166fc7a2b117c8b2518f899a96278edfe41", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983579, "uuid": "33987f52-54e2-445e-a85f-237b65936367", "comment": "Malware payload (Mirai)", "value": "4ef8f16460662645b931dfcfbe0cf53c5d0ccff0a7df19a35e50f2c75d2869907414abfa2fa58d4722838077a16c51bc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983579, "uuid": "81226fd7-5d08-4ce0-9141-7e02270528bf", "value": "T1B6C3842E7E22BFBEE668863107F35F70879521D227919382F26CD6181E7128D1C5FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983579, "uuid": "2e166a72-f091-4802-b94a-7103657ce14d", "value": "1536:47je1TwGq+f+AM2rK/jeve9eLe8B2rK/4eBmq0GAzQj1l72HBeDEJaAW/GrmW+IR:3ClkB0MZQHjJaAW/GrmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681983579, "uuid": "597cd878-0169-4610-9859-3069d073a218", "value": 125959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681983579, "uuid": "d9ff8174-8deb-404e-a1cd-285bfffb145d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983579, "uuid": "45e3468b-7de0-4a12-8492-1d5157c21fc9", "value": "c2707c302689284b3394091fa52a4305", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4157efa9-df5f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681983572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983572, "uuid": "32e0a51e-2d88-44b9-88bb-d70356b543ed", "comment": "Malware payload (Mirai)", "value": "c5b81435dfa300c1264f6dbd1573aa2f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983572, "uuid": "918819e8-2b2b-4fbc-9369-ce2744224096", "comment": "Malware payload (Mirai)", "value": "c6946191c832cd807fadb4fa6a52729d8ac0bf08c2794dbd9f9a269bb6336870", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983572, "uuid": "fd3be670-8556-4e79-8baa-6843fecd52a2", "comment": "Malware payload (Mirai)", "value": "6b9a60106f49aa75a3c05bf91f5711b0b6fd4c62", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983572, "uuid": "503875f1-418d-41ff-b4fa-c1b76295d37c", "comment": "Malware payload (Mirai)", "value": "e99b5833f813ee2a1467edcdde4bd54e02bff1c3065ab2e8920d05cf228b4dae5843a2f265d54007085d2333b335933d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983572, "uuid": "5e5b9790-dc1b-48a9-b414-b1abf574eab3", "value": "T1F144C67B26531B63C0D9183205D71232E8BEDF4430B857D7A8E0687D2F2A6E4359B6DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983572, "uuid": "c2c8df72-48f6-4f66-8a6b-583a7b390fc8", "value": "3072:o+AQH4muQI8tDtpYvNPbDJvbv5GO/u/BDHoMaMfbUCIT:o+AQ19I4vKlnJj5GOGpDHoMaMfbUCIT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681983572, "uuid": "52ae4885-2880-4c67-90c8-5e6d7e1faca3", "value": 261812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681983572, "uuid": "aa22918e-0cb3-4e63-932b-50c6f226296a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983572, "uuid": "f8b7dd79-cc4e-4db4-9487-91366fd58a01", "value": "c5b81435dfa300c1264f6dbd1573aa2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71f0da54-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1681985801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985801, "uuid": "a1232748-9f61-42e5-8203-78648a70a75d", "comment": "Malware payload (GuLoader)", "value": "3931436d54a7af5e532612c3f3e06fc0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985801, "uuid": "7ab4ccff-d911-4b5d-991c-83d192bed9df", "comment": "Malware payload (GuLoader)", "value": "c69e558e5526feeb00ab90efe764fb0b93b3a09692659d1a57c652da81f1d123", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985801, "uuid": "754de01f-462d-4fae-9fb2-6d0d6cb07750", "comment": "Malware payload (GuLoader)", "value": "eb3692c150cc7f8ecea9522b314e50e82c902209", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985801, "uuid": "08fd2a98-98f9-4754-8c7e-c1237617e77c", "comment": "Malware payload (GuLoader)", "value": "46af9db41c97a9d7a2a5eb8704559bd1d6732e60bccd916d15b57e7a3b92eaff2d3566f825296a92655de640fdc35184", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985801, "uuid": "74213e3e-aefe-4aac-8d60-c62eedf36621", "value": "T198A402C67AF0F393E83586B00A16A4B6FA3BFE307594D12723937F0E66715E1991B112", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985801, "uuid": "ecb28f7b-47fe-43cd-80e8-5b8f7c52215e", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985801, "uuid": "4024362c-3e32-4193-a150-2e4e73945388", "value": "12288:gz1KzffDfffr2c0kz0hS19NTivjlmJdio3qH:FffDfffrrzES19NTivjlmnV0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985801, "uuid": "fc3ed585-83ce-4713-9134-c908d153c842", "value": 450224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985801, "uuid": "6b4e574b-2671-4579-81f4-869f35bec2a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985801, "uuid": "69c4421f-4b16-42b3-b8be-c80ded990927", "value": "justificante de transferencia.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "368f0336-df3c-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681968522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968522, "uuid": "8394c15e-624a-4cfa-ae0f-2cc1cfe73721", "comment": "Malware payload (AgentTesla)", "value": "4cc65a324e95c283133278c6665b7cbd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968522, "uuid": "deb4c56a-239d-4695-8f2e-35a9751ca2ad", "comment": "Malware payload (AgentTesla)", "value": "c7db7fa3a5aeba74a3733ed0d0c3a8007c973c122ee73ac0161c2e56d24d1f07", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968522, "uuid": "ad040b20-7c9e-4653-8f7f-be0e5dbc9df4", "comment": "Malware payload (AgentTesla)", "value": "0a7e7f9ddd92bbbe12da96d9614da35007744909", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968522, "uuid": "8b1d5d94-50d1-43fd-bb48-d1deb4c9d86f", "comment": "Malware payload (AgentTesla)", "value": "df39bc55cc522f36b274325cbac0c9b35ab1f0b458699a7c0881448694c4a1a1056b519a8a6c62df4f38ba562858b7d1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968522, "uuid": "e0340658-d7f2-4bfe-93d3-ae09cfc54e10", "value": "T1B5F4E195B366D752C2587C3D92AA60382B7089D7F417C96AFCC810997F27BC91E807CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968522, "uuid": "2486414e-e7d5-410d-838d-47a12656f002", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968522, "uuid": "5626700f-b7f3-4dc4-81aa-4416fd37478e", "value": "12288:8JTLBOjiHMH91DzZt1M8D6kzpnbjIlwZSW0NbjgwEwZAkKPbB/XVCYj77i:8P0iHMd1Dtt+8D1nPIlwZZ0NdgPN/wYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681968522, "uuid": "c4205e33-8107-4a98-8364-4ef17140889f", "value": 727040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681968522, "uuid": "882b10bc-e1ff-4a0a-b1a3-55ac9212a6e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968522, "uuid": "736c2b0c-3911-4c90-bd9a-781b7b004270", "value": "4cc65a324e95c283133278c6665b7cbd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b82c826-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1681985818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985818, "uuid": "b44ff8f1-e871-49b0-89a1-813b333c2743", "comment": "Malware payload (GuLoader)", "value": "7faceeda78eb4d6b0fa34f756370d5bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985818, "uuid": "5a3cd147-28b6-437c-a44f-2dd0405802bc", "comment": "Malware payload (GuLoader)", "value": "c8006013fc6a90d635f394c91637eae12706f58897a6489d40e663f46996c664", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985818, "uuid": "0a4f9c4a-7d67-498d-96ba-c97aa7a91f37", "comment": "Malware payload (GuLoader)", "value": "ba5d789981d5ad45599908a41773b8d8c489a5f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985818, "uuid": "30e58554-ab32-4dc0-bf2c-a9498939065c", "comment": "Malware payload (GuLoader)", "value": "8acd771af4508deeb7b73ddc3733a3778d5feabd46d691e1a3bb007b92a820f4b6b66115658d5cae865261794f99585b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985818, "uuid": "3315eb2d-b195-4974-b036-fd10ebd3e08d", "value": "T17F44021672E5C167D8A856744E37D6BAC3B0AF480118030F7BE0BF5F1C356BA9B1E1A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985818, "uuid": "4362a91f-4c54-4a11-8df6-241ba25adc61", "value": "7ed0d71376e55d58ab36dc7d3ffda898", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985818, "uuid": "a8ead9b3-bd0c-4f41-8fab-c88ca480d46c", "value": "6144:lkyacCTf74aPH48QOdmtTdOXVpfnZAaE0UWTe8AW7:lkNTT3PHpdUtQVxD+me8Ao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985818, "uuid": "6e196447-2548-42ed-89b1-396537df276c", "value": 268168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985818, "uuid": "704e7bde-5fb9-48f3-8ac8-cf728518177d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985818, "uuid": "0c73e4fa-ed1e-4a08-8728-ec4fce5c59fe", "value": "Parfumens.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "663da8e3-df5d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681982775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681982775, "uuid": "b2d308fa-4d0a-4cca-9846-34659cf58b72", "comment": "Malware payload (Mirai)", "value": "1af5a47d6fd4cb710e32be96d82b656f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681982775, "uuid": "6513fa00-6861-445a-bfcb-d2ab70d812f9", "comment": "Malware payload (Mirai)", "value": "c88f5f9f3b01c8f5013a0d193418166480dcde64ac1a71e310f6826f28194ba6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681982775, "uuid": "aaad3bba-cd0b-4736-b799-140dbe11bf97", "comment": "Malware payload (Mirai)", "value": "12688ddbc559c2284315f38f288bd15513ad40b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681982775, "uuid": "fec1ec60-0ca0-424f-9309-e9443f863751", "comment": "Malware payload (Mirai)", "value": "b1bbc05edb191357c5df8f2cb02ca9c40518f8c8be7539db77e919b2f187778c0395272e452961a5face6e418e485011", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681982775, "uuid": "c253e750-1a92-4462-9d99-10d0d5ca9b1f", "value": "T12A03D651F8825A27C6E1127AB6AE4A8E332073E982CFB617D9214B107BD551F0D63F92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681982775, "uuid": "285fe645-ab55-4822-9e72-f80509625754", "value": "768:ZqILBdhxPh91eftcG5dm80LyFBWEu/tOr4MkKvlw9QSo8qMuxE1Jomxu/Nkw7kkH:c0zmf2G5dmSBWjV8kZbJq01RuD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681982775, "uuid": "16505c3f-d376-4ef0-982b-fd2025079ab0", "value": 38116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681982775, "uuid": "ae58c85b-bb95-410b-93b6-13aa16e36018", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681982775, "uuid": "5382f8f1-dd55-45eb-a839-c1adc86c1cfc", "value": "1af5a47d6fd4cb710e32be96d82b656f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c20e516a-df35-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681965750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681965750, "uuid": "6bc1c716-7b09-4b6e-a63d-6240a360f7f9", "comment": "Malware payload (Mirai)", "value": "58d7a267847b8d4ed31e0380cf96bcc7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681965750, "uuid": "37bbbcd7-f73f-462a-b287-0a737d901d0b", "comment": "Malware payload (Mirai)", "value": "cb4a82a2274d5b34286371a98261838dfbaac16a59772e078081e0bb11a2b83c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681965750, "uuid": "6437601e-992e-46e5-97cc-e600c8ee27cc", "comment": "Malware payload (Mirai)", "value": "ec37ea236b8c43356c00e79aaec6e49047c2518a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681965750, "uuid": "9acba51d-e19c-44f7-bf40-a1e92000dfa6", "comment": "Malware payload (Mirai)", "value": "18de86f01f6c0a92c6d92c830e41c69da37f46938e4ebad83cb9d1ca2c35ffbe0eccd7601a12d1acb0b14ffaa8891b43", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681965750, "uuid": "051a84c0-0db7-47d9-9ebb-95b79cfc21a7", "value": "T15E436BC4F643D8F5EC8705702077FB379B72E1E922A8D647D3B4DA32AC52651E606A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681965750, "uuid": "3238732c-c375-45b5-974e-1a44e0562c94", "value": "1536:JeESt/basV2rcZhG6ySN7naQpW1ZzWOIaEjrqMps:JeESt/basVTgS7naQw1ptXESW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681965750, "uuid": "7e1cc3cb-32d6-4200-b99b-f46650545e6c", "value": 55632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681965750, "uuid": "606cfe5a-ac20-460b-83fb-a89ccc973ac8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681965750, "uuid": "695c73a2-b486-4bb5-bedc-86f76438b7a3", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "920ac424-df8b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Nemesis)", "timestamp": 1682002606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682002606, "uuid": "8899734c-9a44-4fad-9ac2-0b0217cecaed", "comment": "Malware payload (Nemesis)", "value": "cdbe0feb82b1caf164c7da42cb9a20be", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Domino", "colour": "#57E4E8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nemesis", "colour": "#DF0852", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682002606, "uuid": "4bba3d12-c5eb-4f70-8a76-5e5749a8b4ca", "comment": "Malware payload (Nemesis)", "value": "cc2c7377a23928aa9e68e48d1f282dd2c77ccf7aaad98fa445f215b8c097e742", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Domino", "colour": "#57E4E8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nemesis", "colour": "#DF0852", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682002606, "uuid": "26c559b0-0d90-4e66-97d9-241b0de1d2da", "comment": "Malware payload (Nemesis)", "value": "3732adf224c310a45043370702a08cd32eef2435", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Domino", "colour": "#57E4E8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nemesis", "colour": "#DF0852", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682002606, "uuid": "211f18f5-aae3-424b-82d7-232b12b5c6e9", "comment": "Malware payload (Nemesis)", "value": "ecd15e8ed78995071f4a4745d2143f80208f4e9e8db3d1a96911baf0ec3be7fe2d9d8586a00814a241f4a2bec494b6ea", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Domino", "colour": "#57E4E8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nemesis", "colour": "#DF0852", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682002606, "uuid": "4af601dc-a363-4cb8-b1e5-d2bcd2135247", "value": "T1FE223B0AA7A51AC4D87FC1B1E8A74E07E7B07962614D373F6339418F2F673A3625A304", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682002606, "uuid": "86675f87-6c28-428a-97b4-9a959cd40660", "value": "144e52d8ceda34529f9690dae4aff702", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682002606, "uuid": "92a0f0d7-3b77-4aeb-a6c6-485f560bab94", "value": "192:SHfqPc1/exAuv9jgPeibNVc1lCgbd822EHbaq6bDMuVZc4k:SHfqPcBEAuGeibDQlCC822EHp6Mu7cN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682002606, "uuid": "54bcc885-69e6-42fa-b336-e281c27fae24", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682002606, "uuid": "3b9af81f-f3ae-489e-8506-e8f50bd6f730", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682002606, "uuid": "d6faa45e-ddb2-4c77-b55e-918100392af4", "value": "domino.sample", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f9f86ad-df5d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681982764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681982764, "uuid": "06085140-c10d-44d8-af97-a0e6e0ae0ba3", "comment": "Malware payload (Mirai)", "value": "de9aaf20ac929fc989d91a141322d806", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681982764, "uuid": "2ce493e2-574b-4f16-9bfc-deee71a38587", "comment": "Malware payload (Mirai)", "value": "ce0dc1c11b16bf28670d4199113d3565c4603bac81227efd42a79e62842b9d0c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681982764, "uuid": "38ba21c2-9359-465f-92a0-6ee4a1d3ba1a", "comment": "Malware payload (Mirai)", "value": "bdad3fb1d7f126ad93a323b111029a0083413452", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681982764, "uuid": "9de970c8-c2c6-4cd7-bb3b-2b8c78330320", "comment": "Malware payload (Mirai)", "value": "b4697c2af6f6e4f9d95f4a5c146ca5448051fb815f7d302646257d87bc1f5a6d20893e98508fcf9e691751919c4a62b0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681982764, "uuid": "6a0b1e1a-a7b8-49a3-a807-35be468aebdc", "value": "T140143A04E703C0B3CC4306B5224BA5EBA6207F3B96675C4EF7A47D78E7368D6A124B65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681982764, "uuid": "12669bba-3db2-4438-a50e-7a6b6d253cb8", "value": "3072:OFvlRwEGCluh4aIYiduOpm+S08FKD/AnuOJLhL/vw2dG9DMzMxZCmU/dZ:OFvtaI/wyEnuOJLZvw20DMzMxZCmU/dZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681982764, "uuid": "9ffb5f98-ce5d-4966-9de1-562fa0701082", "value": 194079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681982764, "uuid": "37a4d7e6-c4f8-4f41-8412-8ee7a785ba8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681982764, "uuid": "c1c907cc-71cc-4eaa-ba6b-982ebb69affb", "value": "de9aaf20ac929fc989d91a141322d806", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8568eb1d-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681985834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985834, "uuid": "8d776d11-19a7-42d6-8609-661acf58b11a", "comment": "Malware payload (AgentTesla)", "value": "fd291ed3e1311b34ec7ae2b00dc15c88", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985834, "uuid": "acf60120-0d5a-4f22-b20c-73c69147455d", "comment": "Malware payload (AgentTesla)", "value": "ce15294969a5c175a13bb2d1a5e78a8c38dd03ab2188841b7458289fabeb7735", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985834, "uuid": "6f34de39-97b6-4667-a179-40d1986ec9d3", "comment": "Malware payload (AgentTesla)", "value": "0d0cbb6e31568a034e36d9ffa0c28bf01176cbd5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985834, "uuid": "33f40784-31be-438a-9b3a-712b5f91ae1a", "comment": "Malware payload (AgentTesla)", "value": "063ecce82cac632df772d427b040ef4b7bafda3296094532a4d10829653a802ca289cbc4ce38f234570cd77ad7a19ba7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985834, "uuid": "99b7a13d-7e35-4aad-8bed-9a6332a3f41e", "value": "T19734F116B7E69616CA481A74D0D3053427F193C322B3E7C73D48428A4F523DAAF5ABDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985834, "uuid": "a0808f00-90dc-4dec-89e5-c4560311dae2", "value": "6144:VETQn3YJlxV3qOlko65OQWxhKV+gfqn4:VKk+lfnlkoaIhKV5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985834, "uuid": "ca41a596-cbc7-43ff-849b-b5bb0121ac43", "value": 245832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985834, "uuid": "96bc8dae-4c7a-4caa-a631-9e4f4b22fb21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985834, "uuid": "d17bcbcc-ba09-4557-9287-475e3051d430", "value": "T12642500,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45a95931-df71-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681991311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681991311, "uuid": "ecc7f095-5970-49ca-8628-a07ed90a8fa7", "comment": "Malware payload (AgentTesla)", "value": "a1346c29c20aba2c3c0370b339d306a5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681991311, "uuid": "f9489b5f-ecd7-4af7-a91d-655f5e6d624a", "comment": "Malware payload (AgentTesla)", "value": "ce2d29ba472110501a421f95c48834cea667eb9b4a215498e90a47e95f144471", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681991311, "uuid": "a1b3712a-e811-45c1-a826-9b585c81eb1a", "comment": "Malware payload (AgentTesla)", "value": "6eb83c5aa3e3700484bb988aef2ed8bc0aa2b606", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681991311, "uuid": "e4e03c8a-2662-42b2-ad7e-fe1731925cb5", "comment": "Malware payload (AgentTesla)", "value": "9df42fd094c0674255f64d30b3be52b7fe6df4549938c7228e129ab0fff816708dad8b3d4a0a47994b5cd8d13af972e4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681991311, "uuid": "0722a623-6ebc-4b77-b602-a6d1a2b1a8c7", "value": "T155C423E3CCD610F49329CA7EB812E9F82EA1BE199B7451ADD4A75F114CACC83D057A13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681991311, "uuid": "d5c7de85-e0a4-43ea-a690-02e8ecc91a93", "value": "12288:H8+b7L2i+1oTomec4QMGTlEsHNnPTxBmqhMZ/U36LMRn6z:Hv1Ompg2nPTxExZ/hf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681991311, "uuid": "404973fa-c76a-43b5-bb0c-f6c7995c80c8", "value": 558119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681991311, "uuid": "48f28cef-a7f5-47b1-b600-b2febc86a6ba", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681991311, "uuid": "2404dee0-d065-4136-ab16-8ad54ac0a8f3", "value": "NEW ORDER.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a46762a-df7a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1681995076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681995076, "uuid": "0ecddefd-b594-4b1f-864c-21024f5d14ba", "comment": "Malware payload (AsyncRAT)", "value": "4e1ff69045a371e33c69387afdccfc05", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681995076, "uuid": "260aa2c2-1e84-49ac-8998-0070e73f0349", "comment": "Malware payload (AsyncRAT)", "value": "ceea3778cb5760cebc3683d4df708971b92dd7b179aa4b6e9e18488ec2f19289", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681995076, "uuid": "0e464e17-8b40-4e80-8180-d2baa2070727", "comment": "Malware payload (AsyncRAT)", "value": "81fe9c232323347e096ca70e17382b22267f8b35", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681995076, "uuid": "a589a85b-1b3b-4664-9568-7c7bb6d8326a", "comment": "Malware payload (AsyncRAT)", "value": "62e7778815b3bcbdc124baf299a7ee407e4d05da48ac0db09c3ed1348af8f375109c98fb86774790c1762afc24e52eef", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681995076, "uuid": "2dbede38-1950-4493-b732-e4b4e572f2a1", "value": "T18FC5126838B57496F1EC45BFCEC11CB9E77CD100CFE93E8A8E51411A7A5304E6FA6825", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681995076, "uuid": "c2539c55-85c0-44d5-9fed-d23159b7a574", "value": "12288:6qxxdEl2aB9GfUh2m3Nx+3ezaXzsJvVnMal6h84q1f6OhU8:6Uxul2aB9RhBb+5KtMawafjD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681995076, "uuid": "cc7f0a14-edcb-4e81-9893-8b5fd04128f0", "value": 2534103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681995076, "uuid": "ad2c3e30-db51-4066-a5fb-1c81097817fc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681995076, "uuid": "1b245bf8-ef85-4bb9-b981-485fc7b44b49", "value": "microsoft runtime x.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "791ce15f-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681985814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985814, "uuid": "0bd0e191-b530-4f9e-ad14-8f98674504d0", "comment": "Malware payload (AgentTesla)", "value": "975e136392ec26be3a8cd7d817097cc7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985814, "uuid": "0479a520-d4d0-4ae2-9cf1-d55c6e888a1f", "comment": "Malware payload (AgentTesla)", "value": "cf28278f08c7fe2e13e120fff395f8241ee8221e9c52bc397fa816a077adc555", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985814, "uuid": "e417ca84-3cc9-4b79-ab61-f80b020796a4", "comment": "Malware payload (AgentTesla)", "value": "6469e7309a145b9ce53b4f90a928772f14cc2ced", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985814, "uuid": "4009d0e0-dc95-4e8a-b2b7-cccb29ed2e6d", "comment": "Malware payload (AgentTesla)", "value": "b6b0fc285a05486eea45108f2bae48930d4dbdd943b262e9b12d46023c71f89ec3af50d997e9dd9b66963752d5ed1c09", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985814, "uuid": "889594a8-8be8-4cfa-a110-7b759dbf1a5a", "value": "T134D4D0C567A9D7E2C2747EFC122A20783FB0559BE926D625FD8850DA3D32FC8194078B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985814, "uuid": "0eb6e1d9-8fe4-4512-8172-a7d1bbe3b20f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985814, "uuid": "fa60c19c-25c9-4515-b2b1-261d1377c3d6", "value": "12288:8ZOhKoJElbhInrZ6by1z395+2+XPbLNPFiNxbQzQX3rFvJvu+:uyF6lbhy3DyPbZ9AbQiFhx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985814, "uuid": "90334ff7-da90-44b4-bff7-f35aa661e150", "value": 633856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985814, "uuid": "2916974d-e371-4cb3-8da9-10cbb99777b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985814, "uuid": "46c1366e-2c96-4da6-bed6-10c4ca978781", "value": "Nuevo env\u00edo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1268ffe-df3c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681968835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968835, "uuid": "92c8c576-59a5-4f8e-b092-7a08697a6f72", "comment": "Malware payload (Mirai)", "value": "613db4a6675973d0f128e6ce4331c6db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968835, "uuid": "a3a8bdb5-aaea-4111-8622-c7761705f308", "comment": "Malware payload (Mirai)", "value": "cf28ce80edb9a301f4334ba63d9d1e8bb3c1cb95c6cdf1ee72c60047ebb0e9b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968835, "uuid": "1f97446e-e146-4c7e-b725-118dafc63e5b", "comment": "Malware payload (Mirai)", "value": "2b65d17700cc3b0e457c55df651d01c314ae07b5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968835, "uuid": "9a9a1f75-5fc8-44e8-92fc-e5df58900151", "comment": "Malware payload (Mirai)", "value": "4bd4fef3efc26458e57b9934c481a33503f81712122add46c38a701cd4131e0f2bbe5341116e8e5b4bb5c7a869b19e13", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968835, "uuid": "311768a6-ea98-48f8-b615-13b26f632443", "value": "T167637EC9E283D8F6FC1705706036E73BAE71E0AA211CE696C778D5B1FC86941A117ADC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968835, "uuid": "face07e5-085d-40db-b42e-2e3474b290b7", "value": "1536:pnUQJZdRlDAXO6QyQwOaOA+ZxWhp3uJ7RvsuIr5bhL8n:pnUQJ7RlUXTQpwOaOAIxWL3q+uW2n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681968835, "uuid": "3b20d08e-eb31-4b62-9e8e-bf17745e438c", "value": 70736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681968835, "uuid": "9fa5903a-0109-4f18-9775-26b51661f453", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968835, "uuid": "e7341e60-123e-49a6-825c-afd252673561", "value": "613db4a6675973d0f128e6ce4331c6db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66fd95e3-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681985783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985783, "uuid": "87b793cb-a029-4b7e-98ad-0a23dfbef612", "comment": "Malware payload", "value": "ef4188f15a0b5939a2f86adeeada6332", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985783, "uuid": "7d1e3ed1-889f-485d-8f28-457702237cc2", "comment": "Malware payload", "value": "cfe44807a0a542f9e76816c8a6785e3f6a50b3e756a74276920f6bc620021c2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985783, "uuid": "c8c6d147-4f8d-418a-81b3-0149510e4de8", "comment": "Malware payload", "value": "0ae12ef5e083870728dc0ef944ff5f2850c4b065", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985783, "uuid": "3dbc9c54-dfb5-42da-9f87-e2c94e011b03", "comment": "Malware payload", "value": "a0b97bc3270505a61f7d7afa180c864a878c22f671831d7995d1ac8b044349deea7ec5e5bb79f645b0406d091cd40288", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985783, "uuid": "13bd13d8-5576-4710-b0ef-f5f157a744b4", "value": "T17384129273C74B00CD2524BD44EF823A07E16FC369378AD9BF0C36A95E16A139F96946", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985783, "uuid": "294963ae-f3a0-46d9-8dac-760ad1dbea61", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985783, "uuid": "16384d5c-8a45-46da-9c6a-4b3653f34424", "value": "6144:OiyrlK2EmkseqwA1Lxl6dONR8NQLkNNL66hUMK/W3dDUyhU2rV:/yrlK0np1l/g+LkNJDhUp/WtIVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985783, "uuid": "6dc3b16f-f269-4774-9a89-e1cdc35d060b", "value": 387584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985783, "uuid": "b689637a-b705-4a10-ac78-f32637bfacfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985783, "uuid": "b85021ad-6e5d-449c-afd8-a1853b908994", "value": "cfe44807a0a542f9e76816c8a6785e3f6a50b3e756a74276920f6bc620021c2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f65dad12-df46-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681973139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681973139, "uuid": "fc2bb7ee-50f6-492a-9be8-cfb8c73c7c6f", "comment": "Malware payload (Formbook)", "value": "14f4905b091377c4e741f78e33031fb2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681973139, "uuid": "986018b2-0da4-483f-9c76-86c40a74c921", "comment": "Malware payload (Formbook)", "value": "d02ef9df3bc1af2c02ad5a9904ea604a55a6a93b5e08ca518232b96fec13882f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681973139, "uuid": "45eea948-ae2c-4f65-ba03-d38c2df9669f", "comment": "Malware payload (Formbook)", "value": "900a5bf8577de33382ccc8aa6c58951b13269b41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681973139, "uuid": "69855354-455a-4b62-aff6-5cdf3b3f3831", "comment": "Malware payload (Formbook)", "value": "9b8c6447dbccdab2a4d4d4e9207203a8f20a7ae92f1f2737672f208d14c8be3011c054ce11381b79cb03ded4f23d34f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681973139, "uuid": "d2b0c4be-b019-48e2-9baf-7598170bc411", "value": "T1C0F4D05DBA98B65EC59B8E3688541C50937164AB870BE347A98F129CDD0E39BCF003F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681973139, "uuid": "3a080fa4-145a-4f85-a980-862222be2cbb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681973139, "uuid": "f0f8a32e-cac8-4b81-91e1-de773e1b7b67", "value": "12288:z6nweiC6xObLVMJXUIxxxS1P+Ud/e8slkdbG7xflFPqdn4H2oXs+/Uozh6TPAIBa:z6dn6OFc81mwcEalNF+to0ots3Bjab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681973139, "uuid": "61c3a873-bbd2-4fd2-a9c0-13aa941e381a", "value": 769536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681973139, "uuid": "d01a232d-db1c-4883-9b5c-766a50ad9dd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681973139, "uuid": "2030ae08-c878-446d-ba45-1d5bf3cfd407", "value": "NGL 3100 . URGENT OF202205635.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4312c5d8-df31-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1681963819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681963819, "uuid": "291ee343-1c94-4356-8108-f0fb3ba738cc", "comment": "Malware payload (RedLineStealer)", "value": "c8255787409e8d36b6ca1c99e838d7ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681963819, "uuid": "bda48579-83dd-40fe-b1db-eb8b9f0af3c8", "comment": "Malware payload (RedLineStealer)", "value": "d04e02ba8eb29db3d17c69a5dcf4075a020eb79a15e7329fe373c60735bbb680", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681963819, "uuid": "84cfe0dc-6889-43e2-9269-f66c95183bfb", "comment": "Malware payload (RedLineStealer)", "value": "813b77eb31d5038e18c87a36103555f38394b073", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681963819, "uuid": "81c7e042-d3aa-4108-bace-598b11dec45a", "comment": "Malware payload (RedLineStealer)", "value": "f7e7974ddf50920dc480682831c803f61482ea1dbf05773ee8d135694642f7e600901679627b0ab33a29d89e64926a91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681963819, "uuid": "75d0cb96-cf15-42c0-88dd-044ab750aa5c", "value": "T17D34CFA176A0E072D8AB04B7D424CE95BDBF7CB18B95C15B37082B6F2D322D15B76312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681963819, "uuid": "8081598e-f9ee-4785-848f-659afe72d4e8", "value": "6d86aa147518c9f783875b9278e5ac78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681963819, "uuid": "fe7123ac-4946-4c0e-9c61-42f8224ade3a", "value": "3072:JBn5nLzTJqlsfH3wX3VbffGm6f8HtaM5zZ5/XzdmsNjk4/oweNL:Dn5P9qlCm3BffH66taMVXzdmeg4/ve", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681963819, "uuid": "8bee18df-f608-4390-9a17-c2357666926d", "value": 242176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681963819, "uuid": "04e45508-0e6c-4c7a-b852-8d77b366b313", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681963819, "uuid": "3756e2c5-aec2-4fb6-a766-04d09f81b1da", "value": "c8255787409e8d36b6ca1c99e838d7ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a07902d-df61-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681984339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681984339, "uuid": "18dd105e-77ef-4e05-a57a-853c73876513", "comment": "Malware payload (Mirai)", "value": "897ea75b57f82caa3c30cb9f90fcd1a1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681984339, "uuid": "b88d7958-de3e-493d-90a7-f9c6d25b56fa", "comment": "Malware payload (Mirai)", "value": "d30dcf29bce3d476d20fa45fff3fcd5810e946503ecfce15d52aec3fc999b12e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681984339, "uuid": "7147c730-0248-47bb-8d33-1d8ffb678f09", "comment": "Malware payload (Mirai)", "value": "25e3c07ae6826c628770c8c984779eabf0f282d9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681984339, "uuid": "9b54b4d3-befe-4f5a-9f44-03608a877bea", "comment": "Malware payload (Mirai)", "value": "be584adcd5997643360a70bee4ba2577237825074fb3d5b4e8e038365a9825bd0c26597889fdee11efb2cbab6536f0cb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681984339, "uuid": "a547dff9-8baa-4514-be81-36d1922d5dbb", "value": "T1A953B519BF650FB7EC6BCD3709A81B0538CC644A22A87B367934D468F60B25B59F3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681984339, "uuid": "23cfab05-7a02-4723-a27a-a17592637e47", "value": "768:iAVWeSUxeYGMmXsew5BheiTebiQ2ZFVyXiSA7mWzkCw:iAVWxsGtwxjTIitZFVbmao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681984339, "uuid": "f4764685-ef40-46c2-865f-5acf95fa764f", "value": 61080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681984339, "uuid": "8e67d710-7b64-4dc3-ac8e-413966f0601b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681984339, "uuid": "188783d6-eaea-471b-bcc0-cd309ff51a36", "value": "897ea75b57f82caa3c30cb9f90fcd1a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12f4f89e-df61-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681984354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681984354, "uuid": "752a4576-e5c0-435a-8346-624cc6a76a32", "comment": "Malware payload (Mirai)", "value": "40cfc4c84fb098a01faa468b2a0cd2be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681984354, "uuid": "a47409f3-e5ed-4f29-9e7d-502aae9b99c5", "comment": "Malware payload (Mirai)", "value": "d4c0bb90550d48d93aa808521d31679f0b294b0971e9450cd8b08a77c5ebe81c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681984354, "uuid": "07c2e1ca-1ad2-4130-9d4f-922abc41159f", "comment": "Malware payload (Mirai)", "value": "772ea7cc8c4492cc79d4450a676fbc97ec3a10b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681984354, "uuid": "053d162f-a783-4d8d-b8e7-8e5d5f054aae", "comment": "Malware payload (Mirai)", "value": "3f88c11917aadd949fefd0d82586d153ece2f79fc1a4d6911169a45b8001085f1b92794c70d8cf2f50c830980a19318f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681984354, "uuid": "b1f15a9c-e40d-4606-9081-9716a7402839", "value": "T18664543E6E22BF3EE2B842714BF66EB0C35624923391D381E17DD6189EB514C1C9EB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681984354, "uuid": "62f16b62-1db3-4416-9b8f-a25d86b30db5", "value": "3072:POE/zYdsX5sf83T6PGkQ7ZcvNR8IwVDGpurv1BZFae6JX7PZIPt5twWGtIDjCeil:UdsXeG1fN6J7ZIbtwWYIDjCeiVZwqR3T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681984354, "uuid": "89e56b74-a9d3-4032-8428-9ee9f39e3472", "value": 317719, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681984354, "uuid": "69390fbb-9a5c-4acb-80f4-b9b5ded3acb0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681984354, "uuid": "7387b87a-45dc-4cc4-a018-d55ef0411b3e", "value": "40cfc4c84fb098a01faa468b2a0cd2be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f1f8754-df75-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681993152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681993152, "uuid": "cb7fb844-aec4-4041-904f-c809805bb31d", "comment": "Malware payload (Formbook)", "value": "555f60fc0fb3982294d7511c15cca91f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681993152, "uuid": "3fb76b5f-3421-431e-9b0b-b87898a6b09f", "comment": "Malware payload (Formbook)", "value": "d54fa39c9bef6f5aef91c29b4b47a305f93eed2267bc19c72e7a5fe24cd7dbe6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681993152, "uuid": "fb0178ea-3204-428b-9c0a-a609cc35e69f", "comment": "Malware payload (Formbook)", "value": "de756531f4784d4e694b180abb2f81e8844bb3a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681993152, "uuid": "b3520abc-a09d-43af-8074-5a4da14db2f0", "comment": "Malware payload (Formbook)", "value": "013d4a2115ed1331e0d267cd3eb791d0c2110198b890edf83f18ad5be12158507d5eb53abcf6f8a6a1d280318b219cb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681993152, "uuid": "ca63e5b2-fd47-40a5-aab4-f6f2c201c922", "value": "T1C5A412691EFD3F5ED86FEEF0A7520502F770B58A38318908644995CAC6AF33189D931E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681993152, "uuid": "309b1162-4b28-47b9-9440-13f70d1aa711", "value": "12288:CJQJKLeXLw9+KYhreR4QNvGQ8agCZ2KsYNyCu:CJgCe7w9+v1eqQNvGvagCZGYyC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681993152, "uuid": "a3a6f2ca-1af8-4712-949a-8fe774da7af8", "value": 490496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681993152, "uuid": "d53bf9ac-d0a2-4099-a374-e6b2b57ee95d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681993152, "uuid": "1f3b4456-0e6e-4e42-98aa-fbc7ac7124cd", "value": "rDLS_19.04.2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6955896e-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681985787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985787, "uuid": "fd6403a8-aaf3-4a75-a5e4-c5ea6ee4ab0e", "comment": "Malware payload (Formbook)", "value": "f37f9bab0f4f9ea9afb66907a31e2590", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985787, "uuid": "8d2b753f-a05f-438b-8c50-cb385d995b9c", "comment": "Malware payload (Formbook)", "value": "d65074de0434f87442490fd9b1dead7f0feff44e1b49ee74ac9636f67c3d66d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985787, "uuid": "ac0330cb-8be4-4073-8d3e-0e62bfd3fd72", "comment": "Malware payload (Formbook)", "value": "41e0e379db5d631f2331923a4131ff51aac2a83a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985787, "uuid": "5b7adaf2-aea4-4d1b-8188-009c2345e3e6", "comment": "Malware payload (Formbook)", "value": "91f191ba459dde1a2322600568158ea54152bbf1a131a4f2183e4c4c8d9e7fd64714e5872e0dd2152b5484a004c693fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985787, "uuid": "6db7347d-1272-46a2-bb5f-eb98b1cad65f", "value": "T13704AE32D602C071E2B251B5F67C1B7B883E0E343694A4FAE3E115A16EF4995F52A31F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985787, "uuid": "ca6ac05e-924c-45a7-8473-d227bf0059dc", "value": "3072:n8QnUQwBFKRujtBxb7ZMcR0j2rg8GYFsh9h2mQlufoRR84gHy0QtHnqkQ:fNFuHl7ZMcuj+K9CufoRVgS0SHc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985787, "uuid": "64493a36-1a67-430e-8523-9b47a5ab341f", "value": 186368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985787, "uuid": "efdba152-8a37-428d-954b-ec93435aad96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985787, "uuid": "f145c596-7ab1-4e65-8ade-3266d4e8a0fe", "value": "d65074de0434f87442490fd9b1dead7f0feff44e1b49ee74ac9636f67c3d66d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "105c5ff6-df3d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681968887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968887, "uuid": "60f613fb-69fe-4d6d-a12a-3c812adada58", "comment": "Malware payload (Mirai)", "value": "53e8a770cc23c8eff97519659bc939bf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968887, "uuid": "fb323a22-2e6b-467e-a3aa-2e6ac2a9e739", "comment": "Malware payload (Mirai)", "value": "d660d99a729caa0b8b6418ac9ba4ee1be744cfcf5978d4e7d06f037c4d6b1341", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968887, "uuid": "ce88d572-04cd-480c-9e89-735eecf31c41", "comment": "Malware payload (Mirai)", "value": "46e51e07e18ab092b382b3854c634b19b5e111cd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968887, "uuid": "9da50ade-3582-498d-9b1f-1fee82b159fe", "comment": "Malware payload (Mirai)", "value": "8c656d24ce4ba204219665b5b62bc20e18370c3b578c0f873d1dcf5d98113da73944dfd1e0c9d3d55c1fd37d324e34fe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968887, "uuid": "f1fd2324-5573-4dcb-8396-4480b60e6aaf", "value": "T1C9534B02B31C0A07D1A31AB0253F5BD197BBEAD022E4F684751F979A96B5E361182FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968887, "uuid": "35876cc7-72d1-4b40-9704-332394a3cee1", "value": "768:qkaZjEoakZNRGHRnDmX7Xm+t/UGx8+BCpEMAE/p9WirYvq1xcNor6FV+tMiwWyIS:MvolWm+pFBgdLWiUC1xcNae++bWyPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681968887, "uuid": "4f159a07-7007-495b-989b-68f0a85d9590", "value": 62988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681968887, "uuid": "cad9c393-5066-45ec-8104-57427a92b928", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968887, "uuid": "9006a173-52c9-4fa4-8c23-2499eb49e257", "value": "53e8a770cc23c8eff97519659bc939bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91fb3a73-df7f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681997452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681997452, "uuid": "6557e5ad-d299-4d14-9f9b-a59bd008c092", "comment": "Malware payload", "value": "e5a5cf018f413821c97986712e5077c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681997452, "uuid": "6ae6fc71-c546-43f4-9fcd-348c7333e2cb", "comment": "Malware payload", "value": "d6e9e0693933f4a4a37d42102ae0a725ff42b7a10c2ed5d5cb440facd59fe962", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681997452, "uuid": "8b6a5f01-aa12-40e7-aef9-f464e50115d9", "comment": "Malware payload", "value": "396cd07035c0e37877a477558d1678efccccf7a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681997452, "uuid": "09a65c29-53c4-4186-86e1-b83c09d3c9b0", "comment": "Malware payload", "value": "d910ae2d7a59e75831b90a856dda3418620d4c9dd5c8ed7444e4f6e699f30a2d7120b24d99a734e74762f6df318580c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681997452, "uuid": "16b71777-be08-476b-871f-736c9fee8387", "value": "T196646B11F4809036C4B278718775DBB6996DBA300B116ACF63E81E7A5F706C2AE3176F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681997452, "uuid": "2c5ba9bc-937b-41ae-8eab-5a12205c4130", "value": "72924ac5a91f563b1f01c642ae375f4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681997452, "uuid": "9685b209-3ec1-46f9-9a7b-b178b7a7e54e", "value": "6144:wa7/sMtu5lWAhp+bbjVlp+UhPz3vLs5ync8lqr7zlJw6tTYg3pBwKF:X7UxpwbplpLhPM4nc8lqzuWB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681997452, "uuid": "a93a578a-a894-4357-b6f6-1b3a36ba766e", "value": 330752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681997452, "uuid": "2041b160-9712-4b82-b82c-7ce55639806f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681997452, "uuid": "ba5eb6f4-b344-4b21-a2a1-85930ed7bd6a", "value": "SecuriteInfo.com.Trojan.GenericKD.66504432.19604.15374", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f43001b-df0e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Zyklon)", "timestamp": 1681948887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681948887, "uuid": "49fc8f52-d199-4d9c-b30d-fa3a22f6b185", "comment": "Malware payload (Zyklon)", "value": "2c8cee0be7b9e8dee33f6490a94bfe61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681948887, "uuid": "fadc2c9d-dec5-4816-8300-d46e6d55029f", "comment": "Malware payload (Zyklon)", "value": "d8312fd35261e3ef4eea90669a22a84352eb613bad5ef5753da7168bbfd7f4fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681948887, "uuid": "bf463552-aa08-4933-acff-716c9ddf0f0f", "comment": "Malware payload (Zyklon)", "value": "2fb2067bdd080c0a1ad9977e1343ca7a55b5f89c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681948887, "uuid": "73ad5253-4586-4793-a293-8582a9545bf8", "comment": "Malware payload (Zyklon)", "value": "d16ec36f3fa1c3a59a28a31a578679516d7cd7ed5a04e0d1d17a2aef86ccac9e40c8d1b9419be567b2d7330cca65b34d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681948887, "uuid": "6c55f0b1-0792-441f-a139-86d23ef5a9b7", "value": "T1450523A97184FB11DD850335A974D2D0D9744C1EABCC110D70B4F3BEEEF8352AA698AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681948887, "uuid": "2937a1e7-13af-4b4a-a26d-15a425bd5ee1", "value": "baf209bc3be6389efada6a514b122ca6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681948887, "uuid": "ab8ec23a-5023-4918-8315-62c1529ac66e", "value": "12288:nfj43aWqvEEasw/UIVXrR+28w3yKt5OER8VXbb+ABFRIlMkQzt8geHbz6Mx:nr43aftqUCt+R6R8VHzBoleuf7z6Mx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681948887, "uuid": "850215de-9740-4061-8694-11216de4abe5", "value": 795160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681948887, "uuid": "5e53adcf-f31d-4717-992e-bb259d7cf0ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681948887, "uuid": "4d6b10c2-9b01-4d44-a9b0-7c5df9b2056d", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "919ff772-dfb2-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1682019355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682019355, "uuid": "421604e8-95ce-4b28-8247-a59829455e24", "comment": "Malware payload (RemcosRAT)", "value": "d7ff86325eaa7809b1e319a5a9dfa8e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682019355, "uuid": "0aeea494-fbb6-48cf-89df-813e6d4e66ab", "comment": "Malware payload (RemcosRAT)", "value": "d89c98d73846067d4468833805f50a5830208fa4e5512b5144ef764b339b264c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682019355, "uuid": "f30d2a2b-a7ee-4436-9fd4-29f986b93573", "comment": "Malware payload (RemcosRAT)", "value": "dace016829707d9b0e1182676a873d75b430c836", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682019355, "uuid": "ff33f82c-e5ab-4ddb-bb28-01b9ea4a743c", "comment": "Malware payload (RemcosRAT)", "value": "03b296ebf8bb5a2f393139b4c18f149fc95cfc6b84d957c3623136be615d28fd23e2acd24b1d745099fba30be8ab8471", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682019355, "uuid": "c1fe68eb-3b3f-412e-bd15-14adfdcbdab0", "value": "T1841501D171276792CB7AFAB4136964710FF252B7FA10D42CBE4D60C93E31BC44A982E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682019355, "uuid": "d18219ad-b0a2-46ba-8a42-4c169489952a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682019355, "uuid": "d12ba5bd-8dec-4e5f-9c95-91aa331744d4", "value": "24576:8EqxO7ENQ4OdjfvXDBOjfKKsJ/B25LlTgPWM:XqxOoNvOdjTBOLs2Lpr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682019355, "uuid": "9a9c35f2-672f-4e0f-8fa7-78657b588786", "value": 918016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682019355, "uuid": "61a1b7c8-cac1-4107-812d-41ceac4264da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682019355, "uuid": "58a7372d-7310-4b99-a16f-738afd6f44d6", "value": "Bill No. SFSAH24-23394 PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b5f3995-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681985790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985790, "uuid": "c734c578-d638-4798-a79d-d5db57133e5d", "comment": "Malware payload (AgentTesla)", "value": "4780ffa4b608a2d1329030e46821dd85", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985790, "uuid": "a658c58d-a7a6-48a3-b85a-ae927d178c29", "comment": "Malware payload (AgentTesla)", "value": "d8cbea719dd030d085cf6a5e00cdd901594eeefc228e3dd2902c8e6fa6b92180", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985790, "uuid": "51e41613-2f67-4aba-b7e3-c59549d11cd8", "comment": "Malware payload (AgentTesla)", "value": "05caa204b4696333c2e0e9d0ad483581da14c530", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985790, "uuid": "ec9120da-2b95-4665-a9a3-fca54c993d7e", "comment": "Malware payload (AgentTesla)", "value": "279b13bd31d576e7c0d8a479d58bdc66ab09c2186899c4d9765d64188ae1a5feeeb58f86c059bd7833b3a17bd2969a0b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985790, "uuid": "ff52b239-e8d8-49e7-832f-ae5cc6557804", "value": "T10D85BF322A8BFED5DBBF0DB4D84722480C805C7B7368D959F89CE18A21B5578AD95CF0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985790, "uuid": "8d898f67-3326-4ad8-b2c5-dbf807e2d6e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985790, "uuid": "f4fb1c29-ca6d-480b-b91c-bb5118d73e46", "value": "24576:THwUsK0iZ2WkBkvs1BKINS2dMFMx8nMoaHT+AC2FAkGdQi/X8AlE:D0izIN1dYC1/FvGd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985790, "uuid": "58ce68e5-3d71-4850-a504-997bdfd8601a", "value": 1845760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985790, "uuid": "af512ce4-127c-48da-9912-03d17191fe39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985790, "uuid": "ce849ca8-2a69-48c2-9519-b351100b310f", "value": "Doc_670513_220pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90147b61-df8d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682003461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682003461, "uuid": "9aca4caf-2e04-4ccf-92b5-4594554b32bb", "comment": "Malware payload", "value": "9cff69fae501092d61e18398469276ae", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682003461, "uuid": "7a200268-0f42-4bdc-b51e-90ade7dc6707", "comment": "Malware payload", "value": "d94a8fe5ca99768f9d071d4b1d3743e746cea369ef7ced625e2e7dd80c7ba861", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682003461, "uuid": "def93c4e-b7df-420e-9ac8-16f6c4e44ff1", "comment": "Malware payload", "value": "51dffe4ad8528e900fe033f5d9d3d0a43a1e12a7", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682003461, "uuid": "2397b883-07fc-433e-8795-c1669d6e3623", "comment": "Malware payload", "value": "999dc75dfb271f04086936074b5169925e3fdf5c767b2a84e972a7b42253bb17cc6a59de73a1f3cea6ae1fa3c7b35048", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682003461, "uuid": "9c42457b-d0b6-414f-ab4d-4f9e2597de6a", "value": "T13DD5230677C00B36C8EB2B72564BC312D7B6EC345622451B93AE67186EF2574B3A33E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682003461, "uuid": "cd21871f-071b-41bb-80a5-eea37a9f0f95", "value": "49152:mIvpY5ALedhUhnYaGBEm9B7I4NXl1vrvtb9LzTSxflrY/aESnlwfJLMGuFFJnpT:RY5ALedhEnYpVhIOXzvrHLc2/wwfJLMT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682003461, "uuid": "0091fd3d-355a-4e06-a869-628cd363082a", "value": 2777088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682003461, "uuid": "7aeceaa8-0403-4775-a914-7a16ee11daec", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682003461, "uuid": "89368406-cc74-40e6-9d53-e04c9c4b633e", "value": "AUDI\u00caNCIA ILTHFWIPYSYQRINAHWULETKSZDMFNH\u00e3.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2912f31b-df4d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1681975801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681975801, "uuid": "18867c0f-47b7-4d9f-866d-6d8c6ee9dae0", "comment": "Malware payload (Guildma)", "value": "b6028f5480012fe5d839b544456282cf", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681975801, "uuid": "0af4af75-6a59-4dca-870c-3aabc50950ba", "comment": "Malware payload (Guildma)", "value": "d9e137c544efa9744ef140ae31c0a096da55fef88ff1f190678a2c3f9bf53aa1", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681975801, "uuid": "89827f02-e89d-481c-8123-8d27b899ebc6", "comment": "Malware payload (Guildma)", "value": "f7ac12c95d2235815d7b5a6cdd401f7b81232901", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681975801, "uuid": "0aa6fce2-5655-474d-8597-85ef09833e9c", "comment": "Malware payload (Guildma)", "value": "37e541d68674b342892bde2cda7b8f9ba6831e8be339813ef03cbd332d3f82aae98a180aa88bfbe01909c095636e634c", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681975801, "uuid": "a748e9aa-851f-4e3a-9c4a-49d819cf7591", "value": "T11132B1AC761D899977A83A03F4F2D353FD3E823E2200C2897235559BAF76574327A25C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681975801, "uuid": "a96c00af-7e19-4c34-9ed1-4d2c8554fcce", "value": "192:khErVBSI7egdsJXFrNph8rjja/xTGvhUhYhzNseTkk:khS/SCVdIpwCTGvhUhYhzNseTr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681975801, "uuid": "337e6d33-586e-4eee-b785-7f74c09fe2da", "value": 11300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681975801, "uuid": "83cf6b13-0ba0-4e25-945c-5555d0fb801d", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681975801, "uuid": "1b621909-5f8a-4514-94f7-c6cef7ecd94e", "value": "payload.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaf9c746-dfa1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682012096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682012096, "uuid": "1c806ff1-51da-49db-8582-9b8089955244", "comment": "Malware payload", "value": "134c7297cce5c8a7ada43b1ea0278962", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682012096, "uuid": "cb539203-085b-4499-aa62-c56c2631394d", "comment": "Malware payload", "value": "da618b8f9884b039ab46121e1b92918da430a8178b7e25775967f5349ba3b03e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682012096, "uuid": "382b66d6-14e4-498e-9ef4-686ab979194e", "comment": "Malware payload", "value": "d1ac29aa0daf985efc47cd855abbed24d3c047ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682012096, "uuid": "d0825c3f-5ebb-492e-8cae-f439b28e1556", "comment": "Malware payload", "value": "b07048c5816ed5aae6e311694b1269e46639f104268abfd4497be2e38f7ac998522031a9f5cd50129a334dad49c12264", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682012096, "uuid": "0c96eb41-c3c4-40f9-b893-5f9f72145bfb", "value": "T154171822F2508A36C09E573A448F466063325D1A4FD3A38216E8B97CFEBD3915F7674B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682012096, "uuid": "150ba05b-ee34-44cb-93f2-38702f042631", "value": "fb608696f9b37f941bae13b6b9db023f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682012096, "uuid": "3b4fef3b-d999-4ad2-a7b7-6064fb1242fd", "value": "98304:0EVYrpOIdGRDTlpI+G1K/7F8LJJrZlR57Zz9R5eAC8UA2/Wm9hanAiZD6j5Ge45d:6rRdPK/7avqAC5FTKVOhDvah", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682012096, "uuid": "82d31f02-83fc-48be-96af-15d850b63b8a", "value": 19834050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682012096, "uuid": "d36afb32-c6e5-434d-aaee-c729f1640627", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682012096, "uuid": "e48c4e57-5c59-4f50-8bea-09d17fbb88ca", "value": "Nfelsof398.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71239c67-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681985800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985800, "uuid": "8f196789-aca1-44b1-b76f-e811545fd136", "comment": "Malware payload (Formbook)", "value": "b257b769d6e090f887f13156cd235e27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985800, "uuid": "09eb2011-7299-47d6-85f1-ca227af79d71", "comment": "Malware payload (Formbook)", "value": "db97e5da364058f275f955609d038c46886beabb40e7f40fb30ae3295e352082", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985800, "uuid": "1f013539-afec-4877-81e0-6eddfb652a02", "comment": "Malware payload (Formbook)", "value": "e1738b41cbb7e4cdee008f9f88438a4662a52161", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985800, "uuid": "64b6652c-e348-4438-82e4-be5bdc5a2e8a", "comment": "Malware payload (Formbook)", "value": "252c61e1495ddafeaca437232d5656ebc1a242f3f77d0164e85df5dd6f00a45654517d8c97bb9009f3fb3469ceb0fbcc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985800, "uuid": "d19da26e-06a4-439b-82b3-d282e8cb02fa", "value": "T14E64E0293903C8FEE4BF42F8083C79A4AE46FD35D417690F53E7BA4567B42A0D82A745", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985800, "uuid": "47731b00-faeb-4e33-8595-a7acd7837c49", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985800, "uuid": "99bb9198-4aa9-4176-9767-6f758109c8fc", "value": "6144:GYa6m2DqJVnPI9OxAJc8ECDZYEMduextZe0ugXEY:GYI3PUfcOD1M1fZTmY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985800, "uuid": "1ceb8ef2-9d92-4162-84b4-ea0ce2db04b8", "value": 320475, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985800, "uuid": "1e0a49c7-c296-49b0-9a00-452598eea2d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985800, "uuid": "19143ca7-6733-446f-b1b1-1d374e3133df", "value": "Invoice_copy_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4935cc9f-df46-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1681972848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681972848, "uuid": "04d7428d-fb0c-440c-ba28-e7f4321a755a", "comment": "Malware payload (Loki)", "value": "22666c94c73b206a5da5d677b1b4eea0", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681972848, "uuid": "324c1a85-9fa9-4022-b542-64856978fc6d", "comment": "Malware payload (Loki)", "value": "dc122bd394d68b4c78eb0f793af7aa4d4367b38b39afb2bbc10b1da842b53f83", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681972848, "uuid": "270c7c30-9e02-4456-a160-4255891da24b", "comment": "Malware payload (Loki)", "value": "bf724da8b4e9b0da4551589f9c43fc903025f3e1", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681972848, "uuid": "0b3e8fd3-7388-4536-ac76-3cf88eebddbf", "comment": "Malware payload (Loki)", "value": "0a712216be9a7e0134afb13dfbdefeb3bc47a6518f1213fb14fbf14e416180db5260d8e14c01a1c5bb33c7db02ca0526", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681972848, "uuid": "267fa448-4053-4ce6-97e6-493b058ee6f2", "value": "T1C30533E546D2689878083E3694F05B3D85EF0F52633B6C7EABBE08349614DF598DE027", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681972848, "uuid": "1429c37c-6233-4547-b1b3-3755e71032da", "value": "24576:MVrVfuXQrFfBWvM11uDGixGn0C+E9IwtXAbRW:CVmAevMyKbiEKw6RW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681972848, "uuid": "490a2eed-fb3a-4190-83a6-1a2fa90345af", "value": 834696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681972848, "uuid": "61b46b06-2f6b-4c72-8364-8fda4cd81a28", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681972848, "uuid": "21554c79-2d72-4a31-837b-2e3dd38eba52", "value": "Quotation list April.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5896a7c2-df86-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1682000362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682000362, "uuid": "e7aed49a-78d7-46ce-9150-0d5349a794f8", "comment": "Malware payload (Mirai)", "value": "1a85675a3bbcd89aabb2b47e2040a87b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682000362, "uuid": "1de6c20a-a06d-43ce-90cb-86de11c11d11", "comment": "Malware payload (Mirai)", "value": "dccc90fbc2722803ccdfc684fd450509b9c11c6f44256aa9c1bdda2606dae65a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682000362, "uuid": "f5b1a4ab-0264-4b7f-8ef1-8def25968289", "comment": "Malware payload (Mirai)", "value": "ce0455ed07128e1b99cb6801f094b07352498230", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682000362, "uuid": "61e3d8c0-c006-4ee0-8fac-915af69c5aea", "comment": "Malware payload (Mirai)", "value": "31f05454c174aa402f31dfe1d366ebdb769287399f4bd16d7dc206d3e5f389631ee2a3ad2c9958e188b170e80155f7ab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682000362, "uuid": "817428f6-58dd-4fe6-bd05-a1c00c944c02", "value": "T1ED93A309BFA05EF7E8AFCC3345D92745288D655A21A83F79B930D928B21B24F15E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682000362, "uuid": "0879e3c2-0254-4d92-a5e3-264d37233bd0", "value": "1536:a5DnSB+v5EjQm2w17xk49d6xZLu8vJ4TGo8S:a5TSB+v5EjQmJ1GFrvhrS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682000362, "uuid": "db7bfcb4-8453-4fcb-93ab-4a9ec2db15b0", "value": 92512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682000362, "uuid": "7d74d509-17f0-4ac2-9c79-a9d118b1f20a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682000362, "uuid": "7992f8e5-6a80-4c13-89cf-04df8baa68b4", "value": "1a85675a3bbcd89aabb2b47e2040a87b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe79cdff-df3a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681967998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681967998, "uuid": "12c93aed-3deb-43fb-b3fa-2dc653e33a95", "comment": "Malware payload (Formbook)", "value": "57b4778fbb5d3dcb29ee57b459c4c0f0", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681967998, "uuid": "832cdb78-6b99-4fcd-9b61-d880416e9c95", "comment": "Malware payload (Formbook)", "value": "dd208244eb1a5fd616173f4dd0ed419bcfc360c5c3237eb0510b4f97fa22b72d", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681967998, "uuid": "b0a869b8-5cec-4364-adcb-92c6689f1cf9", "comment": "Malware payload (Formbook)", "value": "e8a5388bda35c0ea02de38c79751232d156177f6", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681967998, "uuid": "b321611c-9f14-4c42-9788-a7e12ab1d94f", "comment": "Malware payload (Formbook)", "value": "590be4da166c12ead6fdc4890a6d00963a4312ada0e4c44fed7dd742385124db38370b0176517a2d0ca62008416e2cab", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681967998, "uuid": "b498a16e-5ba8-4a76-9f88-c5e648496424", "value": "T191F4E1C5B366D792C2687D3E519B21683BB089CBF557C929FCC811997E237C91E8038B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681967998, "uuid": "6b44fcaf-a61c-419f-b0da-053b298ecfa7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681967998, "uuid": "77516cea-f443-418e-9d1a-13ea78cc088a", "value": "12288:DDiv0S6EHMH91DzZBwuAXaVxpceJ4Sudqtvuf+kDk8iQdZ6xhraLH0DT:DlBEHMd1DtBOaTKUtvuGEpXLHWT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681967998, "uuid": "4f03e5bb-0fe9-45c5-9c75-a200979e2b72", "value": 775168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681967998, "uuid": "49623d40-617c-4138-abde-655965abdd2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681967998, "uuid": "ea17b608-9803-4c2f-a01c-e11787a9ffe4", "value": "DHL6782282.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea2030fa-df87-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1682001035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682001035, "uuid": "a10965f1-bef2-43c4-981c-ce4f04799e09", "comment": "Malware payload (Amadey)", "value": "e78cd6e120c75f22b2d2abe3f5624d66", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682001035, "uuid": "2743b5af-2563-4613-becb-4728cedf444e", "comment": "Malware payload (Amadey)", "value": "de3fcc29037b769e0b9c9e491ba2e71567b42e97d652bc11d68a0855233acd2b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682001035, "uuid": "11ef9ba4-8ff2-4ee0-8ebd-5c463603a7dd", "comment": "Malware payload (Amadey)", "value": "e69d566d8dd34dd4ae2363914bbbcdbecd791be5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682001035, "uuid": "374ad023-e99b-477e-8551-149bc4973a9e", "comment": "Malware payload (Amadey)", "value": "4c0c7bac2f5feedd686cb170c1e5d5953633eedbd4030551c9b9ae7dcc79d73bbab23934e73bf5b9e368b8ed0d7422b0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682001035, "uuid": "e5750e28-0991-4249-b77e-b8261a2884fc", "value": "T1DB7523D66AD89132E8B6577108FE22431674FDD3462CA3E766C59C9D18B22C4E27233F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682001035, "uuid": "adc38925-1edb-4d34-acdf-d208eeace82d", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682001035, "uuid": "6dfeefb2-90d7-476b-95a2-2c0673df757b", "value": "49152:EYpjbS/83eX6x/81B6xHm6zymwVeKKhJ1:hpjbSkdx/81B6xHDzUMKI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682001035, "uuid": "c624d350-c149-4458-9505-4d8415bbed64", "value": 1610240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682001035, "uuid": "d3a0efb2-457b-48e6-b16c-7295eb514812", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682001035, "uuid": "2d64963f-0053-4629-8671-79e75ba18346", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a854d74-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681985789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985789, "uuid": "d2257fa9-b3dd-4147-9e9b-9fec9db078ee", "comment": "Malware payload (AgentTesla)", "value": "43bf8c500a874dae12a788627466cf02", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985789, "uuid": "34361934-ca31-4e86-a44f-a45925d6815a", "comment": "Malware payload (AgentTesla)", "value": "dfa9c347f104abbdb4bfdcfd98c45370d9df69b9cdf8cd573c5c00a2970523aa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985789, "uuid": "9103c87a-057e-4ae8-9fbc-2f77565114d4", "comment": "Malware payload (AgentTesla)", "value": "01105aa5f394e19861b1fc15f4473302d8d2f037", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985789, "uuid": "cb2c4904-b510-4e3a-be8f-cb91d8f51c6e", "comment": "Malware payload (AgentTesla)", "value": "023d6810fda3a211aaf303a46e839c00ae21b31c697ce75dd4272dcdaf054bae4aa542921cd080c3e76a28166f1426a8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985789, "uuid": "c48bf2e6-352c-462d-857e-52e0100af7e4", "value": "T1ABF3292892C99DD3D31DC0B4D8A01158CBB2E1478717E79D0EA1ACF63B867D3362B967", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985789, "uuid": "fbc70dcb-32b5-4268-ac40-9745c5f67075", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985789, "uuid": "801f7e58-b468-4eb2-b074-b97edf3d885f", "value": "3072:qwecjcUe1o1ttPJB0kfnye7EuVoAE9KRfvS4hT5U:YcPRDRzb7PVoAZt64N5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985789, "uuid": "4eb7b9d1-c0a9-42ed-bb4b-2712f3f52fa0", "value": 168448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985789, "uuid": "40ccea8c-30fc-4c87-8ee6-8b1c942daf9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985789, "uuid": "8f359056-a5d8-40ff-b678-81c69f74b02e", "value": "dfa9c347f104abbdb4bfdcfd98c45370d9df69b9cdf8cd573c5c00a2970523aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "915964e7-df7f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681997451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681997451, "uuid": "bf851884-1529-40cd-9c25-774b899e1d75", "comment": "Malware payload (Mirai)", "value": "0ff154d8a82c8c9fe28fc86e9f694e2d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681997451, "uuid": "29731de9-9682-47da-923c-937d9d6153b1", "comment": "Malware payload (Mirai)", "value": "dfb61ab8eed325e4a430f1cf96d9b760e4c97fe079e2994bc8280505bc15bda2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681997451, "uuid": "08dbfcfb-7105-4733-b499-810131896e43", "comment": "Malware payload (Mirai)", "value": "cd316691c8911c497d16bbe5829e59efea2400d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681997451, "uuid": "87b96831-f154-4d76-b846-45ee8d2afb11", "comment": "Malware payload (Mirai)", "value": "06aaee426f57e7acaeff00130e12f95ac140a5768489f04b4f3ed762b2c9baef106831836652e1732a81baf9cbbac14e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681997451, "uuid": "d47c7135-b7f2-4266-aa2d-498540aea599", "value": "T1D3D2E17CD01B662AEF470BB806B60AE209373490CE5085AEF664376D4DBF1899E0BF05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681997451, "uuid": "fca24e09-4545-4612-9968-3ca882e87ff8", "value": "768:VSkur30felMFnM1gsglGQrD2QClt480MSx+NZUCQa8rm:V3kAevwAayvXP9U6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681997451, "uuid": "0dd2f0c9-26ec-465c-8c3b-648aed05e566", "value": 30816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681997451, "uuid": "8e261264-3d0f-4338-a325-cefc7eae2e38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681997451, "uuid": "6894d9fd-eb64-486e-bbbe-59c24ccb828a", "value": "SecuriteInfo.com.Heur.20230420132715076845317", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3afe780e-df78-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681994299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681994299, "uuid": "c0d46708-5443-4173-bff5-6b77b0dcf358", "comment": "Malware payload", "value": "c1b1e85ca2b8590d88917fbc3f2d1298", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681994299, "uuid": "0f94d028-d36e-4ba6-a4fd-f02da1c3f188", "comment": "Malware payload", "value": "e0ca956f91cdf77f63d9e640644525734a34585b64e2705fe7e7437d0e8c592d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681994299, "uuid": "08a32671-4607-4dd0-a8e0-c1cc71fecec7", "comment": "Malware payload", "value": "fe672b4ae58a4f74bc84f358d178d2602ff1bc5e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681994299, "uuid": "79079b01-ecab-407f-a9a4-b76047aa3a53", "comment": "Malware payload", "value": "425badb1838091108109ac0e158a5183ba20127572e102e923beb34aa87dd41b575d2ad222ac70a93ec897b6025b086d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681994299, "uuid": "20f80b6b-44ac-4a2e-995f-025842845c61", "value": "T1F205BC927081D583EB5448B6D490A0F371F16BFDBE92548A4D2FFB5059C0B8AA19CECF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681994299, "uuid": "69cb8899-4d32-4cb3-a9ce-6a9232e5e619", "value": "489a5b81ebb6d345f2eccb2e8d8e0a0b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681994299, "uuid": "49bfdafd-e8bc-431c-82ae-05953be4558e", "value": "12288:h7hqWP+BAWC4khqdXWHBPvuCuuuHYR292phJATVt7N50VDqqCrZ6:iWP+BMkXWhuCApGhJ85cqqCl6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681994299, "uuid": "fdac21b9-6d23-4e75-9ec1-8a50d59d6abf", "value": 852752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681994299, "uuid": "ec8f1bd1-99b4-4546-b925-bd0c6d5e67af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681994299, "uuid": "700de55c-0fed-41b9-8b49-c0d078057783", "value": "c1b1e85ca2b8590d88917fbc3f2d1298", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "228e382f-dfb0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682018310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682018310, "uuid": "b14cf7a6-563f-41b7-86f3-9a5ae6e3e192", "comment": "Malware payload", "value": "f09c96b3c6bc4745c8fade1a8a47591c", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "mc1904", "colour": "#71A344", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682018310, "uuid": "477dc213-a21f-4716-a023-8a9d3a98c8c3", "comment": "Malware payload", "value": "e10d69d66ba22ac3e14100bce8a324db59d15fd1c2a7ce78316d0e3681d3c45c", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "mc1904", "colour": "#71A344", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682018310, "uuid": "de985d75-a45a-4b2e-95ca-c69ad7afb872", "comment": "Malware payload", "value": "68ba06a44bef88885667dc4cf026b02b61e887ee", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "mc1904", "colour": "#71A344", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682018310, "uuid": "d48481b6-0036-4a3a-bc5c-0e2014673455", "comment": "Malware payload", "value": "b79ba80a5658214b16a8513432eaa3502be411f041a824a8487ae72a4bc382d24b42c50d1f11802e1a03228bff352255", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "mc1904", "colour": "#71A344", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682018310, "uuid": "d2e16585-1d59-4b39-88d2-c872468fa36a", "value": "T1EF14ADA6FAF2F1EB71C801B11704F13C62957D1AA7B0DC9C386DE9402B96EF126693D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682018310, "uuid": "02fc465f-4486-478f-be48-c2cd14783c36", "value": "3072:1JTW6j/rvbWb3OUJLfOcOcOcD/elhF08qZZS20tOVkNUXp7+eQin3qf:rtj6DO2LfOrd82lg8qZZXEUX95QQaf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682018310, "uuid": "08edf8a4-e8b8-490d-975a-ea3f6c472f0c", "value": 197184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682018310, "uuid": "80fc2573-837c-461f-b53b-3d7b0dbeed38", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682018310, "uuid": "53b86485-b092-4032-8864-ef321b6e2bb7", "value": "nclase_file_04.20.23.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c56b6ae-df54-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681978893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681978893, "uuid": "8915da44-add7-4120-abe1-6ecbebd70e31", "comment": "Malware payload (AgentTesla)", "value": "bbaa107658cbb66c40967355089294ce", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681978893, "uuid": "d55d5200-3dde-4b41-9292-a953c1741d29", "comment": "Malware payload (AgentTesla)", "value": "e27b566e03c506092699d01d485193919523f8d2b1e0e9a0593bec44d06fdc25", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681978893, "uuid": "53a52c4b-31d3-481a-aaad-ec6523932e57", "comment": "Malware payload (AgentTesla)", "value": "b0313acaf805c5166ad28737b801598d74e4d8c3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681978893, "uuid": "6eb3bc78-e6ae-46ab-a1f5-a403c20f2ffa", "comment": "Malware payload (AgentTesla)", "value": "c723a17ad1cae31a9cfc423240cd10b3c944a34df535c2ede48a403d623b3807611cdb129e1f0556df66659f44a5ac5e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681978893, "uuid": "4e00a0d7-fc1b-46c7-b57a-38b60a3f1238", "value": "T15EC423C8C82B646FD6B0127FB6C06B55CA3BF1BAF62E9CD2ADF6504563800671EE5407", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681978893, "uuid": "f81bdad2-a51b-4852-b442-1a16e18225c4", "value": "12288:oCrTXI5sw29GvS9xTcuDh9x6qpFSSlo8DJGW:oOSPvqxY7qB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681978893, "uuid": "285538fd-f207-4049-a0db-ae079397b350", "value": 591934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681978893, "uuid": "c7fadae4-f506-4df7-98af-b86fd6bc9850", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681978893, "uuid": "b4b2a4bb-3fba-4aea-b098-5cdab0820f87", "value": "Ship Docs,HBL,AWB, P.LIST, Revised INVOICE and Amended CI.docx.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "612df771-df54-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1681978901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681978901, "uuid": "f4eeebfd-3731-4000-9ef2-20b41fd0fa95", "comment": "Malware payload (Guildma)", "value": "9b6e2fe0f5297093e61e8275ddff61f2", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681978901, "uuid": "9610725f-017f-414b-b644-1993abafa71d", "comment": "Malware payload (Guildma)", "value": "e3b80084f2a16852445f2a24fdfe19873ca776754a7b73a6ebea6a71095f75fa", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681978901, "uuid": "2103ce7d-ad8a-477b-8174-0e1190c36b54", "comment": "Malware payload (Guildma)", "value": "423868ce3549b826e5a3242ea2f2569281aa3f20", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681978901, "uuid": "30eaeb62-7f37-4dde-8305-4dad196934e8", "comment": "Malware payload (Guildma)", "value": "23db785693dae33440ffddb1e8ef18ee9563a4e368b000427e0eb5adc0727d912fdef4fc5dd8db5b52a9e898469e23b3", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681978901, "uuid": "83f9913f-130c-4a93-835f-f5f33a547502", "value": "T1A6019AB663790E7F84724385CC346D0C98B6CCF30E4E949EE9233480C9796A22FC1B19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681978901, "uuid": "e1c60cd7-2828-4f3d-a026-1781aecc9a77", "value": "12:QgkjueaTASDVIKVUaVuRAVIz87KZIxFIiVn0iWvqL7:QFjYTfC9a8p40u44L7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681978901, "uuid": "645f9d57-ac2b-44e6-9d11-b99cb3a8ac46", "value": 781, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681978901, "uuid": "2e1ee9d5-2a80-42aa-9ff8-625165393ec3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681978901, "uuid": "4b2445fc-718e-4a65-82f9-0cea9620831a", "value": "S61665430.328768.28472.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fabacd62-df98-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682008365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682008365, "uuid": "3bced320-7108-4d55-91e0-eafc08df17b8", "comment": "Malware payload", "value": "21c687309d44259a119b6695bfa7dac8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682008365, "uuid": "f6c4d4f1-414a-4a3f-a135-b8e41f0597d6", "comment": "Malware payload", "value": "e3dc423684976ae02183ff7156153303f75d3961decb3215213faa46d0926c69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682008365, "uuid": "958aa9d9-725e-459c-82ba-cf973b4cf47a", "comment": "Malware payload", "value": "38601325c8496a4d7d1755874afaa67904a32a00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682008365, "uuid": "777009ee-a3c7-41f3-8436-1698f010b484", "comment": "Malware payload", "value": "a3a06a385f67e3c60e421d3fb7013fc807195e14f4a7e8ebfa6862cdba3fba3eb8048cc03c214c51f76c8467cb49bba1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682008365, "uuid": "204470f3-3ab7-4d5b-a3af-7c3005a13747", "value": "T1DFE54A1437F85E23E1BBE273D5B0041267F1EC2AB3A3FB4B6191677A1C53B505841AAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682008365, "uuid": "ed675e67-2947-455d-b250-e2220d642419", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682008365, "uuid": "811f512b-f1f6-44d4-ac01-d82ce314d7dc", "value": "49152:KvZI22SsaNYfdPBldt698dBcjHzCK1Jo/oGdOuTHHB72eh2NT:Kva22SsaNYfdPBldt6+dBcjHzCj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682008365, "uuid": "b14d4cc6-9e39-49a5-a64e-10d5c96ebca1", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682008365, "uuid": "05ad8e1f-a4ed-40da-8a4b-92a9b37b9d13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682008365, "uuid": "7314c9cc-b7b4-4d39-b27f-c15edf4cb388", "value": "Client-built.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5030534d-df5a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681981450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681981450, "uuid": "ce5b591b-7896-46ca-b6d7-b296f3cc04d1", "comment": "Malware payload (Mirai)", "value": "2279a54758e8f3bbc9613e4df10423de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681981450, "uuid": "25f2f319-49a0-4667-9408-65f0aad7135d", "comment": "Malware payload (Mirai)", "value": "e3ff00a90c19716492c89dbee6fb2c4e377b45d2db21089fba055dd461d25439", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681981450, "uuid": "43d29b25-29e2-404d-a4fa-6e2579469cc8", "comment": "Malware payload (Mirai)", "value": "b9cd7fc4dc6933b39620c9995ac34049661e65cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681981450, "uuid": "4d20a144-e247-453b-a78d-d2f555b87686", "comment": "Malware payload (Mirai)", "value": "c805f8855a870dc113a82fb575d83850afe9c9c4e27677784d5416c9d23d24494140fe74232693535a0b8c1a2ab24287", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681981450, "uuid": "7c3f0255-b6c8-46ac-8d61-7e6ed44accc1", "value": "T10443844A2E318FEDF76D863887B74E31975933C622E1C684D16CE9011F7024EA45FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681981450, "uuid": "68e4b79a-4bb0-4c3c-82b5-de60e3af31af", "value": "1536:loVE52KTXA3YegMTOfDDWE2cUdgI8hEKyrtPJ9:yKTAo5MTO1yr9P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681981450, "uuid": "81a5dfe3-d5c8-4053-99d0-7a572ecde896", "value": 55428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681981450, "uuid": "ed1a20e7-05f0-4d37-9c03-eb06a7b55339", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681981450, "uuid": "7df641fd-5750-472d-8e16-08cf33a130f4", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b416def-df2b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681961309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681961309, "uuid": "864a0327-8feb-40b0-b40a-973a3cf226c8", "comment": "Malware payload", "value": "18fbb46387c4a6b95cc3d28824d4dd91", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681961309, "uuid": "10fe7e2e-43b0-41d7-b9d6-f2fc7cc24e0d", "comment": "Malware payload", "value": "e4a8784c41519138d6ab3c2adc31f1687cb09232baafcd6ec598c6e76ac46b40", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681961309, "uuid": "f0a827cf-fe32-4914-87cd-2adfb3cd1b7a", "comment": "Malware payload", "value": "dfbcd10b59b1d6dd4e0b8c3af692539877651b2c", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681961309, "uuid": "8c801284-fc4b-4fe3-b5ac-6f20514e27e3", "comment": "Malware payload", "value": "8af502305f43ed781913da4e9895aaf723f75722eb59521ca03d1e399fc32e7368e486108d2313e817065e3e5bcb2b50", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681961309, "uuid": "d3663880-0170-4671-a54a-d185e2101680", "value": "T10F93129A9F0970BBF88192B4D82715102F49C5FB583099F31B8B7E914D45D9E633272E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681961309, "uuid": "6ff2105c-f7fe-489e-8256-b1da115eda39", "value": "1536:MDPqSqRzrblU2NRQt0RoYesy3vRjDAnE/fh4S3nmtI4H77ykP0uz9rQ5:MDPqS022N72YesyfRncyfrcI4HZP0uJI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681961309, "uuid": "91882eb0-e472-4cc9-94d9-77abbf53003a", "value": 92170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681961309, "uuid": "210266b5-0689-4fe6-822a-65195a2e92bf", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681961309, "uuid": "063f6028-3d65-4a7e-9739-602efae87d91", "value": "SPYADS.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28aff0bb-df5f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681983531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983531, "uuid": "498a3b6e-5f1a-4f12-9d78-9cb49bfb730d", "comment": "Malware payload (Mirai)", "value": "109999f32501dde7d520df64901b8a8f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983531, "uuid": "c0bd9660-66cb-4538-9e9b-ca669dd8baa5", "comment": "Malware payload (Mirai)", "value": "e4f4640a4bbf6ac3db961e674f54be8f1f13a3cb1e886de764416b5b8c376c91", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983531, "uuid": "265cff9f-c664-4a7f-a903-b4c62bacbc46", "comment": "Malware payload (Mirai)", "value": "32c7e9250579bdff8722cb8b47bafa6b17664fb2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983531, "uuid": "4116bf2f-d9cc-4dde-93b0-39fd01573b75", "comment": "Malware payload (Mirai)", "value": "c7daaa7c8d38fef568e1701232419537ca503ce84b23339ddfbccad3f11cf7d66371504e49f0b964068c52954a52d9e9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983531, "uuid": "90865079-d597-46c8-b6d1-8b0f6b12ce5e", "value": "T199040712A741C6B3C14705B6128B9BA6A032EF3B61D3581AF3B43CB89F391859671F7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983531, "uuid": "d05952ab-ea16-44d1-838c-88290b0afe2a", "value": "3072:85dN8VtU6U4kVQu4/3OmAF1mE9cHmk+loJLNL/vw/qg8D0zMxZCmU/dZ:85dKtVCZo+mrEsmloJL1vw/qdD0zMxZ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681983531, "uuid": "0a005e83-91e0-4b1d-8042-943370ca4753", "value": 189983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681983531, "uuid": "26586b9b-29ce-48e1-8b25-105fbeb6bfef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983531, "uuid": "410f1690-3c14-4542-b4be-4301c33a5a78", "value": "109999f32501dde7d520df64901b8a8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ede38bc-dfa9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682015378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682015378, "uuid": "52477f08-74d2-46bc-8102-f1501bf2a748", "comment": "Malware payload", "value": "e3964adcb233264f26a70dd25772a0f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682015378, "uuid": "fd3b2283-7bcc-4d61-996a-5084ee0b1c3d", "comment": "Malware payload", "value": "e5d8bd92a78f8498c5a7c48d4e36277d85243e1ad99b9d79b6c68514fff8182f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682015378, "uuid": "b557c332-f240-4f4a-b92b-5d26fb757a43", "comment": "Malware payload", "value": "3b222521852d3ef91010bd56bbf90982af40d903", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682015378, "uuid": "da059ae6-0df9-48ef-bb27-7ff284721dd2", "comment": "Malware payload", "value": "e845900e72bd13f1c34b50ea96c4af54b6107a12cc51a215405105f668a19b71f38cecf34abb606bdd87dcc729ea9dd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682015378, "uuid": "a8c73ab5-2dd8-468a-826e-29de23a2cee5", "value": "T1D4936D41B5D19472D6B619321871DAB18E3EF9300F609EDB3798063E4F712C19A36EBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682015378, "uuid": "c2b958b7-5adb-4b25-a37f-fe28217b5f8b", "value": "8608a79c31eb91a63f9876736636a3f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682015378, "uuid": "e08c25c9-43ad-4028-96fd-dc95373063c4", "value": "1536:1alU6kLe15mrhbCiVqAGeiqhR29VbReX8MNhpHD6+J2rZeydZrVksWNcdeDWJyZ:1az1UBZAAIqOkX8MNrD61fr3eaJyZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682015378, "uuid": "0cd5e828-2efd-4914-8c56-140fe52de86d", "value": 89088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682015378, "uuid": "e7577453-fccd-4fa4-85fb-4a3fade1a081", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682015378, "uuid": "40ba3e8b-1d3a-4496-93fc-35e105157e0a", "value": "SecuriteInfo.com.Variant.Lazy.324511.3810.1323", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa4846ea-df0e-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1681948959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681948959, "uuid": "2d1cd7ed-d748-4fa5-826e-a89fd2607b6e", "comment": "Malware payload (CoinMiner)", "value": "c119576ed7e939218feea8440d5fe2f2", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681948959, "uuid": "68bbefbf-b2cb-4d7f-83c3-78bff3124b4f", "comment": "Malware payload (CoinMiner)", "value": "e5e5f0ac7e4dde2ad1546c51ae9fa605e350d628af677b1f1a67fa50ed70a9fb", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681948959, "uuid": "df60b5e5-1938-410a-8706-f07c171ea74f", "comment": "Malware payload (CoinMiner)", "value": "eec7b33ee311a17238027ca095c325c70166a991", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681948959, "uuid": "64bf5fbe-7227-4989-9da1-1acb521f893d", "comment": "Malware payload (CoinMiner)", "value": "6604876a23e016a3c2768c7951db71e1aae8fa638914632306f959a117d6b40e11e66421fb890e61098c561e254afd26", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681948959, "uuid": "db4227d8-b29c-4644-a87a-d9f6d3c0af6c", "value": "T16B64CF03310C8079E4AAE5759DD58A799BFD30752BEF15DBE388162E8E21BF07136A07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681948959, "uuid": "dd2bd708-66a6-4563-b39a-8ded4260d777", "value": "3617baf8645984ded069e254769f48ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681948959, "uuid": "1a88d80c-2bae-48ae-9fb1-539e326c6844", "value": "6144:JTVfs5zrhNTcsRHTBSl0vOfaPCG7OkbGokteH5e:JTxsBhNIsRH0HaPC3Ckk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681948959, "uuid": "0fcfb571-240e-42b3-b0a7-62fb9b35fac8", "value": 313504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681948959, "uuid": "10f7c23b-a511-4528-a0c3-c806b6662f56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681948959, "uuid": "51d6da01-16a1-444c-84b1-73c9e4f82f0a", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1fa4bfa-df6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (DarkCloud)", "timestamp": 1681989801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681989801, "uuid": "9db0bf9e-f592-4a25-83df-472dd70894c4", "comment": "Malware payload (DarkCloud)", "value": "e255bbfb7fb545f908137146fd950dd9", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681989801, "uuid": "11bbe140-693c-44e9-9455-f774dccc5739", "comment": "Malware payload (DarkCloud)", "value": "e65641bdd1d31a37d1caa1cbf41d05fa9e7b0caf3c5b531ba66d32c0a3a94406", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681989801, "uuid": "a6bd2122-a6e9-495e-9bd1-1e04e51615af", "comment": "Malware payload (DarkCloud)", "value": "44177088b79f4465a768df35cc04ab82dededcb4", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681989801, "uuid": "b2269145-b402-4580-ad7c-7109928366f4", "comment": "Malware payload (DarkCloud)", "value": "9554fa9052d20c5651eb4c3dc1436352b5d7254eafce725171a07bbf524790630ded6be05f7f3aadf83e8c04c35d391d", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681989801, "uuid": "2760d6e4-1495-482f-8471-e311ab802ac2", "value": "T11F65122891B59DF6E7EC1ABA400479E9CF70A5E334A3C63C4F95B4CA87AF7102D84187", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681989801, "uuid": "04aa5cd5-b86c-44bc-a3d8-d7b1d0ef8ec4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681989801, "uuid": "5ab407fb-f43a-42bd-8554-a462b8949b2d", "value": "24576:/JxsqB3kj9nCe2r0vcDgU9H8tWAV1IfMrfEKv64z3hllgrTULbRTJY9woz/qM:/JxJRkj1zz024AfcMrMo6gxbgq9Y9/z/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681989801, "uuid": "ac4a1bce-fc64-4228-8341-7c10adad1e51", "value": 1481728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681989801, "uuid": "65216354-b0c5-4e49-9be3-bbc29a157350", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681989801, "uuid": "477361e8-4de6-4764-bdf7-6acb6f77a0b8", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "368a21bd-df5f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681983554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983554, "uuid": "db6e983b-74f8-48b4-b86b-4b70b1563b58", "comment": "Malware payload (Mirai)", "value": "f479a69d75225fd0d293a7ec854b39df", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983554, "uuid": "ac0243f0-e3ca-4018-8927-39db5f218c6f", "comment": "Malware payload (Mirai)", "value": "e686467cc6b8fe8f84df594bc69630ab5a14c21438c0fbe30ec625b876e2c366", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983554, "uuid": "fa1bd235-3e5a-4002-9604-be745d957017", "comment": "Malware payload (Mirai)", "value": "1ba38c985a6ccf2123c69977c9364b13e48a72fc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681983554, "uuid": "45a904fa-c071-4dab-a26d-8430dc301065", "comment": "Malware payload (Mirai)", "value": "ccfff37e9cc0f7cac4d09e1566e25d5c1155496572d74fbc33e8436a686e5fdfba1ac93060224fec189880200749efdd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983554, "uuid": "88568245-7b85-465e-a93a-55cc333aef9e", "value": "T159833B01E743C6B3C88307B2029BAA665931BDAA1E2ADF4AF31D7DF46B128C47116F55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983554, "uuid": "352ee6b9-d5d0-45a5-abe7-c94230b79d30", "value": "1536:yD5b1hE4t3J6lreu5r4hWj8LfRwfhcVmF+wVOz+sXcfW7k:wb1hE4pJ6liuq0YzRwfhcVmEwVOz+ucx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681983554, "uuid": "888d9839-4ce1-43e4-80a9-602465e09bec", "value": 84996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681983554, "uuid": "4965bfb5-c81c-4e13-bda5-84b9870162c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681983554, "uuid": "5bb94bf0-9857-43fd-bfdc-141e42093f1c", "value": "f479a69d75225fd0d293a7ec854b39df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e02d76b8-df4a-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1681974820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681974820, "uuid": "1ffefc4f-1339-450f-8c8d-3d7412e256ea", "comment": "Malware payload (GuLoader)", "value": "df95ee29072bf140a1b7122c4aa1898f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681974820, "uuid": "69ded416-ff33-45d8-bd42-8b02b16fd552", "comment": "Malware payload (GuLoader)", "value": "e68ce815ac0211303d2c38ccbb5ccead144909d295230df4b7a419dfdea12782", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681974820, "uuid": "f43f47d2-c899-4601-a993-393679ccaaf2", "comment": "Malware payload (GuLoader)", "value": "58c1bd02a514fcb5395a2130947a0286bce6c63e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681974820, "uuid": "1e00d31b-5626-4749-8d35-6bcebed76a2c", "comment": "Malware payload (GuLoader)", "value": "8f77d7588503e0b382537e1dcf99c8dc98ae82271f703e587f3927996d652d181db94942c2ff8d1758a4d07f6346bb39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681974820, "uuid": "b81d114f-0fe1-475d-8637-32a098bc216b", "value": "T15AC412C653A4C95FC0238272D4A8CBF4B1296EA5D526CF1367C0FD2B3A36687460C7E8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681974820, "uuid": "2a1fd3a7-16a6-4b96-958f-11f303a3e2dc", "value": "e160ef8e55bb9d162da4e266afd9eef3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681974820, "uuid": "b4864a55-c15f-489a-b234-a55f3abf3009", "value": "12288:Yng3VOqc35Tg4ur/vdBP74wvfK1LPg24oUFrdKNF7Uq9GqZPjf0oj84:XVOqc35TubvdBTza1LdUFBgF7NdZr0on", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681974820, "uuid": "a5f56943-7cc0-4e9e-8608-27912ac9413c", "value": 580944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681974820, "uuid": "6833268f-5bd1-436c-85f2-e22d12c9529d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681974820, "uuid": "998c5cc7-36a2-470c-bab4-e85158030811", "value": "zam\u00f3wienie 4700120746.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "860adac8-df46-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681972950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681972950, "uuid": "40b89529-45ef-4720-a096-098335f52106", "comment": "Malware payload (Formbook)", "value": "1ffbe32f199e39acf9368cd2d04c81e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681972950, "uuid": "894d744b-5f89-4774-9226-0adbf42b2a85", "comment": "Malware payload (Formbook)", "value": "e6d16fced75e8265e62b73cf660a303c0e03f50cead978df78b0a05f51aa42dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681972950, "uuid": "a13a9c48-ee48-4ea2-8424-89f873fea018", "comment": "Malware payload (Formbook)", "value": "6b240192b18ebcd053f077a9b83cf6e4460eb990", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681972950, "uuid": "22ebcbc7-3a72-4fc4-8497-0522dd43b70a", "comment": "Malware payload (Formbook)", "value": "95d63ab77805c8cc3635efd2925c27b06981438dd4d23c55202615d04734640ed6eb3ed55e8e8cf7202387bd763030ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681972950, "uuid": "220bea47-9424-470d-84bb-9596de0f484d", "value": "T14FF4E1D5B366D791C2683C3D52EA60282BB04AD7E566C929FDC8114D3E27BC91EC07CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681972950, "uuid": "762df1f0-5249-4782-87b1-24e9e72324ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681972950, "uuid": "08582916-e06a-4db2-a499-10b986fad1e3", "value": "12288:ZGIjVc2jPdo/HMH91DzZ3ElbPFphu/m8rFvSC98eYft2d0y92NykF1DPgsU:drPQHMd1DtEFru/m8BvUeYftkOvHU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681972950, "uuid": "2ab314c5-142d-4baf-976e-2eb41633fc6e", "value": 763392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681972950, "uuid": "afc62d38-9afb-4063-81a9-e63da9434777", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681972950, "uuid": "0b0c47e7-d3a2-4e12-83c7-3c1532ee5f34", "value": "Quotation Request.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3806661d-df3c-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681968524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968524, "uuid": "a1f24467-6553-4df1-8e3c-f349b53c353e", "comment": "Malware payload (AgentTesla)", "value": "fa1c27f96425e3767c2b11b8fefe89e1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968524, "uuid": "3de976fc-ba37-4b72-81f0-4f375c70e6ab", "comment": "Malware payload (AgentTesla)", "value": "e6e90d14d8ae1df119d47eb1d5550d5f0eef77323dc95e576e3980a53e2555a3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968524, "uuid": "fbf336f8-f930-4f67-ae9f-1e1c1e814e86", "comment": "Malware payload (AgentTesla)", "value": "0a2126e755403858e2f7a5cc4cc77c34b439f8d7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968524, "uuid": "5079eff0-147c-48af-a5b2-b04376be2bee", "comment": "Malware payload (AgentTesla)", "value": "f07e1e8ecba0699506d3a422ccc8f604f3e0a0b100bb2cc33e985fe86e1b94dc931576440ca0f5049b2c43e5700b4312", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968524, "uuid": "12ab390f-4e53-48fd-9cb1-4301494c6f49", "value": "T12FF4E1D5B757D791C2683D3E52AA30242BB049C7F926C929FDC811997E26BC91EC03CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968524, "uuid": "2e81371f-6497-415b-8026-349fcfc76f7f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968524, "uuid": "13cdb0af-03b0-45e0-804f-edf4a42d019f", "value": "12288:z07n6FxamuHMH91DzZU4mMnJg7wvABU6+LdmLuWSHcp52vm7dUN4hyL5gunSRDGq:zwn63amuHMd1Dtvi75NswFN5B72imSF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681968524, "uuid": "a02c5c18-9dd7-4737-ace7-db14852a4ce8", "value": 742400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681968524, "uuid": "809aa348-9203-49bf-be8b-d7fdf83ad530", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968524, "uuid": "f2e20c24-7897-4fce-ab72-3e9f3887ca7d", "value": "fa1c27f96425e3767c2b11b8fefe89e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3bbcd29-df48-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681973886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681973886, "uuid": "c6ee7a5b-b535-42a3-a3ef-9fccdd80500a", "comment": "Malware payload (AgentTesla)", "value": "efe59b832584cde9fde62d2695e6cc12", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681973886, "uuid": "0f780f24-2181-4ff5-8fea-9bfbef7dcabb", "comment": "Malware payload (AgentTesla)", "value": "e787b0f7da3e67e447dcaaffe882c3f6f417ff5774976a9be5a9186d4f5392af", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681973886, "uuid": "1ab9935f-24c2-4e8f-868f-42add7dbe9bb", "comment": "Malware payload (AgentTesla)", "value": "2fb9097065a8f1f95e63bfc0983f742f52fe6735", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681973886, "uuid": "cd6eb39f-71e3-49d8-9cd5-f7853f2ccbaf", "comment": "Malware payload (AgentTesla)", "value": "cfb6ca46df3308c8e874da5ca3ee056892f384c059192f376988e63cd9a6dbda70b1e03b7ebca469b05cbc171de382e5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681973886, "uuid": "242b045f-bbb4-4c9d-8da8-2288fa029ada", "value": "T1A4C4239D77792740F7F5DA1687006F0FBF07C6AF08A380D426A8A46003CF59ADAE6365", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681973886, "uuid": "712f4ec6-5196-4737-89d1-a5c1bee20c07", "value": "12288:V4YWctEB24VWNAyLj9ldfRud2P9uVjQ9mFdewyEDVq3fnoH5LU1G:VfhEBjWmyLj9l3udhk9mTXPD4fn45", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681973886, "uuid": "30822869-3248-4e82-93f4-203a84a2f4f9", "value": 556386, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681973886, "uuid": "6928b60a-ed86-4880-b67b-f0d816a9363e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681973886, "uuid": "9622c597-dc8c-4639-8e70-738eea70038a", "value": "DOC (CI,COO,PL,BL).r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4168443c-df3c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681968540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968540, "uuid": "ba5d68f2-fbe4-499b-9bf6-5648552a5a48", "comment": "Malware payload", "value": "873cf54a3ab391b1511e237ae8ca7d57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968540, "uuid": "91b2f263-bcb2-4199-9b03-4ae1ed2ca851", "comment": "Malware payload", "value": "e8e3e4ea0e3046ecef493d5dc72d04f7a224cdde20a1d46697531c02589b302e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968540, "uuid": "6c089d51-2962-4433-9d16-978d7592d73f", "comment": "Malware payload", "value": "a0a62a8d2638207b61200f6051c2b1ff9175c210", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681968540, "uuid": "3c585490-41a1-4b99-9d51-abe165be8cd9", "comment": "Malware payload", "value": "7015f015075bce68e0ad58576348301a7a7cc933622c8fc5e3edf05c3fda1f2d6a68c2926649e0903e905d8211968624", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968540, "uuid": "e8065744-009e-4061-ac35-19587110a959", "value": "T148B5A032F9B25079D52313715D8DA32D67AABFF10736015721D87F2A2AF34826E38972", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968540, "uuid": "24aa8577-bd76-48d2-9c59-cad88f8ccc6f", "value": "8745df7883a801a0067a7a9eb683d9ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968540, "uuid": "777185cb-528d-45cc-b372-17b650d3a021", "value": "49152:NVqbjZKLyw3B8HLuiAf4XpO5i3l0hH1bRWydCv2HoFN6WtljaEy9NuSwIbFLOAkM:Wbjsyw3BKLujJ5iV0hH1bRWydCOHoFN6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681968540, "uuid": "af8f08db-72e1-4dfc-a214-bbc2903e83d8", "value": 2318296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681968540, "uuid": "5766a906-af36-402d-8d0c-6bc4b71b53f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681968540, "uuid": "a66dc2fa-82dc-4fbd-91f9-3c2820060515", "value": "873cf54a3ab391b1511e237ae8ca7d57.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d827e046-df44-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681972229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681972229, "uuid": "914fe50a-6c27-4511-96af-936066c13ffd", "comment": "Malware payload", "value": "28c495097b37d5ee44caaa83e7cb676d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681972229, "uuid": "7092b29e-a90e-496d-aaa5-f7aeac7da6c9", "comment": "Malware payload", "value": "e921402d65d89ae4ee5ae99d000b4b707ab56b69929ed9892ddee476dadad1b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681972229, "uuid": "de194a39-22ec-4f34-a050-480958e3d2e2", "comment": "Malware payload", "value": "22719d7763407e82691706180d97e85a5f742d7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681972229, "uuid": "0721d2f2-5f9d-46dc-a8c1-aaeabe54903c", "comment": "Malware payload", "value": "a98e6a6688c9bf5f60becb0f01f8418f6696813a47b40e5b14226cc84967fdd91ea4eb630653a5e26eb3eb6ad9ea5895", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681972229, "uuid": "630ec33a-17b9-4cb8-adb7-a09a3417d4f0", "value": "T119C53F9D726072EFC857D472DEA82DA8FA5074BB931F5203902715ADAE4D89BCF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681972229, "uuid": "a3927af5-6bc3-4ff2-b6a2-56facb80e762", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681972229, "uuid": "1a6b6a29-b7c1-47e8-bb3e-5a8dcf454e6e", "value": "49152:EG5oZ2/vSapN3qdBx6iIgTTMVq0E8ypQM:EMoAvSvd3br", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681972229, "uuid": "94bd81b7-70c6-42d2-b485-595471a0dd9f", "value": 2692608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681972229, "uuid": "0039fdef-caae-4ca4-a238-21782fcd86a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681972229, "uuid": "dc3d15fc-5d81-465b-9c79-aef9bd888215", "value": "PaymentCopyKdJnHFM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32fa075d-df5a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681981401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681981401, "uuid": "e1d3a8ec-0a46-4ff1-9825-9dc9467225e7", "comment": "Malware payload (Mirai)", "value": "84651d2017c3fffc5bb5788815958491", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681981401, "uuid": "a9a81915-50ff-47bf-89c3-3afc8b89bbd8", "comment": "Malware payload (Mirai)", "value": "e9f1f0ca40eb3167b06583030dde41aee63a04bb5d0953c0a599f6c4b6959b36", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681981401, "uuid": "a390e27f-7b0a-4e10-b865-321c60884887", "comment": "Malware payload (Mirai)", "value": "5ba652c21d267a898b23fb593c457e24c034e1f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681981401, "uuid": "fed70ef9-29cb-46cd-878b-c2ff149060d7", "comment": "Malware payload (Mirai)", "value": "182209e669db05d5fb77049170d272040449dedf45c126c810aeb035a231f789e8458277e101235ecf39e0c9d3bf0151", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681981401, "uuid": "89d6a332-ad41-4b88-9e20-be28e31a00d3", "value": "T18FE21886D643D9B5EC1102B524375765DEB2E43A6A71EA4BE3AD3735EC03721A70334C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681981401, "uuid": "93798c27-49e8-4baf-9d5b-7364925ccf59", "value": "768:kaIkD3BIfU3HsEPcgUl+NXpT0CTO04P9kQMBjqYuPk0KZOD2X:dEU3MkcgUkXGCSZP9vMBjYPkB4a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681981401, "uuid": "0a2b3569-94fc-4ddc-9567-df29acacc29b", "value": 33904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681981401, "uuid": "1fed050a-1e0f-4b1b-9351-31389f7718de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681981401, "uuid": "4c4fd8fd-1085-4ba9-ad18-37de9d93da53", "value": "i6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ead476d8-dfcc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682030672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682030672, "uuid": "eaa3b9c2-caf0-4d7f-b8a1-1f779df167b6", "comment": "Malware payload", "value": "bd737b740c3ec31380ee4bb4e94f0b6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682030672, "uuid": "7279c74c-13b8-4a30-91d2-f6c999eaec45", "comment": "Malware payload", "value": "ea18ab128f0795e2d020d21b2189bcf25da6ac310e5a15d9aeebfb2be1114f31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682030672, "uuid": "b0fa7b77-d480-4525-96a8-317765d26471", "comment": "Malware payload", "value": "516e8f64e1980e484ca0bd39ef253d8fd7609e83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682030672, "uuid": "baa786bd-ba51-483e-aa13-9eb2a95e8cd0", "comment": "Malware payload", "value": "9d7f588464c44d62bda8dfd2c0598753d0fe3c28a08ee42c870169ba208011c8dde183b7b8e67c2dc57857c81e37c731", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682030672, "uuid": "55d226da-3514-4395-8125-edaa6d16e687", "value": "T199649F137294A0BED126E1B48DE8C4A8BA1C50F53BEFA5D37BC1197D47293E1B3A4217", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682030672, "uuid": "8e44083e-58c0-4ca6-ab9f-398b049ae678", "value": "7ab88a2560b399bb2f4b089a0ec1f31a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682030672, "uuid": "ead68c9c-51d8-4d49-87db-18b2e89c49f4", "value": "6144:n7LK6a0pBKlG2HNjhAqRWn4+0VHzdlj5AzbFY5nDe0j:n7ejmIlGENPRW4bHzb5AzRYBDe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682030672, "uuid": "8ef393e8-c15d-4692-9a61-7ed10cc1caf5", "value": 319648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682030672, "uuid": "dfdec130-5425-4aad-b4ad-cdbafa517a86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682030672, "uuid": "7e2ccb48-ce7a-4a82-b1d7-0bd4532445bb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ae6d675-df28-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1681959993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681959993, "uuid": "0680e0ae-b6f8-465b-9090-78128bd4ef74", "comment": "Malware payload (njrat)", "value": "2255273d59f877cfe2af322eff7dbd79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681959993, "uuid": "2b84e942-32e6-44ee-87e2-1fda114c3a13", "comment": "Malware payload (njrat)", "value": "eb3d55ba1dcd412ead653093c195a8450108be83accaec829ac42b6e2ba95cb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681959993, "uuid": "c6a48cd4-200e-4cff-9649-76c9559ee48d", "comment": "Malware payload (njrat)", "value": "f510050bc6f45b2a24d70c47c0862e1145659f7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681959993, "uuid": "300714c4-4a7c-4d9c-aad1-f4de8883ee40", "comment": "Malware payload (njrat)", "value": "b3666d3f829f58127eb1777bdd9330d25a7ddc4db56d31f211b09ddddbf84082985c0d1e23eae04d85c8514f33d0ac47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681959993, "uuid": "10e03623-185d-4ccd-887a-29992566b062", "value": "T1A1C2285D3BA08172C2EF6BB406B2DB2002B2E1075A27DB5F4CD944FA6B773C14D81AE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681959993, "uuid": "e8faef05-211d-4f2c-bc39-b07232a72270", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681959993, "uuid": "b6b3cb8b-b49f-4331-86fe-4e2ce4befcd2", "value": "384:hLd6G6qSDWo/BqeNzHzCYe/4Y2OzRLTm3yilqr63Rb/tVvGD:B/8DW6hzT5e/4sE3VvGD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681959993, "uuid": "dd92aca4-5bea-46eb-8cec-84ffec712ab7", "value": 26624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681959993, "uuid": "1820f71b-7373-43c3-b555-8d7fb92f9152", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681959993, "uuid": "e0d3c4b9-442f-43c7-81f0-436ab2da3414", "value": "bLNx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf0df442-df3a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1681967892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681967892, "uuid": "18adb27a-554c-4951-baff-98e28288d102", "comment": "Malware payload (Loki)", "value": "f03b5c3a2cb99f15efff619325bca711", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681967892, "uuid": "0505a3d1-e2d6-4222-bf87-562f9824a0d9", "comment": "Malware payload (Loki)", "value": "ed6e05001f2102cbcffe2dddfba91ec120bc95840150ed781e3572b9cb594666", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681967892, "uuid": "00616a2f-d62b-4738-9902-f68289d46a28", "comment": "Malware payload (Loki)", "value": "d18f99cca5a93026b1b51d6ac98a9e2618c08d20", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681967892, "uuid": "59574afb-9b29-4ff9-ad84-23de4376a888", "comment": "Malware payload (Loki)", "value": "c99fbfb0dfbc9d3d5eaed31f5270b3ddf7d6d916297174a56f78138807b31e76502645a3c3049d9f14075c41102f47aa", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681967892, "uuid": "a82d5b47-c2ba-4245-9274-5140e06c6b6e", "value": "T112035B5AE78F02A48F5112B7231A0E89A6FDB63EB35155B1745C833433DDC3E4266ABC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681967892, "uuid": "397841a6-c93e-4f12-bf1b-a3d27e4ba024", "value": "768:gKFx0XaIsnPRIa4fwJM/tanlPkMQy57lM4y6e:Bf0Xvx3EM10vd5xyj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681967892, "uuid": "cd0aa0ba-c3e8-4983-815c-d40d3b6a0419", "value": 38863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681967892, "uuid": "78f21f47-90fb-480b-b1b6-288465700b2b", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681967892, "uuid": "6a62eafb-8954-430d-a737-6c6f185aebf3", "value": "SCAN_SOA_APRIL_2023.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a23fe9a3-df76-11ed-88f6-42010a9c006e", "comment": "Malware payload (VectorStealer)", "timestamp": 1681993613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681993613, "uuid": "caa6867c-e6f5-47a8-9379-c427795e53cb", "comment": "Malware payload (VectorStealer)", "value": "13348cb1966e434e5cb63b82e42291b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681993613, "uuid": "aad4e828-1fbb-44b0-adac-5dcb8c484a97", "comment": "Malware payload (VectorStealer)", "value": "edcf7182460deb84c07d79968ebb518cc9c8611148a4eb0e1e37b78ff175f275", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681993613, "uuid": "f3b9d617-9db7-4960-9d05-5e069d61f3a0", "comment": "Malware payload (VectorStealer)", "value": "0c8c616bbdf2b7996358142af6a6ba886fc2b2a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681993613, "uuid": "06b6208b-38a6-474a-a5e9-5a9a5e9566a0", "comment": "Malware payload (VectorStealer)", "value": "74b73aacd95a0fa1ed18ef48df1eb610fe6260002c6f99b7788943fd1ed5c21c4b01ed457ac36ed39aa8d9cb0521597d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681993613, "uuid": "eaa678b0-c0fa-45dd-aa1f-8ec81e3c458d", "value": "T1092512387B4C9F96C0BE463AA2D151B54770C4675B8FD71FEC8918F819833ABC29A607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681993613, "uuid": "0d368dd6-f942-4725-81c4-377e5c3c4a3e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681993613, "uuid": "771a85c6-077b-421e-afcd-4fd8a71a88d2", "value": "24576:8FUrdbfahvepYoeyAmzhocZn+M+WGDBGkV:8Yb1bPhoCnD+WGIkV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681993613, "uuid": "1ecabce4-7a0b-4c82-8395-da09a6abc320", "value": 1000960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681993613, "uuid": "7285b6ab-218a-463e-9f39-ba34bc8bff4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681993613, "uuid": "61808840-f3b2-4d7c-9565-08ca0bfa235e", "value": "toba22bbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "905b12bf-df58-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681980699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681980699, "uuid": "a6fea19d-afdd-4df4-b7fa-4380a8847bc2", "comment": "Malware payload (Mirai)", "value": "0e5fab2e06902543f52655c012074258", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681980699, "uuid": "7e3a9c9a-e829-4254-be6d-025d58f18168", "comment": "Malware payload (Mirai)", "value": "ee810d6815d182155e55d1d37538d7d497dcf8c3de7a945b39d9f46313260b21", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681980699, "uuid": "85084bec-f63d-4c72-8861-a240d600faca", "comment": "Malware payload (Mirai)", "value": "56e1916c6516dc289bad3dab5fdd4a353e075a62", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681980699, "uuid": "9ab3b01c-628b-4169-b8cb-03cb30ec2d32", "comment": "Malware payload (Mirai)", "value": "1cf396a572b15104cfc60cf2e8914abb9a824157fe85788ba9b372b173f0855bbfb402c639bba73af831fe46be948d34", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681980699, "uuid": "c0b77085-a962-4c8e-b8da-576551728230", "value": "T165D3626B7A109F29F79C973005FB6D34834A23A72AD5DA4AD19FD6001E3231E5C0FAB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681980699, "uuid": "7ee171af-ca06-445b-bb10-71dff8cf51c4", "value": "3072:6gZqoNC7WgjQ1HOFK1ggrUQHWNpOORE+VYEKmbLD3oD4Fb1lPlTqzW4r3E:6goN+HOFK1ggrUZbbLD3osFb1lPlTqzO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681980699, "uuid": "d30d5d78-7348-4ed0-887c-c02a98478325", "value": 136756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681980699, "uuid": "6c5d32d1-1ed3-45f2-9ab0-6ac78dbdb2f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681980699, "uuid": "a986fddd-9333-4886-8476-dfdf863330d9", "value": "0e5fab2e06902543f52655c012074258", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77a8b355-df62-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681984952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681984952, "uuid": "0861c480-dbdf-448f-9635-8b04f075db7b", "comment": "Malware payload", "value": "ceef4762b36067f1d32a0db621ee967e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681984952, "uuid": "fe1a1737-9e39-4ca4-8b0c-820f27fc6d94", "comment": "Malware payload", "value": "efb6169bbb869a849afb91184a75b906fe509cbf6e672b6b4f3311c02343bbbb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681984952, "uuid": "bd3146f0-f131-4a06-ab1f-50b190bac3d7", "comment": "Malware payload", "value": "d23da38df6b0fca8c524b641c59c700a2338648e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681984952, "uuid": "35c8d93b-b6e0-4af3-b268-0339960d82f4", "comment": "Malware payload", "value": "3e8aebffbf78448a17ebee305b2a437551b628788b92546bd7174f7f255226a6964acfec6e1704f7b6d2a751de2f2fdb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681984952, "uuid": "30837bc0-09e5-445c-afa4-ede310d674b1", "value": "T16A856D316392C43BD4332A39EC1AA39468397E341E6898477EF87E8C5F79B417D26193", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681984952, "uuid": "445f777b-11a5-480d-88d3-03db5a1595d6", "value": "a29c07c2a2b71c6edbfdb307967f471f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681984952, "uuid": "b6fa736a-0df8-4ce7-98a5-117b9b61de8b", "value": "24576:fMWohhojVlG981FE03Pb+Cp67LkDdlXUi+nNv3O5AcAQNwuWSfJST4HCLgCGT/TH:KhujVl6p8UiaAKRT4HCUN1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681984952, "uuid": "c35cc3a1-65bf-48ce-bb48-8c15dbd316b7", "value": 1856512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681984952, "uuid": "89c08354-6ea3-4aae-b254-617dc4498e2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681984952, "uuid": "c5f92d5a-b6a2-4ef3-8aa2-37e29ca18338", "value": "abd1\u00aa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fe6117c-dfd5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1682034331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682034331, "uuid": "b5a436f3-203a-4aa1-9d10-163b8c6a7ffa", "comment": "Malware payload (AveMariaRAT)", "value": "3b0c5a9f4793a21d506324105df128c2", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682034331, "uuid": "1b93f9c6-7e37-4c44-9a28-1c821c960a3a", "comment": "Malware payload (AveMariaRAT)", "value": "efc25506dd79ff60985e1a3bbb2c1f4f5b51adbbb1b169c843f57ccf33bab38c", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682034331, "uuid": "59af17d5-f8ac-4e88-aad4-647a02d517b5", "comment": "Malware payload (AveMariaRAT)", "value": "289dd91e93b2cfbfd80f818424d2a09c5dc403fe", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682034331, "uuid": "fe351b64-f1b9-469f-bcd5-83e4452ece52", "comment": "Malware payload (AveMariaRAT)", "value": "83585428a2746be99a04b656871a9b81f8ab0c236aab045633c8e63723b836e9e659a597de2b4d25592c03241459c186", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682034331, "uuid": "7f0fec61-01aa-4407-b54f-e775e25c74e9", "value": "T18905E078A13A5BD2C62F3FBAC19D755E83B069554211F2A9DFCD27F30AE2B849804C47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682034331, "uuid": "1f07cf18-f1f1-4714-aec4-73387e9cf1a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682034331, "uuid": "ed638913-bf8c-4336-8284-4acc08eeb095", "value": "12288:Oiz2/Mi6iJGRTwdvUnlvRDizTztLZP1luwnnJB+Jwu55tduwYcPr6XZJ3P:4/RnJTKqxdneJwOuBD3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682034331, "uuid": "1e761ba0-e77d-4d0f-9a0c-69dd352175f2", "value": 821760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682034331, "uuid": "de62a3a7-a65c-42e7-9814-b608825fc490", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682034331, "uuid": "cbb976a1-6cea-4748-a692-415b27f4ac52", "value": "EFC25506DD79FF60985E1A3BBB2C1F4F5B51ADBBB1B16.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "090ff0b1-dfa4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682013113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682013113, "uuid": "176b68af-83f5-4fb1-88cc-5a6b9c87a89f", "comment": "Malware payload", "value": "2d66abd4085db5832d0426a101e348b3", "object_relation": "md5", "Tag": [ { "name": "1681985211", "colour": "#1A34F8", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682013113, "uuid": "635a5fcf-4c04-4cde-aacd-2692a92bc0a9", "comment": "Malware payload", "value": "f22791fec6cfb59252fcb96a3ea9a01c2dc517e501647241d9d2ee5a5c7070b7", "object_relation": "sha256", "Tag": [ { "name": "1681985211", "colour": "#1A34F8", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682013113, "uuid": "8b4c6db4-6f19-4d43-b79d-28d407744941", "comment": "Malware payload", "value": "0d12122d6d93fae0d0c0542e815df54b1d4d9b3d", "object_relation": "sha1", "Tag": [ { "name": "1681985211", "colour": "#1A34F8", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682013113, "uuid": "787e02c6-6e8e-433a-8b12-fddba3e92147", "comment": "Malware payload", "value": "804913b21cae06aa6d5b30653641c9d7e97ae998ee4a7802bc89dbde0228f360b96cfa5c29fa6deafb9a1dbe7ee86ffc", "object_relation": "sha3-384", "Tag": [ { "name": "1681985211", "colour": "#1A34F8", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682013113, "uuid": "c3b7c5fe-9122-46d1-9c01-28ebcccc53d4", "value": "T1EC643A279F44033017B3A72A621F9AA8D72D42394241DA62F4ADF124BBEED5CC1F59F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682013113, "uuid": "16fa4523-a787-43aa-9138-c18287877369", "value": "6144:ib3WNAiK+poAzunl4rBQCertEfOVFA4D3k/MP3wwt9pFthUTDDXKi/b3WNAiK+pF:o3bRAirEmNBfUTf3bRAia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682013113, "uuid": "21bf7ef0-5bf1-4f6b-9e82-b720ce04b829", "value": 320093, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682013113, "uuid": "f78ea154-fa15-46ef-8285-bf2c5337d955", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682013113, "uuid": "41772e28-e80e-44fa-9337-e4e32c4a28bd", "value": "Votbk.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d47edfa-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681985794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985794, "uuid": "1891e1c4-2d28-4f6f-8262-c941024913ee", "comment": "Malware payload", "value": "74e96cbf40f41bced7fb13a301d49ed2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985794, "uuid": "abfe0687-4246-4c61-b32c-bef6ef00787d", "comment": "Malware payload", "value": "f32236c2c908973c8f5b717f39544296d9e9398cb9186f41e0b3afb0f8b81c93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985794, "uuid": "9fe660f0-ca60-49fe-87e3-029d0bf6bb4c", "comment": "Malware payload", "value": "d314ee6bad87bc527553c421945e2bce6fcdf7c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985794, "uuid": "650e7c36-472f-4f76-b706-fd0498c378d3", "comment": "Malware payload", "value": "92609f1af1814ce6575e67993d0c9f1e07d4f1d895123afcbca24485ad85bb854837b6c6af3a9f1a574d3eb7fb10b230", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985794, "uuid": "b1754f33-6775-4709-aad4-7fc114387b5d", "value": "T153F1D983FAA85A36F3B2097818F9B212942CFA115F5A82C7758C724F1F3D1D3857169B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985794, "uuid": "ee050279-4c07-45e7-a789-124ae1bb925b", "value": "96:RhlhL/YJCnsJBkEpYZmMJ/TP+evdjj6Y5JzjVANNXDJdMs2bKveLZWEWE1GyWwc5:VV/J6pm7P6AJzjVsNnNSWE4yW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985794, "uuid": "29bd34f8-6819-4ffb-8a9a-0ff59b9bc25e", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985794, "uuid": "52b80432-bbc2-4e35-abb0-5b9a026f2657", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985794, "uuid": "85568c19-eac6-4d7c-ad37-ea431d7c23a9", "value": "f32236c2c908973c8f5b717f39544296d9e9398cb9186f41e0b3afb0f8b81c93", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8450f4e5-dfbc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682023628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682023628, "uuid": "815c3f10-73fa-4437-b320-30bff8f57d32", "comment": "Malware payload", "value": "77a8e0366aacfa67813f7055ce9da9c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682023628, "uuid": "d3359969-2e7c-4d7e-bf3b-9096b82e3be8", "comment": "Malware payload", "value": "f38aa0b1a9c9c01f20e04cde84cec5bdf7094da7fb207d1321fefce9f9f9a3f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682023628, "uuid": "a4defe0b-78b5-4f89-8c13-1c59357361c9", "comment": "Malware payload", "value": "30ca94dbfd9c44b75993d6746359fa15e6e47659", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682023628, "uuid": "7a960baa-b661-427c-a513-c046ce0f59ed", "comment": "Malware payload", "value": "e322e80ea444f19b7203262b2bde11a9282e34d5027c6a0d99f82b7297e507255338368fe4071fda860ef245e72ae0b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682023628, "uuid": "ce793fb4-aa3b-4118-ade0-9754e06fb56d", "value": "T1839519AC5D2882BECFC813FCCF65DBFF6A101B40A477B9B672543889594E7097786806", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682023628, "uuid": "f70ea6de-3150-494b-b7c8-d782515af78d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682023628, "uuid": "e50719a0-5672-414e-ba75-2e38b8c7fd16", "value": "49152:cxhNInIid2A7QB+vAIsMVNx+GrijADXfY0Dg:cx/InI3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682023628, "uuid": "6563ee42-c895-4e2a-8cc2-c30c556bb017", "value": 2038784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682023628, "uuid": "83c35765-6723-4ace-ac33-bf46662a9fa6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682023628, "uuid": "f977e0be-16e9-485c-b47b-188e968ea497", "value": "RDR2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "886ec807-df60-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681984121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681984121, "uuid": "430d4fc4-b0cc-49d0-b7e1-d597550c806c", "comment": "Malware payload (Mirai)", "value": "98b6a0e3d1e872ca00b0d643b7a534e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681984121, "uuid": "823febe1-659b-46cc-bc26-a1d50b18b6ef", "comment": "Malware payload (Mirai)", "value": "f38ff9fdb942e5c11f3232a31af270bf0fae1a0d4b0eb72748554a607f743685", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681984121, "uuid": "b36caf99-f532-427b-9baf-025f626a0ca8", "comment": "Malware payload (Mirai)", "value": "c37f703adcd295c24ac1ec7762ed9d9c5fea2472", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681984121, "uuid": "dc611b95-4450-4c47-9865-9c2e79acd17c", "comment": "Malware payload (Mirai)", "value": "764299c3a31c33479d509510aba869ad96c3743720b807ef6bb3fe27846adc7293c0483e961425ae8187f1829b584873", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681984121, "uuid": "c4806990-ceb9-4b59-8760-9a7592bd6f9c", "value": "T14D63C50E6E219FBCFB5C873447B78E21A75833A626E1D245E15CE9011FB034E645FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681984121, "uuid": "3d02c02b-f188-4418-b5dd-ccea980180bc", "value": "1536:y1xZeojGvZuKrgFrmWRTB6H0tIoMX6bJwxGviV6J5AT0ZSqaA:y1xZeojGvZu9FrfRTB6H0tIoMCW5T0Zr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681984121, "uuid": "dc8d510e-bbd7-41ba-8b32-10c470bf91df", "value": 67808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681984121, "uuid": "6309da1a-354a-4b1d-bbfd-692fd377edbe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681984121, "uuid": "98225796-d342-4518-9e98-962c81393ca8", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b098caf2-df3a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681967868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681967868, "uuid": "7345ac5f-abf9-4f50-a436-962dff116fc6", "comment": "Malware payload", "value": "6343ef2ce632f4b18f7500de5d240f2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681967868, "uuid": "cd1f56e7-fa78-4c5b-b27e-713a567c67cf", "comment": "Malware payload", "value": "f3aecf5322817102e240338fd842acce926fff8597a1e9053451abe93e760a4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681967868, "uuid": "ae6e1ef3-7ab0-421c-b78e-e8b24b833b23", "comment": "Malware payload", "value": "375ba5472c6187b44b778176e07a3fd18f148afa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681967868, "uuid": "cf97d421-38b4-4149-a9b9-246d78d4a48c", "comment": "Malware payload", "value": "be02c6ff7183799945007d816fef1e057797825556548e936894b716ebea4f68eeee67691b1b81f06aa1d49b373cd295", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681967868, "uuid": "70da8144-aeb3-4471-8e47-ef3014a1dbc9", "value": "T16BF6334E2B85DC62F6522CB558A1687EC9644DC36B13BF024335DE79CAE2CC4B622F74", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681967868, "uuid": "ba439ea0-f3d6-4e3e-afd2-324b506ed6ab", "value": "12cd3de3a58c5f4586b5a69bcc471f92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681967868, "uuid": "60920307-fcfe-4632-832d-46c752389d42", "value": "393216:+r//SJ9ktPdtGOyFM+0m9UKIv5l8EWe9RTWmk:+r/KfktVtdl+r9UKIv5l8feSmk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681967868, "uuid": "12995a40-78e6-4c59-aeb4-5f860e475d8d", "value": 16516256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681967868, "uuid": "b5230842-f3a6-4ad0-ae8e-fa5e50dcf1c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681967868, "uuid": "f8197bf7-fed6-4eef-892b-b5bddc564306", "value": "6343ef2ce632f4b18f7500de5d240f2e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "764df2bf-df0f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1681949302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681949302, "uuid": "64cb60f0-04fe-40db-bb55-e0479274ae44", "comment": "Malware payload (RedLineStealer)", "value": "14f74bf3111e2f4f5e0627ae73aca0be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681949302, "uuid": "780f0b15-7202-4348-a228-221a3a469e5f", "comment": "Malware payload (RedLineStealer)", "value": "f401cd90e781b747d207796dd7327db534fbb3e362a9df0fb21e78d8104871f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681949302, "uuid": "dfbf5a3a-cdd6-4615-8546-04a319e1ef26", "comment": "Malware payload (RedLineStealer)", "value": "af5a5c13cc3900136b408cd3f5caec957f3ecf27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681949302, "uuid": "1f2cfa39-fcd7-4274-a0fc-1617b2683668", "comment": "Malware payload (RedLineStealer)", "value": "902103f0900ca6189aceda2d3c21f7004f215d4714e2f0d27eafc8bcca7ef8e09857d67009e17a990df11c6b8ac9ee67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681949302, "uuid": "f4c39354-fde4-4a3a-9d24-d3f92eef93d4", "value": "T1A0459D007CE58C3EC82EF33204BCCDAF8579E612F5958A7BC7A8466B1B77660616D631", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681949302, "uuid": "d4c9a136-08cc-4b20-b54e-86f2be05821c", "value": "2ad0bbe7b488ccd9b02faf0349f3e503", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681949302, "uuid": "1d54f3aa-6614-410f-8d61-b0882a33d710", "value": "6144:DG1dDszSc/wXmkAODwyWfKp6LWVMZb1YFv9Edm:q1dDsqN6fKp6LW2ZaUm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681949302, "uuid": "e76b2b34-1bcd-44af-80f8-33cd77032996", "value": 1257472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681949302, "uuid": "60fdf68c-1e02-4b0d-b86b-0292998d4daa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681949302, "uuid": "4a902eef-0748-4592-b6a4-1f9b033d7cd9", "value": "11.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82c13291-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681985830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985830, "uuid": "0d9ab8d4-64aa-41f5-b8db-143167a54aa9", "comment": "Malware payload", "value": "52971ee4469d8c6627c9c5e80a5e7886", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985830, "uuid": "420426bf-8315-45e9-bd9d-e90b3b1642ae", "comment": "Malware payload", "value": "f43b73e7b8a3f314d38d3cc39129333670b79632861cb0a9a87ad162bf885eba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985830, "uuid": "f24aa773-593a-424c-ab85-196077d55d5f", "comment": "Malware payload", "value": "90b2f2cf5d93b5dd5a2d1e89dff295ba6a531504", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985830, "uuid": "fab142b9-df84-415b-a15f-63a982e903a3", "comment": "Malware payload", "value": "978cb415f680ad201e6dee4406aa03b7b5d3c0ba9cd6c746638c0db2677172a4558f2d356d98282dbcbc6a3cec262a11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985830, "uuid": "c57098ca-1935-427f-a118-d81ae6737798", "value": "T14C0427F91BB75C75ED55003E43F3E223557BB490E626B392303165310FE368E29A62EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985830, "uuid": "94e7b6fc-e728-41ae-beef-d95cf0097a99", "value": "a808411a04557309a9c41f351b379c88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985830, "uuid": "e9dd5be0-c9f4-48b2-9504-177a7cc4c9c4", "value": "3072:5d2u3DSb6ERhqxzk428VFYAIvrH6xnh+tZMUndLx5ZQhRCCW2iadTKNYTQ4uY:5sClO8VFYXDaVymhRLWladTKWKY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985830, "uuid": "7e8eb1a2-02bf-40b5-9cad-4dc88eb59088", "value": 185127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985830, "uuid": "1533a845-308c-4eaf-b742-c915b0a422ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985830, "uuid": "69509f12-7f18-4e78-bd17-02b4b87fb85f", "value": "runnerforo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7acc72bb-df7d-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1681996554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681996554, "uuid": "98c3bc83-23c3-47cb-8aa8-755029463ce7", "comment": "Malware payload (AgentTesla)", "value": "94fb1a89f809551622e083c50580293d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681996554, "uuid": "20d93077-3b7a-448b-b1f9-b203b7c2aee1", "comment": "Malware payload (AgentTesla)", "value": "f5b2147feeea4c9e62ec28aca05dc7665cd00925c09571824cb703313abd1a2e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681996554, "uuid": "3643e882-f647-4324-b19b-74e429f38b58", "comment": "Malware payload (AgentTesla)", "value": "3845f00ffafcd8082facc020d244dd0abaa194b2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681996554, "uuid": "b0e651c4-94f5-40fd-a73b-a0948605d937", "comment": "Malware payload (AgentTesla)", "value": "a31f74d0a4e3dba504d4fbed79c77053ae1a14a7d341386161936465c192ab1801290439b2bf66fc86a8ccd09fc837f7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681996554, "uuid": "4c9fd2d4-10d6-4c5c-a583-81d59cd15dd9", "value": "T10245D0C567A5D792C2643EBD123670383FB05997EA26D925FE8D50D93F32BC80A4039B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681996554, "uuid": "519e3423-d297-4c1a-9969-68fc9e3582e4", "value": "12288:NmRK95henzjWn/lPhi1oBEnK61OkHkREZUVdlJm3FJ5ShC5I:oRS5h7/LiGiQuiTz+ShC5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681996554, "uuid": "f7f14d85-3ebb-4729-a23f-1485ba3e72be", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681996554, "uuid": "1a5d0c93-ce8e-4902-8693-d731ceffccdb", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681996554, "uuid": "1963e4ef-6599-46b8-946c-22b9e0cdd7a2", "value": "ninwardRemittance_copy.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4f64230-df22-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681957540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681957540, "uuid": "0ea3cc60-7051-4a9e-83c9-18ce89c6168c", "comment": "Malware payload (Formbook)", "value": "cb62322bf94c2372c0c4c0383f3c2a23", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681957540, "uuid": "9fda27b1-9cac-4a8f-a60a-b8370578c75e", "comment": "Malware payload (Formbook)", "value": "f641f1a87ee2a760b79417b410c52137c114e2618529bb90a0f281967975476e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681957540, "uuid": "92961709-2d0a-48a9-97a1-2c24e7bbc55c", "comment": "Malware payload (Formbook)", "value": "7b628d08dde66fe82002c908a1cdca11db5d54ed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681957540, "uuid": "ea83130d-5243-4a48-8f15-0003fe21c749", "comment": "Malware payload (Formbook)", "value": "0f559606c6b72b02fe9f03028cb349210d169d1a7b5470990b7437fb7111a4bdd0c242d968a5ab077a6202641b24722a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681957540, "uuid": "5080829b-8bdf-4596-8f8c-7bf381c0dbcb", "value": "T17CD4F1ED63A5DAE7C1680B7D402676893F3490E37236C638DFDB449EEB87B044995283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681957540, "uuid": "60e0afc5-f0f0-4c47-8ffa-fdabfa8b2ad4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681957540, "uuid": "050fef18-7a31-4639-b2d4-d51cb77c0785", "value": "12288:FYmXlA7G3NFi0b7BMAsSMMT6sOhOIbw9SopRGdovnyo6VNglbXT:F5aS9Fi0b7BPl569I4p4G6vn32SbXT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681957540, "uuid": "0268d76d-e6f4-4f29-aec3-1fc568ef6639", "value": 619520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681957540, "uuid": "e7815870-9e37-424c-a9fe-e577499d7ec3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681957540, "uuid": "cf4b6210-99f7-453b-82ac-8243a579c0f5", "value": "cb62322bf94c2372c0c4c0383f3c2a23", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60a68c21-df64-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1681985772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985772, "uuid": "ae570b86-158f-4819-8aea-b2bf16aed470", "comment": "Malware payload (Formbook)", "value": "e006d6a7e7e2895689eaecef498332c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985772, "uuid": "b3cdfe89-827b-43ab-9d0c-c030bbe47043", "comment": "Malware payload (Formbook)", "value": "f725a20a3bdb7edb4ba41dc0d018be197d362af8b828a51b241391c12dd1bd34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985772, "uuid": "d0210dba-285f-482b-b6f9-879249e42070", "comment": "Malware payload (Formbook)", "value": "d8051be573188bd8f25ecc77f298a493260c34e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681985772, "uuid": "5d7d6eb7-4243-4446-9909-0ca322e3dd19", "comment": "Malware payload (Formbook)", "value": "b6f1f2603797b0bdbd6c22cd38150c340a2666a1b224b34543ca1e10e529608daac17d275c5a1be00bfdb3aac96e737d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985772, "uuid": "a8f995b2-952e-4498-bc55-a60c3c574178", "value": "T103D4019F5671DB61E09D0BB518442842237CB24AF565EE6C8CD323E78AB3F61206C7E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985772, "uuid": "d6c90d31-ffe2-4d26-8491-5332e5e861d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985772, "uuid": "c7f95269-9606-4a31-9ced-d9f62ae46d3e", "value": "12288:E2LlMCJcaORpA2kEiZq2IdVLJTjFM0Q3EqM25jtECoGu6EtsobAlJq:E2pYaWa2kEj/R3dqZhBoGu6Wso4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681985772, "uuid": "4d382867-de10-44a1-9ace-b3f40e4578e0", "value": 599040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681985772, "uuid": "227b7d07-37b6-455b-888c-6d25421a5e88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681985772, "uuid": "e8a86740-556e-458b-9e8d-00ce002f0940", "value": "Al Safar Legal Notice_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6ad2bb3-df70-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1681991124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681991124, "uuid": "9e79d8dc-3e19-484d-b002-842fe5e354cf", "comment": "Malware payload (Loki)", "value": "816982da765029e810350befd4701301", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681991124, "uuid": "e7f18426-b038-4840-8559-326b79ed177a", "comment": "Malware payload (Loki)", "value": "f79a80b0ff4dd1066e5c4844882278b420c591a05c73838a1c69190f0d145826", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681991124, "uuid": "2b4bf110-ba0f-4d6f-aa1a-874fd7d58c0a", "comment": "Malware payload (Loki)", "value": "ee72610fb3656109ae15b09801390ac2cf006afa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681991124, "uuid": "89c32763-c991-4958-9efd-3381311048b0", "comment": "Malware payload (Loki)", "value": "e86c8ba9b571b679ee0bff8613fecb4516290b1982153a240006e8283b70f5ad1f1b413c72d2c77c2257e65de6a37dec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681991124, "uuid": "d5efb83d-1670-4e51-b006-5f12473bc361", "value": "T1C1E4E095B366D792C2687C3D81AA70683B714987E917C969FCC8119D7F27BC81F8038B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681991124, "uuid": "dd3d13d0-104e-4dfb-8a84-f7930f52ca4d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681991124, "uuid": "dbaa7910-958a-4a60-814f-520a5d78d54e", "value": "12288:9uioIRbovkHMH91DzZG26t9LD1C8zVUuA/fgA2OnWlr4K0LhR2u:9UI5ocHMd1DtG2iLpVkTWlr4PR2u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681991124, "uuid": "32582e26-eb86-4a4d-bca4-35570c5ec60e", "value": 672768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681991124, "uuid": "07a2b63c-30fc-44e2-ab86-4c54bea0625b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681991124, "uuid": "0c067552-8b61-403d-a538-5cfae2d8f028", "value": "Quotation list April.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55ceeeb8-df0f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1681949247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681949247, "uuid": "a1862f3c-45ad-4c3e-80bf-cf21c1e30e51", "comment": "Malware payload (RedLineStealer)", "value": "bc019392b7999ba5620cf30f6f3dd0d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681949247, "uuid": "d0cc5c2e-0352-439d-80c6-e0317f1c80dc", "comment": "Malware payload (RedLineStealer)", "value": "f79c17349084e86a28eba5669f702ab7383a683efbfb0bd0d944dc8beba08ab9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681949247, "uuid": "ed9781ac-9c4f-45d9-b2d5-3b88b51f1a11", "comment": "Malware payload (RedLineStealer)", "value": "cdfa6b704d51555ed3d71ded82f4cf0aa5525472", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681949247, "uuid": "d2046a1e-2256-499f-af36-af1373809867", "comment": "Malware payload (RedLineStealer)", "value": "6369cb8ab2321f42fb6a17b6fe76b92d8166fbb3fe53d13ba99cadf71b0b1c170cdd379e34d1de1728b334309c4e0bdf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681949247, "uuid": "e84366bd-05d3-431e-85ec-d9c7288adf2c", "value": "T1AE456B34E89C9131C4B313F048EB41798A397D621B254A57EB5B1E6B3F303F16D96D2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681949247, "uuid": "e35fff04-fae2-4d37-9bfc-d5a6568fbdbe", "value": "2ad0bbe7b488ccd9b02faf0349f3e503", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681949247, "uuid": "7802c0b1-cb99-40f5-ab17-c11137e4aa6b", "value": "6144:4G1dDszSc/wXmkAOAntenvY2ysgz4ahTf/Jksc05Cqivdm:l1dDsqGncvYR4alf80Xqm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681949247, "uuid": "6320932d-0a38-414f-b852-59a18337d3f3", "value": 1257472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681949247, "uuid": "dbe92a8d-e264-4b89-8e44-fb62416ef50e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681949247, "uuid": "6b1e1d6c-7fb2-425c-87d0-797432e77580", "value": "22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c67e1ac-df5d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681982732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681982732, "uuid": "891b9d1d-da31-4abe-b6d7-38055b54955d", "comment": "Malware payload (Mirai)", "value": "f99917fe65bf8e5792934c664e55ddf3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681982732, "uuid": "e17693f4-b240-442a-a253-070bb0331253", "comment": "Malware payload (Mirai)", "value": "f7b556d9708a9d247a1aeb1c4c5330e1355f1393a8c3286dcadfe8b6920652b8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681982732, "uuid": "5abf12b9-13cb-4633-81a8-c55a60b6c4cb", "comment": "Malware payload (Mirai)", "value": "ec12490b5b2bc77d4a835b43a40bf46dc3bd185b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681982732, "uuid": "c0ffb6f0-dc94-4df7-88d2-a1d5551d39af", "comment": "Malware payload (Mirai)", "value": "84bd5c43167ae4fc65d6d5e1f2f8cb22630b5042ac022624e66fee21fa3e2a4d1deafa73324f8c5e6a32fcc0925acf6c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681982732, "uuid": "8dd60fbc-a2ff-4920-8309-bd4a38257997", "value": "T13943851E6D168FBCFB59863447B78E219A5833D627D1D542E16CDA002EA034E741FFAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681982732, "uuid": "ffe04058-e18f-4e3f-baf4-eef04cf2f08d", "value": "768:bvaLxUxyQpPT5rhmu3rFtImSnoh2Lt3ug+j1EZi0e4fyMnup//dujgtywYz:bvJFP1jtuF+j1x0lk16gtLM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681982732, "uuid": "2d57b72a-4179-4fb1-be6e-65719c4c9fdc", "value": 59768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681982732, "uuid": "b9779ed3-fb31-453f-94aa-d73b4bdf6063", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681982732, "uuid": "15dfffc5-9242-4270-874a-e054f348d011", "value": "f99917fe65bf8e5792934c664e55ddf3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "017a4707-df7e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681996780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681996780, "uuid": "2c0013fe-9417-40d5-9396-3012e25ad69e", "comment": "Malware payload (Mirai)", "value": "957212eb50d04c1bbb364db2a9c8819e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681996780, "uuid": "b7723181-baa1-4c07-9ffe-bf3b415fd44e", "comment": "Malware payload (Mirai)", "value": "f7df81e71d166a4442ddd7878c1664c4f7a71c0dd62a8d268c4d608b4c29152b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681996780, "uuid": "ce316ffd-a4ab-406b-81fe-1070e8e2143a", "comment": "Malware payload (Mirai)", "value": "659104d87128fa74c7fd206eed89ff8679241f2e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681996780, "uuid": "58b78dc7-114e-4767-bfcc-43350d6cb659", "comment": "Malware payload (Mirai)", "value": "c6f6e517e34c1754b23f82654df53e62488cf00189e32d326a8f1f06af903eec5c7ea42f932fc419ec5a2a9dde6db0e8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681996780, "uuid": "e5c42901-7a62-43b4-acca-ccc4a5e7b1a7", "value": "T1BDD2F1847A236156F826F5305113CBD983BC994BCCF56562AAD267243EA90339F18FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681996780, "uuid": "5f129690-c40d-491f-b946-fcf10105f178", "value": "384:wcNFetXDj3Nt4PmR9k5y6ufoqJv1w9dYGMATchvC7lO+8pYmqSfJjlha7a1u4N7L:wcQDj3GE9eO924GlO+aY/Sfdt3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681996780, "uuid": "a906d0c2-b61c-4ab4-98af-925914d37f33", "value": 28724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681996780, "uuid": "772e24b7-e9da-4cab-a496-becc94196509", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681996780, "uuid": "3945472a-ac5b-457a-b074-3c888b772720", "value": "957212eb50d04c1bbb364db2a9c8819e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f11f9713-df93-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1682006201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682006201, "uuid": "25a1af7c-fabc-4f0f-90e7-f17a2ac10bb4", "comment": "Malware payload", "value": "afa6fb724f870e602245ecf17e80889b", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682006201, "uuid": "b73d64c2-947a-458d-9e20-49a06d2ca09d", "comment": "Malware payload", "value": "f8a08e69d16a77829c10cdcaacc23bbce051d6f729fbd551a05a3aa0a4312305", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682006201, "uuid": "0c48923e-374c-4516-b946-fbaf22627ecd", "comment": "Malware payload", "value": "c8c845bcb8149b87e754bf423aa4ff8952fb3466", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682006201, "uuid": "2efc964d-9098-41b5-b8a7-f825188bbdf9", "comment": "Malware payload", "value": "3ac389322e885adf7111108b701ebf076aee792ee2b06a20891efd2992dc0f7b906342d6ea361ad4bb20abdc660a2ec5", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682006201, "uuid": "5730d149-1d18-44f3-ab70-359d8ed797f6", "value": "T106E423D0BCBC1B78C4A78719D5D08B922BB680BA9F1477993A355F3352C6273A9318D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682006201, "uuid": "0fcf428b-7555-4b7d-8ab9-84f4fa12062a", "value": "12288:N0bUHEyqPKlXcPqtRCCFLIagHIcSCTCB+SemnW322eiESJMJGGFc5BtXO:NOyqPKlsUIMsagocbHSat9O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682006201, "uuid": "43b0a6a2-ee12-4ac7-8ea3-c416c0d99585", "value": 699008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682006201, "uuid": "1b8f0b0e-3643-4295-8bfd-74029865e016", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682006201, "uuid": "2d14f8de-4db4-464b-9431-1f07a14bf6b5", "value": "DHL_0093.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79ae5d97-df2b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681961333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681961333, "uuid": "919ea6bd-6a88-4b70-83f8-48318bdaf272", "comment": "Malware payload", "value": "de13c9b7db2cbd45626f50576abd010e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681961333, "uuid": "16c8e423-6f22-492f-bae3-d4adae6927c0", "comment": "Malware payload", "value": "f8c174f10e7e42c86c439f994282b16f4688347f91d92abc36039ea255292176", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681961333, "uuid": "0423941b-af7d-49d7-bbcb-7be4c99cc816", "comment": "Malware payload", "value": "3d4274f3eadd28adc1474b4640e35c8b6c98d233", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681961333, "uuid": "25f7bd28-b930-4638-9203-5bab99657e56", "comment": "Malware payload", "value": "942d1064947cfe1dc307bb419ca783adc3a8462e1da1f4fd7039b2e4ad510a730f609a3180d13e9235a2fd7d096b70bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681961333, "uuid": "d0926d82-f7e6-442a-8982-674796a16f70", "value": "T15436BC6BB2528543E3901378C459F7BD8A217BFCBC9B832274E13DEE78167524E162B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681961333, "uuid": "cd29a0b9-ed09-4c99-91e4-785775e07452", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681961333, "uuid": "8ec1b8b3-4ec5-45df-ae06-a4deb3439829", "value": "384:uWXoCbYV+X24iQ4pQT4Mv/06VAFa0tqRLvqo+xKL2+bEzhaYU/loiFJa9aAnpSaG:uWXmFQ4pQ8jf+oThVFqR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681961333, "uuid": "09fa2211-acce-4648-b614-c05dc9c91641", "value": 5320232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681961333, "uuid": "e5018642-3d58-4fe1-a1ca-99a9b2271778", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681961333, "uuid": "3c478694-0088-4f12-ab09-c50a959cfd8f", "value": "SPYADS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62b96056-df54-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1681978904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681978904, "uuid": "3cb9871a-b161-4065-b4aa-ff3dfee60718", "comment": "Malware payload (Guildma)", "value": "e1c169a7f00948633d4adb9205cd2c0d", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681978904, "uuid": "c8cb2c80-1364-4ba1-8f38-61d0c7520d44", "comment": "Malware payload (Guildma)", "value": "fc1485b00d7c0b3ba4614d34a162578f34943e0369779ef65fca84fd6a4a80b8", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681978904, "uuid": "0c66938d-fb7b-472b-a6f8-f9b6e6d5ae09", "comment": "Malware payload (Guildma)", "value": "fd86fc4ff397a3cb433ca9d72c9d8f70d2855f80", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681978904, "uuid": "ac3ccfad-9f24-4ea3-a091-e0816156a8dc", "comment": "Malware payload (Guildma)", "value": "4f82611cb7028ee4bd5bcca7f30248da033170c1dfe56da69b0ec409076ffa042e7d243039002ec779e3378345cdc9b4", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681978904, "uuid": "08dc7f62-4e9b-4717-99b4-527911de6772", "value": "T106120F5B2AC662CE772CC4DB047C9408C024E17AD408A776758CEAADF228156777FEF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681978904, "uuid": "facbbcd8-a9bb-4fa9-8707-514175124ae0", "value": "96:wKU3rKL7NMusIAmGH7/eYzWtURPS4PqtVgbh1H+WXDsXQJ7MvYT:Ig7arrLeYRl3JtV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681978904, "uuid": "f06af1e8-7554-4df9-8e1f-555cd99b4122", "value": 9912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681978904, "uuid": "dc37e27c-4cc1-453c-8dfb-3e805e48b623", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681978904, "uuid": "d0d89377-f3e7-4a70-9da8-c74f2a1fb4e0", "value": "payload.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bd323e6-df86-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1682000340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682000340, "uuid": "aaad333c-c8da-4a64-a6f3-bd5f1a32d88a", "comment": "Malware payload (Mirai)", "value": "98942c291ee7358bcafb41492f3b33b1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682000340, "uuid": "43649666-cf7f-442a-a41b-031f9e23239f", "comment": "Malware payload (Mirai)", "value": "fc2248b840bafd37fba9c644afd29b04427d4b8b2fa837d997c1ff9a8c3136cf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682000340, "uuid": "a4823966-4753-4a6b-8f3a-9244f5a0974b", "comment": "Malware payload (Mirai)", "value": "df9cebb8bf8f35762899ec3004108cd032d30f49", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682000340, "uuid": "977f70f3-4721-4f7b-941f-661a0842365a", "comment": "Malware payload (Mirai)", "value": "49f2eed96f3bb35f0ad2adf36d2e67b634c34b1c546ce02f06f86e0070a1ce1dbf0b3adb3ff6568bfff48746118a698d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682000340, "uuid": "9fbe5ecb-0e85-479f-acb0-6158aaeeeb5f", "value": "T18563964D3E319FACFBA8463457F39E10A35823D526E1CA85E19CDA011F7034E645FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682000340, "uuid": "a44d6212-db81-45e6-9d3c-1721c916d096", "value": "768:RzZWyvL5MsRXxPx2pqV2UAz9HX8iJ3GecFgoSERFImpPxs6vvSp+ozXeyt42egHO:OKzPxkqV2UiGecFgoSWlHs6t0egwsnM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682000340, "uuid": "8644e74f-4d91-40c4-929c-810aebf9f2ee", "value": 71856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682000340, "uuid": "e3312ad7-6243-4242-8f0c-a7337ab75d6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682000340, "uuid": "c3a00fca-d964-4ca0-b3b1-0dd1e6d6a816", "value": "98942c291ee7358bcafb41492f3b33b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bc0ed99-df30-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1681963296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681963296, "uuid": "32dc0b6f-c365-49d0-81cb-3f439abe7ac2", "comment": "Malware payload (GCleaner)", "value": "ef5c84fd2afbf9f16159dfc413a8530a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681963296, "uuid": "1ee8b619-d9e6-437d-89d3-97c61219045d", "comment": "Malware payload (GCleaner)", "value": "fdd9d9d8cd44d950b95d537f8cd5991b687faebbe61dce64c6f7eefcf9257332", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681963296, "uuid": "eba8050f-1134-4b9e-b47a-6d48153ebb5e", "comment": "Malware payload (GCleaner)", "value": "4b42f18fb880dc34234bfdd1a6984b3362f1204f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681963296, "uuid": "7f3cb733-11cd-4535-a9de-51680f00b50f", "comment": "Malware payload (GCleaner)", "value": "5bb4742bb8925dd1e9bceb7d4f74015c535e127d225e35cdbb39e147864d0da8961e22f70345e6c9a652cd66b90e585f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681963296, "uuid": "475fc3a4-db9d-47ba-88e5-a19eb2e75466", "value": "T12FD5334373C606BFF05168716D27BB185EB534E12D7C81E166958EAEFFB7BC2824012A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1681963296, "uuid": "046b8c38-39ed-4161-b2b5-40b5971df02a", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681963296, "uuid": "6179d310-1b7d-4b24-9f4c-3139175bd88e", "value": "49152:zGlJfsN0ZAOrb0UAEzPoz7fkr2hRgstJHOMdY393OCnXJVPKqwZ82GhP+l9WHygU:qfZaKzgz7sHgJHX+XJVPN2SP+l9WSt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681963296, "uuid": "fc92c12b-76e4-4452-891a-f7e6485fd171", "value": 2908684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681963296, "uuid": "7297cb1f-43be-44e3-8f33-a6e5b18b40e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681963296, "uuid": "41c9e8c5-3b92-4575-9beb-52edb2bf9a77", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46639b15-df76-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1681993459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681993459, "uuid": "b4a509f9-cca1-4ff9-89bb-8a3ec7a3bc27", "comment": "Malware payload", "value": "e26c96bcec047ba19a4880dd8ca1a1e8", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681993459, "uuid": "ae959033-6fe8-4e1a-9474-86069ce2ba59", "comment": "Malware payload", "value": "fe2c585d3baeb745ee7f87c6cfaf227009e77898ce421849c7905a6ad576df90", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681993459, "uuid": "5980eeaf-280c-40ad-b77b-9273f3283f0f", "comment": "Malware payload", "value": "3f5c840be289b31533f0345d75d445667c3f8b38", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681993459, "uuid": "e20da6b8-8ee1-4121-bcd3-9027fc6b694d", "comment": "Malware payload", "value": "afed0d4f54d791181f49b46f5bc39636c1ef499ea89bb18512ad65a79c481deeb2a899a30a0621653c2b8d3f1e9ea455", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681993459, "uuid": "4e527b88-1aeb-4d65-bb68-59ea00b85b07", "value": "T16C112164A51A57ACD3B32FFCE90A190B8BBDC644CBD2EED98039F1B04A425074E13B01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681993459, "uuid": "669dd399-b259-41d1-bd45-e6228798ac7e", "value": "24:2B/+husUs7Fq61j7vLfZ1zKIAyL3pB8ewD20Jikv9:UHdIFBd77oyL3P8ewVJikV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681993459, "uuid": "c7d4ffb9-433f-4a0a-b77e-e231cf55c86f", "value": 1098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681993459, "uuid": "8ad0f56e-afec-4ba1-8100-4307cd84a8d4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681993459, "uuid": "cc970665-4545-44df-9fdd-ccaaf479b73a", "value": "April Order003.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7d7654f-df56-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1681979933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1681979933, "uuid": "e1b645c7-12d8-4e1c-84c5-f5579e415472", "comment": "Malware payload (Mirai)", "value": "83de18ffc8ad6041f2aa7f8b5ffd2982", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1681979933, "uuid": "ba481bf6-eb28-4246-9773-01b27f0c8244", "comment": "Malware payload (Mirai)", "value": "feaec11989e0a7442f4b39d238fc505271693ec4b640552dc3f5f0823ca8fc5e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1681979933, "uuid": "9f87545a-a50a-4a16-b3e2-0179d527888e", "comment": "Malware payload (Mirai)", "value": "676b76bbe67d39934e68157b4fa830c5a13aefff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1681979933, "uuid": "016f422d-3cb0-46c9-b27c-b3ffd7d76dc9", "comment": "Malware payload (Mirai)", "value": "629318d70855c5ba7a914dbc569e18b1715b52130c7e83f2cd5850e7797537cb80e8f472e60b3c11831c83484bd9d890", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1681979933, "uuid": "2fe96b12-02fd-40aa-b6bf-181a472380cf", "value": "T103731A46B8419F12C5D122BABE5E418D33132FF9E2EE3202DD24AF603BDA9D90DA7551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1681979933, "uuid": "2ff6b9ba-faee-4e7f-9f8d-884cf58326f1", "value": "1536:aYn0ougYwXM1G09wBQJqkxeEFqhmeYopFfkzRSoYbFlkOdZ0jPbLhYIIiKmdkr:9JYwXM1G09wBQJqkxe0qhso3fCUT0jP2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1681979933, "uuid": "ea5c369d-b44a-487f-aa40-4f6e1cf850fe", "value": 77180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1681979933, "uuid": "a4ceb817-e951-47a3-8852-9240d7d5c9dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1681979933, "uuid": "31c082c4-f6f7-4897-83ec-719adc30971c", "value": "83de18ffc8ad6041f2aa7f8b5ffd2982", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }