{ "Event": { "published": true, "date": "2023-06-12", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-06-12", "timestamp": 1686614581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "c960aad4-cad9-44f0-92fd-4f49fb89f2da", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a964539e-092b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1686579362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686579362, "uuid": "9535cd24-4edf-4378-93e1-b1cc8e73447d", "comment": "Malware payload (CoinMiner)", "value": "72046d312a90409c7a554eba07e1f3e8", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686579362, "uuid": "a7da5a24-c36e-48a7-aa8e-5cde897f6d35", "comment": "Malware payload (CoinMiner)", "value": "0010b7ec1d9f4bea9f2ca750de9467dc81b75cbb2b4c82f4843e863615409f1e", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686579362, "uuid": "8c345711-a4ce-40fa-ab9c-0cd2fd784682", "comment": "Malware payload (CoinMiner)", "value": "f0a43b88f42f0d1c34bd5bf29b83a3f24f94649a", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686579362, "uuid": "3849071a-ddf7-4fe1-9eba-7eef38c89fe7", "comment": "Malware payload (CoinMiner)", "value": "d9efc093c44a721cd5a36306e506d71e26dae654663b3e6a41bc9b8077babc54fc0668960052f29fc87e2e2611ab4460", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686579362, "uuid": "a8a34663-be29-48f8-a564-a453e5e0b862", "value": "T15BF54B202C65B073E4C37D7D849DA32E148ABC9F550A51C7BBE2CE6ADFADD890D84487", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686579362, "uuid": "d8c90b0e-a64f-4d15-91fe-635f62225fab", "value": "90d81c593f6017e24b2b1072359bda29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686579362, "uuid": "16f9b5d5-2fcb-4537-809b-a97d94b29301", "value": "98304:fs2i2w6gC+FgBrG0vCGBbrbkUAv23vKe0f4GY/5:pw6gC+FgBrGyK2GY/5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686579362, "uuid": "e9c17952-7978-43f7-bf77-27a37268ad49", "value": 3529728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686579362, "uuid": "ba4c2f07-de5e-4c1a-8988-253d8e92e5e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686579362, "uuid": "328e62a8-b9c8-4c2c-b486-860160bb8cda", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "701ab341-091a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686571964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686571964, "uuid": "d2781641-eb07-481b-8cef-2064de42eb5b", "comment": "Malware payload (AgentTesla)", "value": "82577fe70348c57e8f1d6c71cdcaeeb7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686571964, "uuid": "15683150-fa63-444f-8693-0f9b9a1136b7", "comment": "Malware payload (AgentTesla)", "value": "0013a2d85f81640d17e8980e7eceb3e27711f9f1d9b008e9fe64eddfd7e3e2c6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686571964, "uuid": "1bab8064-e7f9-452a-b8d4-e74db43347e9", "comment": "Malware payload (AgentTesla)", "value": "3fab2582e6638db7e12e628bdf315566c535197c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686571964, "uuid": "351f6c26-0b32-4bcf-a6a8-cf9f575d9e41", "comment": "Malware payload (AgentTesla)", "value": "dd73fb848f8d2f2696825edcb14e1410039808d0dfdca25473102e9bb96a34fb63e157cce8a1551d3713717867e619fe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686571964, "uuid": "c0688114-e021-436f-b80d-38f66c9e23f7", "value": "T15705010873EA482BC1AF3FBC1D21B071C3F8B14635A3DA9F5E56A9DCDD85B584A90643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686571964, "uuid": "f568549f-40fe-48ba-a60a-0837ecce4f1e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686571964, "uuid": "d85cdfc6-d4d3-4822-95ce-5b02585c9d3a", "value": "12288:xoAcuF6mn1DHLZnvJ8diOe42KMu/N3mWhQmwmJCMpUNgfAsERZ3573iHvfHXhsVG:QiOV/NOakx5538pYcuAdTB9/EJBtJe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686571964, "uuid": "bb7a91bc-ec69-4038-af2e-6375c4d5ffe7", "value": 797184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686571964, "uuid": "df0a8770-6ad3-463b-be8f-9759f2e9bb94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686571964, "uuid": "c0b5f3dc-b152-452b-8f01-fa10ac369bbf", "value": "82577fe70348c57e8f1d6c71cdcaeeb7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "663af6d5-0912-11ee-b3cf-42010a9c0076", "comment": "Malware payload (WSHRAT)", "timestamp": 1686568512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568512, "uuid": "b6841a0a-e095-46bd-9e38-795c16461cca", "comment": "Malware payload (WSHRAT)", "value": "05f7dda308f1bc24abadf8aa3371330b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568512, "uuid": "26803dd9-e5ca-4c68-8c9f-91e8920d09a0", "comment": "Malware payload (WSHRAT)", "value": "00460e8f2804e45011d3aaf0981b3124fc61bd67a529c8037ae23760fe4a4a52", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568512, "uuid": "67278455-6c11-43df-8321-9309e76366cd", "comment": "Malware payload (WSHRAT)", "value": "aa06855668ac9804721adacbc152ff0c302562cc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568512, "uuid": "d5330209-c94e-4770-b4ca-d80fa67b98c6", "comment": "Malware payload (WSHRAT)", "value": "fc211fd0b9dd08dcf323a2fff3bd70fcaaa3b9876bc3a2448cd0e7ee1fd4863cde1a55ae416b35071731211c61aea1f8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568512, "uuid": "aebdda76-5e59-4ead-b68b-66bc311ddfbe", "value": "T11325A2C2611DAB2BBB93EE06C55A57132574D723091F3C11FA823F8CAF5E48865F8AD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568512, "uuid": "e04698e6-cbe9-44a1-83cd-389c2ffdf716", "value": "3072:7jqQUG/tGfT5hmFesTlDxVa9H8EHGK125p5DE0VsW3ikFBWdtm++fm6KMZ8:7jqQUG/tGfT5hmFesT1xKNoisI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686568512, "uuid": "65795f80-7336-45b3-8528-221a21c7e922", "value": 1035099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686568512, "uuid": "4f3ae2ed-c7df-4f89-9e42-e5c9d35f14b1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568512, "uuid": "713896f1-77e9-48ae-a8d4-e797c6b5eae3", "value": "Screenshot_201.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dd45978-0935-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686583450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686583450, "uuid": "df04a2e4-fc85-4a89-9f96-dfa9b90d829e", "comment": "Malware payload (Mirai)", "value": "3cd226cb7e0213c3d615d1a690092f22", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686583450, "uuid": "a1d0f984-1892-4031-b29e-983c4edf7010", "comment": "Malware payload (Mirai)", "value": "0052b5a83d41ffca05d3d43a934ba97e68ea8920a0115f79e3148e9745d77c51", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686583450, "uuid": "ae87533e-1aee-4aee-9f22-e1e54817fcc3", "comment": "Malware payload (Mirai)", "value": "198f256f7f7a976e35157611770279994ae8e2ed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686583450, "uuid": "5b19aad2-ba81-463f-b0c7-e40ac28ff662", "comment": "Malware payload (Mirai)", "value": "c4e9e05ddc10faa1eb38cd71913ed8eb8c201fa1e2496ff409318294b0757331084334b38c6233bf958ca9927a7d91ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686583450, "uuid": "1558e5ce-512c-4ec2-9796-d0aeb59b716b", "value": "T1F4A2D01176532D66E3ED1C3DC96E8357F9670BFC90B6327669405A20C94D20B3E39A4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686583450, "uuid": "efb97d39-b6ec-4f42-9cb1-a222ca4c2a0d", "value": "384:vvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxj9hymdGUop5hh:vvQn4j+ZO5fKAlxRs3Uozr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686583450, "uuid": "1187644a-a128-4fd9-8957-c643cd36ea48", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686583450, "uuid": "4691bb99-e63d-4f57-b882-f6ad9bc74785", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686583450, "uuid": "f5c11af4-eea1-4ad3-a7b1-396d72574e3c", "value": "3cd226cb7e0213c3d615d1a690092f22", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "354a037a-095c-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686600213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686600213, "uuid": "90545a08-86d3-4426-98c2-566d60958110", "comment": "Malware payload", "value": "3a7726416cb0e3b4644ea6dbc1740e98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Silver", "colour": "#9592AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686600213, "uuid": "61c86f05-f739-4163-8cda-efea3546987d", "comment": "Malware payload", "value": "009f0391a6ad93e17b7c8719dcbdb50d46bc5cb6afe8af2a60e00f4bcb41cf3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Silver", "colour": "#9592AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686600213, "uuid": "707b0d6e-4ea1-4fce-9056-25ba77a39ede", "comment": "Malware payload", "value": "27fa39bb9327150ee4bc9542e5b230f41b33b555", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Silver", "colour": "#9592AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686600213, "uuid": "a61e45a4-8f02-4ae1-96a5-2b53c76a2c2d", "comment": "Malware payload", "value": "c0f398833d56dee20029cb36cc271af87e7a842ee19fdc8f8fdf8d7fa8cb63f18c0a6ec38d89d985d4aaf563e8d90132", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Silver", "colour": "#9592AF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686600213, "uuid": "a5ef353b-6f70-48c2-8338-9ae51d3ee8bc", "value": "T132F60803E8D514D9C8E9D1B089254262F971785C0B6933DB6BB1F7B42B327F09EBA790", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686600213, "uuid": "4eca739e-c0bf-46a5-85cd-ef08dc1972c6", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686600213, "uuid": "0d4fc942-3504-4233-b945-7552d0167f5b", "value": "98304:06qRmDV8DPqHWt1irZhCBb1A1r35ECSN9rq/7XJ5wlnZ:06qRmDOirZhCBb21r3aCMWF5WnZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686600213, "uuid": "debd1965-8df6-4921-8902-64f25717f995", "value": 15708160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686600213, "uuid": "a457b61b-be1c-4d27-acf7-a0acddd809a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686600213, "uuid": "d4b21e9e-33dd-420a-bedc-94e8143fc41e", "value": "se.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18efaedd-08ed-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686552491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686552491, "uuid": "e8e0780d-d133-4c17-9a9d-7f2a74bf3845", "comment": "Malware payload (Mirai)", "value": "1e0d80110f61979c35f7beccdbe03675", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686552491, "uuid": "089bad5c-d4eb-46d9-b216-0aff67abb831", "comment": "Malware payload (Mirai)", "value": "00b54494e5aa8b67bfb9a479b7fc1f19f94f87c1cd115e33460fc3537c5d0aa4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686552491, "uuid": "661bc2a5-a9b8-42de-a85e-4dbcb1148a32", "comment": "Malware payload (Mirai)", "value": "51fb485ad90e4b1ddf5eaee011cde373a067bf81", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686552491, "uuid": "0e799187-6b33-4d66-8f14-e5750a39bc51", "comment": "Malware payload (Mirai)", "value": "074ba2f5b331460fee50a580f3f67e7710f270b3adaafe2103c5c35e3815741446daae21e2ef0340f72791c3cfaf9d1e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686552491, "uuid": "bdaacabd-7683-4e81-b953-50ff8158a45a", "value": "T1D9632BDAF801DD7DF81BD77A4453090AB630F3D542831B3B639BB9A7BC721A81912E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686552491, "uuid": "555da9b8-bc92-4785-9d1c-0a75ba6aff8b", "value": "1536:vAgV/zxEN2fVSDY7Dm8VJyyE1sxQWbxdJ3rWNzE+VQBy:vAQ/zONDE7DiyE1GQSx/B+V4y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686552491, "uuid": "0bc2cedb-357a-4e0c-9682-69e1d16d38fc", "value": 69636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686552491, "uuid": "91e20001-ac91-4d80-8a07-a268b3b09b36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686552491, "uuid": "c7002cb9-e741-4f10-9268-d9bfb2bdbc48", "value": "1e0d80110f61979c35f7beccdbe03675", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "307077b9-0960-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686601922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686601922, "uuid": "1da80965-ce67-46ac-a632-519cbf13f8d6", "comment": "Malware payload", "value": "37b1b821034ae172fc764bcae08bc5ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686601922, "uuid": "92fc9d78-dff5-4717-bdb1-643d6cd2e316", "comment": "Malware payload", "value": "0108e07d10e0ef3a092c1490e3570d4740e2906178f2f997458a3e2a89cba33d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686601922, "uuid": "06391b3f-37e8-423c-9279-5c07397f5b47", "comment": "Malware payload", "value": "baad1e39aaabf46a8d7a5081c7b88b9c82d2ce72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686601922, "uuid": "11edcf39-ff92-4992-a947-f6d57ceb4e91", "comment": "Malware payload", "value": "98bb11706031c7f3641bdfd9eba1dc846d51254b3f37320b94ad693149a7b82b1531016e787487040ee61913be7439b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686601922, "uuid": "598a4cc6-d1bd-4e0f-a228-369185204142", "value": "T1D9333F0137ED1114F7FBAB74AABA16118B3BBE6B6839D51C09A4108D0D7AB01DDA1F73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686601922, "uuid": "0d44b0b3-752a-477b-944a-5cec548ecf5e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686601922, "uuid": "aafc6ef0-b00f-486e-a622-2bc1e30f57b9", "value": "768:8msEeeI2w0wGaV/mcZaq/wV8vcYoTByAcEYWd4YQrgX:JsLswfGa4yAcEL4YQe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686601922, "uuid": "8667ecf4-43a1-4f3c-a63f-ef6fd4f93813", "value": 50688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686601922, "uuid": "8a937918-c33b-4ac8-8fe7-d203f499fc68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686601922, "uuid": "4f295cd6-6743-4e05-88f3-735996d6e0cf", "value": "SharpWSUS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcf18973-0955-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686597487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686597487, "uuid": "6639cb7c-a94c-47f1-8ae3-3beda2e8a35d", "comment": "Malware payload", "value": "cb497d604ad3292df63e822bb2b0f38b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686597487, "uuid": "cca60771-9aab-4cb7-bee3-27e31d7ee086", "comment": "Malware payload", "value": "0145fd5a599543433cb3a5de3658706561e6bda37cbe3fa6da8698a0c57167e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686597487, "uuid": "ade982cc-25de-43f3-97f3-12a349374503", "comment": "Malware payload", "value": "72bb1a111567dcddd643b991499d9758d6c1ec44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686597487, "uuid": "9dd98785-25ff-4633-9fae-3dfd0ce4f719", "comment": "Malware payload", "value": "07a5d0f01273333891527302e79991f9bf46dcfaa50ddc4951ba322a874aaf3acafb62f7a31e7157ee02ff5f3e34387b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686597487, "uuid": "80d3ac78-7fab-45f3-b3c7-b3aea46d34b2", "value": "T1C3347CCEA700C455E9AFBE78B9A64AC87BB13D9D44E98E0D78076F1D34E72414A07E07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686597487, "uuid": "9bee562d-b8d0-4131-99c0-52c45c9f6297", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686597487, "uuid": "c1f09335-6170-427a-ada0-244deaf6b5af", "value": "3072:JDE7b9b0mDZYrYBTTRJfiKID0jJ3XELVci5uLWjRKV1NlFKbL7k4BTiHrfSFDJ4p:JDE7ZbLqP7RKVWbL7ZTiHe/4Go3HWk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686597487, "uuid": "b1b695be-308c-4fe3-9ebe-7a91f219d553", "value": 250752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686597487, "uuid": "41362bcc-36c1-43f3-a38b-867e69763393", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686597487, "uuid": "4d5cec4c-6a94-4fa4-b99a-8798375497b2", "value": "ReClass.NET_Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80b1a3b3-0925-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686576717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686576717, "uuid": "abd68506-22b5-483c-bbfd-f8c6dd14d6a7", "comment": "Malware payload", "value": "bee196a3b95f6e1a6eb37c56b41bc271", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686576717, "uuid": "8439ab43-34a3-4f36-99db-096a98e4cb4e", "comment": "Malware payload", "value": "018f22c7760b32d5d936d02cb62df9bb29242ed2c1820385844cb751f4425d61", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686576717, "uuid": "aa8dfb99-63d6-4dde-90bf-77b2280569ff", "comment": "Malware payload", "value": "fff29a2baa7eb4a8b784140071275863b6ae3c61", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686576717, "uuid": "bf4eb9f8-713d-4e4b-bf8e-8032727ed2e5", "comment": "Malware payload", "value": "c540e3e592a0f97ec3123286e1739ae366ee55c19487b3c19c3b223eddae37116a1e609a1aad520343617c04d4d6d1b7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686576717, "uuid": "82feee8a-1d71-4e3f-8865-c36965b1be41", "value": "T1DF735C0077D0D071EABE19321864CAB19F3E7911CEE09D6B3B9A0A394F701D1DE75E6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686576717, "uuid": "627717b5-c763-42ac-acc2-4e1080244777", "value": "586d0fe3e109a6211399a8a8b04c8000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686576717, "uuid": "1512304c-a3c9-4068-8287-acb364430ef0", "value": "1536:lHvsoKpy9d0dJSgwXdt7iWkrS9GA6Fp/lNuOsW4cdbW/YER:ODxdQ5dfkrVdMKb6R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686576717, "uuid": "719535c0-86d1-4fbf-bb3e-ba9092e414a0", "value": 78848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686576717, "uuid": "c1d84cbe-eab6-4af6-a806-fc8b7363ce9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686576717, "uuid": "d6037739-113a-4bc3-bdcf-d91b0e21851f", "value": "SecuriteInfo.com.Win32.PWSX-gen.31947.12518", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "900389aa-0918-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686571159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686571159, "uuid": "17db5609-11a8-451b-8f5f-6d3887cf269b", "comment": "Malware payload (Formbook)", "value": "2a15f6247c2a5428ec04db50f7224b3e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686571159, "uuid": "c19abc63-9bec-4efb-aece-014a903a1269", "comment": "Malware payload (Formbook)", "value": "01c0819a68dad36a1aa227d4034134ef3118c4ad71a5760b918495fa39cd096d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686571159, "uuid": "74303914-6884-43a5-ae26-8bf2e8f0b61b", "comment": "Malware payload (Formbook)", "value": "35091126b25f252935b4ef322d376cebd280547a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686571159, "uuid": "da367b98-56f7-4051-b53d-28d807197116", "comment": "Malware payload (Formbook)", "value": "cab7fa51202defc846663e5061889a7ed30501e95ddaad02a1c1123b481179c0a620bf000d40b07f18baec58d960026b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686571159, "uuid": "2e82fccd-c56d-4fe3-a033-f6afd783f72d", "value": "T133A42334FC1033BEA01921D91AFAC8DD6E13009EF6211528B8EF74B9CB55715E18BECA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686571159, "uuid": "0ddb471a-d0cf-46c5-9105-a4fa92d1bfe7", "value": "12288:SB26GrTFheRqCecWkOGgv+g7i669fLEHL8jwAqu1:SP0CNADDv+g7B69fLEHL8j/j1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686571159, "uuid": "ad8cee90-97a7-46c0-ae3e-7e3999efec3f", "value": 457277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686571159, "uuid": "7a4df0c8-69b2-4e3b-8787-e540e7e082b2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686571159, "uuid": "14f31add-31aa-4076-895f-d27cb2edfe55", "value": "9962625262537.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ace6e96f-092b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686579368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686579368, "uuid": "cc399adb-9907-4a05-b539-78234f093811", "comment": "Malware payload (Loki)", "value": "e03a07b14036db47894ae0f73fd0fb3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686579368, "uuid": "0ba208f9-ace7-444f-a0e2-81efcd2df310", "comment": "Malware payload (Loki)", "value": "04a48f1ea58d9e0ee540bfe7cc4c0117c3724c91424c2afd35fcce4f88db7782", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686579368, "uuid": "e97188db-5d5a-40bc-be77-fb84004cd4a1", "comment": "Malware payload (Loki)", "value": "6366abda03ba3e96ce34faf19180791678bbf308", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686579368, "uuid": "4b5f4911-8067-4f3f-9a8e-e34639f6ecdd", "comment": "Malware payload (Loki)", "value": "4ebe24c24cb79ba303ac635713f5b5d3ff95b05c6e94d68e15041043501eaf20af9b22b2cc28cc60508d2fa2c2a800ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686579368, "uuid": "5f6a4c71-a4b4-4b31-8c31-370795e3d6bf", "value": "T1E2E49D22DD5A81C9E87931F21422580F11BD5CBD65AA746A71BFFA295C3B203CD0F93E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686579368, "uuid": "095565b7-82d3-409d-bcd1-6b19795bb698", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686579368, "uuid": "0445adba-88e5-4adf-bc10-4090cc2d11f8", "value": "6144:o9X0GSN2TRZV13cWT6MyjVRjmdStA21cogHwT3bRojTdQFVvFr1OsYTFhaIz+dfm:e0uph0B1DYTazjFBJESXNnQkC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686579368, "uuid": "7ed66baf-6465-4781-9d1d-a0f15d35a67a", "value": 659056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686579368, "uuid": "eed121e6-4f85-459c-8add-ade50f057540", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686579368, "uuid": "7e4377d2-87b9-4376-95db-37ee7fbd5164", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7791b76f-08f4-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686555656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686555656, "uuid": "9b0ae4ff-ad93-482c-8bf8-ac24637e0be3", "comment": "Malware payload", "value": "6f47723e5fc6e96ab5e9f96f6bc585fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Void Rabisu RomCom Backdoor", "colour": "#B9B9A3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686555656, "uuid": "3e373545-0fe8-404e-803c-2919cadd3710", "comment": "Malware payload", "value": "0501d09a219131657c54dba71faf2b9d793e466f2c7fdf6b0b3c50ec5b866b2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Void Rabisu RomCom Backdoor", "colour": "#B9B9A3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686555656, "uuid": "8d3ce965-5fb0-4682-bde7-8ead166a02b4", "comment": "Malware payload", "value": "04e3be2ff570eb1a479925560103af5d22961983", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Void Rabisu RomCom Backdoor", "colour": "#B9B9A3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686555656, "uuid": "5315d22b-d5be-4057-9832-2b99240e5564", "comment": "Malware payload", "value": "09f529f148882cdd5137a50eefa45d0b9cbc30e7ca0f11bf04f7e790b947ba1c6434e21ced9036de084a83f76476e4f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Void Rabisu RomCom Backdoor", "colour": "#B9B9A3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686555656, "uuid": "350a44e8-cb7f-4980-9863-1c0ba45f368d", "value": "T1C4C5F117159406F8EAEF0234D04B1A8EB7D074525BA5BC0E29CD8C437AC3FBB558A76B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686555656, "uuid": "2feb69ef-775d-477f-86f2-d3859eddad8f", "value": "b972ea4141876a70af0b29439e13e425", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686555656, "uuid": "3bdc1f40-4976-4620-af66-6c369ddfd334", "value": "49152:fHmIFSMstNtL02iEIbr7xZRusy0kIwPUqS1OW56QcHP3EZ:ffSMIs21u7XMp6d2/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686555656, "uuid": "91357fd5-99ee-4317-81fa-d682e82b8ee7", "value": 2696704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686555656, "uuid": "56d6303f-67df-4850-b768-5e7b4fff995d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686555656, "uuid": "d3e9c8c8-24fb-424b-9a62-2f90e3f27279", "value": "netid3504117486.dll0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89fdfc0f-0912-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686568572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568572, "uuid": "7b691c3f-2bd7-4a96-8c2c-013f918f9fee", "comment": "Malware payload", "value": "26cfabf58b0cca1bf79f1f9487760bdb", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568572, "uuid": "b7223b3a-4567-4bc6-b83b-1cf341831e51", "comment": "Malware payload", "value": "05c7a43428b7332588fe20034eae9969956d82be55743eba3bcea91ee17ffaa2", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568572, "uuid": "922d96bd-280c-45f3-b7a3-c9a38d8fd703", "comment": "Malware payload", "value": "642b100adb70e293d8d680ae76007722f4ae07fb", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568572, "uuid": "4bfd5a35-8531-4f38-9b11-83d5a115cc81", "comment": "Malware payload", "value": "ef4c5a62a13f631a7eb283e737c719471d1a660733f0fffed6ecf9456e5bab3d729b2d31ea0a836b324d8e7076d1b652", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568572, "uuid": "629355f8-6af2-4083-a602-e83822b5ad82", "value": "T1F5D3F82B76814B51C5A96AB5C0F7983403E2B6C773B3E74A3E4592C51D023E9CE8A7C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568572, "uuid": "b95236af-e0e1-4e80-a1b9-bf7a1148943b", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568572, "uuid": "9c819850-55b7-4647-9b74-3d521098e3f8", "value": "3072:kBo1BsntDdWefiw+XynhcTv3xfEJKHxHC3:p1Cn6eawUbWYxi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686568572, "uuid": "430890f4-d489-42bf-a143-0d2e28082c06", "value": 130048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686568572, "uuid": "ebe2d4ab-4537-491f-abe8-5058eaa5e38a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568572, "uuid": "38080638-dcaa-4a9b-ac93-f6d248f267ca", "value": "1686568571818a78a8f1837bfa3f6da272e9769f555489991aa86eacf6babeb9d1030d4bc4538.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44d44f7a-0912-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686568456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568456, "uuid": "3d706aa1-00a1-402d-9793-445d408d774e", "comment": "Malware payload (AgentTesla)", "value": "2093282857be724c339ce27bb5cdc633", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568456, "uuid": "cd6acd1d-e9c2-4ae5-9265-a613492e9cdc", "comment": "Malware payload (AgentTesla)", "value": "06b2ab16e068ff058fd7b142d331ca7b694c4a311320c6a6aaee7acdd38b2402", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568456, "uuid": "4ad27d12-f917-4b80-90cf-a55e98cdf242", "comment": "Malware payload (AgentTesla)", "value": "26ffdf9709e6ca7f4ac422597806f842bbeea080", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568456, "uuid": "9c65c3d9-7021-4284-8769-a80c08e591ec", "comment": "Malware payload (AgentTesla)", "value": "a795804478c97bdb57eac433003894c353d6c2c891cb8d50172c37eca89dfb2dde3479679273756022e0f4a0930b4493", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568456, "uuid": "b425412b-9378-4cc9-9228-266d43b2a0c5", "value": "T1F3159B3B1E9AAC9EC49EDEF42AA611324DA1DE01BCB1C51B1D42708589FCE5073ADDD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568456, "uuid": "74ea1693-0604-4b76-b8d0-b52816457392", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568456, "uuid": "de328729-2d97-421e-9eb3-4f3d07b6481a", "value": "24576:1iOV/NOaXez2URyzwc/787XDSA2ieOwFmBCZhEJB:1iOV/NOas2A+5qXOA2vOAoCZhEJB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686568456, "uuid": "de82a27a-103a-4ad3-b4c7-fb8e2ac36791", "value": 955392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686568456, "uuid": "7086a13f-0269-48d3-b3a3-874c5c7d25a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568456, "uuid": "17ebc002-0e89-4357-9d28-799c11aa6112", "value": "hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c418dcb-093f-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686587876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686587876, "uuid": "4fe102b7-1a27-4e2c-8dbb-baef8e0c85ec", "comment": "Malware payload", "value": "9238be200dbf0dbe0466ebff4db56301", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686587876, "uuid": "4ed1a948-9a14-4885-8622-bb49781c3e81", "comment": "Malware payload", "value": "0758146425c10208d3c8000b444e5f3d1ef203918e1b60a9f9f01214564fb9c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686587876, "uuid": "d983bb18-a777-4c01-8044-21ecd2e00b5e", "comment": "Malware payload", "value": "c1f411c2b8ff7b7bbb77b03340364d54247f99c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686587876, "uuid": "85a52b21-44c9-4d42-bed2-286f78ee701e", "comment": "Malware payload", "value": "0bdfb697736aae873159c003384687bc3ba6b8e62ecae864166a9313a3a82db962104b41a2b6b6c1677e13520a592d1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686587876, "uuid": "1528058c-8301-4118-ba1c-b00d95bd9590", "value": "T136D4BE13F2828076E433143166AC9F72497EB6310A2665B7F3C41D5E5EF02D2EA26F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686587876, "uuid": "7ba45633-8669-4f05-8195-b7f9be642bf9", "value": "bd1dfa5a3a004acbd83f0c70a21378e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686587876, "uuid": "8e4736ec-3c8a-4d29-a555-e9fb9ece0306", "value": "12288:qu02MXY5M92Sc9Cf7g9CXC2dDUpCDJlrjKLUozRSIDnk5:quj4qM9299CTg9CXCqDHrjKQWnk5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686587876, "uuid": "f48f45ba-6a7e-4393-ad7f-dfbe92db116b", "value": 647680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686587876, "uuid": "8520f8b3-4e34-44bf-9911-1827c89503f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686587876, "uuid": "c5b2b272-b81a-4f39-853b-a3440dd449d5", "value": "VapeInstaller.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a25f5764-08f9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1686557875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686557875, "uuid": "ea15d4a2-270a-494e-a29e-52d5c28a2d39", "comment": "Malware payload (SnakeKeylogger)", "value": "979ad4e09e8df2f8cd1acc1a8fa1dba6", "object_relation": "md5", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686557875, "uuid": "7d5143a7-5a98-4f72-a86f-b3f0317edb23", "comment": "Malware payload (SnakeKeylogger)", "value": "07fa16559e1c8a786982b257bd383eac0ef715998689efc3e645d0fc96d64069", "object_relation": "sha256", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686557875, "uuid": "1ae8ac97-0410-4921-873c-3dd3642e9c06", "comment": "Malware payload (SnakeKeylogger)", "value": "47defc3cc7066efe92aa9240e5212fc7f7eab43b", "object_relation": "sha1", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686557875, "uuid": "f5aec990-74bf-4481-85ca-6a6bdcdc521c", "comment": "Malware payload (SnakeKeylogger)", "value": "001d0e15eb9e71c4e91613e41210a06c99f36a88dbf25f297b8e6236c874b73494e8bdb136e26b3d42445dc08fb94e9f", "object_relation": "sha3-384", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686557875, "uuid": "b0f945ee-a643-4a87-81a1-46263c110c50", "value": "T14B230261EBC80EBC5053E3D5E2DB88F4041377FC6BBB9054B6F53124B2729278502BA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686557875, "uuid": "c2913645-c8a6-49d0-b2a6-ec58cf31d3ad", "value": "768:BCWNn+/PLfISs6oq9ERQEHM+ocrrBoUT3Iu1FB6DVhdgcJZvrNSS+ox83QD:Jwn8R6oq9E1ZVBjT3fcjTl+y8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686557875, "uuid": "fb63a3d5-2481-4d2b-858b-49ab5f9796ef", "value": 48515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686557875, "uuid": "54149ba5-f1e8-4225-9a68-5358ad4393a6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686557875, "uuid": "edd65fde-9743-4240-87c8-f373fef82f07", "value": "RFQ 11054 062023.PDF.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23d0faf3-0913-11ee-b3cf-42010a9c0076", "comment": "Malware payload (PureCrypter)", "timestamp": 1686568830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568830, "uuid": "3d260739-4ac1-4d3f-bef2-0478301ddb73", "comment": "Malware payload (PureCrypter)", "value": "34242398be6a80b536ac21be06f7d2ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568830, "uuid": "f500539e-e92e-4e50-8b02-a43b09a09ccb", "comment": "Malware payload (PureCrypter)", "value": "085758594b8004ffcd2c0b7413d67c3fd8024d8915aac54b95db59609c7bd55d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568830, "uuid": "7dbb9c53-8455-45c3-8f57-4b52f31aa4f3", "comment": "Malware payload (PureCrypter)", "value": "91c0b30ad988678182f37a3f4bfa5cfc4a51857c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568830, "uuid": "1d6eb90d-d667-4192-bffe-b5adda6f7331", "comment": "Malware payload (PureCrypter)", "value": "f32323e5dd41586d521a367d93b712824216fd9dc05a73c5fffaaeec5dca3c6be5eea81cf54c1a3df7bbbbdc36c0f33d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568830, "uuid": "272b83a8-5377-4cd8-a523-50be575e42dd", "value": "T129920808B2551813F40E1BB49C5317900FB97D165893D6AFAAB5FE1E0CA2714AA335E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568830, "uuid": "44ca85bf-215d-4a5d-b1a7-2e9cea82582f", "value": "384:t2keTUi5j7+37gHeMF20vvvvvvvvvvvvvvvvvv6svnJCKA6g3N3mSv:t2keD+3SeMFhvvvvvvvvvvvvvvvvvv6P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686568830, "uuid": "ecdb3af4-4c65-4261-8e5b-f377e60ab601", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686568830, "uuid": "6b6325d2-4c98-4cce-9e6d-3c1b896fa1b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568830, "uuid": "cbeb0143-4b77-4509-8e0b-c204d5e15501", "value": "34242398be6a80b536ac21be06f7d2ec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "407f8381-08f2-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686554705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686554705, "uuid": "1f33e64a-27a4-4df8-b675-12bc78ef57b7", "comment": "Malware payload", "value": "a3b7a00315b7ff714ea9f2a2660bb5b9", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686554705, "uuid": "08c78fd1-5d69-44db-905e-47954498b762", "comment": "Malware payload", "value": "08960b36601485c4589ad186cc3dea99dfbfe15b40e3d2615747791fdf137674", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686554705, "uuid": "5f72feda-64db-401c-a562-d15f7d6ad381", "comment": "Malware payload", "value": "4a602596a4e176961a132ec87fb1f2bdf8cb5acb", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686554705, "uuid": "61262807-aa05-48f8-8783-8860a22ddcba", "comment": "Malware payload", "value": "21fc8f45b984317e8879f4b45c5553c68575cc956008cbdf6720a57ac84393b9d43c4d567250db3f302bc9af8b6b74ec", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686554705, "uuid": "057622ba-2513-4d3c-af54-3e85337f772f", "value": "T13AC4C65AF6F610E4F5B6C13899A2312AFC7278654734ABDB8680560B0B31FE4EE3D750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686554705, "uuid": "6e7576f7-ffff-4e4c-98ba-3a7be6045a0e", "value": "67a7056e4beedcd946232c27c372d6ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686554705, "uuid": "3e6af505-b4ce-4f14-b047-2b3ef749013e", "value": "12288:xM04tD6kXMtOJpPh4JIOiXhRdIDIU1Dzoa0pAn:xMxD6kXM4Ph4I7d2H/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686554705, "uuid": "45d88c36-b256-41ec-bff8-65bdf7ec80c5", "value": 566272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686554705, "uuid": "b7925b76-1cdb-4ddb-99f8-bc747341c09b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686554705, "uuid": "97b615f0-ac82-49a3-99ff-273c14d98461", "value": "a3b7a00315b7ff714ea9f2a2660bb5b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14352a0d-08ed-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1686552483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686552483, "uuid": "78450511-f9ad-4063-9938-5f76b8de5729", "comment": "Malware payload (Smoke Loader)", "value": "66d0373df019b2c836711280f989a90f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686552483, "uuid": "f018e304-37ea-4087-8d33-3df8eb3c8182", "comment": "Malware payload (Smoke Loader)", "value": "0b7609e449e5872e1223c2ae6f26253640b0cb7981e7721e5b3a25a28a1fe579", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686552483, "uuid": "b5f54924-857f-45b6-be12-e25d23948bb6", "comment": "Malware payload (Smoke Loader)", "value": "6a7fe2fe8ea0f2a1c656032b3391453bf04e5ac2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686552483, "uuid": "4fcc0ebf-d4a3-4500-bde6-24d099ba3cc5", "comment": "Malware payload (Smoke Loader)", "value": "17ed6e9388ecbe42cbd0185192d9b292e1b7b8636bd13354944ad5750c9fd0ca659b31c47b211f1869ebbff1fe796636", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686552483, "uuid": "9fac1414-7a37-43a0-991f-91e918db866c", "value": "T10A44071392E27D60E5265A728E2FC6FC761EF6104F7E7B6A1218DA2F05B32B1C173650", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686552483, "uuid": "74772052-b92b-4f1f-9206-594ada7800a7", "value": "00238f2ba697aa7e23225a769e849753", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686552483, "uuid": "4d630c5f-ec97-43c8-b2b6-87e745b4ac4f", "value": "3072:p7410cPRDg7JWlfErzbAINCsaGGsxiF2kagGeOC994r5fphyFCUOKynRu4:9Q0kg7JWyrzEI/aGGsCRagUl5f3yF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686552483, "uuid": "63db9e17-37a5-4dee-97d5-62ef9a901d03", "value": 255488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686552483, "uuid": "992de0db-3891-421d-90ef-f21432a36508", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686552483, "uuid": "53a976fe-d340-4203-9423-16ee9ddc20b7", "value": "66d0373df019b2c836711280f989a90f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "396bed4b-091e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686573591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686573591, "uuid": "b5e4ee14-8e5a-48f5-bec4-751fe51eab3c", "comment": "Malware payload (Loki)", "value": "f0b4016e38a7eb6e8e863fd998a65911", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686573591, "uuid": "027576c0-7fe6-47f9-8f0f-6e2a14ce68ac", "comment": "Malware payload (Loki)", "value": "0c9d13e20ab3a6b6c5b28abcf8210e1f626b06e39eb542ada2414350238f55fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686573591, "uuid": "bbc0561d-054a-4880-8ccf-de22e47d392c", "comment": "Malware payload (Loki)", "value": "9edbd40c73f6c4f1765cbea27ee042aa64d9f917", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686573591, "uuid": "9f7753ea-3204-42ad-ac88-514a2e3499dc", "comment": "Malware payload (Loki)", "value": "8496cc63e7b01360164cc238cb7a06ce3186227af449c6603e7d7fb52617e33abd767a47f3f1d05aa9c926f74f13b670", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686573591, "uuid": "402fa6fc-101b-4804-9cf3-5bb869ce70ae", "value": "T10E5307467BF44E83C249673864779644072DFE295A63D74BBA8D712B0DB33D229B380B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686573591, "uuid": "0c9570f3-43d6-4a3e-9ada-53109449a947", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686573591, "uuid": "45c10c6c-6caf-4cfb-ac2a-a64840b9bd81", "value": "1536:/z5PNkXr4M1e187tkcN0s2KG5ehDg8013vfdHldhwR+OGa0Ak:VyXcM1e1iD0PehM8s3vfdHldhwR+OGa8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686573591, "uuid": "c897ddf8-b2ca-4971-8f22-9b5fb372eccd", "value": 63488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686573591, "uuid": "ea9d6f97-3896-42d2-8deb-3f4af8a551c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686573591, "uuid": "a11aa650-583a-4876-ab0c-8ebbccf39252", "value": "Fatura_No 509600_92023_print.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41bcf6a4-08fd-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686559431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686559431, "uuid": "764de9fc-bba0-4fbb-835e-edab4513bb17", "comment": "Malware payload", "value": "d26d8506765d5e3d05bdf3b8fa1a21a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686559431, "uuid": "9088897e-0974-47dc-b3d5-16d6c8c5e9bd", "comment": "Malware payload", "value": "0de2cf050e4bff3c4a3bdae1ee3cb505ca7e840d5ce4e719717c2385f1113bf4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686559431, "uuid": "a2884162-9587-48fc-844a-6431698fd5e4", "comment": "Malware payload", "value": "775ae89fb118d7b84dbf6b91f3208daecfb3d09c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686559431, "uuid": "45881e50-958c-4383-83d6-fa1c45363fa9", "comment": "Malware payload", "value": "db5cba7fa5d5a144e50b696c1dc500fadc3ba433251913921896b0747afee367bcac0c6244797e86da14358eb8159c21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686559431, "uuid": "edf827cd-c3e5-45b0-80e8-8f00d11dda8b", "value": "T193A36B8B63E530F9E5728639C4A15A29D732F8751A209F5F03A442961F273A14E3EF72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686559431, "uuid": "07994107-024c-4f24-919a-b8721639acba", "value": "686b507e79afb7d0cf87ec3f06c7daff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686559431, "uuid": "19234c85-d1c0-428f-83b3-0990893caeb3", "value": "3072:wvoX853GGnLrxfh+pGI3ZLOxPFMz5Y/IM:pm3/LNhiGU3M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686559431, "uuid": "9fbe5e0b-76e0-46ff-b1bb-ea275adf1f80", "value": 100000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686559431, "uuid": "ff965818-f11b-4f8b-ba71-74022491fca2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686559431, "uuid": "ff507d5b-1b9a-4345-bb8f-358d889cf15f", "value": "rum.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26744756-0935-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686583437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686583437, "uuid": "493e0d20-bf16-4b74-bae5-ad5a70085e7f", "comment": "Malware payload (Mirai)", "value": "47303ff2695579bac08ddfcd82ac6c86", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686583437, "uuid": "39be6ad8-eb98-4db3-8d3f-e3b4246e397f", "comment": "Malware payload (Mirai)", "value": "0e001b051b0c96816e4a3c00ab3bf0a51356916130d8c5cba32a1d81a9555e55", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686583437, "uuid": "66df2844-6aee-4099-8bfb-ec6e47601018", "comment": "Malware payload (Mirai)", "value": "7635b9868346ac330fac28c7084e1545b853e74d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686583437, "uuid": "1e9abb20-0bfb-4ce2-b263-ee72665064cd", "comment": "Malware payload (Mirai)", "value": "474f9351af1f7a5e30555db4bb7a67fffabfec78352945a5e18fa45a48a698b465a572bbcfc16e254373e6d203c757f3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686583437, "uuid": "e1c896da-6ea2-48c3-9b8f-6504ba0d371a", "value": "T16C33FA8EB8029D3CF91BE6BE54164E0DB93177C152830B2767BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686583437, "uuid": "6c2e96d4-c0c8-47df-b1dd-e2102e0561b0", "value": "768:gduPBFnHooqR8qOCKq2cH4/te+TK806MMUVjzkfQXObHud2oGH:r/hqaJMeteqK806MHdkfQX6HuCH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686583437, "uuid": "034fe4c1-cd24-4780-bb70-ab6795ff86dd", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686583437, "uuid": "ede6ec96-da4f-439f-8dcf-6fba079afa1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686583437, "uuid": "9731355d-fc9d-4c8e-82a6-e00938ded2d8", "value": "47303ff2695579bac08ddfcd82ac6c86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4c80fde-091e-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686573905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686573905, "uuid": "3f1be799-cb7b-44ad-a41a-ac83704149c1", "comment": "Malware payload", "value": "7fc1ce7f8f7ef9d1beaeeebc32e1ed09", "object_relation": "md5", "Tag": [ { "name": "casbaneiro", "colour": "#29A76A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686573905, "uuid": "5bce21db-60fe-4447-a2a1-89de4e81d56d", "comment": "Malware payload", "value": "0e4032b14abee13511af9b764698fd6ad91d5b8497a7f8e8cc30f81bb0c31a47", "object_relation": "sha256", "Tag": [ { "name": "casbaneiro", "colour": "#29A76A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686573905, "uuid": "3628f55b-cfd9-4056-b874-971fb2984418", "comment": "Malware payload", "value": "f9e175a931f82d9e0ce6c445f9df287ad34b51db", "object_relation": "sha1", "Tag": [ { "name": "casbaneiro", "colour": "#29A76A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686573905, "uuid": "47578422-5781-4bec-9821-0f9d3c731cc4", "comment": "Malware payload", "value": "780b73f7be15dc1ded19def7e2e7eeacd642c5aff6c87e1d03a4920ca57951bf7e4388842169e7fab43df83311fc65e6", "object_relation": "sha3-384", "Tag": [ { "name": "casbaneiro", "colour": "#29A76A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686573905, "uuid": "a5193734-5e28-4c41-b186-50a301fb075b", "value": "T19586D022BF40DD3AC05B1A355527F6549D3B7E216626AC1F1FE4B84C8F36281392A63F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686573905, "uuid": "d5ff8cce-70e2-404a-aef1-b79f76ae3661", "value": "17188ad05350b9217d369e0ebb919820", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686573905, "uuid": "da2ba893-d6d7-42b9-9d7b-0ee323d6b445", "value": "196608:SBE2OO/UDqLHc1mTTKLcVkSy0mhZdrFYlhSw:SBcO/UDEcUwSy39YN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686573905, "uuid": "7696e217-cc76-476f-8644-e6624ec176ba", "value": 8600360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686573905, "uuid": "c1dc56b2-6f69-4a19-939b-d5f7f128f11d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686573905, "uuid": "f2a0c69b-2471-48bd-b45a-f7e2872f6158", "value": "Documento_657 _ 3461.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d75e636-08f9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1686557733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686557733, "uuid": "a8623813-3a6e-4780-83b0-e33fec78ecca", "comment": "Malware payload (SnakeKeylogger)", "value": "f50c01b28f63ea3a2f9eda5d3f62cafc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686557733, "uuid": "cf22dbda-4415-4411-b9aa-2c268e340e17", "comment": "Malware payload (SnakeKeylogger)", "value": "0e7012a66e5d3c6ada99f6dcf651fc8a29f31aa74083f76ee96992df0be54ffa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686557733, "uuid": "ba0cc36b-aab7-4a24-a853-022d351b5636", "comment": "Malware payload (SnakeKeylogger)", "value": "15194fbd3471810bf689da9efeb57efdd4e4f21b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686557733, "uuid": "39d560a2-ad99-4f19-a4ae-a4fbb3892797", "comment": "Malware payload (SnakeKeylogger)", "value": "ff1004a84cdfa1c3fd74400ca7f4cf18886796348d1df34bfc9af980429f140ad801fbc2265ed96b16dfc92f70b8fbe1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686557733, "uuid": "7cf319d3-fd36-45e9-9009-07cfe298de31", "value": "T14A739D42E240AC56EC134A71B469CD212723BF9A59A0CAD7254EF05A4FB334336F795B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686557733, "uuid": "357bfccf-8eee-42be-84b9-933c892b32b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686557733, "uuid": "3b0e672c-5996-4efe-8885-dcaab3f1334f", "value": "1536:Ua3eJtxKnsYsEMINcTa7FFrj3Pxx1Px90:Ua3ez4sKNykrjfxxpxi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686557733, "uuid": "44b8d6dd-20ee-4086-a8b9-ecc084ba7e9b", "value": 73776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686557733, "uuid": "8a329461-0871-4e98-bce0-63657fc37871", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686557733, "uuid": "41e74cef-0945-4dec-ae17-eeee18f20898", "value": "Payment Receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22669822-0913-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1686568828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568828, "uuid": "c44b91db-8545-440d-b53e-14af88d5c3fe", "comment": "Malware payload (GCleaner)", "value": "2dd8503441565dcd34c5522895785ed8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568828, "uuid": "b01dbd5f-b462-4048-9983-c752c7a223a3", "comment": "Malware payload (GCleaner)", "value": "0fdb1fdf6a1aaad1202492abe253758a4711c55de6db3ed52682dc77a7bb53c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568828, "uuid": "231456d0-5649-4968-94fa-f0dca12d5306", "comment": "Malware payload (GCleaner)", "value": "3ec3f09583138e1029bdb534c882a1fea7807863", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568828, "uuid": "efc7aaa0-07a8-4f74-9dee-e3b0f05875a8", "comment": "Malware payload (GCleaner)", "value": "a3fe008e5a5f9a6d810393feaadf315f4a5a0d7b71366c9d61ca47c8ecc47efaf02ae3ef022df200fb8aff16d2de9ade", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568828, "uuid": "83a5f5bd-64eb-4634-9f5a-dc63c16f282f", "value": "T18B64D01039E0DC31EAB665348831D6A5267BF8722934D58BB2B83B5B6D333C26A71357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568828, "uuid": "de766ecc-8c3d-4e00-b16f-364764fbba6a", "value": "3fa0d4fa381293581a648748e6290804", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568828, "uuid": "707311b8-e3e3-461d-af94-bb3190e83a46", "value": "3072:FsT8xXWgRvaBEDqRMnIh1WVIt0aA8kJ9alon3ZxO/9FtwH3FXYHs2tTRE+LvoYXh:yA3aBEqnh1WVkRA59almHkF6FM7Lcl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686568828, "uuid": "94307537-7e14-4f48-95ac-6a38f6fc57d7", "value": 323072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686568828, "uuid": "0dadca29-679a-4a11-9801-992cf38462aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568828, "uuid": "7a88777f-9ced-4575-b90b-5a6d5bbfd8ca", "value": "2dd8503441565dcd34c5522895785ed8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5bf390e-0936-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686584161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686584161, "uuid": "68ce52db-ca21-4bf3-bc41-77daf7a7540e", "comment": "Malware payload (AgentTesla)", "value": "b822ae4f9ecfc11d2646ba3eba457941", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686584161, "uuid": "0e66cf7f-778a-4117-b459-75ca5a8ccea4", "comment": "Malware payload (AgentTesla)", "value": "128b4d5b46b29d5a788f28a9059f7ad139afea6a686eed22acbf05e33ecab3f9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686584161, "uuid": "8a5accbd-4f59-4759-b3e4-0e5b3f0b4ad7", "comment": "Malware payload (AgentTesla)", "value": "e31be0515028db5bce9d033c179506aef922edc8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686584161, "uuid": "29fc7ee3-2739-49d8-90e1-68495ac9184d", "comment": "Malware payload (AgentTesla)", "value": "f0a1d9fc24e097280dc635b540e5abc089a0c783f5996a90c1c79c4e7d10fa12f9604239e4421c72cae510e570f5da3c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686584161, "uuid": "fa65b65b-e5b8-44ac-9540-f7b9d082df90", "value": "T1C3752202BBC144B2D0621D325A7AB710AE7DBD601F718ADFA3D17AAC9D729C0D6317B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686584161, "uuid": "c3e2209b-5d30-4581-add7-b4bcc92b17f1", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686584161, "uuid": "c3bf863c-b6e6-4506-959d-838ac5051824", "value": "24576:wTbBv5rUk0FHSWn+CBcE1lme7B2uC/EZQ/J+4k+lCj4bDtlKmoGusfdpizjnu8yT:iB3ayWn6E1V7snh+KlDtlKCu1u8yT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686584161, "uuid": "8bcf9aca-1911-4018-855d-bca807c6fa43", "value": 1641349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686584161, "uuid": "35507cd3-d459-4ad2-b579-4e6031947f8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686584161, "uuid": "0e8c129a-c668-46d2-8771-d543fcd9826d", "value": "INV67758ASP1 and Bank details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bceb30c7-0904-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686562644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562644, "uuid": "0ad511f8-f157-4de9-ad4d-9d46a9cd97af", "comment": "Malware payload (AgentTesla)", "value": "0d2515ad9092bd07e1bc20bbd8edc76d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562644, "uuid": "25598dec-a1b1-4d0b-8c6b-bf629e2c3cc2", "comment": "Malware payload (AgentTesla)", "value": "12bf15f7a36dde34a0ab6dde0192fd9769c68e124cbedf9a08bf9a2930ee2b9f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562644, "uuid": "12f7067a-c9d1-40fe-a7f9-ce58d1e3f3ef", "comment": "Malware payload (AgentTesla)", "value": "b482050f576680f123abe4fbeb74ccb0e7ee7d8a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562644, "uuid": "d2a04c04-8237-4ab4-913d-c2b51a7fd057", "comment": "Malware payload (AgentTesla)", "value": "0af2192a0003400e50cc596fc2a7fa8afb9fa5d10f9146b9d9c16221b51468298e5c530b97c6e6793bbefc4d9bb6025d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562644, "uuid": "c585bc84-1a7c-4f82-9f19-9952ccdcd855", "value": "T164F402593AFA491ED29A7FBC1D1001B0C5F86D4A3627C38F5F5BB85E8C95F400E81AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562644, "uuid": "a3f04f97-8c8f-4b6b-99ce-c6c082775f89", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562644, "uuid": "675fdf54-e5f1-4d7d-b234-2b8b248bc574", "value": "12288:huCas/16/YHmM9mARLAV+/32672M4lS59/kYWJv98RzvbLU7rEQF4nDg3i+nBhxK:hks6cV9mA9ImkM4MkTJFCzjLslm+9k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686562644, "uuid": "e1a61238-5f73-4e12-92b0-67b82f39e922", "value": 760832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686562644, "uuid": "f76d9dcf-c778-4c55-876c-8c1355aff7f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562644, "uuid": "6b53961f-db7b-4bb2-8d27-9657da00dab7", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23061a58-08ec-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1686552078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686552078, "uuid": "d3cd4001-638a-4143-afb9-ea3580aa0fe9", "comment": "Malware payload (GuLoader)", "value": "b55075639589c8276f8b57c6e945b28d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686552078, "uuid": "baa06bcd-5cea-4a63-a0a7-cfdc57d9d351", "comment": "Malware payload (GuLoader)", "value": "1345cedf79ce0d8f9787ab89aacd9b412fe34d27ad8ff5477ed08c1128c2b63d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686552078, "uuid": "1603b299-a62b-4a67-887a-86ee0554d15a", "comment": "Malware payload (GuLoader)", "value": "8445894022ea25b571dd7fce0581658674bbaa11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686552078, "uuid": "d782790f-ea87-406b-85e8-e68f1fe899e5", "comment": "Malware payload (GuLoader)", "value": "e1e20bc2de275a4713f7073e5bb08fead7ea885647f002a11a7109856f2f2350ecdda6140e03f3f943580e4d096d96a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686552078, "uuid": "c2053f87-5374-4269-9673-a8aa858f4425", "value": "T10994F101BB60C093C8540632D8F6C2B9963DAE655A33071F3BD4BF2BFFB21D15669259", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686552078, "uuid": "b4064496-fcf7-4b8e-99b7-532fdcebb5d9", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686552078, "uuid": "df135546-2c46-4b2a-ba55-baa92d7bdf73", "value": "12288:fcm9MT6gKlnrMY8ZkmznN83RMtWW5uRKxbl34H:fvMT6g+rUt+3oWW5IqQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686552078, "uuid": "cfaa5d50-f68a-40f6-bb24-e39f0d5cd31a", "value": 428480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686552078, "uuid": "a59bc78d-1482-4ae3-b1ff-1eabdc3d9454", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686552078, "uuid": "8246f62d-66d9-4178-8525-f7019eea57fe", "value": "Barkkners.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bda1427d-0936-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686584120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686584120, "uuid": "44216e47-b415-4284-bab1-c2c97434a5aa", "comment": "Malware payload (Mirai)", "value": "7ad4e36b1ecdc4e6c832c5ed580e73c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686584120, "uuid": "2a0d6240-68eb-4af1-9802-f76c6e072e1b", "comment": "Malware payload (Mirai)", "value": "144c69fe5648fa8000327f87e44ca093fc4e67482d3781f702aa95c8ed29260a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686584120, "uuid": "03d3de08-32bd-4f1e-ab42-dddcbea2a824", "comment": "Malware payload (Mirai)", "value": "3933b4d28da262637c30ebe7da7fad660b40cc0f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686584120, "uuid": "2d9b136c-0b43-4636-b8b7-419d9853acfd", "comment": "Malware payload (Mirai)", "value": "994986179b14930112eba9d2237a9444a2cf55e67bef8004f94fcf9ef86aeaae8851192bf1a3130f26d907ce9d5f4040", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686584120, "uuid": "97c6fcb7-8345-4b71-8105-d7eab33933f8", "value": "T1D2F31956F8819F15D5D112BAFE1E028E33131B7CE2DE72029D246F247B8A9BB0E3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686584120, "uuid": "6f521561-614e-4712-9d33-9893562acb6f", "value": "3072:y+MSlfcEUUq6aLXo5IpxrDVavRnvDq2i2Org8Ci727:y+nnkLXrpZ5a5vXi2OfL727", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686584120, "uuid": "d4b7030d-102c-4d5f-8350-987a84056677", "value": 159612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686584120, "uuid": "b4eb2d77-71c6-4313-a893-520830abdb99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686584120, "uuid": "22f67bcf-e921-43f8-9d86-38273e249991", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b7612ce-0903-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1686562159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562159, "uuid": "0d5ea881-ff86-43a3-bbdc-8a1d44308190", "comment": "Malware payload (GCleaner)", "value": "7a321610970cedaff940d92fdf5fc634", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562159, "uuid": "0707a6f0-547c-4395-b65e-9048783d562c", "comment": "Malware payload (GCleaner)", "value": "148b786875a522315116536e6cb4c3564e7e631c44f401a2ac51ac4ee45ded1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562159, "uuid": "372cab98-4f43-440f-af47-494142ead34e", "comment": "Malware payload (GCleaner)", "value": "2a94702f132e1e6d62dbfdf56b1ee8f20b24f834", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562159, "uuid": "69a6c61b-ba55-4292-95c0-25a72128ed30", "comment": "Malware payload (GCleaner)", "value": "350860c63bcd745219a6c4b440a04cd92de0c5b8b61950c8e5ad9c24f00527553a0ca84edcaa5ca2e05977f46fed598f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562159, "uuid": "3c66e529-3080-47af-b460-cab4d26a2140", "value": "T1CCE5122221A37329C1C252395B04C075E7E9CC24663AC92D67F1FE3B777E3A3059B56A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562159, "uuid": "c4830d76-854e-4d1d-8e43-8a6c4ccf49de", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562159, "uuid": "c51b16e7-89ab-4cdc-95f7-c9b602b8cf30", "value": "49152:v6drJkttttt1ttttt1tPqVFQttt7KuwFdr/SfD9dM07jIS2ABuS/NCDT/6LcQJ6u:ydrJ8qVFYvEqfD9K078Xku9T/Yc2OLYH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686562159, "uuid": "4b09b1a1-fc6f-40de-b65b-f2be8b2b4481", "value": 3102382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686562159, "uuid": "a6efdaaf-5b44-49ed-bef7-3979637a0d4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562159, "uuid": "5ab06833-d97e-4cc6-ad7f-caf24cc92409", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecbaeb17-0967-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686605245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686605245, "uuid": "04f5fc00-2c47-4ad3-815b-7456e73a6c6a", "comment": "Malware payload", "value": "2aafe032ccd444188c61238a7e665de0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686605245, "uuid": "57bd15b8-45f6-4e5e-8aee-b37a32016688", "comment": "Malware payload", "value": "14f2bb023e9829a0209141759a88126d346f3bf1121c5c400d8719b060ec8cfb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686605245, "uuid": "61a59340-0a8d-4202-b114-1aad2b06921e", "comment": "Malware payload", "value": "20845d8e9c7a580a0d0747046b98f884e7152380", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686605245, "uuid": "364206e4-7fe9-4214-9c60-c43d8593695b", "comment": "Malware payload", "value": "d61287d5c304fec28c9d55e66636334321db3c5501e92ed5877355714e9a0822a07e41ac6a92a63fcbe92cf7a9ebfa60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686605245, "uuid": "b6c501ff-49c0-47e6-8e96-670b7997396d", "value": "T1CDD50121B29BC523C56E01B2259EEB6F51393D764B3914FB66E83E6F19F04C21332E52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686605245, "uuid": "667d4b0e-4125-4adc-9cf4-340875f99fe5", "value": "d90acf8bf9822f2c7749a773329c6e8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686605245, "uuid": "ce6136b7-ef0b-4658-bcd6-aa218897dd14", "value": "49152:fCnZ5YeC0e32WlWa03UZOAibh8CyNb6TKGWeaJmVN7jizoL5laI3x:fC7/9qzlWa03UY8C49Uz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686605245, "uuid": "54ddb02d-2bc7-47bf-90c5-eee198214876", "value": 2994688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686605245, "uuid": "310ce875-67f8-408a-8b27-222ad91430d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686605245, "uuid": "536786d5-7cff-4775-84e0-05b00d199712", "value": "SecuriteInfo.com.Gen.Variant.Barys.434263.28885.16557", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2396afa-092c-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686579914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686579914, "uuid": "9107c269-fdbc-4f57-88a8-1377fb720039", "comment": "Malware payload", "value": "aee171c2fdc59f45a11ce08b99be37d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686579914, "uuid": "dd683287-2c5d-47ac-9190-8b667990ce3e", "comment": "Malware payload", "value": "15001c81bd129a35ddfe7feb093716be1407479ad9a2b7c8ce42b9267ae270e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686579914, "uuid": "e711b246-ad8f-40b1-83d2-977e0dc71d74", "comment": "Malware payload", "value": "ed94dd89fc6f796c70c2833773c6f95cbdc02e89", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686579914, "uuid": "633c6d6e-90ae-4a7f-8e04-ac58d9138de4", "comment": "Malware payload", "value": "3f3f323005664ab50426601272b2f7dc821d962afb59d4c0b6b0bd9fab0518f3a6dfcd164cee471114bda74cc8a6cd28", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686579914, "uuid": "a4d31914-15bd-4e92-925f-e2174d5545e6", "value": "T19833B50ABF11DEB7D85FDD3745B98B4120CEA4173298376A3A70D52CB62B14F49E38A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686579914, "uuid": "eef4f074-fbab-47d9-9390-3856978d13c3", "value": "768:RLsb8frXNe5g+FRefswjyBsG/xepAe9peGZySe7NXiTAZQ2NUD2+SKW+:RLa8fTNezCsweOG50AQpVIX02KVSV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686579914, "uuid": "8c484aab-db87-41c8-9308-d7cce2dd9c26", "value": 51224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686579914, "uuid": "02126b08-c8e2-4f85-80d5-92e9e1c72228", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686579914, "uuid": "bb583eb3-f392-4003-890a-81762d066b46", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf2adce6-091c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (PureCrypter)", "timestamp": 1686572956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686572956, "uuid": "d02dad1d-59a6-44cc-aa56-6df6ef9fd66d", "comment": "Malware payload (PureCrypter)", "value": "7645321be99ddb26fa2ac770b5767368", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686572956, "uuid": "d8edaeb0-a202-4248-9366-e2d375c8a029", "comment": "Malware payload (PureCrypter)", "value": "15144f4c94fcf98feb2f6316930c474710783c27acb9a030ecd78ee440f035a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686572956, "uuid": "c3d21d56-d43b-45e5-a477-f0331211d80b", "comment": "Malware payload (PureCrypter)", "value": "0ffb01836e0242028b83ff24355b4347badfce7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686572956, "uuid": "f789746a-9e37-4c7b-99cd-6d87d0e37482", "comment": "Malware payload (PureCrypter)", "value": "0e0edf627396bd9dc51833fdc0442a61f9ec94d25cb3ff34b5619c268804ee55b7483d13e146233e3c526f8739e1b75c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686572956, "uuid": "15270e4c-08b7-4d23-ade8-6cb626148509", "value": "T19B621824A3ECE2BDE8BB42778DB3D6944734B6935407CB6E19E010679C836948F513B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686572956, "uuid": "e102a202-f0fb-48d3-b1af-86d72e614724", "value": "192:83GTGf4LBUO93t8OmihnnBVZcsa2pC/rkQJqauiw0/4VokwTcE/stWzSXgcCpBbs:Qf4pnnBVqsa2pCbGw4mklZUzm4LxO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686572956, "uuid": "f6ac3a9f-8066-4488-8551-46ae3b4f895b", "value": 14848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686572956, "uuid": "1ba4a8d2-0b42-4f97-a978-78c79599e344", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686572956, "uuid": "c37a5b84-8f60-4367-bcaf-1dae9ff9b1d1", "value": "IMG-20230608-WA000543845821555000483.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3243136b-08bc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686531488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686531488, "uuid": "0faaff96-cafe-479a-b0fc-28d966fa4184", "comment": "Malware payload (RedLineStealer)", "value": "5d711680ae7ed736fb0312adf1ed239f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686531488, "uuid": "87bbd4b1-705e-4a25-9c76-8e7d29e9c6a6", "comment": "Malware payload (RedLineStealer)", "value": "16db65045055e8e0248a6ee934f541b1b1d6b31813a97a5c25a065d03d35cbb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686531488, "uuid": "4dc59e3e-5982-4182-8729-36d78e5b6803", "comment": "Malware payload (RedLineStealer)", "value": "e37ca79a0098b3024d340074382dd08089791c6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686531488, "uuid": "bf5fa796-c100-4ec8-9cfe-289e956b8f17", "comment": "Malware payload (RedLineStealer)", "value": "904c787a9cb6bbbcd6b4551511b44e7f5526e29fa73539d985055b43de57d6fb5e0e65f9d0f204bd3f75a217f5c32299", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686531488, "uuid": "0ea40ffb-f8d3-4a05-97ea-8fa953c7505f", "value": "T192444A39D8209928EA4E7FF08BF7DB9928596E6007080587BE4E1E518F5FFF41467293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686531488, "uuid": "159d9a40-4347-4a1f-a2d2-609d7653b358", "value": "7b9f66d4832876035770a6addf78ddba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686531488, "uuid": "44f7f975-c3da-463b-a4de-ac87fc71fcf1", "value": "6144:QFi4dXME9CNp5KZ+BL1e17zK3SXzGZqYB:QBd/Cd2+BL1e17zK3SXzGZq+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686531488, "uuid": "f956200d-b87e-464c-b24f-9c5f151bed3a", "value": 257520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686531488, "uuid": "bb4b837c-3130-4208-b01c-b80fb6d00eeb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686531488, "uuid": "4db7fe12-e3df-4771-9d2c-c319c3c413b3", "value": "Universal Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c9d12e5-0902-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686561678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686561678, "uuid": "115213e2-b871-400f-b5ab-065bd5f7cba2", "comment": "Malware payload (AgentTesla)", "value": "36023beb5907f7fb868ac4f7364c3ea3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686561678, "uuid": "f439c962-0dfe-4950-ad1a-6be303ba1af4", "comment": "Malware payload (AgentTesla)", "value": "18729fe07a8017475fe96cb1c3975076929c8e1c1c5226da9c43a193bddaa25c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686561678, "uuid": "10f8ed35-5ad3-4129-98cb-dd44825892c7", "comment": "Malware payload (AgentTesla)", "value": "dd85da701f905cf22f309ee944b8da168e2c78c5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686561678, "uuid": "983b5aa1-2a1a-4eba-9ab3-e9e8c7934bf7", "comment": "Malware payload (AgentTesla)", "value": "cf1715c5113d51619960890d0299ef93d2ee9d9086992df2d018f3a3d0aa9ffa7d3736a3b58250c3d93d2314927fe093", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686561678, "uuid": "179eef10-1834-494c-a9f5-4ce32a4b346f", "value": "T1A754230FAE8FB87BC5657F250386F65D1E20DDAF2C3CD5EB850C4A2B0C505A1EAB1685", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686561678, "uuid": "5350b73e-fd02-40d6-8ec4-0eb373730d20", "value": "6144:I5E/91VD2LnN8pD93krXh2m1I0vwhoFNl+93NZHAtyZIegxSs8/nYYk3vCv:wE/91VDiN8plWq04hsIBVg8smnYY6Kv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686561678, "uuid": "937f5a4c-5fa0-4d86-b889-e2668dbfe283", "value": 296665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686561678, "uuid": "fe665994-9dd5-47bc-adb0-a1d427b2dd2e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686561678, "uuid": "05828c80-3ac5-4571-baec-6ffe30f4c097", "value": "SOA-March--May 2023.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6372ba4a-08ec-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686552186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686552186, "uuid": "97d89fe2-e2f7-48d5-874f-8304020a4365", "comment": "Malware payload (Mirai)", "value": "b6d09aa3cfa75b4c26fb78614debd7a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686552186, "uuid": "a344eb7b-c471-4155-b6db-55e5c26b052b", "comment": "Malware payload (Mirai)", "value": "1886e3db24e5977949b2accf271ff98ead92b858140a4c1da8af02ec43c6410f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686552186, "uuid": "b2061de1-0590-4078-91c5-135b47093c2a", "comment": "Malware payload (Mirai)", "value": "a07183c9398731e26c162a5629222ac884a43e3e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686552186, "uuid": "8c54de9e-2ee9-48e7-b200-8fb407d5dd06", "comment": "Malware payload (Mirai)", "value": "17cfcd4ab34e844b57d827292a2a068c235ca260697895af36d670f2a1fbfaddbc6bdda0b22284be4dbf4b0a5a2c9215", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686552186, "uuid": "819985b2-ea64-47db-bcaf-dd7c43cf1523", "value": "T137C319C39A927EFBC1C6FAF856DAE11459E3F8341773024577C4AEA5662EDD8290C308", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686552186, "uuid": "59fb7906-c8f2-48ec-baa6-2c60e761cca1", "value": "3072:JaMx+XprhCpn3GUhP5yiQD8DrvEhsIl6jeLq:iBE245+ovEhsIl6jeLq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686552186, "uuid": "4cef8ca5-6608-44e3-a030-52a66b6f145f", "value": 119922, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686552186, "uuid": "9b5dbc14-5af1-451f-ac87-248702c77fd7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686552186, "uuid": "e768c97f-8f4d-4261-8518-55402ef18a48", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f9b9e35-08f2-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686554703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686554703, "uuid": "32565fb5-857a-4ffe-ae01-db0d52ad6c08", "comment": "Malware payload", "value": "06738ce42a435767f661f1c6bf476e10", "object_relation": "md5", "Tag": [ { "name": "recupero crediti", "colour": "#F6A0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686554703, "uuid": "224eaec9-e172-462d-a7fd-fd0fc2b6432f", "comment": "Malware payload", "value": "1913b3ad60d6ccfcd7ca1fefd45cba0ce6c2bbe857ca9c21820cf6f2d687961a", "object_relation": "sha256", "Tag": [ { "name": "recupero crediti", "colour": "#F6A0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686554703, "uuid": "974ede28-1b4f-404e-9c52-eb4f05f90adf", "comment": "Malware payload", "value": "bbf069282b772c2eeae645b167b74bad665de80d", "object_relation": "sha1", "Tag": [ { "name": "recupero crediti", "colour": "#F6A0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686554703, "uuid": "79fd96de-9d4e-42d8-a713-21bf3dcacfa4", "comment": "Malware payload", "value": "0997b3738227c0175fc80c2e7b853763771d7da7b08828c4823f3665f7f9c5570519605b998094525b06823585bd8d60", "object_relation": "sha3-384", "Tag": [ { "name": "recupero crediti", "colour": "#F6A0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686554703, "uuid": "7443486d-4e3e-4b25-8594-15736ab46730", "value": "T14625ED4954A8130EC2323BEEAB6D34D2C3709A1776F9C9E3859DB7A2DD5DC368B70424", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686554703, "uuid": "d6deb58f-8422-4341-ac0b-b88e6ead1ad0", "value": "12288:LKAl2RvJjQedJjgLbpL36scEjB1/pzJxEQvn0MqCY4HZ:L02evc1dJOo0C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686554703, "uuid": "b4e9d0ae-8117-4757-a9ac-5ac977a01c7c", "value": 980675, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686554703, "uuid": "97580220-0223-464a-a7be-0a82f338c298", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686554703, "uuid": "6370810f-db45-4c61-9356-6464cd67efb6", "value": "KVORNH", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "941143b7-0928-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686578038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686578038, "uuid": "8669425e-4621-48d3-b242-762251860240", "comment": "Malware payload", "value": "10f628772732f648da5c2a71bf4c8c64", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "recupero crediti", "colour": "#F6A0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686578038, "uuid": "383ee46a-e727-464d-9922-2916b45712da", "comment": "Malware payload", "value": "228d9029b3a721cbf58f6023c9a1808d09c951793d178fbf95a9ae93fe49a2e4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "recupero crediti", "colour": "#F6A0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686578038, "uuid": "f76b7944-821a-4d8e-bcd1-4ea139eb15a2", "comment": "Malware payload", "value": "6b4089211a01f91e668c7b36795c72b0e40c79d7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "recupero crediti", "colour": "#F6A0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686578038, "uuid": "04d34990-83bc-42e8-8ed6-1585005eab5d", "comment": "Malware payload", "value": "1a995847171450eae2a49e25af72d4c08652e44d5337eccea4f93ec627c6af725e17b725159b95f23b6057823cc539ea", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "recupero crediti", "colour": "#F6A0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686578038, "uuid": "7b5f9032-1aba-4425-a24d-c55da288e8f9", "value": "T13F25FF4954A8530EC2223BEEAB7D34D2C3708A1776F8CAD3859DB7A2DD5DC368B70424", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686578038, "uuid": "83903e39-8394-4e45-b375-303aa22e0991", "value": "12288:NHnVPnkEnwPh57N1xs5esUbYlFi3CYTaU:T6c1FA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686578038, "uuid": "382e40e8-2450-48df-92bb-29ffda2fecea", "value": 1011740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686578038, "uuid": "8ae1104a-242b-4ca0-b4ef-d1c246120473", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686578038, "uuid": "758acd93-ef01-4839-828c-9a3678793ea8", "value": "fac.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "764650e1-095b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686599892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686599892, "uuid": "f7dc40b4-8249-4e1f-b310-ae57eb55fecf", "comment": "Malware payload", "value": "33c4b300b3227be91f01df5b9325dff6", "object_relation": "md5", "Tag": [ { "name": "ConnectBack", "colour": "#9A8DB1", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686599892, "uuid": "5bae73c1-84a1-4690-9fd5-3f435eb7e80a", "comment": "Malware payload", "value": "245f3ded62fa5314772e9514ba92b0b796d78a5d123f11e773837d599389a15d", "object_relation": "sha256", "Tag": [ { "name": "ConnectBack", "colour": "#9A8DB1", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686599892, "uuid": "aacf0f9e-7a9c-414f-bb03-0b6130c81d76", "comment": "Malware payload", "value": "e97e7bb3b2329453425d6ae469880af2d029ffc4", "object_relation": "sha1", "Tag": [ { "name": "ConnectBack", "colour": "#9A8DB1", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686599892, "uuid": "59e729f1-3780-4a09-8bbe-f9e6bda1c022", "comment": "Malware payload", "value": "8896ae83dfd497ae853c246faed510df8114c07c438fa3480871100f6b81e311cf022e70736c7016bf73e9027cc2c5d9", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectBack", "colour": "#9A8DB1", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686599892, "uuid": "fc4918f1-1ce6-433d-9a3e-711138847d8f", "value": "T123D080330F4A81DED6D4123F5574597CDB7B967B474C72310854DC011C596446F62D76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686599892, "uuid": "0f32dfe6-534e-4f39-8d3a-5d517ffc7f1c", "value": "3:Bnks//xlEldl1llXllS/rltll3llvlfXwvlltPNTSiPHZYC1E3aBFQqoRQC+ys5t:BnX//In8/r1GBxH2TGFQ3RQdygg5XJYD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686599892, "uuid": "415421b4-0a93-41f0-a4c7-caf0b89205e5", "value": 250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686599892, "uuid": "1bd2ca91-0544-434b-b66b-fb8b5305e202", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686599892, "uuid": "4f3970bf-148a-4d43-9024-9d1268506963", "value": "shell-x861.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0e7ac83-092b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686579375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686579375, "uuid": "e6b00a22-cb33-4a05-9485-184a60ce4899", "comment": "Malware payload", "value": "a2f561bf8d035bf35aca82ee0b2dfc30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686579375, "uuid": "dc53eb6c-1b1e-4b33-8a4f-03bb9a082004", "comment": "Malware payload", "value": "276b9209b19b7bd667db680c848a51b569e7a9969bab886aa5a710ee3664be01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686579375, "uuid": "dae08b5b-d7a4-47fc-adea-b5e504268260", "comment": "Malware payload", "value": "887691c605371448008f6bf682dc996dc0eb78a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686579375, "uuid": "337e52ce-65cc-4a0b-858c-78e9271b174f", "comment": "Malware payload", "value": "88bdc972c18846c04cb1608b965c1d9876cd8b548a105674a1c41cb8b93e4632cba7d27f55f5288ab8b37f27addef138", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686579375, "uuid": "a8c00729-4c06-4007-8072-4cdfcb82b4ca", "value": "T175F4338C03B6A708ECDB6811F8D51ECC99E2FF09290953D9AA4954E8C9CB757D4F388D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686579375, "uuid": "f45e2258-4a8e-4504-8aef-0a1d2edf7138", "value": "12288:CisX5calKTgT2/4GeAh8VUvoryik+LxNdtN8MdCW42hqmrUPGEU9eXae9m+pMhe9:CH5caJvGbh8xryiDNbOXW42hq9eA9TME", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686579375, "uuid": "e435ad61-8b6d-450d-9e92-af2dd14b4fde", "value": 776710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686579375, "uuid": "2bbc6c02-978e-42fa-90d8-6b728f6c4044", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686579375, "uuid": "e934772b-29ad-431d-86d0-975eec05f936", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c486279-08eb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686551772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686551772, "uuid": "8ae67c91-a8d2-441e-8e47-88e3e0990ea4", "comment": "Malware payload (Formbook)", "value": "c231dfcfdf5586a87d731f2c29695113", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686551772, "uuid": "99fe0120-6314-4453-a213-71baba088efd", "comment": "Malware payload (Formbook)", "value": "2a187cdbf09aca5958c000b39783b1974b3493353853d59461175826852bd4d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686551772, "uuid": "075eba51-7c91-4d06-b503-04a101c530b1", "comment": "Malware payload (Formbook)", "value": "eb2e81523f80c6e1058eb83525cf480d1400d69b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686551772, "uuid": "0789376d-8544-4a56-87e1-f33abbc48693", "comment": "Malware payload (Formbook)", "value": "0a614a81384a0e749fd6104cab689c113ed17842869bab20c1d22f55b18681cf8d85e69778da9a6b193b746c19271740", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686551772, "uuid": "4e67c5a3-028a-4205-9f21-94393dfa2c2a", "value": "T1C405011873EA841FC26F3BFC1C646171C3F4A5527163CB9F9E46A9CCCD91B688A90693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686551772, "uuid": "4b828c71-2457-4326-898d-ff48225e86cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686551772, "uuid": "53061c33-5dc9-4bd8-b389-f184eadbb1ce", "value": "12288:OoAcuF6mn1DHLZnvJM2iOe42KMu/N3mWhQmwmJCMpUMmr626nZ72xLVgi5n9Fu/i:YiOV/NOaUr0ELVgOn9FuQnvonzBEJBx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686551772, "uuid": "05e41e2b-a500-4480-8850-27b5b3d698c8", "value": 821248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686551772, "uuid": "a1fa3742-5ec8-4fe5-91ae-9147fdad841d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686551772, "uuid": "7ad5f39f-5244-4299-80bb-6f84ef9f79c0", "value": "PI INDUSTRIAL MACHINES PVT-pdf-.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3cf771e-092b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1686579353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686579353, "uuid": "02bb8ddb-00c2-4a05-99d6-0f8a691b7b0b", "comment": "Malware payload (DCRat)", "value": "3a68a2cbeb827588f3749568b121a79b", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686579353, "uuid": "84e77529-6edf-4817-9c74-57af90f88e72", "comment": "Malware payload (DCRat)", "value": "2ab209c8b13fc820c0f2cd15de422053e94e2ca02b939ff97eeb2abceb5bb810", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686579353, "uuid": "fb225e37-44ff-4601-9f0b-6d09b6729504", "comment": "Malware payload (DCRat)", "value": "a40fc3b0c547826353088baf247b379f1e10f25d", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686579353, "uuid": "8dc4e1a1-866d-47b3-a9a3-73087570ebd2", "comment": "Malware payload (DCRat)", "value": "9924fedfa8509dedeb8cd11e161a2c3165fb5f450c8747ecdd385a26da6473b2940335e04056a88b1d0a4376ad626e33", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686579353, "uuid": "556d7914-f11c-4c9f-93ba-c0a5b90364bb", "value": "T1E115670715256B17D4926FFDC9A132A2387C8A64093AA0F797763C1ECFAE3D1163923D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686579353, "uuid": "36a49478-9a29-4940-84b2-8bb8b4f36bc1", "value": "836daea6dc0c0e58deaab2b0e9ca3107", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686579353, "uuid": "4ac91fce-0519-4a0f-9603-b7fc48ac928c", "value": "12288:x7Gmaojeh4hLyhLk9el5ih7XrIqEMbs0qFvPrVc8Ml1T5J4rNl99uF04r4hZZ1v6:MTMYP2tP4CKdKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686579353, "uuid": "6ec931ef-b6fd-4dd1-86ed-aa090333ad89", "value": 919136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686579353, "uuid": "654eb452-baf4-4d97-b0d5-d83e0944861c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686579353, "uuid": "f487f6f5-89ac-4c5b-a4c0-0493b2a9b4e7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b316607-091a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686571956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686571956, "uuid": "aff96d43-5a44-4876-946b-b034f839b39f", "comment": "Malware payload (AgentTesla)", "value": "c78dff796b8db5060a32c5e514bd67f0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686571956, "uuid": "465b3e63-9576-4d2d-88c1-bd5e0dddbb17", "comment": "Malware payload (AgentTesla)", "value": "2c297ee99f448a8dab452f6317dcbfdb9510ae07b70fd6baa486ff46c0fe507c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686571956, "uuid": "c4b79d5e-63c0-48f8-b895-4ae3bb4fddf4", "comment": "Malware payload (AgentTesla)", "value": "3f4eb58e8c2c04edaddebf9385088b760c5afa5f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686571956, "uuid": "a8668767-0687-4221-9568-cb96f0724c69", "comment": "Malware payload (AgentTesla)", "value": "facbef8b9fad16c4806444100e796104cbd815d47baeae900dee8ad40352add5ec484d8d09a2f050976ebf021a0f690e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686571956, "uuid": "82b1025e-50e0-499b-9f8b-353e492d2ebc", "value": "T12B0563BC298075ABD775DD6281D208DBF23B2B17B2139DAA21D237D2562150F37EC90E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686571956, "uuid": "6ca21b56-fddf-4d50-a288-0d1b675ce33b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686571956, "uuid": "f84a816b-7911-4ad9-af44-3f94b00d91da", "value": "12288:k1+SI3rP5Uo97n5gIKL88nniptda+XvXB9xLwr+:k19mPqo5wL7nivf/t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686571956, "uuid": "67cce00c-9abb-492b-8078-0c9f652a0c83", "value": 808960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686571956, "uuid": "cb212f9e-8998-40e1-a239-5eb9c29b5a12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686571956, "uuid": "0c89b4ac-d316-4aed-acd3-b3169c2d20f4", "value": "c78dff796b8db5060a32c5e514bd67f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74d84339-08c0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Tofsee)", "timestamp": 1686533318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686533318, "uuid": "f7bfa4b7-be48-4faa-94d3-3c95f8903aa8", "comment": "Malware payload (Tofsee)", "value": "de716bcd69eaa397ec668a600e290613", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686533318, "uuid": "7cfc51da-312c-4c69-a7f5-dca139be7353", "comment": "Malware payload (Tofsee)", "value": "2c56b7eecbb1f8bf1ffab07fe19f92dc17f91675cf518565c67bb06af8b11916", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686533318, "uuid": "40a4f952-bac2-4d80-8d8b-c2f79841003f", "comment": "Malware payload (Tofsee)", "value": "4fe4841959d458f6389ad15767eaccaf13d013f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686533318, "uuid": "a4b68e2a-b341-417f-8214-9e6b0aefd3af", "comment": "Malware payload (Tofsee)", "value": "ea2fec72a61a4b277445b0de9e32dd02e8d0770f3e98348ac4173a28072ffbc94908ce23ea4ddbee6538ee3ee9168b48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686533318, "uuid": "48b73bbb-4850-4818-b7db-1c4f611698ce", "value": "T1FA349E117AE1C432E6F78534593DD2E47A3BBC63AA75CD8B72483B1F2D312899A61313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686533318, "uuid": "46b2aa73-e4b2-4129-8ae3-4e817d504d0c", "value": "3fa0d4fa381293581a648748e6290804", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686533318, "uuid": "43c3fbe0-09ee-45f1-bb64-c88af6f39783", "value": "3072:BpN/PqeipCA+QWm9coi7u7Tnt8x609HRFQ9UZqn5syBgBRe1fq3:Rn3i7eeMu7TnK5yewn56O1f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686533318, "uuid": "6bec98e6-6d70-47c2-9814-5ef842752451", "value": 250880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686533318, "uuid": "b93d4200-3c02-4204-97ff-1f790eab7a87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686533318, "uuid": "a90224bf-e504-40b4-bea4-6b5d5666e449", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e191a1e9-0907-11ee-b3cf-42010a9c0076", "comment": "Malware payload (XWorm)", "timestamp": 1686563994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686563994, "uuid": "562c7285-15a5-46f6-b9dc-f34e6537e170", "comment": "Malware payload (XWorm)", "value": "9dfdc3ea69ab6a4da0e0f292dc7d5f48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686563994, "uuid": "6336da17-7d9b-4b52-9e19-c44aca1ae734", "comment": "Malware payload (XWorm)", "value": "2e0008dddec3136ea48bf0b54b1f4908b9720e9c1651955d7d896ba09f8a1893", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686563994, "uuid": "5654675a-d21a-46e3-b171-1f25265822ab", "comment": "Malware payload (XWorm)", "value": "254f3da7684c156720b161e00bf55eb6ae3e19d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686563994, "uuid": "dc8bc9ad-c79c-4ef9-8da9-17b1c12d3deb", "comment": "Malware payload (XWorm)", "value": "2317efca0f7875aa19c89feacba309e499484d9df5f9ae99a1624ae03fa6047cfc31ccc75235923bfcb11359d5345e67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686563994, "uuid": "7fa6fd6f-525f-48f6-91aa-e76d8bcc64d6", "value": "T1D7A4B25A0AE93C10DC9FC52DA76F7DAC4392034A5A0274A906FF4C586B396CF21E5DCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686563994, "uuid": "06e02b86-4389-4434-aefc-18058a3ea088", "value": "341ef3eec107cf8949a849080b1bfce0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686563994, "uuid": "1bea72d2-1860-4b27-87f6-4539dd173bca", "value": "3072:9Jvg7HfUQjfrnNsRgARpWOCHjkgRB+lyVaOmS41b+fc9bHcchyP/WQ+mNLylj:sjfbRiDVWjkLoafb8chqQma", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686563994, "uuid": "5412edbc-cca6-4dc5-8334-15cf5b8ffea3", "value": 454656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686563994, "uuid": "44b2a851-f85b-485c-945b-8bf078b71e6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686563994, "uuid": "ae01d313-9ea3-4a9a-9854-114556282c4e", "value": "asas.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91a36bb3-0939-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1686585335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686585335, "uuid": "8b7933ef-0170-41bc-8583-fdfc77afda15", "comment": "Malware payload (Gh0stRAT)", "value": "54da74f54571d7727d575a46364d8cfe", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686585335, "uuid": "038a32cc-872f-4e95-83b7-765b8ffb10f8", "comment": "Malware payload (Gh0stRAT)", "value": "3115da1c274f378293e579087aa2789d86c4de13f1db9f7a5b5468c55f101c79", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686585335, "uuid": "74470224-982f-425b-9488-b136e287d601", "comment": "Malware payload (Gh0stRAT)", "value": "ba680e3d604fa326b55801bc2af4667a54afbe25", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686585335, "uuid": "6d1f426e-a4c2-4186-b93e-efa3de09a503", "comment": "Malware payload (Gh0stRAT)", "value": "b3eb5e6160ba91477abb465e19bbc1698ff703a9f59176e52a3cf1f43ad099f7e064470b868022c0879d9204a5baa946", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686585335, "uuid": "7e9af33b-cc88-47a9-9fdd-00eb0eab2a06", "value": "T1B6A58D3377508876C5633230925F6BB996ADA9300B3941F757A01E383EF46D2AD3936B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686585335, "uuid": "a944feaa-ee25-4bb1-a586-77d36b8b1787", "value": "fe6c0fb6919a1760c4068f06fffec698", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686585335, "uuid": "69db6f4c-f0f7-4b6a-8559-6cb21d27ba31", "value": "49152:NCAdw0gW0dvWmWMF1CS8dqBzMAPyTTHbuEtoisshLms4NV7ojUH1uQWdOGDktv2e:pyk0dvWmWMF1atTTCEtoisshLmHAUH1G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686585335, "uuid": "aff1a0ff-d478-4bf3-8790-6db684f75c33", "value": 2144256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686585335, "uuid": "e58e28b3-3251-4f89-bda4-f7b437ad623d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686585335, "uuid": "758577c8-0bf4-40f7-beeb-d5674d5b5a5f", "value": "\u5bb6\u5ead\u65e5\u5e38\u83dc\u7d20\u6750\u7248\u6559\u7a0b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15748f18-0913-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1686568806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568806, "uuid": "50b7298e-a71a-4edc-902b-3891207c01ba", "comment": "Malware payload (GCleaner)", "value": "30f56c0e9e14616611341ce6675b750b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568806, "uuid": "4c531caf-f715-40ae-994e-55841b71ecbb", "comment": "Malware payload (GCleaner)", "value": "331477c8a32a61c122285be40eb36545d6ff48dbc7a83acce7dddb5bff636e98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568806, "uuid": "a5afc609-6424-4d6a-ba07-14e4ae9a36c2", "comment": "Malware payload (GCleaner)", "value": "82ed6dc64fcce6fc3718ba3cbc589f049dbde906", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568806, "uuid": "3833f386-5758-4e98-bd28-e377cadfc6ba", "comment": "Malware payload (GCleaner)", "value": "49eb5dedce3e4e16915d1c46111c8e66964a7f80f9bac4d81956e2bbad05770d10302217b261c016ccb4817973b9521a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568806, "uuid": "8d697fee-1d3f-451c-b93b-0cd1a6022a3c", "value": "T10554D01139E0CC31EEFB65305835D6A4267BF8B65829C54BB6A43B5B6E323C26B71343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568806, "uuid": "8c8a0cdf-c4bb-4f43-a3c0-a4871cc2170b", "value": "1b96bbe7f35030dff720bfd4a2e62f20", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568806, "uuid": "f8779dcc-ad65-4a47-81b3-f171209500bd", "value": "6144:wS6AOUKw9aLcn8BZ+Ay8Mu3XDClVB1f4t:kA7gP/BUu3XDy1f4t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686568806, "uuid": "2cf43edb-499e-458e-a3fa-c0d93998245b", "value": 285184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686568806, "uuid": "e9612b03-35ad-4e92-8229-7faf69beab75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568806, "uuid": "2d09d494-3917-498d-9231-4ef3fc037778", "value": "30f56c0e9e14616611341ce6675b750b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6663454-08bf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686532998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686532998, "uuid": "3b124bf0-75df-470d-82cb-a20a0c2f56d3", "comment": "Malware payload (RedLineStealer)", "value": "a68cf6c781f0641a46f90f74e6c3b360", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686532998, "uuid": "93d7f133-02aa-49c3-b08a-a43652f1abb6", "comment": "Malware payload (RedLineStealer)", "value": "3411be33cd514a23e0a799f888ecafdee90ebc724077e078babd340c02b3e444", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686532998, "uuid": "b557dd63-bc65-4b5a-8cc2-00459ccc7cb8", "comment": "Malware payload (RedLineStealer)", "value": "0d7afb3820972117289451a50c3265d2f672497b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686532998, "uuid": "f4e88ec9-b91f-4178-a700-ebe3b7b836a3", "comment": "Malware payload (RedLineStealer)", "value": "9ebde7de84124f9bef691e933baa5d039be59dc05a88d19c2fbc83ca8b6f2af4325bbb82985b2bc697de12eb603eed05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686532998, "uuid": "37b2aecc-77ef-4aec-954b-d69ac84f79f7", "value": "T19E74D05176B0C871E6E789345835D2F0263FB8B7A965898B31483B9FED322C29F56313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686532998, "uuid": "9dee5d48-81e4-4f09-8390-b0c19e5532ff", "value": "3fa0d4fa381293581a648748e6290804", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686532998, "uuid": "5a5e2930-bc80-4bbf-864a-402f64510d0a", "value": "3072:18d4mYAHxbyrcSBV4sKXY/eeBUaN+Z/FboDWrSYU94l0gWk1M3K34zSQReT2q3:uVdygmbCYGeB1C9BrSYq9W/T2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686532998, "uuid": "3b62843a-4e5b-4494-aef4-b3354e706ede", "value": 338432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686532998, "uuid": "06fb079c-226e-48c8-a34a-bb9967428857", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686532998, "uuid": "bac3c404-2b03-481a-89a4-4073c7322f2f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63489547-08bc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686531570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686531570, "uuid": "4f052662-7da5-4e52-89ee-21982f612609", "comment": "Malware payload (RedLineStealer)", "value": "4b464dbca0a70ddc9a357b0ddfb8654c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686531570, "uuid": "39b5474e-b00d-48bc-ba3e-2fe01257870f", "comment": "Malware payload (RedLineStealer)", "value": "34ee31adf966bf50a7fe0f897590b3002c25edc2a36f9ee70adebb7cc76da160", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686531570, "uuid": "ca2b5d73-6e64-4063-aa32-daa4788a2261", "comment": "Malware payload (RedLineStealer)", "value": "3c37e54bbc599501cc82cef5769e37125537c476", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686531570, "uuid": "d94f272f-96fa-4241-904b-4c0d031ae2e1", "comment": "Malware payload (RedLineStealer)", "value": "21754085c59766d9f4704a8b22686d7466fc2dee92013fb38c3aee8d27b038d851fde287d30bba70b80048786736f7d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686531570, "uuid": "4be99d95-4a84-435f-9c99-f536771ac94b", "value": "T1FB149EAC3788B95ECD7E887599700C649BB0B0675307FB0B848794E82E1DBD1AF552F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686531570, "uuid": "13bd09f5-8a38-497a-943b-523636768f6a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686531570, "uuid": "f1006aa7-fe67-456b-a0ff-8cb0286f23a9", "value": "3072:IfnvBpBlvYWRoixNJiLeN66TxXEcLqbQobc8qw+IMK+:Ifllposn6KXLLqbnb+ID", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686531570, "uuid": "2ef52d25-c857-4dee-95e4-911bfc7ed662", "value": 208384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686531570, "uuid": "74e86ea6-6ddb-419b-8f48-b90c8488bf22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686531570, "uuid": "70b853c9-8a49-4dfc-966f-344b9838dcc3", "value": "ProjectAspire.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02369359-0902-11ee-b3cf-42010a9c0076", "comment": "Malware payload (DanaBot)", "timestamp": 1686561472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686561472, "uuid": "4063d351-9486-4b0f-9f47-92af1fc74d7b", "comment": "Malware payload (DanaBot)", "value": "bf9e270eeb64a48e46fecfeb8804ebe3", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686561472, "uuid": "791ca89d-451e-4af0-888f-e71f599d8e84", "comment": "Malware payload (DanaBot)", "value": "362e976d80d02f603c2168e3db721989cd44171de8d8888cb384f34a8a34ab71", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686561472, "uuid": "34ccbd15-5109-4317-a9a4-2d3d932fd398", "comment": "Malware payload (DanaBot)", "value": "b920969b0de02eedf2fb66b4306ea8357bcb4414", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686561472, "uuid": "b3dfa3f6-dd13-4c3c-8444-7cbbe14fd0f5", "comment": "Malware payload (DanaBot)", "value": "58688a9c816084897469e93bb6d1d049e6c3615c23a2a7fbd95cbd80e56893090460c7b2aeec016f843283e5c3403010", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686561472, "uuid": "98090d84-d7fc-4715-94c4-95a6dfd43a73", "value": "T100544980A70799AEC8140BB577B34BC606F4DC6C55E0876F2BC9AE390EE27FD1952247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686561472, "uuid": "0542dd1c-97ea-4cf4-ac35-8b3ee77f607f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686561472, "uuid": "d8fd92e1-a05f-4eb9-8643-e20447563f04", "value": "6144:ereaqxCVBQP5j8hn+hJd5K9TXlFxyQPw27+vHQN9Zov6R:erebxeCPNCn4Ji97lvyOivdS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686561472, "uuid": "59c615b6-abd8-4ac4-98b0-ad6375d91c0d", "value": 283648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686561472, "uuid": "9ff5ad25-f745-43f0-a9de-e86106f994c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686561472, "uuid": "ececf8c4-44c8-44f0-bd34-a942501b01ad", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66ffb580-08f3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686555199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686555199, "uuid": "f8f9616d-6383-4646-a685-d99424a3d164", "comment": "Malware payload (Mirai)", "value": "07d574315f33f2b95716d6c3b48ad229", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686555199, "uuid": "a3c48ad6-6e5e-4272-bfde-e318b72dbd09", "comment": "Malware payload (Mirai)", "value": "36cc8f2ee1d904cf90af5c5fa7b7173ad8fa5e2074d82a5e396b71ae1d497f02", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686555199, "uuid": "314ccdb8-62b5-4c6a-9f90-33f8a62d094a", "comment": "Malware payload (Mirai)", "value": "ddbcb68b45b12b8af7a122b690fcbe543e7be5c3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686555199, "uuid": "75da0dca-ace5-40d2-b49e-8c25bfb57fc6", "comment": "Malware payload (Mirai)", "value": "8776fca2acd9f81d677ca927e794e5e8cafe160e57e847cb4a9ca20bc1701be5596fc1d4e5eb446f663a19e61b28dae8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686555199, "uuid": "7398ef64-aa3f-40a8-a4c5-e33ff7ac8253", "value": "T16DE31983AF12BEF7C4CBEE735AFAC70520DDA4032799632672B4CD58E61E58A04D3564", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686555199, "uuid": "c5b88be9-2b8f-4ace-8cdb-2c765b76da6d", "value": "3072:gBXfd7bW0USLLGvsiEvXMLTYvGt4zwUQtjF:MPd7b0SXGvsXokvGt4zwUQtjF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686555199, "uuid": "6e7cb396-d0f8-4ae1-8a91-488f45102a12", "value": 143819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686555199, "uuid": "2de8118a-6945-4691-b81f-f93ee6131bcb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686555199, "uuid": "e3d0e49a-8e0d-4f1e-a4ec-d21755b31be9", "value": "07d574315f33f2b95716d6c3b48ad229", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d939603e-08eb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686551954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686551954, "uuid": "2c989616-a99d-496d-b408-1632f278549e", "comment": "Malware payload (AgentTesla)", "value": "b8fe27d56bffaa847b7ccff25ff4ea17", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686551954, "uuid": "a0011c24-44dd-4091-a6a1-360892c4bbae", "comment": "Malware payload (AgentTesla)", "value": "38b7e813402447704258ca274ea142fc05f52da70913bbd3d31392a855287f8e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686551954, "uuid": "62accd15-a00d-4910-8822-f382e4a3b41d", "comment": "Malware payload (AgentTesla)", "value": "e153e10eab2cd19670556cbbf9574466ea5c9dc6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686551954, "uuid": "fd3b859d-d403-4e52-b2bf-d19613b8df9b", "comment": "Malware payload (AgentTesla)", "value": "01af0953db06c8dd83ea1752ef924efdb7f8631e46b159170ee4e96e9b3babad8661ab12454bfc87a7e304cdf35f0706", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686551954, "uuid": "c8d74356-f60d-4c29-b12e-9336716f8eba", "value": "T19B6413096FD9D467C4621F710E76D72E7FA1EC3A2878869F13480B1F7C516A2DA25343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686551954, "uuid": "54ba5e28-f488-4833-8285-4151da1c5fec", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686551954, "uuid": "b33a332e-90c6-4c4c-a822-b7de2005337f", "value": "6144:pYa6wXxVSu2LnN8p793SrXhum1I0vw5oFNl+9hNZHAtyZIegxSs8inYYk3vCK:pYCxVSuiN8p9Mi045sIv1g8sxnYY6KK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686551954, "uuid": "d5cd1f0d-39f5-4439-806b-bf4c07085a07", "value": 312968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686551954, "uuid": "5dd305d3-ca27-46cb-a45c-2e0fadc7c73c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686551954, "uuid": "9299ce65-6249-4263-bed1-cfa6e03f891a", "value": "SWIFT 56650XXXX_0716NSMI0015024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee7be6d9-0912-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1686568741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568741, "uuid": "0480fbca-aae9-4e55-abe7-0edb2017611b", "comment": "Malware payload (GCleaner)", "value": "e969c49617ff094d23c91ae23755a2f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568741, "uuid": "f8e323a5-2d87-4eec-bd5e-1decf632a175", "comment": "Malware payload (GCleaner)", "value": "3a51b888edf9eefa97a1e129bdad76858716757fa2b160b44830bdaa1f3c2f78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568741, "uuid": "2d515319-5d17-4635-bf87-72a2005acb81", "comment": "Malware payload (GCleaner)", "value": "e14bb8476e9fc7a2d96b9e63b8fbaf118546407a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568741, "uuid": "18ca0652-c5c1-4bf4-b599-942b89923b5b", "comment": "Malware payload (GCleaner)", "value": "0e0d948fee24d48be34bb093ed693f595cd5db83870dcb4432da17630345cc3f4beb6696fe8152ba1ef05f395522835d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568741, "uuid": "89bfb1e0-65c0-4f50-8580-69d0108bce3b", "value": "T13644F1603CA18C31E1FBB1344975D7612A7FB8736A34CA47BBB462695E33AC16A70347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568741, "uuid": "91d29868-6127-4573-948b-4376bfae043f", "value": "5affbd003e86f6425e6f5983fd37fec5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568741, "uuid": "294edebf-4875-427d-9d2d-f3938280eae6", "value": "6144:/QCsWKo/PPxpM68CqRyI7UE7IZsHie85SSw1pojt:ICEo/Ppy68Cz/EcZqqYSw1Wt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686568741, "uuid": "18d36a79-bc30-47d5-a0a2-8b23d515d465", "value": 263168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686568741, "uuid": "2f8ee93a-ade6-48e8-a2d6-3c18cf8e53d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568741, "uuid": "a3549fa1-0b68-4c97-8545-c90f277ea318", "value": "e969c49617ff094d23c91ae23755a2f9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93c87938-0936-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686584050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686584050, "uuid": "ea770e6a-bc87-4d12-ba5c-b6871e6a597c", "comment": "Malware payload (Mirai)", "value": "9340f7afa1b3d8d29375470779bb4f23", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686584050, "uuid": "5fb06088-d7d0-4c7e-aae5-fe31e723b2ad", "comment": "Malware payload (Mirai)", "value": "3a5dae4972df07316ed8a4dbc650dce76f784b62fd8802ce3f7cd95940bfacf8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686584050, "uuid": "602fe223-e03a-418d-95bd-41492bd8902a", "comment": "Malware payload (Mirai)", "value": "c759136b6075d79189a20d8d1aabacc8f8ed19f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686584050, "uuid": "1983fa01-06f0-4a7e-bb17-48cb1fd00033", "comment": "Malware payload (Mirai)", "value": "fe8be15d328d9196ebc187f7c9e405d319d4e02cb786f5df8d1d6a0a5bcf3d2fdda0ed2d6b1d9285bcd78d5ed8c923cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686584050, "uuid": "e94cb38f-8953-49a4-9f25-994156a0a757", "value": "T18CE31945BC509B23C6D612BBFB5E428D372A1768D3EE72039D256F24378B95B0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686584050, "uuid": "423932db-6e28-4de6-a2a9-c47a06260bca", "value": "3072:OaTEa1Sgl7JVFf/4YkPoAJzCdrxKhgId:OaSgRV/4YOoAJeEqId", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686584050, "uuid": "a81c69e3-6faf-455f-b966-d5f842306d11", "value": 150080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686584050, "uuid": "065fb4b8-15bd-4154-adb2-733121676961", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686584050, "uuid": "5f6d3fc8-c7cb-4b4f-ace4-6cd1d08da525", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbfb03dd-091a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686572199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686572199, "uuid": "05e413ce-b764-4911-aa44-a847167a8d54", "comment": "Malware payload (Formbook)", "value": "12e6bb77a27964b19155c601adbc0bb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686572199, "uuid": "2e06904a-1f38-4ade-8e6e-59cf516a26c0", "comment": "Malware payload (Formbook)", "value": "3bfdf114998cc67d1853f54e5305b774454b68fc190964a64af30048ca34b926", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686572199, "uuid": "077b682f-8fc6-4304-9a00-f7bc3bb64e95", "comment": "Malware payload (Formbook)", "value": "6e0003e1cc45f361e55f2f4f2dc98d0c72fbd4c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686572199, "uuid": "04050950-6a91-4def-9456-7ab657f23e32", "comment": "Malware payload (Formbook)", "value": "45d0fbac204ddb32f1f3260efc639942391546c981181af1889b7c10741daedbda96cdfa69b7f34d9c1e904d539d90a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686572199, "uuid": "e33f014a-7a36-41d0-8f82-cb09a312b273", "value": "T12EF4183D58BE5737CAB5C7A58BE59417F290E9773012ED29A8D323C64312A4239C633E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686572199, "uuid": "e118c70b-5ea6-4b91-8c79-2e936a0da7ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686572199, "uuid": "53ee8c39-a884-4433-8bb4-58240ab82c49", "value": "12288:+gMdFwyE/6g0Ikhgr4RXNtrdN/w0ae6GxmJeRTOeGHhp:adFwurIkhgr4drdtw0ae6GIET3GH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686572199, "uuid": "025f7439-0eca-4f32-81da-f86b93e12fd8", "value": 776192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686572199, "uuid": "bfefa72b-9d8b-4373-b2dd-fd4701f1459c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686572199, "uuid": "ef2ed42e-2506-4772-8de3-f36505c7a08b", "value": "rInquiry_1120236.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2cb3f8d-092c-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686579834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686579834, "uuid": "3d098d47-68ef-47e9-aa36-fe718c4082ea", "comment": "Malware payload", "value": "144dee3ce55633a16b535e6d1ba67aca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686579834, "uuid": "91c92886-0239-4a97-80dd-14f7af452d25", "comment": "Malware payload", "value": "3c56ba76cc5279f991278b1c60958e7b52c8a7a73c6dd244b1982dea58c92b72", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686579834, "uuid": "0f880dcb-07b5-476b-baff-0158b42d5084", "comment": "Malware payload", "value": "de07d088d6ae256f9ccde2030586099a66a13139", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686579834, "uuid": "b3cfda0f-25d6-489c-948f-f957b3d0a7a9", "comment": "Malware payload", "value": "412cd9a52b5d5d2c1a09c0651ea6d3fad52dd4cf80495792098a55cf08807ae8229cb15c679fe8d023001966052552a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686579834, "uuid": "36360392-976e-46ce-b98a-c58e2cf2881e", "value": "T18DF2E7036A41D0FDC45AC5704A6BBC329AA3757D133376897790BA32AE5EF215F3C50A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686579834, "uuid": "715c6ec3-eee3-4726-9f1f-f9d5bc515bc2", "value": "768:SLmGk0xix+bQaGDIIBsEnlZCjucrk/nO/mY:VWQaaZr0juE7/mY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686579834, "uuid": "bb878db3-67b7-4503-9a9d-cbfe8662d694", "value": 34272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686579834, "uuid": "4bb33d92-1337-4f17-9301-7c27820509d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686579834, "uuid": "7292c6d5-044b-4eba-a01d-c7f0527eb404", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8572a4da-0905-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686562981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562981, "uuid": "cd73d32e-6801-4832-a163-bd3682b5018c", "comment": "Malware payload", "value": "c45df757999bb55bc06e410d7f5e46dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562981, "uuid": "a81e6894-cbcf-4604-a1aa-dba944285f95", "comment": "Malware payload", "value": "3c7c5fb965e63d99a394d2742da9efda4cd70c4f95d68bcc67816ece7d127add", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562981, "uuid": "88176fdf-0af4-41b8-9d31-af44a2cd2197", "comment": "Malware payload", "value": "82d2f9304f3bfc7086d2f518958738e965e59750", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562981, "uuid": "c32c4d78-af42-4599-adf7-eabfbe159c2b", "comment": "Malware payload", "value": "ccef51803ad1e81befec3ff7c67504132d29935c812a8364092dab6c3b3291611870ea2349ece6ed7ce9464a9f2783be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562981, "uuid": "613a66f3-f73e-4be8-bd2f-bbb50d9de349", "value": "T1E0F60217AD69CC6CC9A394331092C397D20AE18DAE0DDB9F13B11945CEE496B1F12BED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562981, "uuid": "d3439441-3f25-44ff-a816-8aeb4ef7acaf", "value": "1f2702872592229d2f4cb1162cfbc55b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562981, "uuid": "d218c24e-2f38-4b6d-bd4a-d8ad36f34476", "value": "393216:gvaya1YN3LTuDwSoOZOUcrEk2woJuQFkyRmazVNEJj:gvaFKLTutowqEkZoFVRQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686562981, "uuid": "b57735b9-12fd-4f43-a715-55fc295558ab", "value": 15809999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686562981, "uuid": "c2ec17e2-343a-41e5-ac3b-bfcfa6ad9010", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562981, "uuid": "9eb1f7d7-b00f-43f0-9080-2f0e92283f25", "value": "c45df757999bb55bc06e410d7f5e46dd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "169c5267-08ed-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686552487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686552487, "uuid": "095edb6f-3e11-4db9-b3ab-8b6667292f42", "comment": "Malware payload (Mirai)", "value": "766561ecd3ee1f96f13447407d417656", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686552487, "uuid": "5b120d2d-301c-4691-bfd9-9996a55c7393", "comment": "Malware payload (Mirai)", "value": "3d30f37e36d4aa82c110e9e274dc1a759f20954615f6552b958fedf125c4db13", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686552487, "uuid": "3a1adc6c-6f50-409b-99e2-7cf1a86ced88", "comment": "Malware payload (Mirai)", "value": "e9b44c3c92644083207cbc934dbf5cf68a8176df", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686552487, "uuid": "9c115e46-c42d-4020-89fa-3bd2e129fdcf", "comment": "Malware payload (Mirai)", "value": "e1ec2ddf10e6a76da66f586b995e12b23263d00760680664020f5284c1509126764a6c6cfafc5e3992c8c145099f3a64", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686552487, "uuid": "1ed8b21f-c31a-492b-a9ff-9b0283239fc6", "value": "T1BFE32B56EA408B13C0D61779B6DF42453323ABA493DB73069928BFB43F8679F4E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686552487, "uuid": "307d2e5e-4f44-43ba-b02e-877823e928be", "value": "3072:eJLce5p0VdxSEaaHbz4NrA/Jt5IQ1FwUXMk/M/9U3kY:eJLcj+EaaHbz4NU/JrHwUXMcM/9AkY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686552487, "uuid": "54354ff3-d2b5-4b0a-ae22-9735e5ef40c3", "value": 150594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686552487, "uuid": "2ab07fc2-df8f-49c7-b410-73016205e626", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686552487, "uuid": "0a4bb90b-632f-497b-91b6-b7d681bf209f", "value": "766561ecd3ee1f96f13447407d417656", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dc7b8f0-091a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686571961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686571961, "uuid": "e42253cf-052f-4f88-895c-4deedb0b22c3", "comment": "Malware payload (AgentTesla)", "value": "046ed750609f61a01f15f23d2f2ac351", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686571961, "uuid": "13f3ae18-ea34-4589-9f1b-3de772b0b7d2", "comment": "Malware payload (AgentTesla)", "value": "3d318fe7e857edb9267b1b826b71027ad24d9872f8540a707f1e2505a43c95af", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686571961, "uuid": "c4b0bf50-6a3c-489a-8a6e-b42131728f67", "comment": "Malware payload (AgentTesla)", "value": "7e8610871fe78556c6eb8f84591a7363c79b2aeb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686571961, "uuid": "fe0971a6-755b-4bb9-8c36-92d521a7b3be", "comment": "Malware payload (AgentTesla)", "value": "1542eddbc78d1f873c6525ee951c72e8d0c8b2b762d4ff18c60c807d2034f7d6e07ff8966993f78ca9f4d7c16c1fe95c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686571961, "uuid": "c644f995-bdc4-46ab-b26f-8a112759bc25", "value": "T1A10583BC2980B5ABD775DD6281D208DBF23B2B17B2139D9A21D237D2562150F37EC90E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686571961, "uuid": "db38b8a2-38b0-4a16-a297-d543fc8995cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686571961, "uuid": "1c5fbef2-b0c8-4d5d-befd-2cd8731f3109", "value": "12288:r15qeS23r1qwr+foifmYe2EfCGsMVMgHYGCeuz/qSysgt:r1E+1uvf2tlGg4DeayFt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686571961, "uuid": "b603900b-2c42-4833-92f8-8a464af17a54", "value": 832512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686571961, "uuid": "8ba91597-68cb-47ac-b67f-c5b136b751e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686571961, "uuid": "677c685f-348e-47da-9df1-a2abba6994e2", "value": "046ed750609f61a01f15f23d2f2ac351", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b90121f3-08fb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Neshta)", "timestamp": 1686558772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686558772, "uuid": "7e9f002c-003e-4c0c-acf6-10777032479a", "comment": "Malware payload (Neshta)", "value": "9c95c44c64b175e1f48678a3d4798208", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686558772, "uuid": "04e38b6e-345d-443b-9c79-9ac7ddaf58c3", "comment": "Malware payload (Neshta)", "value": "3f0c694d090c2cec0e946eb7a85126c127106211f198f391c81832928fd6ea11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686558772, "uuid": "3e54dab9-c1d8-4a35-9a66-b0887774052b", "comment": "Malware payload (Neshta)", "value": "200858f218f4eecd9a99ca92b1178767c3707f3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686558772, "uuid": "0bc1e730-c256-48b8-a0fa-d7a982ddf7f2", "comment": "Malware payload (Neshta)", "value": "ead4dc30a04679377f4279ef4f7ce92003a894857d2d012807092abbc61f46547d3fbd66d0ce75669e3c503efbebf684", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686558772, "uuid": "219570c1-5033-4109-bfc3-e8f1ca130e0a", "value": "T17905F114B2FA8B39D47A3FFC089094B183F8136A716BCB4B4E9278D94D75B854E01D9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686558772, "uuid": "b5a0db21-d211-47e9-b67a-936ce39b87a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686558772, "uuid": "99c5c3b1-4c39-45d8-8447-b001db948567", "value": "24576:fM3KYHlWxMiQW/O4ue75fCgY/yiecUhTXXezQsvLZ1CwjC:izlYMiQWmS756gYKiYak+LOGC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686558772, "uuid": "e0923dbf-5d72-42e7-9108-ba4c9334c0b7", "value": 838656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686558772, "uuid": "944e52ed-d39c-44fd-889e-0dfb835bc4e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686558772, "uuid": "b5b0d4a9-aa57-4d9c-aae0-875b15ef9f9c", "value": "FUNDED SLIP COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d11af893-08f2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686554947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686554947, "uuid": "742a7143-a027-4862-8ae6-5634b8cbc9d1", "comment": "Malware payload (AgentTesla)", "value": "e8caac8d865f4a94f766c5935fcf669f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686554947, "uuid": "45c7252c-3eb5-468d-bc49-f0e1b0470bf9", "comment": "Malware payload (AgentTesla)", "value": "4070607b1c6de0c546ed8c15e64c9499de4d2a7f59ba7c132f588887b13567f0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686554947, "uuid": "0785a966-7a93-48e5-811b-76f028f5a905", "comment": "Malware payload (AgentTesla)", "value": "4a200b108393ce25901893d45c807860823e4320", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686554947, "uuid": "af1661f5-2f84-4a92-999f-8474bc9525eb", "comment": "Malware payload (AgentTesla)", "value": "cb59db2fd023be4b3f42b9cda16ef45a0aac77d45c5267b4c9b95f5a90d1a2bfc8a0d2c0e37021ec4210bc5fbaffff11", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686554947, "uuid": "7f9ebbbf-c544-41f3-8a2e-c20000dbdf86", "value": "T15EA2C1565B8C4C61F35AE8BB465EA10E08BCF23631C215D5BD9DE2743B2E14E0B7B1B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686554947, "uuid": "1eaea4e3-b0c8-4c06-bcf0-bb89b4813ebd", "value": "384:0qXjvKGK/bv3t0xGJjNYtx1KZMr8YwW2HuH3ZfK87um16Nwpsiu/o09L:0UotEyjNMMZMF/2HuH3ZsnwyAyL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686554947, "uuid": "818675b8-e18d-4ad5-a289-6575e740a8fe", "value": 21447, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686554947, "uuid": "41e4afce-6e9b-410c-990b-53b5ad0f855c", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686554947, "uuid": "5b429939-21b7-4da3-9202-b2ba58c442f9", "value": "e8caac8d865f4a94f766c5935fcf669f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "575cfe21-08d6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686542717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686542717, "uuid": "22e3f709-aa20-4778-9078-613ae8e3d3fa", "comment": "Malware payload (Loki)", "value": "18fb30c005b8c9cbd708b72789783e96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686542717, "uuid": "90b7a9a3-671f-4b05-bf74-48bb24f3da3e", "comment": "Malware payload (Loki)", "value": "4115b8dcc5fe1686132189b3fb783c4e017d34581688618358dd93c76075f0c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686542717, "uuid": "6bc57da3-0d5d-418d-8696-2017d761f3a3", "comment": "Malware payload (Loki)", "value": "86137f7771aa5c983caf1960d567a0aace59da0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686542717, "uuid": "678f6329-f556-4ce3-80e5-4f46ee925cfc", "comment": "Malware payload (Loki)", "value": "f45426220d2927b9ca1a38c810ebb835e4e2325938203c58301721da80e218875566fd7a383f1014e4a15d99f4b3ffc0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686542717, "uuid": "72e08473-7ab5-4347-b925-d927e1a9ac82", "value": "T1FDF4F10973FE851FC5AF3FBC0C51617183F8B1923463CA8B5E52A9CD8E96B558AA0643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686542717, "uuid": "235f9db0-88d8-435b-a03e-e3fd41d6219a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686542717, "uuid": "37206eb3-78d6-4f86-8424-3c5928983ae8", "value": "12288:yoAcuF6mn1DHLZnvJR6iOe42KMu/N3mWhQmwmJCMpUawZXyB3igsoi65svMRnEON:niOV/NOaGXyB3i8scmVdES426UEJB9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686542717, "uuid": "12f3d612-919d-4e70-bfc9-6252d0a9a943", "value": 723968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686542717, "uuid": "d5c14288-618b-4ab8-beb0-b9a836d6eff9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686542717, "uuid": "6a9469e0-f92d-402a-b981-551a69846ee1", "value": "18fb30c005b8c9cbd708b72789783e96.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e8aeecf-08ed-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686552500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686552500, "uuid": "f84ff7a1-9115-403b-8d65-ecab40ce8b78", "comment": "Malware payload (Mirai)", "value": "364b8397758b629ba7aeb66eeb0fa58d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686552500, "uuid": "282ded28-7d55-4d56-8431-fac7621196ce", "comment": "Malware payload (Mirai)", "value": "41540acf10e1adfe247a8973d77fe059901f431c4237987aeb2bbfd4fdca7aa7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686552500, "uuid": "ddc9f89e-9f3c-4f40-90f5-40fd894085d0", "comment": "Malware payload (Mirai)", "value": "3caa27af912e3c659af468d093b0890fd13b6339", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686552500, "uuid": "c3a4984a-a075-49a3-89e9-945fcdd2ee5b", "comment": "Malware payload (Mirai)", "value": "7924df5f52f92b6ef62860abe97f3449782c0dc0401d919741773946a6ea98bb43e1a49436386630eef797efc477d74b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686552500, "uuid": "78e09c45-81a7-4929-854c-44415ceeb519", "value": "T168632A21BA761E1BC4C1947621F74B25B2F143CA26ECCA0A3DB20D9EFF71A446543AF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686552500, "uuid": "4ce87cf8-bf00-4e0c-acfa-412c10b78709", "value": "1536:lGBVg7AOotXhGIAsQ/VJAwQrQm75YH/tatvV:lSCz5L0QmVNtV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686552500, "uuid": "793b27d9-35c8-4fa7-b989-73b27161320f", "value": 67312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686552500, "uuid": "7addca79-5c38-46d4-bc7c-c27fa254c12b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686552500, "uuid": "68ee416a-13a6-4859-8f13-17bec440f1de", "value": "364b8397758b629ba7aeb66eeb0fa58d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b48fd449-0904-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686562630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562630, "uuid": "9d8be984-2eb4-4df2-ae5e-bfd02a5b3ec8", "comment": "Malware payload (AgentTesla)", "value": "05688260cd0f68779347d8e274db2597", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562630, "uuid": "22360c3d-c61d-4691-8274-919d4b199653", "comment": "Malware payload (AgentTesla)", "value": "42ab2450f0d6513cd866d8a5bf33d728569ca37d8428ea4bec47f560bdfc2992", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562630, "uuid": "ed47c1c3-e1ff-492e-a7bf-78a93201359e", "comment": "Malware payload (AgentTesla)", "value": "a9ebfa0a2da1fb6a81a68c358727df84e0f047c3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562630, "uuid": "2f0cf811-ae84-4127-834c-6d749a1e14bd", "comment": "Malware payload (AgentTesla)", "value": "12f9af358e5bdcb6dea019459da9b1c90890b866ec073d28c1d1f35a5605080bb5f350d3c569865ac206f179445e4272", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562630, "uuid": "3d87dbf2-de29-4c7c-a96d-11e267be35cc", "value": "T1E5F339699E897DD1C72C4FB8D4A11148CFB291535617EF6D0FA198F63B0A783322AC63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562630, "uuid": "9e3c3b9a-5cc3-4811-9853-bc5549fe80bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562630, "uuid": "c36b2101-a8bb-43be-ab3a-9fbe82bace32", "value": "3072:PG/1o5GVEFx9nj1r8VWn3DjR5xf9dZRYa0ujEsxt/DwQnckuYCKFBsnVYTI:IEFxhpr0g3hXf9d8a0ujE+p8RbYPrsV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686562630, "uuid": "bbc41fe5-3de9-43f8-a20e-343261c14df1", "value": 168960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686562630, "uuid": "16ea9a42-4526-4b9b-93c7-4f34fdbeeb67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562630, "uuid": "0d763a1c-3945-4686-96a0-e4e570228927", "value": "42ab2450f0d6513cd866d8a5bf33d728569ca37d8428ea4bec47f560bdfc2992", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8ec8308-0904-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686562638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562638, "uuid": "d2b40bfc-b85a-4f9a-8f22-b96ce8779bd6", "comment": "Malware payload (Formbook)", "value": "c5f087f29dbd650d691873bf914451e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562638, "uuid": "c5470c5e-d406-42af-8f8f-adefc46054d2", "comment": "Malware payload (Formbook)", "value": "42ac276b5c8ef02ce840e95ef1992a5d1eff163faba90e3de9fb6633c8bd040e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562638, "uuid": "b844fb54-793e-4d74-9916-97f8847ad1e5", "comment": "Malware payload (Formbook)", "value": "044d71ee391c1e6cba7417f063845c6f199746b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562638, "uuid": "5ffa0f08-8005-48c6-a3b1-ecb53cc635bb", "comment": "Malware payload (Formbook)", "value": "6f23dcf313336ee14fbc2165d714d4632b0659780e231d748ba4c3107510beeb20712da8539c751ebca260a98b6e5197", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562638, "uuid": "467bf709-c33f-46fd-9ef1-ad01562b66e4", "value": "T1C444220826F6E497E9571730CE392B1CFFE6E80B64F65BD643408B69B874610AD0E763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562638, "uuid": "aac51390-a4ee-4e23-9960-17524f91822e", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562638, "uuid": "e9485e5c-8af0-4a61-84e9-2d0ba9f723e8", "value": "6144:/Ya6aPRG1lU6LboYRXCdjQCA9/aWDgYViZdcOG6I/c:/YEPg3Ueo2XmQj9CWb4ZdcOGF/c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686562638, "uuid": "ca4af8a7-4da9-484d-8046-b8413e078655", "value": 271759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686562638, "uuid": "2109f4b8-6ae9-4c6f-aecf-1e7beeea421e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562638, "uuid": "e79384b5-24a9-4658-bb05-c936e37986d3", "value": "DENIZ-M_ VESSEL PARTICULARS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9435532d-0918-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686571166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686571166, "uuid": "51730bea-aa19-437b-91e3-ac5925799c1b", "comment": "Malware payload", "value": "5ba8b32d8bbe3ef88d5124b87eb08294", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686571166, "uuid": "c40e50c8-cdbd-4ec2-a1a2-2a74849d3e2e", "comment": "Malware payload", "value": "436fec3b9ce311d4cc6f3c8c308c9d1cf4210cf692e71445e175a03a44ac7a0d", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686571166, "uuid": "fc52cbb7-3237-450e-8c00-e1a1d0544491", "comment": "Malware payload", "value": "4d3addadaf4f6300e8fab3a08aa26bf7f31b6e02", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686571166, "uuid": "fd679b43-787c-4945-830b-06bd5e020c36", "comment": "Malware payload", "value": "0406859bc1e2147a158385b48683b165ba7cbccb99957ae188bb6a88882635e032b9220df38e6f55cccd9b63889e745e", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686571166, "uuid": "4d7e945e-ed53-430b-9805-71b2d1669cbf", "value": "T117C423E9C4E8D4CB75D11E6DE8100C292C906EE53886DDFE7A986F31DFB07A1716C222", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686571166, "uuid": "7c4f0ffb-fe35-40e1-b32e-9839e18c6878", "value": "12288:Gc1UOIFItcudvRs1LItDd960CIkuftN97CRpHaSCDRt0ewuM:6OIFItPJYUtDd+EFCRxCFt0ewl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686571166, "uuid": "30644907-6ae6-46d7-afdc-a5ccc394f59a", "value": 576450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686571166, "uuid": "df309603-7846-418a-a86c-53d1a6209e5c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686571166, "uuid": "4813f156-e9a9-40a0-8529-56f16ba3e852", "value": "Order confirmation #872635.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6a52aa5-0904-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686562661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562661, "uuid": "7f5d8734-c49e-48dc-9926-c11d5207cabf", "comment": "Malware payload (Formbook)", "value": "fa4393d1a9b33465ef4915178348f5d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562661, "uuid": "2af84924-34f8-4396-8156-d2e359243b5f", "comment": "Malware payload (Formbook)", "value": "4500eda0f4d1cf716592b3e4d2576df69c3a68b585c6de4b560452454474c831", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562661, "uuid": "ea9c6acb-2bd8-45a7-9888-d7a83f83e80e", "comment": "Malware payload (Formbook)", "value": "30943b64847e6bcdb8ce7e817eaedc286e3f0ab9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562661, "uuid": "1fb9c888-b032-4b4e-9505-2091b276b190", "comment": "Malware payload (Formbook)", "value": "58b088a7549170ed8ee35986b5bb92f4b540ef37ad9d3b63442be75eeb7f1c40ffb1065470e1e993d63981bfca95a1f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562661, "uuid": "da973eec-1b5f-45b4-8fb8-dde4a5285850", "value": "T10B05F12D22AA9B0EC57A7FFC9D60A631C3F96E463133D31A0ED338EA5D25B1448D1593", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562661, "uuid": "1b1b581a-267b-4aa0-a467-7662de1deaa7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562661, "uuid": "baa1f603-f3a8-4203-9821-3c105298eb43", "value": "12288:kJP452iNoOe42KMu/N3mWhQmwmJCMpUpMrkveBVixBnG0aktFTlf1A9jH0:oP+1mOV/NOaBr8WGbTTlf1ojH0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686562661, "uuid": "d71a0667-df19-40de-acf6-d31e15e898e8", "value": 846848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686562661, "uuid": "e70ffb4e-1344-4ba0-8b1c-7b1a458db9c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562661, "uuid": "329b1a7b-1f96-45cd-8817-f14cef25bb5d", "value": "Revised invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48856a69-08f9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1686557725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686557725, "uuid": "34f0dd69-aac9-445b-a12b-7a9e40cc9da9", "comment": "Malware payload (SnakeKeylogger)", "value": "c997aa9cacc6b03feccbc1f4abfe6de8", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686557725, "uuid": "fd31f470-bb12-432e-aa68-15fea4c574ca", "comment": "Malware payload (SnakeKeylogger)", "value": "455c8d5400dc3e4f7bc02ddece8852a403929535a67daca9a6b48bb7e85461d2", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686557725, "uuid": "aeeb25e1-ea48-4714-bbf3-bf27234b1b3b", "comment": "Malware payload (SnakeKeylogger)", "value": "d699e0b316cecfbdb373ea73d9ca14f36f56fb05", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686557725, "uuid": "817b1f17-3b25-416f-ab44-4af7dce55d21", "comment": "Malware payload (SnakeKeylogger)", "value": "6aa1a8b06541f88163b1f2c61a082be444e65b6473edd385dd7159796f05663345aebb6902fa2306623f7e5e06cd662a", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686557725, "uuid": "20a3b3d6-c0dd-496d-9ea1-9967ac6f9a3c", "value": "T1DE230261EAC94FBC1153E3C5E2DB48F404537AF86BBB9064B6F93124B272927C502B64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686557725, "uuid": "e79b8b09-5e1f-4559-9729-3c35f1f36b7a", "value": "768:HCWNn+/PLfISs6oq9ERQEHM+ocrrBoUT3Iu1FB6DVhdgcJZvrNSS+ox83Q3:vwn8R6oq9E1ZVBjT3fcjTl+y8k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686557725, "uuid": "39a3055a-0349-4a1c-b57f-e31eab54e7b5", "value": 48513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686557725, "uuid": "5e3a7ac3-199e-4f10-8096-f180a329f0a7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686557725, "uuid": "e3d252fb-0195-4bc3-a913-dced5578c720", "value": "Payment Receipt.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5181640-0904-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686562658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562658, "uuid": "8b96c9b3-73ef-4625-bdc7-e0dfd7e59547", "comment": "Malware payload (AgentTesla)", "value": "6d0e03f3a195357523b999e5bac03638", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562658, "uuid": "1a1062c2-a838-4038-a39c-bd03233f3ea4", "comment": "Malware payload (AgentTesla)", "value": "46b4b2389f1560cd54de61d97335027c5ea7d8967b16c328d456927bc58538fe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562658, "uuid": "6ec5a332-e8e7-4441-8fcc-62d9f192fa05", "comment": "Malware payload (AgentTesla)", "value": "c99d45de0b807dd8b6aa2c902a83df82ace3457d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562658, "uuid": "e2e97543-3833-4229-9fae-98e3cb6668a7", "comment": "Malware payload (AgentTesla)", "value": "f7aef75197c52339d38fc1cc6e2e46ca30ed5fe201dbcf84b20d83a683a6bd04d0efb81bed3f7ebbfdcf54daba9e4953", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562658, "uuid": "de754d2e-dc2e-4c36-ba2c-cd0f2cc770c8", "value": "T1E3F4024C7BFA590FD66B7FBC1C101170C6F8AA4A7523D35F5E8B798E8C91B440A81A63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562658, "uuid": "188d1046-4740-4aa2-9f07-685d6249c0f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562658, "uuid": "3dbc7dbd-0351-4b3f-973a-833f12de78bc", "value": "12288:pumas/16/YHmM9mARLAV+/38hGbsj8XQJGnMldkFgigC0C1VWy7Tj7:p8s6cV9mA9ImsUbsj8dMLir0C1VWy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686562658, "uuid": "cc34a46b-1b0e-4631-afa2-d32e01094e4c", "value": 760832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686562658, "uuid": "1194c5db-44cc-4e76-b1c4-74714e082531", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562658, "uuid": "97bb3109-5e49-42da-afba-88ee953d4fe3", "value": "request for quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72fc5929-08f3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686555219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686555219, "uuid": "3e469de8-613e-49b0-bf37-18f32e2b0867", "comment": "Malware payload (Mirai)", "value": "3c47a4a7d79092df2192d7602924b9f6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686555219, "uuid": "1a002690-8f15-45b8-bb66-932c128ce478", "comment": "Malware payload (Mirai)", "value": "46bf74482101d110d2ced546d776f01e58e032c68bb0013da8d16a72b4031784", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686555219, "uuid": "b39f68ce-f96f-4a29-b34c-e718d14bf604", "comment": "Malware payload (Mirai)", "value": "e943b3575211a84394ef4011131d6e4bab0b1236", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686555219, "uuid": "af852993-4de4-41dc-9094-64780804df8a", "comment": "Malware payload (Mirai)", "value": "34d7ca1fbd66ac70e6f9e8d49a699ec51e82f6b38292c777fb50266f1ee5c47572f73096acac963fe803ae531c8d5d42", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686555219, "uuid": "97a17292-6941-4955-944c-37bbc7cef14a", "value": "T122041AC5AA417E37C2C36BB6FADFC14533A38B54E397230554685FF06E4BA8D0E1660A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686555219, "uuid": "b92d7c2c-19b2-4443-9ac1-8fbdebf30cc7", "value": "3072:A51tFlgNkXjzMaUeAbAd2P76/nnaq+twDGSlOM/9w0rX:YtFlEyMaUeAbAdk76/8wDzoM/9rrX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686555219, "uuid": "ffb9a668-e473-4bb5-9162-bab7ef620ecd", "value": 182976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686555219, "uuid": "2a6a3b25-f49e-4b9a-a858-6e95d144c93d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686555219, "uuid": "bb416306-74d7-400b-bf47-87559a6c08da", "value": "3c47a4a7d79092df2192d7602924b9f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0dc8aa7-0909-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686564852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686564852, "uuid": "815c02d5-c92c-4bcf-a129-dfde7590d70a", "comment": "Malware payload (Amadey)", "value": "2a6633b460141950df83dd8b07271da2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686564852, "uuid": "b3e1db32-9297-4741-a5c2-5f281c0ccbb5", "comment": "Malware payload (Amadey)", "value": "4a8717223bb41c1a9ef72c6692b7c5764ca942f665ed6fac72d75db5a710a1fa", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686564852, "uuid": "20e38e61-3f2a-4707-a343-015266555140", "comment": "Malware payload (Amadey)", "value": "871b417e8e04d15d8a36d113c38f6923c0132bcf", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686564852, "uuid": "c94408c8-b474-4c09-8efe-da062e51e8cf", "comment": "Malware payload (Amadey)", "value": "e44b8e9900db0ddeb19f2491ff35d28c6815922d5de0dbb0a3dbd462de57004ddc024df434b74944a4311a0c896b4922", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686564852, "uuid": "5fabdfbb-1814-4d8e-ad3e-70074dfa87e2", "value": "T1E3052342ABD85512CC761B7059F613C72B357CD26D74872F2A92AD9A0C73AD0A831B3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686564852, "uuid": "431f4195-4973-4a9a-bb6d-041c9606f203", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686564852, "uuid": "2e088e0e-1822-407d-aed5-5069777485be", "value": "24576:7y9jpZIiNZrk/HXsQdNGQ/hYt/rT7BdKSHHu:u7ZVruvhiDTFjH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686564852, "uuid": "2cf357c1-b2d3-4218-abd2-b214dd217573", "value": 795136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686564852, "uuid": "e578e38f-385d-4621-9d30-8a6a5ef7618b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686564852, "uuid": "6a36b1ca-9c03-4f63-85a0-eb24fd26e68a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5219684-08bb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686531359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686531359, "uuid": "e54153ba-7b5e-4a5f-899c-e10ee60e3cf7", "comment": "Malware payload (RedLineStealer)", "value": "616f0116d5ac033979784f0942ae3ce0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686531359, "uuid": "c1917a27-0e7c-48fa-967e-637cb7b22a87", "comment": "Malware payload (RedLineStealer)", "value": "4a9c93e088da7f15b571b3595624ae59f112d3f532c8265178d4cc71f7ddd8b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686531359, "uuid": "27fce748-334c-4320-b8d6-6e2e9b00e857", "comment": "Malware payload (RedLineStealer)", "value": "2bd71edd6577dc222abc2fd2a24bcdf6428fdb11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686531359, "uuid": "62ead324-95e1-4c6c-8ea3-9b6fe5e4650d", "comment": "Malware payload (RedLineStealer)", "value": "84209ba77b1af5ded495d6d01feea0b52fb80ec014e458bd56050c25876a66892563079cba566c10d2464a11cbffe326", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686531359, "uuid": "078acddc-59dc-4c15-ace4-0cf5f86f9132", "value": "T164444A39DC209A28EA4E7FF08BF79B9929196E6007044593FE0E1E558F5FFF4106A253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686531359, "uuid": "4702f722-0ea6-4176-813d-abad97388c29", "value": "7b9f66d4832876035770a6addf78ddba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686531359, "uuid": "e8204600-7426-45f5-a8d9-69ed007b4b5d", "value": "6144:d6krcpMmKgjrwpWSyubkvjz9YYFMAq/33oR4:dNcggj9Zubkvjz9YYFMAq/33oe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686531359, "uuid": "95b8d011-d68b-4827-8055-32bf32e0012b", "value": 258032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686531359, "uuid": "6c679b3c-93ee-4b63-b57b-ba94369ad9fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686531359, "uuid": "ab2bcb27-6618-40e9-916c-6ec9a6688491", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a66656b-0935-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686583417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686583417, "uuid": "e720cd56-331a-4f45-b358-70b961b5cbb1", "comment": "Malware payload (Mirai)", "value": "4b9678551af729f0ebf7dbde9419e4e2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686583417, "uuid": "16f83c29-dece-471b-9e9d-043323ef6197", "comment": "Malware payload (Mirai)", "value": "4cf16984ef7dfc01b74c44bd773e1469b874e2d18ff5c51262b7a6bcd5fa0311", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686583417, "uuid": "e9189e1f-326e-42f3-90c1-494ad06915c9", "comment": "Malware payload (Mirai)", "value": "0107e0f62010207de94d21ac582d7cf17b83b97e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686583417, "uuid": "a9ebdcbf-4bf7-4061-bffd-02e38b7dbe7c", "comment": "Malware payload (Mirai)", "value": "16969eab3fc2b0ed40b87324b4116617a6c011ec73f48bb3cba91d93c50c779178ccf337af7ad46a58d8a6a9f46f4008", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686583417, "uuid": "beb2d172-7a80-403c-a68d-b2dffb9f027c", "value": "T161B2C0CC61943084CA8D7C7D1B8D4A664F6CA190BAED8B16E354CDD8B3BEA8B345D079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686583417, "uuid": "843fec81-9123-4e64-918a-4cd17cfa2e80", "value": "768:obrQlS07dEv0UXqUhvQE+CXQKMQKCXBphAZqSWvl:4QlS07FUXqIYSXQKquiq9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686583417, "uuid": "398256a2-4058-4f58-9a62-60297b3d1e3b", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686583417, "uuid": "a4c8b072-eabc-424a-8b94-ded591d0e6b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686583417, "uuid": "6377eb37-0cb1-4f0a-add6-e9782931b2bb", "value": "4b9678551af729f0ebf7dbde9419e4e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4283dd43-08f2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (StrelaStealer)", "timestamp": 1686554708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686554708, "uuid": "d1a48d8c-fa03-4b99-b70e-d2bd7ffa4f65", "comment": "Malware payload (StrelaStealer)", "value": "8d82b61263a52d999c346b335913b86e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recupero crediti", "colour": "#F6A0AE", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686554708, "uuid": "498748e9-6cbd-407a-87a5-2930cea1e2b5", "comment": "Malware payload (StrelaStealer)", "value": "4e46e03a43a1b2805de578d2d0e11f7570f477072cee9ee4843fc7273906a5a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recupero crediti", "colour": "#F6A0AE", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686554708, "uuid": "f2f39262-8bf6-4925-ba4c-aecdf0745d4a", "comment": "Malware payload (StrelaStealer)", "value": "375fe4ca442ce93af496a4a59408bccd66f60b60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recupero crediti", "colour": "#F6A0AE", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686554708, "uuid": "84e29abd-37c7-4b2f-a02f-29bb46525680", "comment": "Malware payload (StrelaStealer)", "value": "ce66133538e3486418bc90b0e59999b4146aec9e335ee9797c055cdab40df846a9faefeb9e6d33894556e780be5642e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recupero crediti", "colour": "#F6A0AE", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686554708, "uuid": "d34b5de3-cf9a-49fc-8351-b6f6e68a197d", "value": "T11A647CAE64EB694AFEA18C342FFCBB71D77734A88653D7F144A8603025204E39C56727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686554708, "uuid": "a91b29b1-4105-45bb-85f7-c7bd31d95c56", "value": "fcfbe5457e76d2ac347d7db113c0ca3b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686554708, "uuid": "ddef0478-2560-4537-9581-f0ee5a6e807f", "value": "6144:P+K5abvf/kECt8FL8XOmK21+xHzJ1zfcTKg2:P+V0RCLrmK2CXUKz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686554708, "uuid": "64a8eabf-d67b-4276-b439-54fd93cf20d8", "value": 326891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686554708, "uuid": "9c329fd5-8f2b-434e-a85a-5ffb092f1d7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686554708, "uuid": "a3065220-2819-402e-83bb-1ada6c8bc628", "value": "TZ0SX6.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "531ac19e-0928-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686577929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686577929, "uuid": "17d532ab-5c2c-4421-adba-45b4fb720a4f", "comment": "Malware payload (Formbook)", "value": "ca2c4733c657dc8a1c66507f14f62970", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686577929, "uuid": "ac9efc53-afae-4f8d-aec5-9147c65817cd", "comment": "Malware payload (Formbook)", "value": "4e52766fa90e1ffd16cba2eb039e5bdb2916f2c6d61d3f53461f44b4e9796907", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686577929, "uuid": "8874a5ea-eb43-4d46-a7a6-ac80990a051a", "comment": "Malware payload (Formbook)", "value": "c2c049e161bd514eda1f278114de5e1fdaaeba9a", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686577929, "uuid": "80b79d5a-5102-42f9-89a3-23e7a40552dd", "comment": "Malware payload (Formbook)", "value": "47f0b3a1f51ac44b32cd2e0589b5e8dbb3d53de479547204ac619a27e03f1c0076498cafa5bcd54b11e5ef04fd7c2a25", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686577929, "uuid": "64bb3acd-632b-4762-8f4c-30f16d0067d6", "value": "T14F0533D91E2A39C6930394E8F14F1DA530826885B6FEC25077338A76FD8F3C0A1E55E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686577929, "uuid": "d4319f11-fd4b-4d89-b04e-de97ba96fc47", "value": "24576:9OqZ7lXZ1ipT4Uap+YISOHcknrCugywl6lv559ObKIz39fT:VJ1iOUawYROHcSgywlkvHE7zF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686577929, "uuid": "444ee42c-9142-49cd-acfc-870b4cce70a5", "value": 869798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686577929, "uuid": "71647cd3-f616-49c5-afcc-187a17252d64", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686577929, "uuid": "6637375e-627f-4672-b47f-0ff761e0584b", "value": "june order sheet.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7b5f283-08eb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686551925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686551925, "uuid": "89d2f1e9-0727-42f7-aa98-c850d327e000", "comment": "Malware payload (AgentTesla)", "value": "36e960a607a68d682eddaef625384a51", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686551925, "uuid": "42918908-b31a-4112-bb9c-68d657917b7d", "comment": "Malware payload (AgentTesla)", "value": "4e6012a95e4daac2ddb4a6ebfbf11d702fc848da567df7a4094f83abb1f9bfa4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686551925, "uuid": "0eadadd5-8fe4-451e-b5f0-de9ece8798f3", "comment": "Malware payload (AgentTesla)", "value": "5f7f9b417b4d9fbe10a7a010087e34af37b3dc77", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686551925, "uuid": "8072b1b3-7010-4525-9732-831b1eba1e27", "comment": "Malware payload (AgentTesla)", "value": "d771cea88facb7e8d0205a9a920a158ee776db3446dc40c0b1cd025d17f79b19fab7a708552a2a38d1b4aa39b6022a7b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686551925, "uuid": "62534627-46a2-42ec-bfff-fc7d5cb7f292", "value": "T1F605010873FA855FC1AF3FFC1D216031C3F875123163DA8F9E9665CC9E96B198AA0652", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686551925, "uuid": "8fbcd412-2721-41ba-bbc7-40aa973f5b92", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686551925, "uuid": "ed48190c-cefb-425c-9875-703676f15ef3", "value": "12288:EoAcuF6mn1DHLZnvJ0MiOe42KMu/N3mWhQmwmJCMpUfrT3OXnyT1lWK7LBlPDCV7:4iOV/NOaYfeXbK7LBsVuXTDLhSJBn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686551925, "uuid": "8508aae1-1f42-4cb6-8133-e6e8eca6f9e7", "value": 800768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686551925, "uuid": "972d39c7-4e3c-4e9e-ada3-0082ad7433d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686551925, "uuid": "23e41e55-9b30-413d-bbcf-f6136e627f6d", "value": "Quote EM092723.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4e5cac2-092b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686579354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686579354, "uuid": "de2fce3c-7f28-4e91-8103-0e8c56c36905", "comment": "Malware payload (Amadey)", "value": "09b8353ba30da7abd836ea8b2bce535e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686579354, "uuid": "b1a2827b-d8dc-4e32-9f5e-1f4998f2e8c8", "comment": "Malware payload (Amadey)", "value": "4fe304e1ceef6b6a6cd174669f74707f5d832911fc7cbc6a07e50c84d1703c4f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686579354, "uuid": "575fb9f0-cbd5-4eaf-84d7-b4a3b11fc55d", "comment": "Malware payload (Amadey)", "value": "ee3a106546f8e19477b91463685b75a4c161de56", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686579354, "uuid": "80a67676-3198-41cc-850c-d1a9d95601b0", "comment": "Malware payload (Amadey)", "value": "c5b1b464d7b03b694104317f0721cd72eb72c36e6bb071f738ac7bb8fafce50cea13e7239101175665bc4b9074edcbd9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686579354, "uuid": "65d871ba-3f0f-4399-aa78-3edbf7171532", "value": "T1DFC41216E7E89472DDF02B7458F212C30A3AFD918C74836B3B95A95B4C736909832B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686579354, "uuid": "dea0647f-2088-4a48-ba44-047c378ead14", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686579354, "uuid": "6e6cfafe-8a5c-4233-a4bb-791b5c61b0a2", "value": "12288:SMrUy905YmSPZYR0J0UkAswi8fOm1UrEBIITGxwbT5tC5QG4W:Syj7xgI0U5hWu2E/TGk3ha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686579354, "uuid": "28f94ab4-3b32-4112-8601-20724d8c8907", "value": 588800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686579354, "uuid": "9ecfc177-7164-4a4a-9790-e18885d1f95a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686579354, "uuid": "16ae705c-90c9-48ea-925c-7e1f3ceca080", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ef92d55-0918-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686571157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686571157, "uuid": "f23b363a-041c-4c86-b81b-21f562fe6d58", "comment": "Malware payload (Formbook)", "value": "fe063f58390e106c939aa6bdd09aaba6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686571157, "uuid": "72c6d03a-63f2-4feb-86a4-1f90733fad40", "comment": "Malware payload (Formbook)", "value": "51e9ab106ca72189b724415ace85775bb907178d4621cb2ee123cad629f2e4a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686571157, "uuid": "84baf0b7-2a79-4455-a2d9-219708855c70", "comment": "Malware payload (Formbook)", "value": "4a47f9313b08a00aa62d8e0fad57b7af906253bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686571157, "uuid": "028e115c-35eb-4676-a394-97ebda507a23", "comment": "Malware payload (Formbook)", "value": "14453db405eec416d3370273fad934c6249438899ba3405bd507058bb0081b312d82ed23548f76a06cbdfc0aa4c83b6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686571157, "uuid": "a260908b-02cf-4be6-a8d7-efa795550021", "value": "T1F7158E52B6F2D833C66635348D0787A92429FF602D28744EBAEC394DCF3E294B919357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686571157, "uuid": "86865af8-a8e9-4398-9a7b-b3d19a8bb1cb", "value": "10208bb07d454e47048be37ee7fc6e0d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686571157, "uuid": "3c2d3bb0-aee6-4071-9720-83ca6f75dd90", "value": "24576:DqdXPn4tl29UFPWmKoyk4TLmgvky46i95nwkac:DqdfXUFPjKoNw714J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686571157, "uuid": "14b9e571-bb30-4e37-816b-13f0db5ab73e", "value": 912384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686571157, "uuid": "82d62478-5c92-4d46-bf13-563f49f236dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686571157, "uuid": "cfcd53c1-ed49-44dd-a4bc-610546608114", "value": "9962625262537.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "207819a8-0936-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686583857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686583857, "uuid": "c8e8413d-6c86-4f58-928f-5f056967d46e", "comment": "Malware payload (Mirai)", "value": "da42a10f7654edca4324dbfadc3f6059", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686583857, "uuid": "aa66243d-7a92-4be4-a4ca-a3bdf2f566a6", "comment": "Malware payload (Mirai)", "value": "542d6b29c74666d17ba8d0cd96592fbad8680675cf69bb3a61d573ad7f0f3944", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686583857, "uuid": "055f25d4-57b8-428e-a875-a79f14c90dbd", "comment": "Malware payload (Mirai)", "value": "a7d78fa84870e83dac9d8d4e936c086d4afac1ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686583857, "uuid": "df5be9b8-dc7d-48ae-a59a-ce7958f67a3e", "comment": "Malware payload (Mirai)", "value": "5f37664d5d6b7a36188e384a8a03170acf8205ea35230e6c90d9da159b6410314f3c55a4e88b8c18180e2b81a786d08f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686583857, "uuid": "005ab4e7-c16c-4ad1-880a-53d4cbca07c9", "value": "T1C7A37CD1BB83D0F5E94645B56037AB378733F43A502AEB42C369AD32ED92911D60B36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686583857, "uuid": "02a2a913-345d-44e8-a0b4-200dccba7d87", "value": "3072:YAD3iloqFw1EnqBBe3KuyKPBmZSzLDN1777:YOi/3KI5cSzfN1777", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686583857, "uuid": "cde06972-1648-4abf-933f-a9a1d0e81004", "value": 104428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686583857, "uuid": "2aa69dad-e8fa-416e-ae14-d42dacf63ccf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686583857, "uuid": "40f69f0c-c26a-4b8a-9c7d-136da0de7ae8", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be05c6da-0904-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686562646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562646, "uuid": "1579cb95-4f27-4139-a7b9-6d568b0ab872", "comment": "Malware payload (AgentTesla)", "value": "2eecbcfe08c036deb46c136966140c16", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562646, "uuid": "17e52c52-1496-432e-848a-80b8eb22fb7a", "comment": "Malware payload (AgentTesla)", "value": "55cad0992becd01b1789cebf7f95e381d6ef742f282d2ad6ff8791cf8e40614b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562646, "uuid": "285f4e8f-33b6-4370-9989-4e0bdd0fd6e5", "comment": "Malware payload (AgentTesla)", "value": "adbb869af59e9f1f108b856a0f91065bdab4ce51", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562646, "uuid": "faacba96-a427-4935-8336-d2239c67fc84", "comment": "Malware payload (AgentTesla)", "value": "25e4511ab5d6bdd99392915611ea9ff0b68a5da0d25350e8629fee8547ca0df4c616fc96c2186f03ecace0a37e9d04e9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562646, "uuid": "cfbcbd66-aae5-40dc-9094-8936970f2513", "value": "T1F705E08862BAAF57C4BAABFD0410117183F5566B303FE68B5CD2B4DEAE64F450A40E43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562646, "uuid": "f26d984e-67a0-4f3a-95a5-9d8cda740b11", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562646, "uuid": "13d8cbce-8fc8-4633-b52f-ada0823ce08d", "value": "12288:kUlRuzARiGhaDnLMzIL2q+RTdOL8JobHb1yp0XLG2HbMJXxO7HyvBY+rKwKd3nrJ:kUlRuzARtOyqGUL8AqM+Bnvu+rKwE3r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686562646, "uuid": "e1f7e1cc-7ae5-475b-8fd0-aa7adeef09cf", "value": 813568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686562646, "uuid": "caa813c7-3f6b-4977-a4f2-be130fc1fd31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562646, "uuid": "408c09b2-82fd-47dd-b7f8-bb234da0dd65", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14ba2a66-0935-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686583408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686583408, "uuid": "c523578f-804a-4442-89c3-6bb1afdf1d8f", "comment": "Malware payload (Mirai)", "value": "42f96e8dd126e00ef923a0bc0d37d899", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686583408, "uuid": "2682ba6b-f354-46e4-a6d5-cf0972994f9a", "comment": "Malware payload (Mirai)", "value": "561f3404b4f5137eeb7f90b61c292d3f598c800d8dda1d14bc47c27ef3209691", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686583408, "uuid": "257ac634-1c0a-4578-af08-0765c9876350", "comment": "Malware payload (Mirai)", "value": "165bb6bdb909c289c8240dadff37c6bf038c50b6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686583408, "uuid": "95644322-fe21-4844-8d3d-5f33ec129778", "comment": "Malware payload (Mirai)", "value": "cdcba4aa62ef52aa2f7df2f8300916853798c7e293b0d19fb8d6ab56526ebcfe35f3709b8e1fea99a1272777b3432d99", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686583408, "uuid": "36d5362d-903e-45a6-abfd-41357e590af8", "value": "T18E336C36E029DED0C6560134A4E88F751F03F1C893536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686583408, "uuid": "c42cff57-7f1e-4728-9bca-746d764d123a", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686583408, "uuid": "5712577e-8241-4d23-b2a0-cb6d5955c949", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686583408, "uuid": "1cf9a75a-3e4c-444b-9fdf-d9a824acbd73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686583408, "uuid": "ae9eee45-bebe-42b4-ab27-a0c95073d583", "value": "42f96e8dd126e00ef923a0bc0d37d899", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f57330f7-0912-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686568752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568752, "uuid": "6fd16d19-b5af-40d8-81a8-4e89f04b90af", "comment": "Malware payload", "value": "f2f7f0f8a3b25a099f12e05d99b24b42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568752, "uuid": "99af123c-483d-4e1f-85c2-fbc8fba79cc6", "comment": "Malware payload", "value": "5a263321ab44de273873c955bb3cb2b7e8b775b140a9cbd45b215b1b5135e3a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568752, "uuid": "cd1c9c98-5acc-4618-a993-8185e8c37d9b", "comment": "Malware payload", "value": "547a681c335ac9fd211ecff6b0f1d3640a4a674c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568752, "uuid": "9394a190-bed9-4d44-b3b3-e3661f65713c", "comment": "Malware payload", "value": "227f8e393993434a2317baa7b60112bcc562b242f26993d0e20efbac86718e6ad2779045da66c1453f26409fe88f44d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568752, "uuid": "1e2427ef-7521-4718-9004-74ec223013e2", "value": "T13B937D21B660E432D4874C7068B8C965693AB9304BA8D1C737DE47BA5F203F05FB93A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568752, "uuid": "22c1c9a1-6f67-4dd7-b254-f6c7368f7938", "value": "7b9f66d4832876035770a6addf78ddba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568752, "uuid": "acb052b5-391f-432f-88d3-cc1563f93b2b", "value": "1536:XSJi/8IDnWMVoEg9mSkQtcNgXD5y1rXgYiqo94v79Pxn7HPx:XSJiOHcSkEcik1rXgtqM4v9xnTx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686568752, "uuid": "eb9cf23a-e3ff-428f-9bc0-2041bd0ebbdc", "value": 96759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686568752, "uuid": "699b29eb-33a3-4a47-9542-02a8544d08d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568752, "uuid": "d0367cf9-fb92-4405-a6fa-a928b77fb6cb", "value": "f2f7f0f8a3b25a099f12e05d99b24b42.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f6f3225-0933-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686582701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686582701, "uuid": "ceccb144-e8f7-4449-84b4-4742b2aba7fc", "comment": "Malware payload", "value": "73e820644598851123c6090a938a6e78", "object_relation": "md5", "Tag": [ { "name": "AVKiller", "colour": "#CE26A2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686582701, "uuid": "0aeeec08-4130-4542-84c7-a9fd460e4f9a", "comment": "Malware payload", "value": "5a71f8557912ead00716b5e47359b3b2b123453fcf0b1b27d0af0892541fb1fa", "object_relation": "sha256", "Tag": [ { "name": "AVKiller", "colour": "#CE26A2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686582701, "uuid": "45643ae3-0e68-4383-83e6-303333c6961d", "comment": "Malware payload", "value": "c67ab9f51c81178c24bc8ca87d25cf73d6831515", "object_relation": "sha1", "Tag": [ { "name": "AVKiller", "colour": "#CE26A2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686582701, "uuid": "53ef5806-9a24-48ab-84f3-e8c3ec6190cd", "comment": "Malware payload", "value": "d7d0817262831c2f1d53d5f70a2d644b3989bdf5a11291f66a4ff38288ddc334fb9e2bc30311c1a5eb4585fa53726e8c", "object_relation": "sha3-384", "Tag": [ { "name": "AVKiller", "colour": "#CE26A2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686582701, "uuid": "93b04eb4-8dcb-4205-bc30-5463b2f630b5", "value": "T14492D702B7D24677E9BA4B349CB342000375FE568D53AE5F31CD229E1FB26989EB2711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686582701, "uuid": "9ff7a13b-d314-4492-ac53-7f23adeff0f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686582701, "uuid": "09ea6574-b66e-41df-bdfb-2f4b9a654dd7", "value": "96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt0uYBgty:yw+wGWt94+iANiCkc4JhpeDodk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686582701, "uuid": "a5f72551-6965-4637-ad5b-b5e34e0d07ce", "value": 20472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686582701, "uuid": "79cf7db5-7231-4ff6-b4ca-6484b197ac26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686582701, "uuid": "437c7718-bb6d-458e-affd-7ee4bb7e0934", "value": "Healer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0d0d709-0905-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686563134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686563134, "uuid": "54a582d9-33db-4315-b085-b328007b906f", "comment": "Malware payload (RedLineStealer)", "value": "64fa4caa5ca01f22b804c329939656db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686563134, "uuid": "429ebb52-a907-443a-bbcc-3eb27c0cbb86", "comment": "Malware payload (RedLineStealer)", "value": "5a92fbe395867e25c5fe4ae2f61946a3c3a9f141a14e41584939f7715b82ed26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686563134, "uuid": "7d3aebad-b177-4625-be88-677332b6ec47", "comment": "Malware payload (RedLineStealer)", "value": "1b6eaed8106d5b4b1b3a153d8ed39ff861531c31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686563134, "uuid": "9bedd7b1-f2d8-493a-8a09-831a61101a46", "comment": "Malware payload (RedLineStealer)", "value": "b242c14b915e12a6c6b75d79c314b79e21cf9b220b962859439b0cbda1d61c7a51b0cbc6434f9b7c60cde315e9486285", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686563134, "uuid": "0735b1a5-ef74-4da7-8694-b9246fb99cbe", "value": "T1C6747B1392A17D50E6255A728E1EC6FC765EFA204F7D7B6B2218DA2F05B32B2C173710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686563134, "uuid": "ea55d267-4c71-4f27-94b1-560aa11d1d43", "value": "71066788d95fce2cfb22e5743861df9a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686563134, "uuid": "4a22c732-fa92-4721-ae9c-ec62e5839742", "value": "3072:m4zIOC5CcHpexcdkgaIekzxHuh6yekmkObWsserTumx9nLVBYAY+cO0466hdlT1u:3zICcJexcdqmV1VHnBBFW2dlT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686563134, "uuid": "efae5f60-6e3b-460e-8a4c-7a3eb3d3a30a", "value": 353792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686563134, "uuid": "1c5fd4d0-71e4-4d6a-b306-50a827e92c6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686563134, "uuid": "5c478947-a95c-4d92-9210-e077cc3897df", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a58142d-08f9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1686557835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686557835, "uuid": "82d838ed-7fb3-4d44-848e-44bcaeade568", "comment": "Malware payload (SnakeKeylogger)", "value": "890a3c454f15fb5dff65f1ad6b3b9133", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686557835, "uuid": "d5ff8d18-8850-4925-bd02-8733067d5c1e", "comment": "Malware payload (SnakeKeylogger)", "value": "5ad17bffe3731205fe37d626ca9f597a57c70ee620cb09f2b46547f5a174df17", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686557835, "uuid": "6b0d400e-f08f-4508-98d1-ab88dac4cb23", "comment": "Malware payload (SnakeKeylogger)", "value": "4246a7def52030ef80d0dd4ce92f7d0a5bdbdd55", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686557835, "uuid": "d648889c-a741-4862-94fb-f8739eb98663", "comment": "Malware payload (SnakeKeylogger)", "value": "243d0689df383b7f2fc73ea33ff1c179a5024ef0f7a1314c7e1aeb226fadce07575e76b02fef6e0e11f253f420d48ff1", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686557835, "uuid": "b344e79a-58df-4f8d-9960-afab3b2d0cf2", "value": "T1AC230261EBC85FBC1053E3D5E2DB88F404577AF86BBB9054BAF93124B2729278402B64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686557835, "uuid": "71d0ee65-f9bd-4fa0-b53a-f11673f510bc", "value": "768:32CWNn+/PLfISs6oq9ERQEHM+ocrrBoUT3Iu1FB6DVhdgcJZvrNSS+ox83QS:3Iwn8R6oq9E1ZVBjT3fcjTl+y8d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686557835, "uuid": "3a7bc142-7121-44d9-b41d-f702f14a2af4", "value": 48517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686557835, "uuid": "b01211ce-194c-4cb2-ad14-e81ff39a1d34", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686557835, "uuid": "498b324e-2832-4e7f-a501-429eeaeb3e70", "value": "New Order _letter.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78c24c44-093f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1686587870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686587870, "uuid": "6e230be3-9477-4cc0-afab-1d8d6573d3be", "comment": "Malware payload (DCRat)", "value": "642032685b8048204bf59668a7ed48c9", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686587870, "uuid": "23861f49-ab17-4989-a47a-a5d3f0845a6c", "comment": "Malware payload (DCRat)", "value": "5ad5e035ba717e1db0bf6b1dde36d4da4a25d6156c3f51ca8c44ed075b57c043", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686587870, "uuid": "cd09275d-d638-45cf-84d2-50b9fd609296", "comment": "Malware payload (DCRat)", "value": "910555e0aa8b52cc5210f6523bde469f0f3e90fc", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686587870, "uuid": "f72e37a2-6bbb-4ec6-a570-0419e5188ba4", "comment": "Malware payload (DCRat)", "value": "bfeb1da72d619c4727bfa382cffcbdfe60609af0b04b0b97873d8711a17ed90cfb9cf52092b95f561229b75093f39664", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686587870, "uuid": "7949d954-b02a-43a9-946f-5480fe10662a", "value": "T1B0D5DF027F50CA11F5181637D2EF854487B4E8512AAAE32B7EBD376E94123937C1DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686587870, "uuid": "9a82ba4a-ee04-48e2-b9f4-9ad57e75ee64", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686587870, "uuid": "a4951235-0ace-4609-9719-be9d6a464c69", "value": "49152:UbA30J2bjYDwitkxyOO1dHyWOdewRrirxMjvQI7OAax3Bd:UbNgjMJ2dyrybQI7Qzd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686587870, "uuid": "ebe0d1cf-17b1-46cb-ae59-c6800e9f4f16", "value": 2974519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686587870, "uuid": "6f7424ab-0440-4f05-8414-1c2191b67aa1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686587870, "uuid": "01eb2305-9809-4892-ab74-17d77a6b7b2e", "value": "CHEAT and Bypass Matrix.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a922e69-0912-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686568492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568492, "uuid": "d4dc75cd-4c58-4e33-a9a3-fe0cadcfe8a0", "comment": "Malware payload (Formbook)", "value": "03e83bc9a506a966f1d8293424e963f8", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568492, "uuid": "04df284b-498b-467e-af8d-5c2b5e96e7c8", "comment": "Malware payload (Formbook)", "value": "5adbcb5406936cc182300072b9306adda1eb3cf1aac9e87ad211515d19450bd9", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568492, "uuid": "34f84a3d-0921-4909-89b5-ce777f61c891", "comment": "Malware payload (Formbook)", "value": "f359837714b034a3424c8b809750893b243f1bd3", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568492, "uuid": "fc8eb7bc-f0e8-4022-a923-9fb518157309", "comment": "Malware payload (Formbook)", "value": "090d99ed3bca7be5d69540079d81bb02629736d637c3450e8096d0d30a0ba911a8e2a48d3bb5803ed6ad250dc48bd6a0", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568492, "uuid": "5aa8ff47-e092-449f-a25d-2bef57ab09d9", "value": "T1B905125D06FB421ED94A3FBC1C500671E3FA86A67537D71B9EABA8D8DF2270805906C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568492, "uuid": "2cc8501e-b74f-425b-bf33-b2fec9d6e79b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568492, "uuid": "619fd984-99ea-43a0-b7ec-9e07ffdf4001", "value": "24576:IG0biRoSErVxIE5b/lmEt/2zFByuUtb5nUq1Unzj5di4:3y4oRrjIwb/8IOREb5nUq1UzNdP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686568492, "uuid": "6fd62c9c-d353-4ef3-964c-bf5cbd3273d7", "value": 829440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686568492, "uuid": "c7f65a94-8bf9-4d23-b854-9b6e6af139ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568492, "uuid": "29439552-c42b-474a-9869-97ebe1a5f73c", "value": "DHL Invoice Details_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d60610b0-0936-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686584161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686584161, "uuid": "157f6c1b-ca5c-4f42-8931-854d688103b5", "comment": "Malware payload (Mirai)", "value": "9ef29703822986ac3ed53f6e1bee0219", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686584161, "uuid": "2e7d1cdd-826c-458d-8fef-1e72c8f9a749", "comment": "Malware payload (Mirai)", "value": "5ae8d2b75c9a294376635b452762e72b86b9fe9e540206956e9ef2178ae0a537", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686584161, "uuid": "c4cd469e-d9e3-4620-bcbf-deab61a7136b", "comment": "Malware payload (Mirai)", "value": "2e96499e86e25be0f4d465ce18a256162f084434", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686584161, "uuid": "125457a4-c791-4bbd-b582-e34ca421f781", "comment": "Malware payload (Mirai)", "value": "1ac7ceba3f54524aaf509b0b04f8afcafd30d57306f242911b55ff9a459453441fc481a0dba5a50299f06fc697ad87fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686584161, "uuid": "1b470cd3-b0f5-48f5-82bc-3376f1b5ebcc", "value": "T12AD37B73C8696F68D264D1B4B0318F796793A551818B1FBE296BC2B88083DCDF6053B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686584161, "uuid": "5dc2c2d0-b1d5-4da6-9bbb-d0e21fa71bb9", "value": "3072:qJuAGPdzPshM4muI8NHiRrCSWNTgVAKn:qJuArhM4mXMBfN6Jn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686584161, "uuid": "fec01d84-da5f-4f81-8942-29bc3a853245", "value": 133728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686584161, "uuid": "8fe0f45e-dea4-4a44-b610-c8332e7196d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686584161, "uuid": "2d8eda94-2588-4cc5-b29a-d179eadd2f72", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a80b56d8-092b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686579360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686579360, "uuid": "771f8ff7-2c78-4882-a18b-febc07833c60", "comment": "Malware payload (Loki)", "value": "3ff1627e96d78ebc2c33a1d04ea2fabf", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686579360, "uuid": "201b1c54-8422-4a23-88d6-52f092024f0b", "comment": "Malware payload (Loki)", "value": "5c01a6552e36179e065fcc044162f061bc780efdaaac71e7b0fe94efce6b449f", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686579360, "uuid": "63fb0705-c441-4e37-ac55-5530c0a4d314", "comment": "Malware payload (Loki)", "value": "4c113c57048603d585523b1deeec93e2b6b64b4c", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686579360, "uuid": "754ef6d4-baaa-4727-97be-3a4af98146ba", "comment": "Malware payload (Loki)", "value": "95e019ea2460a81c17eb4f3d4358172a4cdd59cb0e5ce45d5ac6b2846bbb557afe22b0fc86415eb94ee899d509ea4bd6", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686579360, "uuid": "99066d87-03e3-4314-9666-d43c665fce35", "value": "T1B7F4014833EA451FC2AF3FBC0D252071C3F8A15235A3DB5F5E9268CCDD46B698A51A93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686579360, "uuid": "a9f18f5e-f5ae-4db0-9aae-b625faf1874e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686579360, "uuid": "7001159b-42a6-442f-b931-560ae843aca7", "value": "12288:VoAcuF6mn1DHLZnvJDMBiOe42KMu/N3mWhQmwmJCMpUDJqZWhFesds6UQEJDmB+o:kiOV/NOaiQ6ogSJ/SsAEJBQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686579360, "uuid": "3988f31b-b2ea-437c-9908-455b9e8d7659", "value": 726016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686579360, "uuid": "356a983f-5bf6-445a-8186-8d23acb0b1d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686579360, "uuid": "b7f220c3-bd1d-43dd-826b-91abedf1e3af", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43fa5801-08ea-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1686551275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686551275, "uuid": "8ce2b2f8-f040-402b-bb72-e3cee5b81731", "comment": "Malware payload (AsyncRAT)", "value": "52ffadcc31852e900c70f28498187bc6", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686551275, "uuid": "3fc18db4-2f74-4c1f-97d2-3906f300a551", "comment": "Malware payload (AsyncRAT)", "value": "5c06318e1614eed017bf727ddaf46ee6cb90a2115199b35e408bea8152298e1e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686551275, "uuid": "d9164be7-b6ae-42a3-8e75-157d1208d451", "comment": "Malware payload (AsyncRAT)", "value": "a6ef0d114f2a25c01eafb7a611f8821bfdc0e8af", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686551275, "uuid": "d0aba57f-0ecb-4a9f-a2c7-28584414e213", "comment": "Malware payload (AsyncRAT)", "value": "db6d95e83e380bad897841b75f7583b2679c60dc8ec6164003a1b3899c173009545217294126ab8a0f32119821e014df", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686551275, "uuid": "60b4cc20-d2a6-4065-b398-15703ddad67a", "value": "T154551202BEC143B3D4A2CB311E25F945F17EBC283E39EA1E3698B61C1736051D5BEA65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686551275, "uuid": "3574c7a9-9dea-4be6-9226-9519d3e96760", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686551275, "uuid": "2d54a358-d273-4ad6-a93f-032d67bf4d9f", "value": "24576:wNA3R5drXhDFw71enfWt03TzmNJ4Yx8eQ+aFvWoTzPslCsmUKedewxFJ5:p5VmefWts+NByeQJ9WoTzPPsmUVnXJ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686551275, "uuid": "3fb7af9a-a61d-41df-8f59-4597beeb7b98", "value": 1392788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686551275, "uuid": "68c4b8f3-c832-46ec-bce7-e4a95d48fba4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686551275, "uuid": "5d66e223-a706-488a-b0c9-bbd5553c1f1e", "value": "Confirmation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fd3bab8-0904-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686562461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562461, "uuid": "3c377b90-2d49-4aca-9eee-43984918f1a1", "comment": "Malware payload (AgentTesla)", "value": "38288b5d022eeb1000c96b369e7232a1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562461, "uuid": "481c556b-e403-455b-8f95-c005f41304d2", "comment": "Malware payload (AgentTesla)", "value": "5e65e9d84c60c1ffd706808176ddb777a63dc8ce712b212e9d65289d81b58160", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562461, "uuid": "bc9c7a14-5aff-44b1-9c0b-512e58d8faa0", "comment": "Malware payload (AgentTesla)", "value": "32e76d0d0b78350a2c77324b54de1d446134a78d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562461, "uuid": "3710dca8-2591-48ce-b9f8-a317825fb9ba", "comment": "Malware payload (AgentTesla)", "value": "ec765df10d926a83be3ed1e5510bb72a775d23d3a9d8f63826b159ceb9429d6bfddd46553deea636d70e981a7f477a6b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562461, "uuid": "ba85bbc7-dbb6-4ff8-97e1-692a03fb5e00", "value": "T166818E20EE8850DB80877189C5E04B136E3330DE93FE7588BF6627E47575D614A61DE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562461, "uuid": "db25e62e-a583-4960-8e1f-3e26e4316d73", "value": "96:1E+HDIJjtx0d20xYjB8XO0dV1md+Bne5v9PWYPM8Kz/Epoz:1DFdvYjB8ddV31kPWYAEs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686562461, "uuid": "bf48888a-7322-49f0-91eb-f0fe58788591", "value": 4175, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686562461, "uuid": "2a3ba12d-f241-4c33-bea4-d16a1809bc6c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562461, "uuid": "5b68137e-1041-414c-b48e-e8764b457d95", "value": "ROCA - PO - 4501226854_Order.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65984354-08fb-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686558632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686558632, "uuid": "daaadf66-8aa4-4005-b8db-68cb498b141a", "comment": "Malware payload", "value": "fb5d44d25191a2c4f6dc91493900472b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686558632, "uuid": "005eb580-362b-496e-b59a-931eabe07459", "comment": "Malware payload", "value": "61359c462e0551c49721b8d6402d92f405c2e5008cdacd50234c431654fd404c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686558632, "uuid": "c73d6fdb-fe33-479a-bbe3-d5f5480929ca", "comment": "Malware payload", "value": "ae52a57887ae880313323d5efdf0d0299bed438a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686558632, "uuid": "c20a49d1-9ae7-4bea-9578-56c35293e780", "comment": "Malware payload", "value": "4cdf0bc6979246408c4d9b25decac0743c9f797fee29a664b1611b10917b3ed3341baf112b1fa2f462297b70259a1170", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686558632, "uuid": "4920462e-ddf3-4b4a-8fc8-19111f79480f", "value": "T17283090BF9819F01D4D331F9FA9F51593313AFA8D3FA3102D924AF6427865DB0A76612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686558632, "uuid": "29fccc5f-0d8d-4751-9dea-6999dae9fffe", "value": "1536:m5nBUOftNTqKF8d/ek+QX/JUK0mWaZClPsLkZY2lRy4MiozWJGhY7vJ3LvUUa:gFfjOKkyS/r0mWaZClPsCdGzWJGh4xLI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686558632, "uuid": "4dcecfc8-d160-4be3-9842-618f3cf5df8f", "value": 82108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686558632, "uuid": "f7d75b2c-15ea-4c99-8b77-58d3cc244674", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686558632, "uuid": "2e0190ef-3c46-479e-bdac-e1022ac7ba59", "value": "dbg.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cd9cf83-0902-11ee-b3cf-42010a9c0076", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1686561490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686561490, "uuid": "314fcb5d-82d3-4b4d-9503-e58b52f90be2", "comment": "Malware payload (ArkeiStealer)", "value": "00062e0d47080f8eef81bb7597c9b758", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686561490, "uuid": "6d51fbc5-b9db-41a9-8e83-f77e9183d148", "comment": "Malware payload (ArkeiStealer)", "value": "614543952c73a92e9e6b0adb97e2d0836035c96f8413a1088a3f42ebc7f0a5fa", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686561490, "uuid": "217d9476-6a62-4dbf-82be-381029e31de9", "comment": "Malware payload (ArkeiStealer)", "value": "4bd1b5b6f53f0a0fa321b932d6262096d2e3f4fb", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686561490, "uuid": "ceeb7fb0-b98a-42c0-af40-aa8f2d8d18c1", "comment": "Malware payload (ArkeiStealer)", "value": "09fa12b7737af9cef852abe56d20a1035e014db58e2d1301bafbf0755b7a12eee0015f201310a3882e4fbb06a5151ac6", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686561490, "uuid": "64fec9e1-9c03-4dfb-8d43-df89d0fec14f", "value": "T11E54E01079F0D832EAA687341C30D2E07A3BFC73A975955B72542F1F7D32781AA6532A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686561490, "uuid": "e483d6c2-e10f-491f-9c9b-b8a26a97b6f7", "value": "197e61892542256e2ab3439e72486e7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686561490, "uuid": "96c4f8d8-993d-44b0-9948-9209ae4b4533", "value": "6144:oW8+P6/9Qv/rkbbuBR7SVPNaRtrB/VtWkQtU:VhP6/AAbKBRW1OrBtvQtU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686561490, "uuid": "e1786eef-a63f-4e6f-ba7d-f4a78f7870ed", "value": 305664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686561490, "uuid": "b2e9f950-1ab2-4a47-b9bb-6da5dda7f449", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686561490, "uuid": "b473dd13-4864-4474-b885-574f419df6ae", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98c486f1-0918-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686571174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686571174, "uuid": "b43c9e1d-c0ed-42d0-bbd9-87ca1d915816", "comment": "Malware payload (AgentTesla)", "value": "1ad73bfab1926d3b72681b8e4380c3c7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686571174, "uuid": "45c79423-50ac-47e0-a9b4-fcd9986e999c", "comment": "Malware payload (AgentTesla)", "value": "61586688d716dbcc460d57086421e4e88d4c97e491caaade35e466914bcb1556", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686571174, "uuid": "8e21e4ae-550c-4fb5-a238-fb1874476156", "comment": "Malware payload (AgentTesla)", "value": "91bb549387468eca17b756363e91b9237759e443", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686571174, "uuid": "e0bcdafc-a159-40f0-ae13-64ea61787b2b", "comment": "Malware payload (AgentTesla)", "value": "088ebf1a0cf6375d60e5fb010ceb40fbadc9bdfc690e01089c06cb328d543cc092ccbc06fc12efa311751fc90cb9adbb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686571174, "uuid": "45d07658-919a-4b78-a0e6-153ee2ee60f8", "value": "T1A7E423CF9D179339DD650C65A3A08630027358BB8C3998C66E9DCB0B1B0B798D6EB4DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686571174, "uuid": "adab822a-fe15-46a5-a049-399fc34f6f73", "value": "12288:VjKOJymvyHxybUFc9mJVE9ye7NwO8HMtk6MPS0n/NvsmMMzTAHQsS4Hb:VRJymvyH+x5ye7NwVHMm6MPXvsmMgTAP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686571174, "uuid": "64fc6327-b999-4862-bfc7-84a6e7dc3380", "value": 677722, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686571174, "uuid": "0a8e11c8-fd0c-4642-8a57-78a3ae0e2c54", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686571174, "uuid": "eb694d01-88fa-4d52-a662-76e5bfacfb69", "value": "Shipping Documents_3.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cbcf233-0912-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686568496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568496, "uuid": "c875bac6-1bb3-423f-9dad-ccaa9c739daf", "comment": "Malware payload (AgentTesla)", "value": "d3485bccfbbb56f2b05c1b9c4f98eed4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568496, "uuid": "d2c3f105-17fb-4131-bac1-f8e79003892c", "comment": "Malware payload (AgentTesla)", "value": "61c32fc492c76bc59c8f674f5b0f42ff18c194d59c594c6a133c75e33fa566a8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568496, "uuid": "857da8c6-458a-4204-ab6e-fff3333df386", "comment": "Malware payload (AgentTesla)", "value": "576620e109025fe2af81ee7477997c9c5d0cbe67", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568496, "uuid": "5a927c33-cdf6-4ace-a521-210b841e5cb6", "comment": "Malware payload (AgentTesla)", "value": "923bd79100e3fc9473f42aca0409aac357d6cc581230d6606499e4f6109590c0bc38bef22f7fd3db3ae14306a15c5ec8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568496, "uuid": "6acc8164-67be-46ed-aeab-62f76fbe0899", "value": "T16AC48C57F7C7FAB0E6BE827A82B1851C527774520260A78F764472896F22392493DF0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568496, "uuid": "e5cccacf-0db0-4f21-bab3-ebad13750d91", "value": "a31761b5a590c4c499d5f4a347d75c12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568496, "uuid": "efde4967-84a8-4f52-9268-949f2d2c93a5", "value": "12288:Jn/zDvGHAykHSzLW/4+8bzbBSreMd2hgFK/UqW:tzbGHAzHAjX1VcL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686568496, "uuid": "9bbbafff-3761-48d9-a953-987edef5d241", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686568496, "uuid": "6695bb08-7b82-48a2-b561-0657eb9eb1fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568496, "uuid": "ec97bc7a-f76f-4ead-99b3-44dd0003ce8f", "value": "MTC103USD568700AD67898T909.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2286dd4-0904-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686562680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562680, "uuid": "8fc4cdbb-f868-4168-882c-ea059f86393f", "comment": "Malware payload (Formbook)", "value": "df0f119491d6598ea1058c7f08881d0e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562680, "uuid": "a141838b-6a18-4d6e-9ef6-fea3ea279568", "comment": "Malware payload (Formbook)", "value": "622771fb67708ab5585e708cee5cb16c45c23fe7f38f48026da96e5078121820", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562680, "uuid": "0e426902-60c9-4e7d-bab7-7268d2fee33c", "comment": "Malware payload (Formbook)", "value": "6508f9971f1306e532e6396757e1b6d0c517fc31", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562680, "uuid": "f60ecdc3-8cc8-475f-a47d-c1dee6dca8c3", "comment": "Malware payload (Formbook)", "value": "f2a1f0a1cbc3bc258062f78f088ed4545fc07c41e6904c38a7189f1c1a0f1f60eb7a986f7076762f5abedcd8ca1ad153", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562680, "uuid": "248d53b9-c529-49d6-936d-07dfe83fec7a", "value": "T1BDE433F5781FE10E869C6E46645185C9CC877321F1C4B8CEC5696730E888ECEEAB2977", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562680, "uuid": "f8a0738a-9636-4f2e-90ad-cf614318a50f", "value": "12288:h/GrzB4zRNmxJ/HMFe8X5d5UEarAHr5Wjsl7c88N9xVxcqEn6vsqFvsieDdVJpE:h/GPujkstJdaVAHr59c8oYqE6vRvWE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686562680, "uuid": "b4e4f246-e7bc-48c4-b0e2-a10cb6ade447", "value": 712484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686562680, "uuid": "0d7b048d-137e-4662-8f03-b79a6988522b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562680, "uuid": "ef59f103-d8d2-4b44-abca-691e5b384c1e", "value": "Payment receipt.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d62d491e-0902-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686561828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686561828, "uuid": "1144b766-9d09-4766-a233-274466a53d21", "comment": "Malware payload (RedLineStealer)", "value": "71e343c2f2889f05d14fb924ffa3a2c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686561828, "uuid": "582ef31a-e99b-4d2b-805c-a6588aae70c0", "comment": "Malware payload (RedLineStealer)", "value": "63283b3a8d9fbbbd8488c4795d31567b5db421b3cf59cd4c8d42a4420aaa57ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686561828, "uuid": "a53b6aff-cbb3-47de-b412-845362df598a", "comment": "Malware payload (RedLineStealer)", "value": "05781aa749f10cc428eac0b638430ec3c9d63fa5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686561828, "uuid": "db632d89-1eb9-48ab-8047-df71f3485a99", "comment": "Malware payload (RedLineStealer)", "value": "fd67d25afa5678ce24de53be9409a735469f3d36851c79d5e1700d606eff078416c30fbaad19d0a0e2d93e4cde502ff9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686561828, "uuid": "770ed1a4-b132-423b-8fc1-038c19d60f15", "value": "T17D445C39DC609A28EA4E7FF08BF39B5828196E2007580587FE4E1E458E5FFF4156B253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686561828, "uuid": "2bad0b81-7d76-4abc-bc43-b924fe152a83", "value": "7b9f66d4832876035770a6addf78ddba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686561828, "uuid": "0f242a25-b33f-492d-8081-dd326acac442", "value": "6144:8sgrf45vyR6wgzWsbLji+HD8SRF5xXOY0NyDae:DgrAvsaLji+HD8SRF5xXOY0NyDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686561828, "uuid": "32443851-fe68-4a4f-b5fa-5b41bf1f411c", "value": 261616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686561828, "uuid": "6f5090dd-39c0-4b02-9783-50f9bb4194c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686561828, "uuid": "baca526f-2694-480f-8618-6800dd93b0b4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79f5a7ba-08f4-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686555660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686555660, "uuid": "bfe76d16-a34d-4830-8acd-8fe535815063", "comment": "Malware payload", "value": "69072084fcad54dcdc386f6b8b591bc8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Void Rabisu RomCom Backdoor", "colour": "#B9B9A3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686555660, "uuid": "ffbb88e8-2750-4da5-8e47-0f0446e9db84", "comment": "Malware payload", "value": "65778e3afc448f89680e8de9791500d21a22e2279759d8d93e2ece2bc8dae04d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Void Rabisu RomCom Backdoor", "colour": "#B9B9A3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686555660, "uuid": "9bcf851c-74e9-4e59-a3d0-3ecd6f8b3de0", "comment": "Malware payload", "value": "e267e26db077a72f6ca8322993a55038b147c408", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Void Rabisu RomCom Backdoor", "colour": "#B9B9A3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686555660, "uuid": "31cdf31a-917e-4cb0-90ec-0574c38efc48", "comment": "Malware payload", "value": "61e031b15ebff3f7a74258270cde5959cd20bb6b1028595e68f5ee862bc315389600c18ece408db2d465e4461533bd8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Void Rabisu RomCom Backdoor", "colour": "#B9B9A3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686555660, "uuid": "8a329ee4-0b37-4ad5-b8cb-6e3523179eb9", "value": "T100C5F15A149013F8E6EB0234D08B1B8EA7E074555BE86D0E1DC888437BD3FAB558B76F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686555660, "uuid": "e6fdbed7-16ce-49b8-b35e-0c81b99adc87", "value": "86cc27a0ea4356b958b6d5f4ab5f5a4d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686555660, "uuid": "745f7f46-8dac-4e20-8a2e-497e3980d8b6", "value": "49152:F+k5TfwYCRsAxSBQJOtJB0v6e7QF5IDx/Zr1oKIrSmrdvzr1z:4kBfwYC6+6Jo66DRZ6pZzh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686555660, "uuid": "17ec71dd-7cb9-4b2f-9078-946685a6646e", "value": 2660864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686555660, "uuid": "38de7d78-7d40-4bd0-b19a-3fd22079480e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686555660, "uuid": "96b4e2c3-633a-467d-8c1f-c21da4ed8141", "value": "prxyms3504117486.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b68b014c-0904-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1686562634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562634, "uuid": "56a876c7-d6d0-4606-a761-0a6da91a52ed", "comment": "Malware payload (AveMariaRAT)", "value": "90858f6188a8a34a9cd7ca092aeba089", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562634, "uuid": "8daef5bc-abb9-498f-80a3-7a2e0d31195a", "comment": "Malware payload (AveMariaRAT)", "value": "6823da737689a3717969e3f98c8482e6163fd13debb5a2da6fdc7e013750f2ed", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562634, "uuid": "90efdd0e-2c29-4b06-bf57-aa63a1e1f36a", "comment": "Malware payload (AveMariaRAT)", "value": "ee7b1e8e017eb9bc6a430fb7a1ed2b996f49ff82", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562634, "uuid": "6bc4b5f8-e18a-466e-b868-7b508822edfe", "comment": "Malware payload (AveMariaRAT)", "value": "c4314aef401e6ed2eb7f13d4294c67f4b1e86e2e9835883e6773cd7c352e9bf39ce3165d1157701d6ae845fdbdc9e496", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562634, "uuid": "f1cec8a2-2493-43d0-a7b4-766a8f2beda9", "value": "T1CC44013C663B2238D96EDC3E7C2705A116A194EF4C25CA2A7A9720BC57A7F374441CE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562634, "uuid": "f8e004f4-66ab-4237-bec1-8020f1f74c31", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562634, "uuid": "81444eb6-70f0-4271-b4a4-88da28701673", "value": "6144:NKhiy7kfS0bDTaXaYtCmtWZCboOJB5LK7F:2D7kfS0XTaJ1tWZCboOL54", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686562634, "uuid": "c944dabb-2d02-43f2-ba83-c64678d5f412", "value": 256000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686562634, "uuid": "cbf8a638-36df-4ee1-8030-fac2fe9dd1d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562634, "uuid": "ea32e686-af3f-4a81-b278-f1eef612cfc8", "value": "BL - OOLU2719450450.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2530b0e-0902-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1686561821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686561821, "uuid": "e92b7dd9-a701-418f-89d3-a109e2f97d39", "comment": "Malware payload (SnakeKeylogger)", "value": "10a4c9d49a1e0f7ed66dd8cd1b94bf94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686561821, "uuid": "5ebf4643-4b08-4934-9fdc-2b1135202e10", "comment": "Malware payload (SnakeKeylogger)", "value": "68498ff9770059481e174c149a2c193479b556dd7ec91c1d34dd76c573ac709c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686561821, "uuid": "795c50ad-b1c5-45f7-8c56-9491353144e0", "comment": "Malware payload (SnakeKeylogger)", "value": "54e1eb6b3e1b777e87743216e0ae23f94d901ec7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686561821, "uuid": "988388b0-4a13-456e-94b7-401f70fda14c", "comment": "Malware payload (SnakeKeylogger)", "value": "f4a03de8c8a955817897d9c7df86070a370c2b62b933fb073269b2312f6c5d9a3032bf83cb4021897bb9e24ba9caf6fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686561821, "uuid": "d41a7c0b-18fe-4c7c-b7bb-d79e0f40a722", "value": "T1BCF4021973FA450BC5BF3FBC5D206071C3F8A15631A7C78B4E86A48CDE85B684E91A93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686561821, "uuid": "81c68ecf-d335-4e74-9157-bfb789f3386e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686561821, "uuid": "8f2ec4af-c343-40ce-acf3-35c478c5192b", "value": "12288:PoAcuF6mn1DHLZnvJl2iOe42KMu/N3mWhQmwmJCMpUXa09lmr8+JyVlHcAGEteTK:KiOV/NOaMa09l08gyV1nGEteLG7OJBs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686561821, "uuid": "c7cfbafa-c5de-4097-a436-b06316d69e74", "value": 763392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686561821, "uuid": "cb079578-bdb4-4731-ad1c-7d5fa41f49d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686561821, "uuid": "711a3b2f-665d-4340-b459-9aa5111b5031", "value": "PO 7875FRSE.xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "233201a9-0905-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686562816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562816, "uuid": "31c21a61-90a1-4900-88a3-ab2c4c70843a", "comment": "Malware payload (RedLineStealer)", "value": "7a6cd742e076a9e208f3e97f96e59692", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562816, "uuid": "7a0a7e61-6fb6-4ca3-86d2-08e5edaca5bd", "comment": "Malware payload (RedLineStealer)", "value": "687d0b0186e4533c96949185042937a69acafb01720207a61a402b045d29a38a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562816, "uuid": "f7829d1f-cea4-411f-a194-bcfeaece12d5", "comment": "Malware payload (RedLineStealer)", "value": "249625563a389cc1a770026383e0ee4243006ea2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562816, "uuid": "90cc2d66-b331-4f6b-bc68-7b23c2555605", "comment": "Malware payload (RedLineStealer)", "value": "18f3cd49c0d6f1342075bdf07bc984f9e3a57c2ac9e0f8028faf839c3c09ebc59ad675dfe19a226f8665f87a33989e4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562816, "uuid": "571f088c-e6e4-41f2-9ae0-606b1ab740fb", "value": "T1FDF41206A6D88123DD75277059F11FD7077AB8A28CB493AF3B81E85A18B36D87630737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562816, "uuid": "84f71c12-1814-4bc6-ac42-ae6f673f8eb1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562816, "uuid": "35140947-03ce-4367-8da8-25061827bc29", "value": "24576:wydfXKWY7O2r+HTRde/UC7/qH6bm4pfN3:3hXY7OdeMCjqH6bm4N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686562816, "uuid": "37324cef-7da6-4f03-b82b-07dc0dc5da23", "value": 794112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686562816, "uuid": "ca50edb5-d563-4b36-8731-992440a008de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562816, "uuid": "6da7a163-f6ca-473d-9a3a-86a4b8332c08", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c43d9bbf-0904-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686562657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562657, "uuid": "5cf7bf4c-cb99-419e-bde6-7cac9681ebaf", "comment": "Malware payload (Formbook)", "value": "847a625f5d7312e37cd7cfb6b8376ac6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562657, "uuid": "3b72da15-96fc-4003-897a-d01b72c41ab7", "comment": "Malware payload (Formbook)", "value": "6993166411c91917f43e2a6fc68fdbcf52d10e62efe1e98ee63c2af87ace1fd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562657, "uuid": "b3b5c35e-2756-4fd0-b252-01048db6fdd8", "comment": "Malware payload (Formbook)", "value": "73a81d69a4755e8036d89b71a3889f47b698e0b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562657, "uuid": "fb2e8284-906d-45a7-aeb9-010e9d98eb10", "comment": "Malware payload (Formbook)", "value": "d71702925326017f6afc50e33ad4f8e97feb43eed63b9fe71748cd1e7b148520f7638e033b19b01afbf827e3c12ba006", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562657, "uuid": "27a6b664-fa28-45c2-b598-69d13c64d3ec", "value": "T10964F1162913C8FFE5BF02F5182D75B06A43BD25D81B650F23EBAA499B742A0F037791", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562657, "uuid": "6a52e248-dab1-4087-ac8f-c2e32fb19f64", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562657, "uuid": "132abf75-74a1-44d2-b00f-4b00cada95e8", "value": "6144:mYa6m2DqJIPP9YproIr1EsfSqrZvvTqPNH8+Q9Ot0VEBOcBshS:mYI23gbRvLqPm9OtKAOoN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686562657, "uuid": "a8bf6b8b-b745-4f25-bda2-7713fc6bdeb5", "value": 331122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686562657, "uuid": "bc2861fe-6297-426c-b20e-87b58f06d710", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562657, "uuid": "4d3b48c5-f5b0-4d95-9d84-15b1f6283404", "value": "Purchase_order_list_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a307905-0935-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686583444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686583444, "uuid": "96e8fb98-9a49-4f81-8d84-e690f592bece", "comment": "Malware payload (Mirai)", "value": "f0d85621d8dc55919a8499e9e8d614cf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686583444, "uuid": "5e0e3fb7-6a2f-4101-874c-73f3b7148775", "comment": "Malware payload (Mirai)", "value": "699684b88e105b45b097ad75fadded082128a3f3c7021c02c02933f4f7eea053", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686583444, "uuid": "5dc53ff4-14d9-4dee-8d92-b78483f50967", "comment": "Malware payload (Mirai)", "value": "e412b6c9f160eaceaa86015967de2f2c6610f605", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686583444, "uuid": "a30c980f-5cee-46f2-bb79-da1c399d9aa1", "comment": "Malware payload (Mirai)", "value": "3c2af1f71b6a6c5bc8b1698a98df3fda2b61ac0b28016e69da7ec01a6d5c6c2d6e8337b39d7aec45f9877f4cded2c1b9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686583444, "uuid": "e7a9c473-6cff-4873-b1e7-a21bcc5949a8", "value": "T1FAC2D0E07726FE31C4206C3DE52B4D8A3A51067C91FF353664258D398EC2A5A67F88F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686583444, "uuid": "6395c194-a956-490f-a8f3-d82b3f266eba", "value": "768:eMKyhegCCMqfizjoNpd2vJdX6vwrD9q3UELuc:NKy4qfqoeJdXWgCLZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686583444, "uuid": "4cc471f7-d98b-45c6-8c9d-b754c7fb6316", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686583444, "uuid": "be8d9517-385e-4be2-9fdf-0675eeb99ce9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686583444, "uuid": "7de41b03-dad7-4102-9a44-9885a209f413", "value": "f0d85621d8dc55919a8499e9e8d614cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6b2b34c-0936-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686584109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686584109, "uuid": "34313486-4ada-4215-8999-83a002b041f0", "comment": "Malware payload (Mirai)", "value": "411d920db9969a0de386b705aad64bbc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686584109, "uuid": "4c0b5da6-d20e-4e42-b8f4-c8889a144455", "comment": "Malware payload (Mirai)", "value": "6cbaedea90bf064c0b3e2905380c5bd7e886af053840c29067b38f831816055b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686584109, "uuid": "4cd83b6e-6b39-4717-a519-183047284035", "comment": "Malware payload (Mirai)", "value": "b294ad372f37d0a1d4cfb893f4c8c1a2dd2c71d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686584109, "uuid": "8c64edb2-fe14-4d9c-8b7c-77ab284e24ea", "comment": "Malware payload (Mirai)", "value": "35706657a9abb9cf35edaad16e042c634652b9471e9f4f2d97d9ac135b691bf85b4b8ab92d5b4f1973bd16e10d742dac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686584109, "uuid": "296ff024-7b2b-4a87-8f21-d4d44300d2b8", "value": "T114131A85BCD2957BC6D023BABB2E168C33A96398C2EF7303D924176436C665F4D37A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686584109, "uuid": "fdd597c2-72b8-4fe4-8127-c63dcc80baca", "value": "768:cg3RO50ujIU45wwcG5XJhA4e/BxHnl5xCkke1P6PzM9kHUMLWo2FUvtkMPQ4zVRq:NIIU4wnG5XsrbF5Ke96PGkH3LXVk8Q4t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686584109, "uuid": "671eae31-5ded-42dc-bea8-a8b2132f480e", "value": 43500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686584109, "uuid": "06e2fdca-c4f6-48ce-9787-fa3a45830031", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686584109, "uuid": "ad3f742e-2c15-4501-a64a-4de066226efb", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f712363c-08f3-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686555441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686555441, "uuid": "e5a953ca-0a49-47bb-8d41-5fbbe64da16e", "comment": "Malware payload", "value": "007a67bfa732084b3f8278b302bef49e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Noray Consulting Ltd.", "colour": "#B1D670", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Void Rabisu RomCom Backdoor", "colour": "#B9B9A3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686555441, "uuid": "424f0c73-e4b8-49cf-b2f6-aa004f0bd187", "comment": "Malware payload", "value": "6d3ab9e729bb03ae8ae3fcd824474c5052a165de6cb4c27334969a542c7b261d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Noray Consulting Ltd.", "colour": "#B1D670", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Void Rabisu RomCom Backdoor", "colour": "#B9B9A3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686555441, "uuid": "d7e3a2ea-a38d-4795-9efb-e7a53df9ef99", "comment": "Malware payload", "value": "50c48db4fdcb0b4d464ec5fcfee2ebd7b8405e1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Noray Consulting Ltd.", "colour": "#B1D670", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Void Rabisu RomCom Backdoor", "colour": "#B9B9A3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686555441, "uuid": "b98858c1-7309-4bd7-85cc-68d621faeabf", "comment": "Malware payload", "value": "acb3c7319b513fb3e5051abc5a379e1d710ea9b92c84db79d6d2b604fd2a473c1855babe948daaa25204f003bd4e46c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Noray Consulting Ltd.", "colour": "#B1D670", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Void Rabisu RomCom Backdoor", "colour": "#B9B9A3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686555441, "uuid": "33e03a7e-2786-4810-81d9-e4ffddbb1c5a", "value": "T10976F12BE19452BCE5EF0330C0671649A7F278116A659C0F0ACC7847AFA3FA21D5B75B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686555441, "uuid": "e00885d4-7311-4d61-b9e2-de811e0e431e", "value": "cdfc995e1c265084a7a13bc6b033e81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686555441, "uuid": "6375a538-126a-47ae-a415-aee2ea873bc9", "value": "98304:R+fSMIs21u7XMp6d2/PkBfwYC6+6Jo66DRZ6pZzhlkLTt29s4C1eH9G:R+ftIs0u7H2HkZwI9DwRZWmTt5o9G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686555441, "uuid": "9ac7fe4c-18f9-4790-99b9-aa2587bcf158", "value": 7244272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686555441, "uuid": "304d8752-a247-4df9-b628-2dbf1b34d31d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686555441, "uuid": "eac24ce5-dca7-4937-b0a3-08876c499818", "value": "Installer.RemoteDesktopManager.2022.3.35.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "140a030e-0913-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1686568804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568804, "uuid": "e5044e91-f361-4375-850c-2c682d55b6a6", "comment": "Malware payload (Smoke Loader)", "value": "7062cc95c3065bac8c4827a1a6ec3f33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568804, "uuid": "c9d1f879-e487-422a-b140-42e0dec04d3d", "comment": "Malware payload (Smoke Loader)", "value": "6e06846b13c0f90b5c2a600b9a95106cb7af27b8fe78dba06916263c780eddb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568804, "uuid": "475bc052-43b3-4e11-b7af-1c28c92b0bfa", "comment": "Malware payload (Smoke Loader)", "value": "d19d78f192fa68736f2aa82494d54bca7ecf271a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568804, "uuid": "28878e8b-593d-42ce-8c69-cfd6a289aff6", "comment": "Malware payload (Smoke Loader)", "value": "60ae0975fcc6fccaf89b74e4bf81903204ad2210ba6bd53b3c7ad41ab1fe6e8624e8a40aa19310513bbb3b5592e443aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568804, "uuid": "97a72159-c5e5-4e1b-b2d6-c3f9fa86db3e", "value": "T151249E1136F1D032E6F745345831D2E06A3BBC73AA75958B72DB3F5B2D322829AA5313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568804, "uuid": "e7b21df6-f089-4d35-8999-7e3130d0f8da", "value": "1b96bbe7f35030dff720bfd4a2e62f20", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568804, "uuid": "713069bc-9286-45dc-86fc-bf3ef89cb430", "value": "3072:EE1ZApup/CWo9tutV/wWGduPNfg/e/406+AMPzWbVidDXRdAtDaH:XjmO/CWo9glGdE4/xtyCpiJjAt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686568804, "uuid": "2b39237a-de36-43af-b39f-2fc129d40716", "value": 212480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686568804, "uuid": "4180e95f-6560-4a10-a3c3-3b463104cb79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568804, "uuid": "d225bece-dbdb-40d9-9186-1a69a079e84c", "value": "7062cc95c3065bac8c4827a1a6ec3f33.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07d9b365-0956-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686597559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686597559, "uuid": "bf04e932-49df-4cb5-a3d8-4d5cacae4662", "comment": "Malware payload", "value": "263a5ea865d180a5370ea13405129055", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686597559, "uuid": "5fc1b43d-8b44-4e4f-93e3-d91676ab5362", "comment": "Malware payload", "value": "706d1d79242e5150e6b2a7cc2b336cfbf19e959bbd1d88de73186311ffe96fb2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686597559, "uuid": "9b08d6ad-b386-445f-9a45-5dc851e1889f", "comment": "Malware payload", "value": "2c7c0b9a269a4260bcfd2b594f48e9d51a4fcb0c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686597559, "uuid": "1dde0f7a-3189-4f35-8eca-9d09c45322fa", "comment": "Malware payload", "value": "d18f137c9f8758b0ea6b64b379f69edfca2272f3c881dd4d25da94e84157d77148b052ad3a40d5dd58781e1e8850e5b4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686597559, "uuid": "e60cda10-af2e-45ce-8da7-bd8a44e225ff", "value": "T143645C13DEE07F60E6354B72AE2EC6E876DEF5108E19376A52289A1F05B01B1C963770", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686597559, "uuid": "6321eda8-b659-4523-b270-da2db91ebc4d", "value": "73d4962fbae1e4c40152701417afb0c7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686597559, "uuid": "a6db2814-3a7d-44ff-a3f3-65120fba7a66", "value": "6144:nM4XhUYUEz2bpNgcjXKITJHRg2/ks8gM7J:nrXhtI3XK2x0V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686597559, "uuid": "0012cb86-ae41-4da4-91d8-658dc4a051cc", "value": 332288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686597559, "uuid": "e6b57b8f-3def-4b09-b253-24240fe72289", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686597559, "uuid": "781cfeab-6ce4-406c-bec5-b0c0de39ca71", "value": "263a5ea865d180a5370ea13405129055", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d12b3fc-0936-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686584066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686584066, "uuid": "43f7d67e-bfcf-493a-b45d-d851137d5ab6", "comment": "Malware payload (Mirai)", "value": "1113e27d1290273a8ece136837fcb89d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686584066, "uuid": "2ce7f0d1-86ba-459b-b3e7-a8e8df3a868a", "comment": "Malware payload (Mirai)", "value": "71624b2364c9a8928747a90f8f5bb0ff3ba6e1c7b46d9e36fe7353a19d1300fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686584066, "uuid": "a5f6e240-5e98-4f0f-9fc7-0ab8e78c5ca4", "comment": "Malware payload (Mirai)", "value": "3706fd5802ec7560412d18e29e96178c53741f8e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686584066, "uuid": "33e8a564-d9e0-478c-b3d0-c82ccbfe3e39", "comment": "Malware payload (Mirai)", "value": "5b3beb2bc270c25421298b83255ef44874a9a0404ed0c41c933b89aec0140fce017cfe7d951285fd481e1004a6188006", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686584066, "uuid": "3c1010dd-0a8e-4882-b3ef-33fc04196190", "value": "T1E414971E6E228F7DF668C73047B74A24975823DA27E1D684E2ACC1145F6438E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686584066, "uuid": "a3881bed-7d21-4891-90a4-7568bb56dcfe", "value": "3072:UDRKt2YpRTC1b/gKCZAn/Fvozt/TRLqQqnqqZWY:UDRi/KjRW/tqQ8qqUY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686584066, "uuid": "6e760710-1c7b-43ba-b36e-c30ae4d2e2b6", "value": 195164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686584066, "uuid": "e690b12b-c65d-4511-8210-7265adf8bc59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686584066, "uuid": "f043ba75-b7a0-408e-92b5-61b42dd021f3", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f3c2f76-0942-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686589036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686589036, "uuid": "9a088bf2-903d-4145-aac5-0dc334724960", "comment": "Malware payload", "value": "15e71e7bd654ec7edfcf79f2b780e4ab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686589036, "uuid": "93f39d85-ceeb-47e4-b9e6-00bd5ee4031b", "comment": "Malware payload", "value": "719ddc41a6854c119889e51948cc5a3ce275e136a5f4cccfd3f1af5096ad4838", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686589036, "uuid": "4fad9748-e68d-4fd4-804d-8f7fac35a921", "comment": "Malware payload", "value": "ee507f1262ca75c6e36edbb702f0c0e01e7c9ade", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686589036, "uuid": "e6e98f0c-1077-46c9-bc98-942813c1fb18", "comment": "Malware payload", "value": "3654cb8ec142c6a7e09597e437d39eae2be49799219c88796eb342e6713602fa172ddd6612ff319e5676a8703ebb48f4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686589036, "uuid": "6c0340ab-1e6a-4c10-b116-880324a36d2e", "value": "T199646C13DEA07F50E6354B32AE2EC6F836CEF6508F197B6652289A2F05B0171C963771", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686589036, "uuid": "51bc4922-0313-4b37-8f5a-7c912830b009", "value": "73d4962fbae1e4c40152701417afb0c7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686589036, "uuid": "4a4fc568-2683-46ae-9dd6-b983b457eb8a", "value": "6144:BW7GLvDnY4YuL5AGfxycv86TJi8xz8rmTWPC6fAPZ2:gyLLZ5AMkveAWz8rxC6KZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686589036, "uuid": "8ca95d5c-3ac9-410f-9d7f-a69a7e88f367", "value": 332288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686589036, "uuid": "e8f696e2-770b-44d3-8731-5cd3a32c25d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686589036, "uuid": "64754cf3-af5a-4837-82c6-3195a1fd2ca8", "value": "15e71e7bd654ec7edfcf79f2b780e4ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f9a1024-0955-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686597304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686597304, "uuid": "530dba1d-1e6a-4704-8a45-2bedd5652ad7", "comment": "Malware payload", "value": "6441d7260944bcedc5958c5c8a05d16d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686597304, "uuid": "3204a0a8-52e5-495b-be39-dcb725638089", "comment": "Malware payload", "value": "723d1cf3d74fb3ce95a77ed9dff257a78c8af8e67a82963230dd073781074224", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686597304, "uuid": "32ca3206-511f-4449-93fa-9c42c38298e4", "comment": "Malware payload", "value": "46257982840493eca90e051ff1749e7040895584", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686597304, "uuid": "44a69729-7abc-4b1d-b7de-9c3e0ff77eed", "comment": "Malware payload", "value": "6f102085dd5521eae77312e240a058a1096847f51e5692be992482ae2caec019a0b52ed7b76dbcd89dcdf1ab59b4054c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686597304, "uuid": "dc6f5b8f-a6f4-47dd-a007-540bd9e88d7c", "value": "T19B65D000B680C036FA722870556AABB2897EBC30976555CF23C43D7B6E726D19D3672F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686597304, "uuid": "525aef88-b5eb-473b-9367-d59816a757b6", "value": "e7481059b799ac586859298d4788584d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686597304, "uuid": "fbf88f32-c684-44b5-a698-21c40c72f76b", "value": "24576:1p2gwjk6ikYhJ9lvGnYZvy48/V33ck7LnBAyldFu8hod/Qodly:1AgxkmvGnYWccjBAwFadRd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686597304, "uuid": "61a5880b-e0a8-4356-8612-666652bbdeda", "value": 1489920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686597304, "uuid": "9509e15d-615c-4818-a9f8-7ff664b36acb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686597304, "uuid": "291d5a93-b5cb-4759-b946-108ae4e66f18", "value": "723d1cf3d74fb3ce95a77ed9dff257a78c8af8e67a82963230dd073781074224", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7527f85-0904-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686562635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562635, "uuid": "d56c4cd9-17d7-45e8-90ea-e4a08d08cdb8", "comment": "Malware payload (AgentTesla)", "value": "a9ba4f85ef5717b75faa2f36a0fb6e65", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562635, "uuid": "3f68ef68-f257-4601-965a-df126410110a", "comment": "Malware payload (AgentTesla)", "value": "728417f7e5c03131b6ec700ff72a2a631975f93478cae5c80c3308afa801858d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562635, "uuid": "271d674e-0fd4-43c2-941c-bc02df163c07", "comment": "Malware payload (AgentTesla)", "value": "d6474922eda2dbcb1f7c8c3f2dfb373d21728749", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562635, "uuid": "330d427d-57cc-4ac0-8d0a-c0ac33b79810", "comment": "Malware payload (AgentTesla)", "value": "7417b3aae4cc346c951ee38c62ef28f908b6c84821afdacfd35edbd7584451560463fac432a94e186f8f43fba457a23f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562635, "uuid": "c6f86a1f-3842-406d-9b27-8968b891ada6", "value": "T118639D92C280AD56EC434A71B079CD212633BF965DA0C797261EF01A4FA334336F795B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562635, "uuid": "66a0d5d3-be48-4cdf-a23d-eae8823e20e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562635, "uuid": "bdadf587-35ff-4141-85d9-76279b2525e5", "value": "1536:j5DHJtxKnsYsEMINcTa7FFd+3Pxx1Px90:1Lz4sKNykd+fxxpxi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686562635, "uuid": "1e6d3e5c-f01d-4102-8b1f-9d8610fa66b9", "value": 72240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686562635, "uuid": "238dcf89-a4aa-46b8-95f1-ce3ba3a6616e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562635, "uuid": "0e3df997-f0ff-47a2-91ab-adef737e5770", "value": "booking information.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47d1b241-08ea-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686551281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686551281, "uuid": "ced1f2f6-98ce-4531-8ba2-add448b91187", "comment": "Malware payload (AgentTesla)", "value": "4edc79e7c945539a783aa5b16c171f0d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686551281, "uuid": "374604ce-6e62-4680-85e4-918ed53ac350", "comment": "Malware payload (AgentTesla)", "value": "7680d977b63a749f186c0b526d37b258b7fb76c41e7e535a27e9c435f72b1804", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686551281, "uuid": "8e473234-3fbd-46a2-ae20-3dfeafba1233", "comment": "Malware payload (AgentTesla)", "value": "f421c23a1802f51e1239bc65f08b659b96a01d56", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686551281, "uuid": "7fb19263-5548-4a6b-a343-5493fc9a087c", "comment": "Malware payload (AgentTesla)", "value": "2425da557dc0b185db178cca076ef18c36d165ed554cef465daeee482101d045c1043af3f5fdba9286238f477d21ce7b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686551281, "uuid": "2351e3a1-25d3-4b68-bfd7-c0ad1ff6d685", "value": "T16105010873EA842BC1AF3FBC1D246170C3F8B6567163CB4F5E96A9CCCD82B588A91553", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686551281, "uuid": "609ca624-a04c-4194-8287-63766709bf3b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686551281, "uuid": "2f15545d-4cb2-4b00-8e59-4eb7d46ad5f2", "value": "24576:GiOV/NOajkQoniHsFLD4992n9mIqAKfvuoEJBdjq:GiOV/NOajk/iHstewn9bqZfnEJBs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686551281, "uuid": "a70bf674-d48a-480a-815f-96f6a6bcfb2d", "value": 796672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686551281, "uuid": "908ce1da-76d4-4fa2-ae26-8252b42dac32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686551281, "uuid": "c196338c-1e52-4bb1-bc4a-06f6ea6d354b", "value": "Parking List.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ce64d7a-092f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1686580817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686580817, "uuid": "a1556be2-b986-4457-8165-c3177ada422c", "comment": "Malware payload (CoinMiner)", "value": "4b57ab30e2ecf878c6d980369432f957", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686580817, "uuid": "03650753-162c-40ac-9c3f-560ec3bf87ea", "comment": "Malware payload (CoinMiner)", "value": "774ae4107d461361d672eb14e89dd4aec312cc1b880e7b24c0cbad40c774c0ce", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686580817, "uuid": "ff005bc6-1d37-4c1a-a958-c2e6cb48ad3a", "comment": "Malware payload (CoinMiner)", "value": "356038e8406ceb627969f0b6e5156f5ab5fe6c1b", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686580817, "uuid": "75436e6e-2e51-4db5-a1d8-13f9569d2a18", "comment": "Malware payload (CoinMiner)", "value": "a3925e8e9ec1d65ea50f61bc6b3adf7c8963f2a0938741ef85dba32c1c706c2eabc4aff9d0ab1833529fe4dcffeabc10", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686580817, "uuid": "0ed03e15-2507-4381-a6c6-0ff4b95af0bf", "value": "T18CF44822EB45C37EF94319FC045ADFA8302459E98F5A2DC3EE056A2A583D1CD793217E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686580817, "uuid": "4e9745af-5c59-46a9-accc-9727401cbb4b", "value": "562361e739955c76ea1b133a50897c7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686580817, "uuid": "73b2ccfb-b325-4d8f-838a-89efd903eb37", "value": "12288:yyxALG6QhsYuu2Gjhqb7/JqNUn+URYbH3WMNCTPDAJK:yyxEWtqb7ANUn+9brNC/AJK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686580817, "uuid": "91145438-144d-4b4b-913d-aa09a4bf6679", "value": 794624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686580817, "uuid": "8911a725-d58e-4039-9318-b236a0f858cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686580817, "uuid": "cf0772be-3a2e-4e6c-b060-cb249afb246c", "value": "HEUR-Trojan.Win32.Chapak.gen-774ae4107d461361.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0df3720-0903-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1686562275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562275, "uuid": "abeb3b2d-9797-4ec3-989d-5fc44ecd8545", "comment": "Malware payload (GCleaner)", "value": "1ac9023b97ee61b98648cc0aaca3613e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562275, "uuid": "8f250003-2987-4990-a977-22db4c83dc9c", "comment": "Malware payload (GCleaner)", "value": "7a614d63596d6f9e5ff9860297e74f6b6d25ca8ae901ab892320508777fcda8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562275, "uuid": "ba03731f-3bac-4b97-802a-270e9c213aeb", "comment": "Malware payload (GCleaner)", "value": "1951498d9bb6f8df99e502144c4872f4520e7cee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562275, "uuid": "05ee2a07-144e-40df-8497-08fc43ddc06b", "comment": "Malware payload (GCleaner)", "value": "4a5cf89702de102e3268393cc3edadb1dabae72c7010448ccbd8c37c18d48186924bc7d35744802c1a00e630dbb4e7a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562275, "uuid": "814aec7f-39f4-4a1c-a764-585ba2f0c464", "value": "T18F746B5392A17D60E9265A728E2FC6FC766EF6104F7D376A2218DA2F04B32B1C173711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562275, "uuid": "60a1cd27-7ee7-4ec9-acba-83a6679c55a8", "value": "00238f2ba697aa7e23225a769e849753", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562275, "uuid": "1ee672e6-c273-4b66-881e-4e3a4c0bb829", "value": "6144:BZDBN4L88rCxkiJBBoJS7m22aimnisZXE7HbCb:BtBNYikiJBuJSK21ipsZY7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686562275, "uuid": "55a4cc6a-da6a-441b-a554-118311ecf358", "value": 338432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686562275, "uuid": "120d4ff9-b4f0-48de-b441-30d4e36ddc0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562275, "uuid": "ab2aff02-db27-43a8-9566-6a58b3c77a00", "value": "1ac9023b97ee61b98648cc0aaca3613e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6842cb4-0912-11ee-b3cf-42010a9c0076", "comment": "Malware payload (PureCrypter)", "timestamp": 1686568727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568727, "uuid": "354fa946-f58d-4a10-b6d1-622a3798e90a", "comment": "Malware payload (PureCrypter)", "value": "479ef78157265f023025dbdb69cdad17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568727, "uuid": "0376b6fe-dce8-4614-8937-86a337db4fad", "comment": "Malware payload (PureCrypter)", "value": "7aae9c3c1ffb5983de4c595a757f5f3d970ee895a17948aa17394cabd2910d78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568727, "uuid": "59427eb8-2ded-4384-bbf5-58dda9e53d14", "comment": "Malware payload (PureCrypter)", "value": "1d80e1ae39482182f8af54e32a3107f5536d63f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568727, "uuid": "4cbaf7aa-0c5e-4171-9310-1868a1a2d0b9", "comment": "Malware payload (PureCrypter)", "value": "dda564bb660aca51cc8b522076572c5ebac7344f5ad0473f57cc1367a46253dd6953efbefffa6587c97928aedd1cdc63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568727, "uuid": "b1a7a8f3-8454-4d6a-af56-00189bf1f4f6", "value": "T14D02C50137E88733D57A87F189A353120376A659A9D2CBEF6CC910CE0DD67809A637A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568727, "uuid": "3c9c55ea-2426-4adf-91aa-a88ad268ba1f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568727, "uuid": "55a7a026-6b13-46bd-858b-1a5191ee0870", "value": "96:Nlv8wBZsgB11/Qp4eqIulLLVeVgVlpxbEPWgidtiEllAHBzNt:LvtNGulLLVeSVPxAmf+HD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686568727, "uuid": "000ab1f8-166a-403b-a36b-5da004443eb4", "value": 8704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686568727, "uuid": "0380208f-66cd-4214-bd95-2a4a7fc06442", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568727, "uuid": "a54631c1-2079-4e62-947c-62176e479a57", "value": "479ef78157265f023025dbdb69cdad17.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd649508-091f-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686574268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686574268, "uuid": "492fd611-3dad-4e93-9ed9-8dfa4b60f195", "comment": "Malware payload", "value": "8c1d40db6464fd098716a317486db961", "object_relation": "md5", "Tag": [ { "name": "activator", "colour": "#607195", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "piracy", "colour": "#1E9F3E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686574268, "uuid": "6ff819aa-8321-45f5-abe0-4b07f01378ac", "comment": "Malware payload", "value": "7b9723c3ca58ecdde9af2dd2215e00fa7c7692e960242d9c6b2e80ab45fc90d5", "object_relation": "sha256", "Tag": [ { "name": "activator", "colour": "#607195", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "piracy", "colour": "#1E9F3E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686574268, "uuid": "e148be23-5667-4f46-b57b-3fee26106112", "comment": "Malware payload", "value": "4b4d82e0a91f11e1348488b9e9edd43697d9db67", "object_relation": "sha1", "Tag": [ { "name": "activator", "colour": "#607195", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "piracy", "colour": "#1E9F3E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686574268, "uuid": "ee507290-f125-4ba4-80ad-cd657b3e41d5", "comment": "Malware payload", "value": "87eaa8be1473005e1d36df822afa2f8952c45fea396ecf12ed6851da90a1a16f76d4eb4c7006467085f58a57f008df05", "object_relation": "sha3-384", "Tag": [ { "name": "activator", "colour": "#607195", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "piracy", "colour": "#1E9F3E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686574268, "uuid": "6dcc6149-2151-4b61-bda2-d0a3c0e467d6", "value": "T18CE44D05E7F211ECECB6AE3495622129B8B53FA8473497FFC652750A0B31AD49A3D703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686574268, "uuid": "23f09410-e13e-485a-99f1-851b0b3810a0", "value": "8a34435494423bb3db4df792ae5ddd31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686574268, "uuid": "b79b4dfb-9b30-4cd5-aba3-1584a1bb4171", "value": "6144:5UPAUV624Zk+nC+f8Z7DgMvVXYNlV8F/2/6utZeiXhOy8oMmkCOutH5BysohXWwm:5mV620nN8ZoAutZeiXhOBuOaBToo4ZY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686574268, "uuid": "fe023e60-51dc-445e-ba65-2644085e6697", "value": 719872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686574268, "uuid": "540666dc-5aee-446c-898b-cdc656299ee5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686574268, "uuid": "769e2635-b3b0-47c9-9824-30e65af1eaa3", "value": "Activation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10c85959-0935-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686583401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686583401, "uuid": "336789bf-b404-4417-bdf3-ca7ccbbee963", "comment": "Malware payload (Mirai)", "value": "88e0b1205a18eaa0858c450102e05607", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686583401, "uuid": "b1f7ae22-ac07-4168-85da-97919ebc4b57", "comment": "Malware payload (Mirai)", "value": "7ba4b85d8a631ee44dd71bccfc311f3bc6d234ab6af41bc742854644e393c692", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686583401, "uuid": "1905a243-bb3d-4c5a-a716-04b4f0c0af49", "comment": "Malware payload (Mirai)", "value": "47af80b83d865d7e51812863c873bd9317b6b91b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686583401, "uuid": "119bdecd-1181-496d-af9e-2c12a7574ee7", "comment": "Malware payload (Mirai)", "value": "6dd8d61861482a557399b8cf7e6aa175fa8fcf2cd0a24617976a1a54e9d9d13dee0ce1212cad35f27768ffcc21390c70", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686583401, "uuid": "3a1c3854-1c89-4bcb-8f35-8b70f54301a8", "value": "T1DA432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686583401, "uuid": "3cc5c9f2-d726-4b13-8a28-6d2790cbdcd6", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwz:RqtmZPuutfbltZFBSJsBcfDSTFI+BEz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686583401, "uuid": "67781125-7aa2-4fa7-b068-14f717a9995b", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686583401, "uuid": "b7125b92-6bab-4b0f-9e61-8a2a2f596bbf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686583401, "uuid": "b2bde2e3-58d2-4ee9-9a27-8f85529aadc8", "value": "88e0b1205a18eaa0858c450102e05607", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24f4eaed-0913-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1686568832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568832, "uuid": "be2fbc8a-5782-40f6-aaea-c70c2822ca06", "comment": "Malware payload (GCleaner)", "value": "17707edc41cafb123a032991f7ad8ae8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568832, "uuid": "2a654b75-1f47-4957-8942-792f886234e4", "comment": "Malware payload (GCleaner)", "value": "7bce4ecdba0dec6ad52286615c8dc344bf7800e390f811dcb21ec4c42c1c9768", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568832, "uuid": "ae7a65f1-67ea-4113-afaa-aebc33e0b337", "comment": "Malware payload (GCleaner)", "value": "7f25b192fc3048a7331af794fada4c736fa80785", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568832, "uuid": "86017a43-da02-42bd-9830-1cc3f7cab832", "comment": "Malware payload (GCleaner)", "value": "74f030a3a0f1bb860bfbf8f68b9a4cc9522a8191aec91fb261e7cd2ab10fca60a8138ee8a9ca9277ab6a72b9498fca0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568832, "uuid": "0a1a1bd4-6fbc-469e-b218-d97752735a21", "value": "T19E746A1392A17D50E9255F728E2EC6FC662EF6108F7D7B6A1218DA2F05B32B2C173750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568832, "uuid": "fb1eb257-1922-48ba-a19c-98e38eb9efde", "value": "00238f2ba697aa7e23225a769e849753", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568832, "uuid": "fb42b822-369a-4190-9d3c-4612f0824f8a", "value": "6144:6DAYiXhWENbXMmG17DA5MDaOFItvkwygix4ILjpISZ862ayRDgU:6kYiR7DMmApHSNtygix4QjpTv2a8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686568832, "uuid": "1df31610-d161-44a9-873c-8fb891454f25", "value": 337920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686568832, "uuid": "eb3f7bea-9be1-417f-bbfa-9ccf0783e9f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568832, "uuid": "391b5c5b-bd56-46d1-8251-1900ede40874", "value": "17707edc41cafb123a032991f7ad8ae8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd54a072-093b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686586375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686586375, "uuid": "21b399c7-1b99-4b16-8924-a75962cc89a8", "comment": "Malware payload (Mirai)", "value": "a566b39c2d64f76c12d1eafacdbff5dc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686586375, "uuid": "fd206bcc-c2e8-489d-a725-1e1aa643387a", "comment": "Malware payload (Mirai)", "value": "7d00c8c37062646c23feecf8cf06537d37c1ff44c99903c5e853b92b7a7ff96c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686586375, "uuid": "139e01ab-3089-41ff-9663-50699cf67351", "comment": "Malware payload (Mirai)", "value": "ad4791d21fab3adc6f86ae42961912206ceed3d9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686586375, "uuid": "19b16d2c-4748-4ade-98f9-324a61a06832", "comment": "Malware payload (Mirai)", "value": "b7f14b7d5bb5d215caea547efd6953fd1887cf092a7c7c5040bdea37fe5691b829bebdaf8ae9c69a01c5ac9f2b0c8ac8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686586375, "uuid": "956ce2e5-a071-49d7-be8a-b9919dd9e942", "value": "T1DAF34AC7F800DEBEF80AE33B4853090AB130B79555925B377257796BEC3A1D90467E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686586375, "uuid": "9d0dc9e2-1172-4a3b-a1cd-cd44f70e3b3a", "value": "3072:1pogI1KuBrn7PMW+tKlDMwGp9B6y0EocDxnVcjbiLLFp3oW+WyNjc5:3a9pkUMRpZDDxPLFp3FyNQ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686586375, "uuid": "cee343a3-2a17-47e2-b688-e084d942d27b", "value": 169792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686586375, "uuid": "d64c89d6-6d69-4be5-978a-62b2440e6e1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686586375, "uuid": "359868e4-4a4c-40c4-8b22-6d6ef02864eb", "value": "a566b39c2d64f76c12d1eafacdbff5dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea07bbdf-08e2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AZORult)", "timestamp": 1686548117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686548117, "uuid": "0bdc5e39-a5fc-4fb1-b755-207fdf00953d", "comment": "Malware payload (AZORult)", "value": "b8fe94f5f46b95d7fb937aae3e0f611d", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686548117, "uuid": "a751f541-849a-4510-b2f8-3e2a6f3ad335", "comment": "Malware payload (AZORult)", "value": "7e7a55a8c34aa6adce1e64e519b1f0bfd7f82237fd0a3097f015fb184865ccfb", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686548117, "uuid": "2591cdfb-9213-428c-9094-dce571a2fed3", "comment": "Malware payload (AZORult)", "value": "c82b4a96a08ea022903777f302de5f6970a3bcf8", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686548117, "uuid": "69c6037b-6b81-4caf-ad19-6fe6703b43cf", "comment": "Malware payload (AZORult)", "value": "00fac4fc9766fa6370c38cb23322126d9a0faadde76210e8c19944b2a9dc5118294885f43963cc44579a3bc6b95900c5", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686548117, "uuid": "1ad69585-bc88-484c-b431-e3c7cd7d133e", "value": "T1CBF423C6D291EE71C7BB497096BC13BDDEA1B1170C90DB674BA01A21BCA24D1F913BB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686548117, "uuid": "cc5188c1-7e1b-4faf-9889-c0571e2fbfab", "value": "7fd61eafe142870d6d0380163804a642", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686548117, "uuid": "d74d316d-1d16-4782-b3c0-926f0b3e4b77", "value": "12288:GbM9FsOF+UqGJJooTlpwH++kbdEouK5pndNQZjdgHnJ784OpoqctZvGREdH3FvGa:r9yOfqGJXpwtkZEBK5NvSjdgHJA4OpfQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686548117, "uuid": "29a8b0e4-a8cc-4108-90db-26ff22fa449b", "value": 760580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686548117, "uuid": "f436b704-df27-4185-8f93-bbdc6aa660df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686548117, "uuid": "224ad326-4366-436d-8fba-fba35ce2ad9a", "value": "No. PR216696.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49851c0d-08ea-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686551284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686551284, "uuid": "31d781a8-9e51-4af8-a842-e5b21aefc0b5", "comment": "Malware payload (AgentTesla)", "value": "b6271cf94164f6185ae6abefacf57804", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686551284, "uuid": "6a1661c6-ce05-4a50-b39d-3a14d67d852f", "comment": "Malware payload (AgentTesla)", "value": "813394227eda6bcc0dc99aad00002d92b1cb1113dcc2f5c48c2ca9c69b4107c3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686551284, "uuid": "5a19fc66-76d1-4eaf-b558-3d977b753f8b", "comment": "Malware payload (AgentTesla)", "value": "e00f5a4aeda5d02a494ddf140b21e13c47a47f07", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686551284, "uuid": "75ce8d1a-0f5f-4336-9d73-51212fdca81c", "comment": "Malware payload (AgentTesla)", "value": "e858e9de8e326d556c203fd3521ee47a68e20bc831e177811bfa28630ea16e2eac29dbfd802e47ee0562799b8b5458e0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686551284, "uuid": "755c29a0-ec5f-4e13-aed0-e05ea9628ca7", "value": "T199E423144E9F37F06094833CF919E92CE7FC7A885E413492D65F4D1A3A5189E2BDAA8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686551284, "uuid": "6db1f594-e92e-4e07-924b-03221d4bdbab", "value": "12288:LYByiq8FTIZ5ClGMja4JLcWGIkHABbCYAmFY7cfminZwjFHgh/pnTKolKsRhUFyt:8PCWRj745gBbtAOfnSFATKovTUFaki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686551284, "uuid": "3c292d13-4b3f-493f-b493-b85b45a3cb9c", "value": 667097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686551284, "uuid": "47a0203e-cc50-47c8-a0c3-d39970674c1c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686551284, "uuid": "3bc88a17-db25-48fb-a23c-b8bb5143ef2c", "value": "Purchase Order List Pdf.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e3fa586-0913-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686568821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568821, "uuid": "99e04e74-7117-4e25-8d82-9ef6309c0450", "comment": "Malware payload", "value": "b267da134319b1c96de8da8f38ed5bd3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568821, "uuid": "a2408746-c683-4357-8344-f00b3b6d77eb", "comment": "Malware payload", "value": "874e904d8c8dedac1d727ef4e5af004bd916333d19d9bef286444e681e3dcc65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568821, "uuid": "ce438fa8-365c-411f-92d9-20b8d65a5676", "comment": "Malware payload", "value": "866c5ae6fd84b3e0a27ccd482c5cf1bba52621fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568821, "uuid": "35dc1395-8e86-47e3-8fad-ea5df5a61e5e", "comment": "Malware payload", "value": "4145504df0c3c94912c3d62d756de6b281ae56a728251cee12e050291dd075426a5fcc9acf7c9751a5d71b07dd24e92e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568821, "uuid": "b1f078c9-ad50-45c7-9717-74299befb5e4", "value": "T11E756CA2610872CFD89E0675B063CD01645D0BF587105ACFA9AEAA7E7D13CC235BEDE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568821, "uuid": "6ab2726a-7c7b-42a2-934e-4a1a0edcf7f1", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568821, "uuid": "8223d017-2e81-4420-b407-6f7c3b97926d", "value": "24576:aWQGi9UEpcO8rLLr79+ME2t+VG/y7Ke1NJLlQ5R4HgQ6ShlAm4ZwmZVfK:pji9bperPH8vlSGBhlATmm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686568821, "uuid": "1002219d-efa2-46f5-8894-304526a50c4e", "value": 1619456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686568821, "uuid": "27293ab5-7ee9-4dba-b3fe-f152cf5448a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568821, "uuid": "574e0db0-bff5-45d9-a903-f40ed7412e42", "value": "b267da134319b1c96de8da8f38ed5bd3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2963fb2-0904-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686562654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562654, "uuid": "a6d653ad-eb25-49d7-b631-7581361b9224", "comment": "Malware payload (AgentTesla)", "value": "2c1bdb573c1e0d042a774f1225c66fde", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562654, "uuid": "87f36b88-1a15-4298-ad8f-9e09f765b7e0", "comment": "Malware payload (AgentTesla)", "value": "87bf3cbb6855ea7ecf72f8cb029442726633cf81bda8545e82b588f779951037", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562654, "uuid": "a2d3cfb4-c700-474f-bbf8-12790077741e", "comment": "Malware payload (AgentTesla)", "value": "6d3347389275790be40e2d33f75c96f8ad025bcd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562654, "uuid": "44e6c481-c790-4e80-b925-4215e313ccad", "comment": "Malware payload (AgentTesla)", "value": "c26bcbc52315b3a69c08e1fe2cfa581f907e6982650c15ef9f8e490e829bc1070c9a9c6195ba860d19406503abc11998", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562654, "uuid": "a3c0d6a8-6cc6-48dd-8c0c-b39bdec967a3", "value": "T1E725A2BC4C43E4EBEE78E23A95F02747B7291416765E398D22DA37415D83DC2B2D0A1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562654, "uuid": "5c69d3fd-80de-4bce-ba73-50a604b2f777", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562654, "uuid": "56709e2c-9625-4597-9285-cd41765451e9", "value": "12288:/VTtTxHJ3wr+ZJSFTVAG10QkX1jdpDSLN28KnZ+97x+:/hXHJTJSpCG10RhKLN2jngRx+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686562654, "uuid": "d571ca6e-0561-4c53-8964-8a272bdbd0b4", "value": 975872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686562654, "uuid": "573730f6-268a-433a-ab88-c8882548ce67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562654, "uuid": "3defe3a1-f67e-40bc-814b-39a726c7d645", "value": "Purchase Order 2023.0608.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d388722-08f3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686555209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686555209, "uuid": "fd60e3fb-ca41-4f09-8d0d-19716e8a4c44", "comment": "Malware payload (Mirai)", "value": "7cf749ac97ce7ea59c0996e4936a3856", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686555209, "uuid": "c7c5856c-f6ab-4b3f-b301-24d7f045a4f1", "comment": "Malware payload (Mirai)", "value": "87fb9bbaa6cbff3d7f959fa2f8bbc2e3f9b5b429a381059d3179173dccef1f68", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686555209, "uuid": "4cdede61-8285-45d7-8487-eba17c30f9bf", "comment": "Malware payload (Mirai)", "value": "e93e46187478b797e9662d9979e340c45abe1cdf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686555209, "uuid": "7e26c326-2f90-4a91-9ba7-600b82c6c868", "comment": "Malware payload (Mirai)", "value": "a4d0034bd0c0de3145a2e3e4152da0ca6397a576b838f81f660d580b908e961e39a2ad4393cef78b1f905152a744f944", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686555209, "uuid": "6297ae6a-8224-4c05-9b14-dfad1bffcfd5", "value": "T1B2B30A82B71A7D37E5C7EEF06AF7E6E057EBE8511B930144B4CDEE84413AAA11404F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686555209, "uuid": "7fe0cd19-4a6e-4f91-99ab-b3d6b9a3973b", "value": "3072:UryD18Dc34BcTuLkIhNxTMQLX0wBnvcfzUVudxZF:buDcIBLLkIDxT/LEwtvcfzUVudxZF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686555209, "uuid": "0c39824c-b646-4a89-b15f-31ff937dd239", "value": 113574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686555209, "uuid": "c039bf67-baf9-4e72-9414-d79d5e3779f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686555209, "uuid": "d56ba78d-a6d9-4950-98fa-7d0f63d1b5c0", "value": "7cf749ac97ce7ea59c0996e4936a3856", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5691676-0904-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686562632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562632, "uuid": "3a4a90f2-1b84-4cf3-8287-6b9afe033087", "comment": "Malware payload (Formbook)", "value": "739a45a65e7a0dad790d96943339302e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562632, "uuid": "76753341-c083-4494-8948-dff775f27446", "comment": "Malware payload (Formbook)", "value": "88fadeb423bb62b7b435752119aac90877bb3486f3fa493e6b4cb1cb4c989bce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562632, "uuid": "fe34adcd-9e09-420d-acfc-f5d7eafe1551", "comment": "Malware payload (Formbook)", "value": "84beaf38c037a02e81e1a811ef00edb34efe4d27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562632, "uuid": "fd361aec-5916-4c75-8a0f-eb5cabe1472f", "comment": "Malware payload (Formbook)", "value": "a76f15a6560a0140d7ee5c6870366c04f696509fc695db168ae9982f762c6af3c5f8aabfce4f4377b41ff5520a2b7b95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562632, "uuid": "4420b1fc-d8ff-439a-93d0-624b9079b9b3", "value": "T18B05025C17FB461EC8077FBC0D101272D6FA5A9AB437D6038EDBA9D8EE17B190990293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562632, "uuid": "b3634108-c7d8-4c8b-8de5-153f271299e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562632, "uuid": "ef170646-79ff-417d-a0f9-b37eaccaaaad", "value": "24576:T0biRoSErVxIE5SeyeDlt7Th4W0srLXICqQY:Ty4oRrjIwTDlRTh4WRLYCjY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686562632, "uuid": "5b6be6d9-e555-456b-8bdf-ea6bcf986c75", "value": 827904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686562632, "uuid": "ebd08156-f03f-49bd-9be2-16a6762fd9d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562632, "uuid": "b71d486f-2c85-4652-9970-cf9237945707", "value": "5BVPh8YBmhokV6N.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebfe2bc5-0908-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686564441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686564441, "uuid": "441e8821-e503-47f0-8c2d-dcb0ae94d4ee", "comment": "Malware payload", "value": "0badd5d81db34c5cf7fadd460ccc3def", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686564441, "uuid": "e7cdc1e8-14a2-4e19-8f1f-2e3c20820244", "comment": "Malware payload", "value": "8966ee958fa7e3fc38edf78d0f0102354a937fa9eac03d27aa538af59dd7b418", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686564441, "uuid": "c3ec2822-cc7f-40fe-a58f-9a9a9baff1e0", "comment": "Malware payload", "value": "44b218305c7829656c2cbfa6ddab6a8298c221ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686564441, "uuid": "ec9ef968-37cb-47fb-830f-362343d5375d", "comment": "Malware payload", "value": "0fa7bb220c7de38017cf7a31bf86a0d0fd22115d512c44cb1c508d653bafef0bf15f0f8fe70d1411e5663c9243b393d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686564441, "uuid": "815b183c-35ad-4636-9c02-30b86307d597", "value": "T16A254D37819AD1CBF1E48D7739C1B756B0A37A2AD13A7FFA9670EA014314340978E729", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686564441, "uuid": "4d5573e8-354b-45cf-b083-e048a7392008", "value": "67d615d0e555a51601eeb52dbd795c0b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686564441, "uuid": "216fe8cc-e04a-4a82-8bec-14367f2fa8db", "value": "24576:5Y9axe7URrdnooZ5tEjCssPRwOABjytsOK:5Y0O+ZooREjCssPRhApp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686564441, "uuid": "ef594514-7b4e-4b73-8c84-4b6c9c708d59", "value": 1013248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686564441, "uuid": "3fdc7d11-5111-44e9-a350-055f3b1cf377", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686564441, "uuid": "5c5e248f-607a-49ed-9433-51a968ff1779", "value": "RobluxCoins.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbb04f05-0901-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SystemBC)", "timestamp": 1686561461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686561461, "uuid": "d8739725-afa7-4475-9dfb-ccf069918eed", "comment": "Malware payload (SystemBC)", "value": "04a18da1c7e7c59cd5f27870221dc1e5", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686561461, "uuid": "9890c019-e039-4fed-b3b0-6d1b7a47f007", "comment": "Malware payload (SystemBC)", "value": "89e5681774347bfa7e087385062bbd741446308c239beff8f1e2ad1613372aea", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686561461, "uuid": "f8899fc2-ff20-4df3-bee9-ac16506e105f", "comment": "Malware payload (SystemBC)", "value": "11ce4d54bb900f1d6eab8757b81464683a5775ef", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686561461, "uuid": "44ec1ba3-659e-479f-b1d3-33706a505092", "comment": "Malware payload (SystemBC)", "value": "93c4f5593ad6030985c4fa621b24ba94b550c828f6fad2c190ceee303b255aed007868015e2a8b0a1bc26f8c560b857b", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686561461, "uuid": "5ef6409c-c43e-4a53-8e42-3f5f946ddd09", "value": "T157249F1D7AE1C431E6A74D745834D2F4EA3FBC736A65858B72483F5F29323825AA2313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686561461, "uuid": "0c8d7f31-52d9-4099-8d5d-97d249745a96", "value": "1b96bbe7f35030dff720bfd4a2e62f20", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686561461, "uuid": "d6c9a29e-898b-4278-b5fc-a1eed22bc175", "value": "3072:P9wYBQRVJlQYIkxkeg52vAqAcvw9Dz/EcDVVRdjXtDaH:FtOrJOYXe52HuD55jXt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686561461, "uuid": "12f499a2-4d98-401e-a8e8-9929d3dec5bd", "value": 210944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686561461, "uuid": "d71105fa-d445-4c25-b9f3-96d293176ae3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686561461, "uuid": "6fb4211c-e388-484d-82ea-c4ae78e0ab6b", "value": "04a18da1c7e7c59cd5f27870221dc1e5.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f087fa0a-0903-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1686562302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562302, "uuid": "af8f9ca3-041b-4088-97d3-ecf3e892c7af", "comment": "Malware payload (GCleaner)", "value": "a28cffb774dd3cf225eb023890443aa1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562302, "uuid": "0671b818-6433-4ae9-b367-c503ab5c1e89", "comment": "Malware payload (GCleaner)", "value": "8a0076bd43afae62fc5a51528629402c8184ab4dbb8dcbe3114e5a138bcd8d35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562302, "uuid": "f4008a53-1ed9-45dd-a85d-afe7484df376", "comment": "Malware payload (GCleaner)", "value": "f44e62f520b719dc55acd971f3221646812f1e8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562302, "uuid": "04c979bb-bf4f-44e8-a9f2-9bee09bf8e77", "comment": "Malware payload (GCleaner)", "value": "04f99110c14d38fb725a1cd7f293e13f4ba90401c3e48dccc5bd3b87a229556b11fc83bb5047aba093f4d32c22a1d8ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562302, "uuid": "d53a54f4-964c-4fc5-b193-dd471d51c492", "value": "T18F64E04039E0C831F6B765349832D6B51A7BF8676835E68BB6A43F5B2D323C16A70353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562302, "uuid": "b916e2c7-af63-4345-a834-677195cb7028", "value": "3fa0d4fa381293581a648748e6290804", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562302, "uuid": "9a96e6cf-118d-433f-a066-0ef2c04b48a7", "value": "6144:vS3as9TCCAoM1r4U0ANwJaCq6WPEDClw4/q/ivT1+:aqs9TCntZKewJaZ6WPEDClFqi+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686562302, "uuid": "f31450f4-0617-4aff-8b14-c25ca26ff597", "value": 322560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686562302, "uuid": "c3f6e3e6-41d1-4a94-9c07-be2d776de8b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562302, "uuid": "5c62de1c-e3d6-4675-937e-2b971fe582ab", "value": "a28cffb774dd3cf225eb023890443aa1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcf90f1f-0912-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1686568711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568711, "uuid": "5111dbe0-e896-4367-bbb4-4e78251a8508", "comment": "Malware payload (Smoke Loader)", "value": "9b31e1fefcb6ddca5be2b800941ed51f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568711, "uuid": "a04b5c38-ca7d-4d6d-a9b5-9f43bf772e25", "comment": "Malware payload (Smoke Loader)", "value": "8ba95cf7643edb6a572e660d541d96c8e1c138c76dd6e476c5943fe2d50ef59a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568711, "uuid": "feb24cef-eab0-4d69-98cf-91bf48b1bb9c", "comment": "Malware payload (Smoke Loader)", "value": "eee2448f77944e3d9a070eda2bf44355580ad86c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568711, "uuid": "cbc29310-d6f6-45ca-bb7e-b0df77efaa78", "comment": "Malware payload (Smoke Loader)", "value": "08de78ed77be9874a2e49498d18cda68bcad281e595d3692cbbf7aedd138865d095df29fd440fd93c8c572d4464313e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568711, "uuid": "12c7ef5a-769f-4d14-b475-9bfac5940080", "value": "T12514CF213AF1C032E6BB45351531F7A06A7BBF332BB2858B3340166F1D726919A66F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568711, "uuid": "d29175de-0572-4882-96dc-6beffac51c0a", "value": "5affbd003e86f6425e6f5983fd37fec5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568711, "uuid": "6605adb9-9379-434c-9593-47d577dbf83c", "value": "3072:M00zhyjmLJNGiGghL1d7NHK24SnWP4rYENwQ5Ctc:90zhy+8GhxH77WPf2Mt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686568711, "uuid": "b981c875-b811-4b92-b1bf-186848f71583", "value": 190464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686568711, "uuid": "705d73d1-cbda-4920-af64-78611c11f2df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568711, "uuid": "801cb8c4-1e45-4041-91c5-bfd5202cad11", "value": "9b31e1fefcb6ddca5be2b800941ed51f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9a1cce2-0902-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1686561753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686561753, "uuid": "55faf24a-f6f5-4c6e-bff9-fb09313e9a7b", "comment": "Malware payload (RemcosRAT)", "value": "9af9bc80c0122725fda165d47e373089", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686561753, "uuid": "11970903-14fa-467a-a208-f1bffc1cecfe", "comment": "Malware payload (RemcosRAT)", "value": "8c80ec1c91dcd77ea0be5d0e53e289a6bc0ed764a12f9262ba979f579bb25591", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686561753, "uuid": "1c48d552-a6d4-4014-b16a-a945b3324228", "comment": "Malware payload (RemcosRAT)", "value": "ced80a90a316ab3232621270253bb832908fd22b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686561753, "uuid": "38bcc04b-fdc1-420a-a231-215ddaff45bd", "comment": "Malware payload (RemcosRAT)", "value": "ebf599ec4569b6bb411c40dd031b7177d38772900796301edbb5df4a6ef3621440e2ce42891b9b721a101784864e741e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686561753, "uuid": "8548fb2b-3fdf-4d80-90a3-756ae560b1af", "value": "T187158E52F6E2D833C26635348D4687982815FF602D28B84ABEEC394DCF3E694BD19357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686561753, "uuid": "35029e8d-c7be-478c-bff6-d79b97367f0f", "value": "10208bb07d454e47048be37ee7fc6e0d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686561753, "uuid": "9c16529b-2f73-4cac-99ec-4357b3e7fe1e", "value": "24576:DqdXPn4tl29UFPWmKoyk4TLmgvky46i95nwka0:DqdfXUFPjKoNw714p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686561753, "uuid": "1369275c-f08e-496b-985c-e06243ceb0db", "value": 911872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686561753, "uuid": "b4db1849-39c7-4eda-8bef-62bc6f044190", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686561753, "uuid": "ecc1da68-fa8f-41aa-a20e-bf6f627c8a6f", "value": "June New Order _12_06_23_Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b0b1e27-08d8-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686543690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686543690, "uuid": "7c2fc383-aaf0-4bfe-bb2a-ca748a59d58b", "comment": "Malware payload", "value": "4a3f936b7097831a8dfcc8960a71dbee", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686543690, "uuid": "1292d756-e11e-4f00-a6e5-586ae8afa8ba", "comment": "Malware payload", "value": "8d9e334f557a03738bb4d95d2f1439d7275a20ab6f04729daf800ebfc02b2d18", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686543690, "uuid": "817e4af8-ed33-4fde-aea4-a7bcec737c9a", "comment": "Malware payload", "value": "4852cf0f3e412db0e18d5fd5df2dc02d781e2d72", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686543690, "uuid": "8cb1c9c9-0ff1-47c2-a105-21d4032b3222", "comment": "Malware payload", "value": "be418544a2981fb778ec5f1c160dd8b62e64bdde26f940c9158012b50f011b26fd3b9d57d06f2ad6f3960edafbbfa760", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686543690, "uuid": "23e86aea-d4ed-4ed3-a38f-ca22924c2a35", "value": "T18D56127961803358C41FC8305123AD7BB2B65D1E7BF8A5A671DABE807FFBB109522B05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686543690, "uuid": "93cea5a0-035b-492f-a75b-10ad18cbda9d", "value": "1c4dfdba330f9207b50c6b2051ead1e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686543690, "uuid": "5e70e128-a7ce-445a-b5a0-8352564caf37", "value": "98304:40d1l3uN8NH+RJ9ZO6w9kPnH4bQy87yEg5lT58hCdZeiXu1Kf+xZ7:40d+N+H8JrOAYEy87yflTYvie1/Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686543690, "uuid": "c73d6ab4-58e5-426b-90af-7ce79ce91f54", "value": 6011392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686543690, "uuid": "03a59130-f4c4-42f5-b090-a4ff4e2f75e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686543690, "uuid": "f030c5f3-5d60-43c2-b3a6-3f192a2a11db", "value": "4a3f936b7097831a8dfcc8960a71dbee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f78776a-0946-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686590915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686590915, "uuid": "ce3f733f-054d-487c-a170-2e6ca65a52a9", "comment": "Malware payload", "value": "44b6359226d9c9ac0813792def47aab2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686590915, "uuid": "2f32ec67-4f19-4d76-ba46-008ce4404c0d", "comment": "Malware payload", "value": "8df62a1cf269063152fea1a1c73eb7322ca98e2d7d7cd4b4aa646ab639d8ee9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686590915, "uuid": "62ce7fe4-11fe-4c8f-ba1c-1012ed3f396a", "comment": "Malware payload", "value": "1e5283571ca270f1ddc0467fb603172234367d5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686590915, "uuid": "37aec9cd-3045-4ffe-ab37-4c1b920f17f9", "comment": "Malware payload", "value": "e7850f1546745d02d073f491ef58f2977cd3f9d18b576fe1ae8611ac48cf66506ba197b9ee3cf6dff3c5870e7a8097ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686590915, "uuid": "00545650-daf3-4e30-9ff8-15e33acd1656", "value": "T1F55438409746CA9EC81403B5B6B757C606F0DCAC45E8975F2BCA6E392EE33F95C82213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686590915, "uuid": "db12c3ca-3c73-4382-ba08-57846d1b68ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686590915, "uuid": "1950e8a8-561f-4745-9e06-8dcb0769aed3", "value": "6144:ilnDpZE9DUux4GxF8C/XcU/DV5Sm8k/hQf69EEz7eP87FY:ilnn6ge4AN/DVr8Z6E8nF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686590915, "uuid": "47e9a431-ff58-47b0-94b8-9b8bedb07283", "value": 285184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686590915, "uuid": "19b62981-9494-473a-a10c-289f66a8cfe5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686590915, "uuid": "dbb75eb2-a383-40ac-9131-c372a7489ab4", "value": "SecuriteInfo.com.Trojan.MSIL.Runner.3006.876", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3ef199e-08fb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Neshta)", "timestamp": 1686558764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686558764, "uuid": "f8b94d47-d12c-4618-a182-ed28502a6fcf", "comment": "Malware payload (Neshta)", "value": "9212e2678be5adc047402fba5af83e88", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686558764, "uuid": "26e1131d-29ec-42c4-b7d1-b4063f55a98a", "comment": "Malware payload (Neshta)", "value": "8e1068b7778cd33c198977f4d07e3d444bbde246716c7d78489a7ba2fd5a98cf", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686558764, "uuid": "79f84b44-6f5e-424f-82c9-13a57af030d5", "comment": "Malware payload (Neshta)", "value": "acfb1d2436d3db83cd500d0715d16de798480ee7", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686558764, "uuid": "f2f4e0e3-5dec-4bc4-9701-1d883604d3cb", "comment": "Malware payload (Neshta)", "value": "e2244f2593bd46ec68c3f5d1e63ee830428129859cda46526d53351539a8e98936e8f2437fd14ac1ea67a897ce5127fa", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686558764, "uuid": "73cb9502-8461-49e7-b8b9-aa1516281190", "value": "T189E433BA3583E2DF27068789E7F4147139E19557B28E49FBF51F3E420B5A83B3019868", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686558764, "uuid": "aae1abbb-6111-4b7f-9956-83a7173a6689", "value": "12288:74u3ebK3ey5cByVONai0n1ZLInGmi1VHAK71SEs9MIBl5QCjjkXgWprs:MyebK3r5ckxzn1ZLmeVHtSEmSeYXDprs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686558764, "uuid": "8a29cae9-0cd1-4214-8fdb-845a3545603d", "value": 707228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686558764, "uuid": "b2f462be-4bc5-4e5c-a240-304cb606b6d9", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686558764, "uuid": "91e9b45b-cbeb-488c-9482-b4c6dca12ed2", "value": "FUNDED SLIP COPY.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d944d2a7-092c-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686579872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686579872, "uuid": "c7f08cfa-f460-4c17-a150-a03be970f8c0", "comment": "Malware payload", "value": "b7de2f74d35caa881ad5c48bed86682c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686579872, "uuid": "4e794080-c121-4458-bf7f-5e952759365b", "comment": "Malware payload", "value": "8e23f0162f04dc652ae2c44bc717367211263fd4325e5bbbf4fed5998a9c73d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686579872, "uuid": "9fd487ba-89ee-4d93-98e4-60e3700ea41f", "comment": "Malware payload", "value": "1186bc4d85613ce288e1ca2022f16663c86a9a9a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686579872, "uuid": "81cf83df-2df0-4496-9051-f403806a488a", "comment": "Malware payload", "value": "00368929c40351aa6bad4ecae60cad9f3f4fb2a6650e24080e75926258dd4b56bae84e59364e2cb0312ca967582830cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686579872, "uuid": "f5aad5f7-7e7a-4772-a7e8-05017281dc6a", "value": "T145E21A8AB981CE16C5D063B7F61F82DE3726538CE1DE7303DD166F657A8A85B0E2E101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686579872, "uuid": "310ac464-cc8b-4cba-a5c6-fa837db5d7a5", "value": "768:/FUAeGtwcdLOv4R2+mioNZ+j90ISyPd7rk8ZS:Okw/+yUOGV7S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686579872, "uuid": "2dbf9c55-834e-4ebd-ba1d-cff05eb3b359", "value": 33596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686579872, "uuid": "50ca436c-7a87-48fe-8296-69ed94db4998", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686579872, "uuid": "61fd8ba9-9c7d-41c7-a690-e4a552d0ba52", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a12bcf25-0902-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1686561739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686561739, "uuid": "bfb4313f-b975-412d-a024-d2833cc408d9", "comment": "Malware payload (RemcosRAT)", "value": "a56017405c5e11a68dbe6be86220bccf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686561739, "uuid": "4463c2e6-5172-4aae-8c4f-390cd90cc2bc", "comment": "Malware payload (RemcosRAT)", "value": "8e861cbf43bd4068930cb5ef3821cab163fad49d42b77c66b70fff8fa038db48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686561739, "uuid": "4ce8ae45-57a0-4cf1-b3c5-b91e04256f5c", "comment": "Malware payload (RemcosRAT)", "value": "c9d59060e3ee281c52aff93261665ea006e64f18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686561739, "uuid": "03f8c183-cc36-4e36-8d66-177b204482a7", "comment": "Malware payload (RemcosRAT)", "value": "3c19c162349d849756116e1e99a881533711283b74c72bcafe9de3c2a77906480a37cb400d7f20b1af6691c874bbfa75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686561739, "uuid": "531523c5-0893-4ce6-a121-08767eab0045", "value": "T18235012823FA9B0AC4BA7FFC8D146635C3F96D963133E30A4E9334E99D66B5444D0963", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686561739, "uuid": "41f60ef4-6d47-4b31-9a0f-2bde0eacca3a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686561739, "uuid": "48de196a-59c8-4ca4-8ec0-6f9e1ab5157e", "value": "24576:ZY1mOV/NOa9Ji9+kQG0KUzoBxg+fH9L6fJOg9FReq:ZYUOV/NOaQw/ardMJOea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686561739, "uuid": "c4a4a6b0-a171-4de0-b3dd-04e70a0890bf", "value": 1138688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686561739, "uuid": "73687d80-0e6e-4a5a-a273-cdd8c6c7a69e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686561739, "uuid": "923be9f0-4456-4f9f-b32a-b403a6ab2803", "value": "a56017405c5e11a68dbe6be86220bccf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42eb5fa8-0957-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1686598088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686598088, "uuid": "24d0c0df-0ef2-40a9-a4a6-7f2cdc4f314e", "comment": "Malware payload (Cobalt Strike)", "value": "7801672edfa75401f81ea9c3d61e3089", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686598088, "uuid": "4ed51666-2f16-4ef5-a8c5-c8f9467b645d", "comment": "Malware payload (Cobalt Strike)", "value": "8f280957b0f67aaa85e635f8ea7023598498a0ffbe6f8d53d7dd032ca27b632c", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686598088, "uuid": "336d81a2-0a15-46d4-a2c3-c48ada80532e", "comment": "Malware payload (Cobalt Strike)", "value": "f524a9ebc5e96d81c85a53c2dca92875638bdbc3", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686598088, "uuid": "6019ff3f-5f16-4af6-8c82-92fa4a990336", "comment": "Malware payload (Cobalt Strike)", "value": "67f579fc69b5510cc8ccdd03cb56f44f623bb54d75f80c471f6e88ed37468892ae1221eca2d9684154f5e2ca15b3e0e9", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686598088, "uuid": "a32c642f-4e34-4dbb-9fe3-ae04efd01cf9", "value": "T1633559E9F2408134C66523B58CE56659BA356FE437F0808BC0C0739D6F7B5EDAB3924A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686598088, "uuid": "9a5eabe7-7e0e-47e5-8afb-dfbb09e9f511", "value": "24576:jtlcpVGqMpxEqB6JYcphsEt6rss7v5KV:0pQqMpOqB6lp76rL7s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686598088, "uuid": "bcf28dda-b365-4fd4-a271-faa8c8e0fca5", "value": 1077248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686598088, "uuid": "3cca7b48-29d0-4549-819a-da6f89ffc19e", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686598088, "uuid": "e3e03184-fc03-438c-afd0-f545810ce88b", "value": "SecuriteInfo.com.Win64.Malware-gen.30039.22337", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22c67645-0935-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686583431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686583431, "uuid": "bdc55dcb-e726-4af7-98cf-d3217ecd26a2", "comment": "Malware payload (Mirai)", "value": "189b216923a02c5509e89ce7cb55b7bb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686583431, "uuid": "fd4739b9-2e0e-4998-9387-83859a02e285", "comment": "Malware payload (Mirai)", "value": "900be6762351fddfffc2ed0db1dcf85ad325e8d306aefabefbcddd0ca5f667ce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686583431, "uuid": "98f86a1a-73f9-4e9f-b16f-5f5f031d86cf", "comment": "Malware payload (Mirai)", "value": "518cab6f4babbcc00135996da8b33a9bccf10e24", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686583431, "uuid": "5835b3ab-59f5-42fc-986a-a83357bf05f6", "comment": "Malware payload (Mirai)", "value": "428588cdf0a39c4719eea323b3670cdbde0be915cf0b2873a5e4e6dccc938b3dc7af2bcb1b161a014415406f9645a1fd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686583431, "uuid": "3e9c6923-0ab5-448b-8951-9b22d1cb1361", "value": "T13AA2E021BF1DE98FCD37B23886A9E5C692D07D60D3DCC9466781C11FABA36846820E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686583431, "uuid": "a3233d78-0e35-4c66-9da4-210442b8b7d7", "value": "384:Mg9Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaQNAr8vcoBAvP+qNV+KLebRtkSyb:798o08kxofBE+ZkXaT47C2Epitwb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686583431, "uuid": "57fb4132-38fc-4e5a-b999-66e171812b12", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686583431, "uuid": "fb17ffe1-77cb-4738-907e-84667ca54682", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686583431, "uuid": "9e4fa3f3-fe36-4104-ac01-67f9e41ae530", "value": "189b216923a02c5509e89ce7cb55b7bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd2bb46c-092b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686579422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686579422, "uuid": "28a13bc7-c038-459b-99f9-d175306a12cb", "comment": "Malware payload (RedLineStealer)", "value": "018133d0320b59b54b4df8d0e68447a3", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686579422, "uuid": "3092e705-2867-405d-b0aa-06e31a54dd60", "comment": "Malware payload (RedLineStealer)", "value": "90296bb0377ce9b5a0a2261b6ae3845f706a5c9b7cfe9d84a09a609f584e8d80", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686579422, "uuid": "b24eee0b-96df-4e97-a469-ec5387a68d03", "comment": "Malware payload (RedLineStealer)", "value": "09814c4aebac944a314a2488b2d7fff982ff077e", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686579422, "uuid": "8379ff61-6707-4cb2-bb8a-f6acf5537c9f", "comment": "Malware payload (RedLineStealer)", "value": "7e8afc01d8eaf359314ee0faa9448f74642e1ca07e87828aeb7d98a10041e4042c78c504ce691d239374b3976e4dd3d7", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686579422, "uuid": "a54ffc06-6df6-4534-876d-9d6421c2631d", "value": "T16D663327AB63AF07DA6D4CB24D46823100974EAEC260F143B664E96F14BD3F27B615C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686579422, "uuid": "29221eb9-3d22-4bdd-8f15-60d1bd908813", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686579422, "uuid": "5279aea0-7689-44f4-b94c-253417b26395", "value": "98304:meIAkfJ/2UUJ/8gz7pZdRDt9xTGemOhKWsP2F/FaLQA26J5K+YJQdI22/dtN6JF5:mxUJp7lqem5WsaA5e+YJQdIB1K1FJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686579422, "uuid": "5c3521c4-12e7-4646-811e-d66f84402611", "value": 7097856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686579422, "uuid": "d39609b2-d88f-4300-a293-2a76ec2718a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686579422, "uuid": "c3b1dd6b-fd85-4ac0-9628-d2e3e0ca9602", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cce53185-0907-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686563960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686563960, "uuid": "e67289c3-a56b-4a2b-a372-aa27c2ddd0a8", "comment": "Malware payload", "value": "20d6f6ac44d18e9ac76adcb983329257", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686563960, "uuid": "06e3f9b1-5c78-4158-93f2-1571070b27e8", "comment": "Malware payload", "value": "9034fd219b35798fc9dab05a9c3713f008ef59316fe77fc565291d79bdbcef7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686563960, "uuid": "4af18456-8604-4523-b3d1-cc16eb983107", "comment": "Malware payload", "value": "185215e0ab285cb9b620042af371104436e7b56f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686563960, "uuid": "f526e892-f92e-4743-80d5-9303be7bc1eb", "comment": "Malware payload", "value": "1ea79433241842ab8af1020eaee9386b2c1fb056a746ea0086819a1b0089af102e826b93a3b7cd35835eefb41c15ca8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686563960, "uuid": "6fac9034-aca5-40e8-b5d0-8cdc6598a3f4", "value": "T18D646C02FA8154F9D56BC430C6424A66763278CA0B31FAEF168562793DBB7F49F3D248", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686563960, "uuid": "063d4730-1e42-4d75-8eae-8817d2b37448", "value": "7cd0bbb42d4b316f99f5cabd76b4bcaa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686563960, "uuid": "8be1d49a-1af5-4d97-afa1-1f6ca96381c0", "value": "3072:1NbwPB64IPZ9jwMVuG74CHy/8c77uv6tvkNN0P3ohFB2Nf8aTVcZpaKW:1Nbwp64ijtVuG7Hy/7uv6tvNP33K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686563960, "uuid": "d908ca78-4e67-434c-8a80-96c42386746f", "value": 322560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686563960, "uuid": "8d9d2816-d1f4-4fbe-b097-f1184d85d6ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686563960, "uuid": "0cbb19eb-194e-4695-9f4a-818178f9998a", "value": "elevator.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "203ad3a3-093a-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686585574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686585574, "uuid": "f5bf7a3f-3d26-4001-99b1-719b8f248ad4", "comment": "Malware payload", "value": "6bd2dcd2225106bdd31c0d62162bddf7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686585574, "uuid": "2b378571-4b57-45c7-ab61-bbda8f5e3cf0", "comment": "Malware payload", "value": "916cee3a37e0d1d3c0eb8230a591a3ef8721b7ea8186014d334bc7c8eb40c515", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686585574, "uuid": "5643102b-6b3d-4cde-b59b-845f1877c5cd", "comment": "Malware payload", "value": "3416d3c904100f5bc08035318592c44fccdbb90c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686585574, "uuid": "fb2074ce-95c6-488c-9e84-6105544febbe", "comment": "Malware payload", "value": "47a7e5ea73e7bc70a4cbed7839d999d922434c246155dbeaec52fac7781ef61f58ec512ad373e7ce7f3a1316d2f67999", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686585574, "uuid": "638024e1-c374-4a8b-b566-51ba093b488e", "value": "T115456C10F651C035F9F725F54ABEA3796A2DAAE0172490C793D81AF99B356E07C3830B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686585574, "uuid": "19359e23-ecf1-4450-bf31-6390e2bec84c", "value": "4b8d9b10a87ce85e3422e8d8fdc1fb82", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686585574, "uuid": "6b423ed2-977c-415b-81d4-27cf0f7917a2", "value": "24576:5eUAjB9kEWAPifbyqVxwNLjYeKrQd9sayHKFcnnJsORqvgBF9k:5ZyELbxwNoeKeMHlPk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686585574, "uuid": "65b653cd-7759-4a51-adf3-842662caf7ea", "value": 1258496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686585574, "uuid": "4b54ea7b-51d5-4fc9-a8e9-4ff33f768563", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686585574, "uuid": "44ac4c66-309f-41ce-8da7-b6b7db93282a", "value": "SMS-Activate\u63a5\u7801\u5668%@8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bbf5ff4-0939-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686585272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686585272, "uuid": "f187c668-14ab-4d01-a0fe-293b69c821fc", "comment": "Malware payload", "value": "f5031d649936417ccde13d0c009b01af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "keylogger", "colour": "#66C828", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686585272, "uuid": "bb74d1ec-23b1-45d8-a67b-6e4e67d3c509", "comment": "Malware payload", "value": "91a409c414131638c3549c624d2798dab3b3067f13ad4dd949c84e35d986b072", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "keylogger", "colour": "#66C828", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686585272, "uuid": "b7013e2e-43bb-4d32-abf6-ddbb127058d6", "comment": "Malware payload", "value": "0c52c19b9ffc94cf86fdbaeeab4c22f72c7defcf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "keylogger", "colour": "#66C828", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686585272, "uuid": "b28568db-3552-4054-87c8-39ad6247ae9d", "comment": "Malware payload", "value": "96a0892a4fede80ce82147e6264d09e7cb279c77b7f21e41ae1b51ebf0195e44ba4ff417ecbbb16b790e5aaef936c4d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "keylogger", "colour": "#66C828", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686585272, "uuid": "7713d041-48db-41e9-8251-1eae688fa95c", "value": "T1F245331AF5877DA5D00C29BEA67AC91C37255E248305A422636EB7DBCFF4EC3654220F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686585272, "uuid": "82494be4-461e-49e9-9dcb-1a276f38a60a", "value": "725998bd251fc7e7bebb8bb06526ee13", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686585272, "uuid": "adbc778f-a8d3-45be-8617-b7dc9faac650", "value": "6144:xFOwywzufMBqLH9QyVWEkFS7sDJoiIkojhCo4CqeTqUsGlbiq6jCzuW7ZcNLI7h5:xFQkF8kIkolCo4GTqUflbiLKhJNPSso", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686585272, "uuid": "452a697f-0ec4-4a2c-be57-1a05381059bc", "value": 1261568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686585272, "uuid": "4fe5b1b7-1986-4380-b988-61e834a2570d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686585272, "uuid": "b288434e-859c-4db9-9d05-7d0adf9e254f", "value": "v\u7535\u81111D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26672a64-0902-11ee-b3cf-42010a9c0076", "comment": "Malware payload (LaplasClipper)", "timestamp": 1686561533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686561533, "uuid": "86497521-035b-423a-a256-c9b6ebf776ab", "comment": "Malware payload (LaplasClipper)", "value": "39e1f49a6042aceff8fed09cb3085005", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686561533, "uuid": "a1093146-8fd9-4dd5-8353-0f7a4ffdeaf3", "comment": "Malware payload (LaplasClipper)", "value": "91c807a3b304b61e268d884f3310e7b4c0cd74400c95c48ff7bc6ab6150282ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686561533, "uuid": "26eca67e-cbd9-4d4f-bf8c-8e68c87a62ce", "comment": "Malware payload (LaplasClipper)", "value": "d1ec91d7f709776514ce122f43ed78576dd76c79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686561533, "uuid": "4ef3ca27-ba9f-4320-ba07-ce29c40024ea", "comment": "Malware payload (LaplasClipper)", "value": "1485889f5fa9c9e0ea6ad70a13ff2be226dddb5ee3df61e1314db7c53ef0812868a9a97fa216ebdd76ba988a378a0517", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686561533, "uuid": "e1c464e4-aaf0-4bbd-ac54-e5003d7f5689", "value": "T1873549313495823BD07E243949B1665F4A6CFEEE03346AE73798387A99302D16FE3572", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686561533, "uuid": "7fd29f59-a205-4eba-b82e-038d7b66e54d", "value": "527b682a1f3f91fa6516fa52d71c731d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686561533, "uuid": "93d49249-5208-4cf8-aec0-0e83b9c878eb", "value": "12288:LR5lMAN4B9tdhJ3mfCqgdDOImbiaobw5:Lni7J+gdD8bmbs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686561533, "uuid": "b4fbb21e-daf5-4713-ab2d-a322cdc14b6e", "value": 1116672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686561533, "uuid": "4b70b1dd-5957-4447-9857-fd9bf2c54f19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686561533, "uuid": "58078868-9eaa-412a-81c7-e42bf6967c09", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a1671c3-0960-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686601912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686601912, "uuid": "23daaa7b-ed1a-4ef6-bdbe-1eb370a5cb48", "comment": "Malware payload", "value": "b8723176a783b0cd8b0de444a2ed1636", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686601912, "uuid": "f65cb774-c660-4c33-bf9e-fb32826594bd", "comment": "Malware payload", "value": "92bcc91ea249feab6523aea0d94f5e476feedc8d5a726bbbc76f6860855e0a4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686601912, "uuid": "a3ae86f6-60b7-4176-bb00-838932c8f3fc", "comment": "Malware payload", "value": "d8a2a633fae3dc174821712d304026d6f72551d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686601912, "uuid": "96c9829f-6398-4cd1-baa2-63a6d491cd5c", "comment": "Malware payload", "value": "34f8201f8ccd3d983da9a7ed8d46d62765673a21b72bbae0ec918be4e782dd600565bff7b9bd4bc1b51051027b7f90ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686601912, "uuid": "3008b0bf-539f-4f02-95af-2648775cfc87", "value": "T1BBD36C1773B530F9E4778639C8A14A16F7B6787207659F5F03A042A62F232819E3EF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686601912, "uuid": "e6993e92-a77b-4431-b48d-86f65249c116", "value": "e6eed02974b29af22831389362750616", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686601912, "uuid": "867b6b54-770d-446e-b7f9-17d313ea36d0", "value": "3072:wh7nZdc/qGS/rTdy0zEUpdAowH0iVtpdo:OPc/qGI9VztpCosm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686601912, "uuid": "750565b0-7b31-4402-b013-fbbde7af8a85", "value": 139776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686601912, "uuid": "71a3aeed-09b7-46b3-9074-998a45c96f8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686601912, "uuid": "eb966460-08b8-426a-9298-4b4066dbe24f", "value": "RpcClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1ab94e8-0904-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686562652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562652, "uuid": "f39cdaae-d8de-4fd3-b3a0-6ef1f42267fd", "comment": "Malware payload (Loki)", "value": "d4b8d4ca6b8a73afc1f1b365b91b1ae6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562652, "uuid": "3e01eb5f-b75e-4b75-88d0-3f8a82d7a0fd", "comment": "Malware payload (Loki)", "value": "9329a473fbc644201fef14d26d708eca73a6d524c629c6b2881527525bfff3a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562652, "uuid": "1a0433bb-7aa0-4d9a-87ca-5267c1bd8d38", "comment": "Malware payload (Loki)", "value": "9265e00f0c2e6c3bbe38f1346363f06076f36136", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562652, "uuid": "67cd0d92-8607-4b22-b818-355b2f24636a", "comment": "Malware payload (Loki)", "value": "697d371ded93790feda1586b9c0cd3e1633de0f182ef46ed423283cbc14994a4790ec8d149c5c461cf7e67faf7f49b54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562652, "uuid": "d62d8e21-d3cb-4f55-b998-3bf1cb12034f", "value": "T1F4E4011937FA580FD65E3FBD1D200170CAF9AD463553C38A5E9B769EDCA4F400A81AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562652, "uuid": "f6dca677-1a68-4b68-a640-fce293eb6a90", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562652, "uuid": "bbae7ff6-8653-4ff7-8e34-e8f1dedd021a", "value": "12288:2uyas/16/YHmM9mARLAV+/3uvnVFS5LAsy6hMDvzeuim6UxZZqqLXi0:20s6cV9mA9ImYLgAbRn5qqjh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686562652, "uuid": "15f6839a-bc04-4a3e-8223-36a7fe8be06d", "value": 691712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686562652, "uuid": "3fb727b9-0d1f-4fb8-8ef9-f8f794f9e21e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562652, "uuid": "e0b19c00-2092-41d7-82a3-3324f9a04777", "value": "Product Inquiry_KPCPU-231.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a990f5f5-0955-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686597401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686597401, "uuid": "344ce7fc-79fc-4876-9fbf-d67c2254df19", "comment": "Malware payload", "value": "7bd00958b9caabfc1e426205700b63fc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686597401, "uuid": "f61911ec-2f3f-4779-9a43-4cdb793b0a1a", "comment": "Malware payload", "value": "93b038797a7f57f38b886395935377b9870c0b7e5db254fa10905149d63f731e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686597401, "uuid": "74f4f20d-985b-442f-9013-9c4f0cd310c3", "comment": "Malware payload", "value": "1eb93896854fe11e47942530ab109a74adb90c2b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686597401, "uuid": "992d6d81-7db4-4232-8251-74e797addc09", "comment": "Malware payload", "value": "6aaf2120b36b07ba7947ac3473e340b15dafe33dadcdb6f656e98e214f7a59e838b7eb6f5a97272876e9f136247bea78", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686597401, "uuid": "77f594f3-b6aa-439d-9a99-68ca615dd01a", "value": "T1B5045C007D81D131E5BF053689BA8E7AFA3DB5014FE158DB27C817AACF316C1A63295B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686597401, "uuid": "319cf12a-412b-4fd9-9bd1-6504a0cdef1f", "value": "56a8c0b14fb0e62143533bda2f2cb1c7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686597401, "uuid": "2bc06792-447c-4815-b8ed-1b5a8b9180a0", "value": "3072:THNrzbMvVEsXrgTsoiq6EVZontPupyeBNXpUZTLAINA:THEEyrgTVZ0PufXZyLrNA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686597401, "uuid": "f95470ea-d644-411c-9ce7-8695889c9925", "value": 181248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686597401, "uuid": "e0f06614-c0d1-4ccf-97e8-8c156ebd9a8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686597401, "uuid": "658ea69d-3d6c-4a5a-9793-123cfe667f52", "value": "93b038797a7f57f38b886395935377b9870c0b7e5db254fa10905149d63f731e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0413e85-0912-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1686568743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568743, "uuid": "cdcc7dbb-1988-4bdf-8145-39b9e733ce86", "comment": "Malware payload (GCleaner)", "value": "bd866010de8d44581d2dfb380fb3feca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568743, "uuid": "f1328658-56ac-4b20-8a26-b1aec6041406", "comment": "Malware payload (GCleaner)", "value": "94bdaa609bbc3539c5857b904d8483813f41d710dd67653d23c301c96a497caf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568743, "uuid": "03b73725-d6dd-4c9c-bc99-4765739a8fad", "comment": "Malware payload (GCleaner)", "value": "5e3900132e3529192b600706d4beb0d73a27e39f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568743, "uuid": "04c18ad5-064c-4e86-bb4c-cbc0b5352a81", "comment": "Malware payload (GCleaner)", "value": "1562b4d61ce8026ab7863eafe4cfa2a4de6ea825289824ba20c4d884dc08317acb71f925245e6be68cbc4f1b600a22f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568743, "uuid": "07d53211-e623-4682-be7c-7608cb42a586", "value": "T15744E0503CE18931F6A3A5348936E6A12BBFB8336A30C58BB6B4125D5E337D16D71387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568743, "uuid": "bd5190a6-b485-4d70-b72a-b5a42c968ec5", "value": "5affbd003e86f6425e6f5983fd37fec5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568743, "uuid": "57040b5a-b42f-4f59-8d20-1df7301eef6f", "value": "6144:+/ExOKwGiIrBv93/8GrxHBfcLkS9Ca/t:6EdwqFR/LZNqJ9/t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686568743, "uuid": "d972d741-9559-4b30-be09-24893177ffb3", "value": 262656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686568743, "uuid": "79de20ae-1c9c-4ad9-ab7a-5f644b046665", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568743, "uuid": "9b441d21-8769-4635-bfa0-af2aaf4a5d67", "value": "bd866010de8d44581d2dfb380fb3feca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df07d9bf-092c-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686579882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686579882, "uuid": "758fb6e4-fb6e-4408-b61d-c41da899ef56", "comment": "Malware payload", "value": "3b5b7cd04df41b7580fb0177709d2c61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686579882, "uuid": "06473af9-7415-4920-a032-bac183715e26", "comment": "Malware payload", "value": "9676b81004eccb7d63afc5d8c4050e97df3232b9328c71860d1660bff553df56", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686579882, "uuid": "4e4f1611-fc87-4d2c-8bca-a9f6d68a1af2", "comment": "Malware payload", "value": "2848c5a3cc86046c6ebd68198babd5cab8ca7a6a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686579882, "uuid": "3c5158b1-858d-44be-b82e-718ea3ae9a21", "comment": "Malware payload", "value": "ffd3d4465e15b2cca9697a300afde7b5b2dfc2047137778245fa4a41abfb78fc9e79a5f402240f899b69284bd91309a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686579882, "uuid": "990a401a-fc72-4de0-9645-ff7cf16587db", "value": "T1A723F74BB991DF11C5D012BAFA1E224E332357ACE3EF73139E146B25774B46B0E2A905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686579882, "uuid": "eb1f389e-3937-4e71-acab-c7055fff3ed7", "value": "768:olngDUAiWgd6ph4MBUwA56ssyEE+sFKLkYfWmu91YMcCDissO54OG1ln2VXS:olnXXL4D4Ksj+sFokY3FMni5OiOG10S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686579882, "uuid": "32aab013-351a-4676-ae59-e2576ccd2d12", "value": 46300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686579882, "uuid": "91d58b95-32a1-4a1c-a783-d28fed283a45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686579882, "uuid": "734bee2c-cdd0-4dba-8e5b-866f98a00818", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7099d156-093f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686587857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686587857, "uuid": "f3d549d3-bbaa-48ee-bde4-8244e120515e", "comment": "Malware payload (Formbook)", "value": "05c3624435fda6bddfd80b5d337eb2a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686587857, "uuid": "7a97e244-5257-49ef-8dd0-08a1e15fc8a8", "comment": "Malware payload (Formbook)", "value": "96a14d1422dc0f5889cdb4d2e110b5dac6c638167509ddf728b9c84f3af40aae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686587857, "uuid": "f3d0a6f6-5bb1-440b-a0c7-2478148592ef", "comment": "Malware payload (Formbook)", "value": "cab9431c6a2bf87a909e435731992708dc508034", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686587857, "uuid": "dd628b92-3f08-4d32-a49e-9709b996c7b7", "comment": "Malware payload (Formbook)", "value": "c6edf25cc8f130b85e3be7456ba81c43ab6e6a39092aeba772d4ef050fb13935e8c6bf0a4822520949566abe6f4f0915", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686587857, "uuid": "334536b6-431a-4670-9ac5-653d90e79c9c", "value": "T1E364123EA11BA29FC615B238CCAEFB8D55F6D655A0474407C0CE27A82D8A794E17037F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686587857, "uuid": "c996e441-7a7b-42fb-943e-b6610ab7c993", "value": "6144:oJInV4P/mWHsj56EnE+ngz0P0LGeUN0G7EdbrNrnvt0J6lN:oJIV43mrN6EEQkpG/N0G7EdlzaG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686587857, "uuid": "cd043624-acd4-460a-ac28-0b2870fb3543", "value": 316416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686587857, "uuid": "dfd28b00-2ad1-4981-8e51-dccc36a7eb2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686587857, "uuid": "1f23b4f6-386f-429d-8837-8e6a590af188", "value": "MatrixHackByFilard.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc9fdd0b-0902-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SystemBC)", "timestamp": 1686561812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686561812, "uuid": "2e241271-326f-4e49-ac25-0e29a4d98b0d", "comment": "Malware payload (SystemBC)", "value": "0c0827b80b8450ed442d0a5afbc1324c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686561812, "uuid": "ff0831d0-88fc-4e61-b090-e48c7bf02829", "comment": "Malware payload (SystemBC)", "value": "96bb40eaf29d3619c016a62e397e02761e898f342ab4dfdb52232ceddc13846a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686561812, "uuid": "1e6f33a8-c1a3-429c-8c77-d0fd15aaf166", "comment": "Malware payload (SystemBC)", "value": "f212fc466d539f1b327e0f23269c4d2818e9bbfb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686561812, "uuid": "ca0f13ce-dddc-43ab-aeac-7dee62e22c76", "comment": "Malware payload (SystemBC)", "value": "3fc3598d0af3a5dec7eb662f5a7ad79d2881b05ed66b044a0d12405e682cf6d9030263bc5eae8feb0d366e8027c0454c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686561812, "uuid": "c5b3dd06-5556-4681-8fd5-fb904f74c504", "value": "T147159D40F4D0C431E57311324DF8A6BA9ABDBC21476758EB6BD40E6F8F20AD1A6315AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686561812, "uuid": "0efbe818-6236-4490-800d-c0cebde49f24", "value": "cae5900a92ba6c4de6ecf85e5f8c7e5c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686561812, "uuid": "b9b34f14-e5c3-4fc7-97c5-9590e7a27853", "value": "6144:zuK8X8DB2w0M4/Pwj33eCWhBZMZ0AO5Z1YS:zgXWB0V/Pwj6LY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686561812, "uuid": "df8dc254-fd3c-4015-a61a-1c49d7718368", "value": 945152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686561812, "uuid": "c25a11e2-f6ae-4d66-ad43-d3fead539736", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686561812, "uuid": "ffdc8ab8-89ac-4fa5-aca6-ed52c301faa2", "value": "0c0827b80b8450ed442d0a5afbc1324c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb88bee3-0906-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686563501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686563501, "uuid": "4f6ad341-73b0-4ef2-8be6-170365a485ce", "comment": "Malware payload (AgentTesla)", "value": "af91bd1a0af069b39b3293dcd50bd4fa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686563501, "uuid": "475d0bbb-b35f-40ca-a251-a812d5399418", "comment": "Malware payload (AgentTesla)", "value": "97ad8dbd6e1db83248c8ca803510f18477375e1b5ef37d7cf2811ff565346c09", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686563501, "uuid": "19894119-e811-40a6-8bfd-9e425a140709", "comment": "Malware payload (AgentTesla)", "value": "9ff4d3d6a7f355d9114dfccd620c614ab4b2632e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686563501, "uuid": "3f603055-24e2-4c79-8824-33db14b411bc", "comment": "Malware payload (AgentTesla)", "value": "b8f727fd6da2bd2d0854595003919155638d8b76f86cfc4b0aed7c88b64c0bd016bb96a735c299afe6f4ffeabab801b9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686563501, "uuid": "00ca0f68-639b-456f-8fb0-65b4d124820e", "value": "T1F274016AAD808D59C8731671443A9B220D6BED64A4501CC727F3391FBC37CE19ACA7B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686563501, "uuid": "2086a3d9-8d93-4503-b623-6dafe08da100", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686563501, "uuid": "4fe23727-9fbf-452e-9011-3c0fef5ddfd7", "value": "6144:wYa6RQq1CWmEkBpbf5VNuFOuvsWn4LVpikZ4jKyxza0Q8QvNn:wY3rADN4b5nWLKjR9W9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686563501, "uuid": "02dd5a27-13df-42b1-a530-ead9ff1cd606", "value": 337968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686563501, "uuid": "4a07ae6d-3ea0-4202-a975-ef3bd32c8a08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686563501, "uuid": "ba593141-744a-4d06-8a83-7e5fb7ae6a25", "value": "RFQ_0932000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "267d503c-095c-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686600188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686600188, "uuid": "10d77f54-6844-4963-afa1-3f1fa7dcba2b", "comment": "Malware payload", "value": "89e654eb46d8778dd74873aff5536ccb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Silver", "colour": "#9592AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686600188, "uuid": "9e59f012-37a5-4dd4-a10f-ea6405efd8af", "comment": "Malware payload", "value": "97fca8c72a1dec07e15780f3e7299d6652c86b8be4c603493116657da0b84fc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Silver", "colour": "#9592AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686600188, "uuid": "d5b9e42f-37ec-497b-b94a-e833ee786bef", "comment": "Malware payload", "value": "eb1a06e7a8fe1003f2dd06619f5cc3d205678f5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Silver", "colour": "#9592AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686600188, "uuid": "e373c71e-f0f4-460a-8c12-4e3613507e23", "comment": "Malware payload", "value": "fc9179713a8b34958b3bf3b2c5e75f64b2f392d3c6e4dbba6ef5f90088f78e6ae077dd95237140644d51b52f6b37270a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Silver", "colour": "#9592AF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686600188, "uuid": "f2c1dda1-8d39-4dd2-9a06-95d0ed72a052", "value": "T152F60907F89615D9C8EAD1B489214171FA70785C0BB933DB2BA0B7B42B327F45E7A790", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686600188, "uuid": "098204d4-89a6-4312-99ab-d0dc93be69f5", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686600188, "uuid": "d16f4180-018b-4898-99bf-d9de5600a286", "value": "98304:eI+iKpf4Omt+/N8xNzaoYJEjczox4uwnEPcsnBy5C2v:eI+Xel+uxNzEJJzomuwEksE7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686600188, "uuid": "e745dab7-3638-4f6c-88a9-3e708030079f", "value": 15427584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686600188, "uuid": "e6c62db0-8bb8-4cb5-86a0-a18b76b080ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686600188, "uuid": "42622356-efa3-4c42-bc3a-4cc9aae9ce4d", "value": "ss.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe217a60-08bc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686531830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686531830, "uuid": "222fcbc0-af9d-4d0a-b4bc-65d2cd741ade", "comment": "Malware payload (RedLineStealer)", "value": "115d00a03367c51c109d195239f60772", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686531830, "uuid": "4db5f8a2-3960-4459-9a8a-3b42b917e904", "comment": "Malware payload (RedLineStealer)", "value": "989e06b1895a3580491046a25415d7b1249e9613ef42c1df93c7e14b1a74b479", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686531830, "uuid": "87602f62-496d-488e-b02b-66a00383c40f", "comment": "Malware payload (RedLineStealer)", "value": "e1e7ef8dc4077c1139c67b129bf69ab5552cf9ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686531830, "uuid": "5b8e8227-1c96-42cf-8f5b-12242147a375", "comment": "Malware payload (RedLineStealer)", "value": "eea40c500c3f08cc6853f146f1b5b250354a0a0f8b39c5b84f07b3f44de504537ec7a95d37ba704f2ec18a8f6303d392", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686531830, "uuid": "fb120cdd-6089-4dfe-a332-3a34460a2db7", "value": "T17D04D558364BA57ECA6F483DAC700CE46A7CBC661246A7078C8EF4E43D3A7919F151F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686531830, "uuid": "240de429-7959-43d2-a9bd-329fb85cbaa6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686531830, "uuid": "c5bd4899-0563-447b-8518-27723cf54329", "value": "1536:8LCMmb36sv0W7T6brprHtRAMWQM2xNxcYQHBbuf8I7K8A0GkRk8e8hh:oCBh+DRzJM2xN5U9kK8An8e8hh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686531830, "uuid": "5fed680f-6dc9-4061-a2a2-05b94a58c3e6", "value": 177216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686531830, "uuid": "c9a95eb7-e2de-4eb0-8042-e72b06ff9f17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686531830, "uuid": "eae50388-18cb-494d-8ce7-6c0d89978a7d", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dc20c1a-0902-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686561492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686561492, "uuid": "f7422f8a-cdfa-4506-9c25-2a5d42e5cf13", "comment": "Malware payload (AgentTesla)", "value": "87d0f1e09af16b80b0ad2d82c7ffae7a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686561492, "uuid": "3f4408f2-6574-4384-a62a-81accac584b9", "comment": "Malware payload (AgentTesla)", "value": "9946f5627aca5f1aba7618580b518bb502b4b7f6c8b1002685a3e4227fce0d10", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686561492, "uuid": "77f27118-5df0-4aa9-b018-1cbb86c9cab3", "comment": "Malware payload (AgentTesla)", "value": "514b36b0f93a504469105dca131908566e8708b5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686561492, "uuid": "df298311-7f25-4872-a9d6-bb5473c11328", "comment": "Malware payload (AgentTesla)", "value": "ab7e4ed569aaed2d6ab54949d4e0d946407bdde3bf1fff8740952d656f784b8ffa56915291154632a791b3cefb7cea5c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686561492, "uuid": "b76be880-e235-40fd-9160-1546b6752b70", "value": "T1A1F37191BA27ECB7E921427476B9F22211475F237A10CE552AD3B01E03F3B907CB9D4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686561492, "uuid": "1d04c46c-b691-448e-b2e5-04a4026f4b6f", "value": "3072:TrIkZ+RwPONXoRjDhIcp0fDlaGGx+cL26nA3XN2/RrjZS5PgbYbYRClYMj6q6XFm:ThZ+RwPONXoRjDhIcp0fDlavx+W26nAZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686561492, "uuid": "1b124428-e5b8-41a3-9102-2cba09cfb2e2", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686561492, "uuid": "f7a97197-aa82-4a15-90a1-5d60eaae166e", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686561492, "uuid": "7919df62-0212-4cff-a69a-672c60b13b78", "value": "PO 19743.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eda8ade3-092c-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686579906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686579906, "uuid": "dc9bd15b-c056-43a5-9850-f1b392807467", "comment": "Malware payload", "value": "dbb6181f73d814e042f4683d1734604f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686579906, "uuid": "869ecaba-50f9-4c49-a065-30f250ae9815", "comment": "Malware payload", "value": "9960b64e437d891bfe623e5b077a49a8037b66b974c3510155daaf8a0035cb8f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686579906, "uuid": "b649dbfc-203e-4be0-a2b5-65bcf1577570", "comment": "Malware payload", "value": "62e51a96c84f9a76c87743a50cf8beb0446d49bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686579906, "uuid": "be7d8e12-f4f7-4811-9bdb-47e91d2ac5eb", "comment": "Malware payload", "value": "b4a0db101cfb30468b5427323ef50785b642ecc8847e6cdc77dd202f5bc35438781e54d9b115b4a266812c7c9bd48b6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686579906, "uuid": "d1c2c01c-fd90-485f-8b08-b5fb9ffe623a", "value": "T17E3364192E32DFEEF7ACC33447778A30969473912A91D148E26CEA095F7020EB55F7A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686579906, "uuid": "a51ab4c4-e3c4-44fb-ae33-fd804360cd2f", "value": "768:Mz0E/Wts1jPQxn1cRSxe1ZpR+zrZa5UEo8qKUASbqSTSTSTSTSTSTSTSTSTST9Ll:rCjIgRCe1j4fa7L7Xt28rxS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686579906, "uuid": "c69f4b23-23e5-4776-95b2-9b2505458bd2", "value": 51224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686579906, "uuid": "b6da296b-9369-4369-8aa7-c527880868fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686579906, "uuid": "fc56182e-beac-4af0-a97c-60e8f92c782b", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80f0e7da-08f3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686555242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686555242, "uuid": "dc980ed2-25be-43c0-8c11-b252aa18e05d", "comment": "Malware payload (Mirai)", "value": "db38730a192d6f47917c82b937017135", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686555242, "uuid": "2de6a25f-01e5-4025-8186-89db4ed836da", "comment": "Malware payload (Mirai)", "value": "9a755882b9304db54b494a9d69ba8f7f51d324727da5935d27c55531416be330", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686555242, "uuid": "d1877c70-8279-4d84-a779-eff9bfe8e5e4", "comment": "Malware payload (Mirai)", "value": "c215da33b59349dfcdb218ac6b83d93aa7d1b735", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686555242, "uuid": "a30b629c-ade9-4b4f-8d19-d98428d2a39c", "comment": "Malware payload (Mirai)", "value": "94278a14f3336ce00f776fde54cb45b0a4e407976901ca5a4d72653a4a9b65fbede3186d15e140420fe3c50471ae13db", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686555242, "uuid": "8b63e097-b501-42fc-951c-45192883f830", "value": "T151E3F9C2A9527E36C3C39BB7FAAFD00937A39B54D397230194586FF05E4B98D0D1921A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686555242, "uuid": "6b04c16f-7eed-4f1d-b3f5-a2e31c63a77e", "value": "3072:s6mXAkjXksvawovnKYLqJVIvVbGw4MJ12:oXAkjdawovCVIvNvJ12", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686555242, "uuid": "7cf5495c-f098-48f9-88af-de2b5ff94024", "value": 143988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686555242, "uuid": "c86b1c53-5b27-4f87-b5fa-78048b3fb2a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686555242, "uuid": "d3fffdb5-d935-4a35-891d-e8fc20407aea", "value": "db38730a192d6f47917c82b937017135", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbbf5c37-0904-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1686562642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562642, "uuid": "bf589a54-d4e2-4bdd-8de4-9f26b4acde8c", "comment": "Malware payload (SnakeKeylogger)", "value": "bb41e0c7e253997200ea8e76aa8a459e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562642, "uuid": "7a920b2c-d259-4156-8f16-97f16f27b993", "comment": "Malware payload (SnakeKeylogger)", "value": "9a9c787236bf745a2c6a8566ce6e8ec685d835663865a97caf1a1e9a034f5486", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562642, "uuid": "3797266a-3d97-47d7-a2a7-9f3dbb114cde", "comment": "Malware payload (SnakeKeylogger)", "value": "34e98f74df552f860a13857b9080a48ad4fc4d00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562642, "uuid": "71d86f22-c8ff-4e38-b07d-62e59b38270f", "comment": "Malware payload (SnakeKeylogger)", "value": "13c20b67fb5e7907ce30458c30a3a41893d573775d3437541048faf24a339e67ecfd3fc0d509c02ca6e82d60740cb8d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562642, "uuid": "bcd82e3c-02e1-4066-ab05-c24ccfa19d7e", "value": "T13D45BF32B2D18437D1731A3D8C6BA3A5982ABE512E38794F3BF41E4D9F3D68168152D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562642, "uuid": "98ae90a4-0dd0-4293-84da-8cb1c7fe77d6", "value": "332f7ce65ead0adfb3d35147033aabe9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562642, "uuid": "d1d67ea2-368f-4a8b-b985-850976307b37", "value": "24576:YnsJ39LyjbJkQFMhmC+6GD9+Y/nVEh8HBxNp7FfJwgXjK:YnsHyjtk2MYC5GD9v0OLPucjK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686562642, "uuid": "a73b8b06-c247-41df-9679-f332075643c4", "value": 1164800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686562642, "uuid": "ffcfab90-9984-45da-b316-62c0c0c386e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562642, "uuid": "ae0a5288-7282-4e1b-8f6a-f9416b6db531", "value": "EKS - AND. A 100-150.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbe689fa-08bb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686531316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686531316, "uuid": "eff9c3e6-05cf-416c-aa7f-be399952cfa0", "comment": "Malware payload (Amadey)", "value": "11faf30b9a350c66e0491e5d01685a36", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686531316, "uuid": "aff8db32-aa28-4eb0-a1aa-cc73dc3ec4cd", "comment": "Malware payload (Amadey)", "value": "9b558df6585ee7a7ceb9570573175fe23f71401f3474077ff08d6704ac10cfbc", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686531316, "uuid": "e538cd51-16c5-493b-979f-ae5b472ee4dc", "comment": "Malware payload (Amadey)", "value": "6d6e12f0dfdc47c75fc3d7dcdcce4efc51e1e454", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686531316, "uuid": "ecb04389-d588-4e1c-909d-92ebf752dfc6", "comment": "Malware payload (Amadey)", "value": "41336a272b970d3970d2a2bb6e0bedbca0b877e1f50d7e3d35f10711343a55aab4766bbda1825d8024dbcaded6248aa0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686531316, "uuid": "67d4334b-999d-4325-897b-c5396030c2be", "value": "T167F4125679F8A473EC7517B04CF203C31B35BDB119B8A3570346AA5A0872BD8A93276F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686531316, "uuid": "4ea2750d-1062-4ecb-b3bd-d4c3cbc2b901", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686531316, "uuid": "abb38d0b-f30e-43b5-99f4-7cdfb5025c95", "value": "12288:nMrNy90qPBqMG1zQ5VjNmVrUwIj4XSwlSgVhPr49yTQxfwS8iU3I6:uyTczQ5VMaw4elSg7s9yExV8iUY6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686531316, "uuid": "7120d618-dbc6-45c7-9f44-494c7f02b1c3", "value": 742400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686531316, "uuid": "bde83049-6a10-4df3-92d7-1879a6a5548b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686531316, "uuid": "86b6925d-2d7d-4ab4-96ec-ba77aabdc6b0", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebeb08c1-0967-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686605243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686605243, "uuid": "f9221da5-02c7-4d34-84a2-3e791daeb3b3", "comment": "Malware payload", "value": "057604b4bec13ae8ced06b6a202eda0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686605243, "uuid": "f0726849-8059-4b87-914d-d9de9c2758eb", "comment": "Malware payload", "value": "9cc096fafe1169aa105eb830f1743621faab1dc47e16d142b94d9d739a9f05be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686605243, "uuid": "9698b82f-1531-4ca1-83d4-198877930258", "comment": "Malware payload", "value": "b3e58af51f867db15f49487baf2e1a82ea8e5dbd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686605243, "uuid": "3b7e6d05-c0ab-423a-992d-e557bac9161f", "comment": "Malware payload", "value": "779ee292e147f8a8f09addc1c8af078d546547725d8f79154b1dd2e29036f8986faac348d58ce22c7c68f1b034621bdc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686605243, "uuid": "53d9bd64-0c5a-430d-8fab-dccbdb02c411", "value": "T1EFB533AB427C88D3DA9F743BAA4909A6741E249ED7C83C3487F85B0B72FD552031B51B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686605243, "uuid": "c77e4f1e-7aac-4870-90e9-e683b63e93cc", "value": "d90acf8bf9822f2c7749a773329c6e8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686605243, "uuid": "cbfb0412-5050-4737-9c2d-91b81c138abe", "value": "49152:fCnZ5YeC0e32WlWa03UZOAibh8CyNb6TKGWeaJmV:fC7/9qzlWa03UY8C49U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686605243, "uuid": "77ae36a7-f9b7-451e-ad47-c424e7af8178", "value": 2290176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686605243, "uuid": "cacb4fd2-0fa8-4314-ad97-45d0037be440", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686605243, "uuid": "057a43c8-4f34-4c1d-ac70-5094b56d169b", "value": "SecuriteInfo.com.Gen.Variant.Barys.434263.9180.17617", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff7fcf7a-0912-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1686568769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568769, "uuid": "580e410b-eab8-4100-b717-b2cba55715db", "comment": "Malware payload (GCleaner)", "value": "0a0dab46b80375cf523bd03154a93d41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568769, "uuid": "193b2fde-9f5a-40d1-9712-b4bb9a6c048b", "comment": "Malware payload (GCleaner)", "value": "9cc77f14a45bf56d9a670b057ee5d05c88fda7874373c372b5335b035976792d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568769, "uuid": "37e33e8a-df2f-4c9f-91ec-6a55017b16ba", "comment": "Malware payload (GCleaner)", "value": "00dae9aeda4bc9c23a742aebbb939707df978906", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568769, "uuid": "9f536689-84dc-4ce2-a9cb-fd6df9cadc83", "comment": "Malware payload (GCleaner)", "value": "95b2a40811d8da8529df9417a85811f85104b4b645e158bdc25b94e16945f2e88c372ae20d323241ffdbe3f6632ea338", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568769, "uuid": "c9142229-54a2-409a-94df-8c3b94200925", "value": "T17154D05138E0C831EAF364348D34D7E56A7BB8665938998BB2A43B5F7D237C25A70703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568769, "uuid": "20edef87-66c0-4a89-9c7e-231e669be608", "value": "99f427a37c6c1a1f0f727259f833cfd6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568769, "uuid": "19ab2981-ef60-41cd-805e-891c9cecc1dd", "value": "6144:jLrVo+huT3MfwopY2/wWZIkn9sd/yLnrufX3t:/ruquTcYopHPIkadWruP3t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686568769, "uuid": "899c1f67-c9da-4c26-81d7-0a4c6f690517", "value": 281088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686568769, "uuid": "bd1c5280-f366-4f17-ad8c-db9924cbf67e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568769, "uuid": "75caa9a2-0cd7-4c90-aad1-d05277035931", "value": "0a0dab46b80375cf523bd03154a93d41.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c47ec64-08ba-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Fabookie)", "timestamp": 1686530673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686530673, "uuid": "aad1e55f-f979-408e-b574-a07b09b7df9f", "comment": "Malware payload (Fabookie)", "value": "a06ec6c0adfcc5034586fbf877e35b54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686530673, "uuid": "90b05d5d-5507-451b-ac25-058990abb277", "comment": "Malware payload (Fabookie)", "value": "9d4bf2fa222c2fa818ed73796f639d7138d2065616ee126c38b8145723164a94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686530673, "uuid": "3e7a7775-b36f-49d4-980d-ca58588fc2a7", "comment": "Malware payload (Fabookie)", "value": "4278f26913b85bfdc4cbf0a5909e2d810ac583f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686530673, "uuid": "aa3e88f7-4d91-428c-b816-de85f9493955", "comment": "Malware payload (Fabookie)", "value": "5cac678636d7f93679a2bbf215fc5748b908a08b70ac6509e80df951071f4adba0d64c5c44aaf3ee7091b7bc42e602b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686530673, "uuid": "725f7d74-89ca-4009-8070-0f45a3c3c21d", "value": "T166D46B05B6A84361E173D17E9AA3C759D6F23C050B30DBCB5251D7BA2E33AE5893A331", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686530673, "uuid": "287328b9-2c65-4451-9e63-17e3ca460ec5", "value": "3c8dcaebe69607cf65907d4c035ab4d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686530673, "uuid": "b1cc2823-8bea-4866-a6d4-182a0cbf5ef0", "value": "12288:3quFnYzy3VGiBX5fYwarPZpBqxVyfndmLB:3qOn0ziCPzBqDem9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686530673, "uuid": "72802fa6-796b-4630-a7ee-2a3818f26af1", "value": 650752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686530673, "uuid": "9d32f57f-bd56-4a57-b911-3822dc0eecc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686530673, "uuid": "517b8842-a8d0-4604-9ddc-6e4cb41c3af7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6f9bc7b-08fd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686559708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686559708, "uuid": "5dfe0c9a-2fc0-4c19-8942-08224c030ff9", "comment": "Malware payload (Formbook)", "value": "f8efcba2959be68aa3ac02e97e57462b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686559708, "uuid": "51d8f122-1cba-4739-9b48-8ba638c1fb3c", "comment": "Malware payload (Formbook)", "value": "9eee55870f96064bcff1483074720ac2f5b19da69ee94f72f04a6e8b8b1e8290", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686559708, "uuid": "139fd7dd-0c88-462f-8ab2-90713e20e26b", "comment": "Malware payload (Formbook)", "value": "12d63474867d4e3f8c9817931e033a7f88b31bd7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686559708, "uuid": "e76691f7-4d89-44ce-94c3-072d7c8ecd39", "comment": "Malware payload (Formbook)", "value": "5324593f9535f7503485cd28f010bcac74b528b3ebb1bf048ce236a83979065e99fd55f3ed8cfaa26d084e1e7226a862", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686559708, "uuid": "23ed5de5-1ddc-438d-af7c-324446ef15cd", "value": "T1E005F12C63AB8B0AC5B63BFD9C205630D7F96D5A3073E34A4ED338EA9C75B544890593", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686559708, "uuid": "f9693fe1-bf5a-4cab-819a-dd47bb333689", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686559708, "uuid": "2efb7f0a-d642-4903-be43-dc8a35327c8f", "value": "24576:jV1mOV/NOa0WXTRVYUtbS+D9+HX1uH5vzIz5Z:jVUOV/NOazfY8bZQHX1uH5vzIz7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686559708, "uuid": "59704e33-3532-465c-9512-d8798e005617", "value": 852480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686559708, "uuid": "913d6f48-b655-4be0-84b8-e01c35cb82ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686559708, "uuid": "2f1d8dfa-7421-4f85-bda8-41c1d33d65bf", "value": "SC621092Y.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c3580f2-08bd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1686531988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686531988, "uuid": "7b847c89-be44-42ff-bb2d-753a7bbe21bc", "comment": "Malware payload (CoinMiner)", "value": "5d6b21e777987b139e60eb89b73a8ecf", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686531988, "uuid": "6370db6b-09f1-426d-82de-52684a2fc745", "comment": "Malware payload (CoinMiner)", "value": "9f647bd67971c1ec3b4e1c2a420cf2238ca274f956ac277119c333f923a9ee7e", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686531988, "uuid": "66eceac5-e292-4c0e-ab75-a2996dc23294", "comment": "Malware payload (CoinMiner)", "value": "a5432c57b7b9c5fa6c1b37cfcd877693b0118c4d", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686531988, "uuid": "81e3cc36-8b12-4c6e-a750-28c968f45d10", "comment": "Malware payload (CoinMiner)", "value": "2066cf0f8c750b51f00c23d2c332898fce1a903fabfc7f0f1da6f7a8e63c3c12c75b952c35bb1353519573dedfe7ac7f", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686531988, "uuid": "e9c146a8-1a70-4686-ac93-c12c9828b661", "value": "T179063322F5A766F0F64383FA828C2CCE39097FA39A1775D8D69C15161DB5B4C1DBE804", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686531988, "uuid": "c36f1b79-c31f-421a-9f7f-19935cb241dd", "value": "e64ab2f4e7dbf88e67dbe16da9682293", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686531988, "uuid": "749b4639-d578-40f5-b499-2933527a3c4c", "value": "98304:Zyxjz0hnFFzj7PuW8NVniiDLZ7LM2tLLbxDYwl:ZQ0hFhj7WW8NYwVM4Pf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686531988, "uuid": "8d80a5e2-d0f5-41de-bf89-1accbf9a5b09", "value": 3803136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686531988, "uuid": "55078dff-ea94-4f71-9cc2-e5bf398f91b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686531988, "uuid": "1cbad549-54b6-4f5f-982c-71bc7890fd2c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13d8872a-08bc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686531437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686531437, "uuid": "5fc6a88d-2948-4f0f-a04a-402bb398c477", "comment": "Malware payload (RedLineStealer)", "value": "4ac364d64faced185b528bfc55b06fc0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686531437, "uuid": "6f69e7d0-4d0a-4142-9a41-c327d56f733c", "comment": "Malware payload (RedLineStealer)", "value": "9face4e25101e9fba7d23623cd5d7aa5f7f1e4ef95717b1005707e3ac11ffcc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686531437, "uuid": "2e288a99-c9c4-4a39-b1d5-877908a35f97", "comment": "Malware payload (RedLineStealer)", "value": "29b66fd42b1cddaa14f4fbc561bef3cfd56a2da9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686531437, "uuid": "fc4d22b5-bff9-4c52-a6f9-cbaab33b4335", "comment": "Malware payload (RedLineStealer)", "value": "084bd03cd8daf7a9b21857c9de19928777901efdb818569180a5cdf9ee5b8efaf086bf78eee24eb0feda9a0bc874cd15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686531437, "uuid": "c73a1117-279a-49ba-baea-50b4dd05cd27", "value": "T138346A39D850EE2AD88E6FF40B2FD86978556C940B4805E7FF8649A58B43FF044B62D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686531437, "uuid": "7fa5dd75-7d49-4c06-8ca5-c9a9ee5dbe3c", "value": "7b9f66d4832876035770a6addf78ddba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686531437, "uuid": "ea4d8600-f023-477b-a83f-9f898fa224a3", "value": "3072:fQOqBhcpBYTMf+IsbrBNo0UGK2B4SpaY4j/hqCoBAv9xnTxK:XqIlf+RnBvUGlB4GahcPj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686531437, "uuid": "ec8b1b2f-d231-40e7-a90d-a195ae4e9af1", "value": 233968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686531437, "uuid": "5c5c99d4-2d87-4b97-bfcd-68a89e518e02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686531437, "uuid": "cacd2d5d-39b9-478d-8de9-f36892eb6ced", "value": "Vape v4 crack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c47e0621-092b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686579407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686579407, "uuid": "4ab07a44-4cd6-4e7b-8e93-3775d83855c5", "comment": "Malware payload (RedLineStealer)", "value": "adcbd01641d983e2716a61c2df0a6938", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686579407, "uuid": "29e0d9b9-36b3-4cf3-b5d6-f21811d194cd", "comment": "Malware payload (RedLineStealer)", "value": "a0ba4c6172beeb0405bfb26b40bf59745a7f1bcc3cde177002362638db2e5d89", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686579407, "uuid": "b705dbda-5c46-425d-92ae-ea0473ac2e4b", "comment": "Malware payload (RedLineStealer)", "value": "54a7c3b9f19173e7ed509038d4fd079a45e8d429", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686579407, "uuid": "25f864c7-e75c-4199-ae57-472fa10d61b3", "comment": "Malware payload (RedLineStealer)", "value": "67cebc9ae1a9a290bf2ba7d9bf910e6b407a172d19617c53116ee9fd1b172d9dd85daf1f4635b2276d89ae5e5938ae36", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686579407, "uuid": "cd154a30-4502-4b2b-9716-cefd82988514", "value": "T14266331564F47C27C9FC6276F9E712702A14228AEE997B0751F8FA36BA0C8717833935", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686579407, "uuid": "592a3c99-1915-42c7-8aee-f2344f49855a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686579407, "uuid": "8c45f8c8-774c-45b9-9e29-7602b721acf9", "value": "196608:IdtQ6O6FfP+RqDfTHiYg9iu01x6doMpT6j2BCK//i2:IXbFfGYDfTHiYg9a1UdoMt6CgKHD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686579407, "uuid": "9e951eee-dd6f-4f7b-83eb-cb1740b127a9", "value": 7066624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686579407, "uuid": "9efc398a-cdac-41df-8ed5-949bfbd092d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686579407, "uuid": "e9f68779-56cf-40e9-8d7b-d7fd760a4048", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8de674f0-08bb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686531212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686531212, "uuid": "29f797d0-261c-4172-bc99-66f6c25a71d2", "comment": "Malware payload (RedLineStealer)", "value": "a368eba364d4dd3e2940b689d7b46443", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686531212, "uuid": "ff30c34f-81d6-4b5d-a347-2b7f750c6b9b", "comment": "Malware payload (RedLineStealer)", "value": "a13e3e70d56ca3903225cc985172fdb10b426c66e4fd38d0313d69498b2a5884", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686531212, "uuid": "570f286a-8922-4367-92f5-d6573a337395", "comment": "Malware payload (RedLineStealer)", "value": "993e193b6d98ab7f2d1e738731e1e701629abd92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686531212, "uuid": "363d8df5-365b-4ea3-8344-5d5bda39f388", "comment": "Malware payload (RedLineStealer)", "value": "e806f2e044a4fb326eaa06534b92df19f3d861f1133841a940cb229368f511f501655102fbb1056be18028c79eca0c90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686531212, "uuid": "48756061-cb5d-4fe0-bb06-59db829ddfec", "value": "T1D6F41203ABD850B3DCB51BB09CF603870B38BCA59978525B2729E9990D739D0B67473B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686531212, "uuid": "b12000bc-1722-4bb9-b90b-2c934993626d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686531212, "uuid": "6f3d55ef-9188-4feb-9a81-182f55c5124d", "value": "12288:cMrTy90vAnrW0lstROwF6+TtZ3VcnL0lTOictzpUpL1uRdzUNfbMglPIYrmT:Py3xGv0+v3VkL0EFtzpOubzURLlgYrmT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686531212, "uuid": "4edf30a0-71a2-4def-b3ea-be6751ea7c48", "value": 743936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686531212, "uuid": "389c1ec6-2b9e-441f-8545-e267b11cd68e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686531212, "uuid": "786e8d72-3025-4347-866d-49207b0aaa7b", "value": "06575199.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e00604a3-0948-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686591909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686591909, "uuid": "db0d0717-e217-4fa6-bb00-381c7289d653", "comment": "Malware payload", "value": "07ac4cdbcb1bdbaab07d90b8695a867b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686591909, "uuid": "0138bc27-fedb-4934-9a2d-9401e74811b4", "comment": "Malware payload", "value": "a14f354cc6644ca354f6b4aa8898d54ce7b483937e818f5d53c8440ab4988f60", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686591909, "uuid": "e0c38bb5-50e7-464a-a0c4-5d51d07b93b3", "comment": "Malware payload", "value": "ca6d60fad5ef783898de4cda90104967cfa67a07", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686591909, "uuid": "6d10bde8-e63e-4a93-8458-77868b42d910", "comment": "Malware payload", "value": "d93d6fc8cf83b51ff3e4796c0afe19fccc7ff09ed30a8804d269a1f3fd0801bf40774e40b0ad3a167334d84fe7c6b6fc", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686591909, "uuid": "313c8a3e-5408-4c54-8dd4-cc538ad46ecc", "value": "T11FC5334A0ACFEE1674215A9A33F4EB526A7C201DBE00F992276F30D76072916D1B71DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686591909, "uuid": "4970a3b7-1642-4e3c-bfea-593c1debd192", "value": "49152:ct6quTA2A9NRIwzljnH9YVBS0qFzNtv/vGa+HV4fV3uSSO1ara6HEJv:LhTA5NRFpj9vbXea+H6fFuSScaG2E9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686591909, "uuid": "73546f63-0e2e-46c3-83e9-03b7b8d4720f", "value": 2711679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686591909, "uuid": "dd3857fe-5425-45c0-96f2-5a7a55fd2609", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686591909, "uuid": "bed76b70-9a4e-4abe-835e-37946139246b", "value": "07ac4cdbcb1bdbaab07d90b8695a867b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8eac2ce-0904-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686562665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562665, "uuid": "86076e0e-b38d-4254-a8bb-00d7224df490", "comment": "Malware payload (AgentTesla)", "value": "67e06735506d9e7739bba2a242c6c36b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562665, "uuid": "5ec9dbad-23b6-46d1-b96b-2047bc21bf5c", "comment": "Malware payload (AgentTesla)", "value": "a30dfc493d539faaf9f1da3306dc2ad867188a70dd6c93299beb089a8b5527ab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562665, "uuid": "e5027694-4d6c-4a38-8831-c1d4ef7fab70", "comment": "Malware payload (AgentTesla)", "value": "e8793da5a339738c22cef92d412766d3df9fdecc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562665, "uuid": "3cb1efb0-aad8-40d2-a1f7-20127901a245", "comment": "Malware payload (AgentTesla)", "value": "986bfba8f7c16a9d3b7fa65f8b07fc07d9ca1e9e52ebaa1e92496302749ff972a9d0065ed8f4b955d0ab809c71e642a0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562665, "uuid": "3aeff06a-456b-401f-af8a-dfe1a17af043", "value": "T12CF13A21E7A9EE33F5628B77FCB3C3812739F754C552DB6E4C04012E5F647608AA1AA0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562665, "uuid": "ec62a438-2e3d-432e-b217-4d984cb98df0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562665, "uuid": "ee9f064a-84ca-4f77-b462-c7fd1161b96d", "value": "96:meqVhfUoMwmAeeApGaCyzj6hrCL9K6ScE3Gta6B3hfXjhCUbFnU:meqV+o5mde4C4Gh2L9KRP8amhfTgN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686562665, "uuid": "867df946-a5e2-42f2-b977-2ccbe801260c", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686562665, "uuid": "7519519a-e6f1-4987-b640-396c2eac3b0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562665, "uuid": "2b28855e-7dec-409c-b9a6-675983d5e590", "value": "Transfer copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a764ed46-08ce-11ee-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1686539415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686539415, "uuid": "a2f8e094-2ba6-4cc6-864f-5970e43d766c", "comment": "Malware payload (njrat)", "value": "c4cfbb0106571122d1cc4364513e7803", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686539415, "uuid": "39205fcd-cee1-4078-af25-378a9a4155bd", "comment": "Malware payload (njrat)", "value": "a54a3ca8ce01f7e9855d4d47d35bc82520ebd8d16a77df24e398b220d86d445d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686539415, "uuid": "93102a5d-b53e-4879-9bd3-f375cf5692e6", "comment": "Malware payload (njrat)", "value": "1a3a7b1357ed56b0183d03ee4b859659cc68f986", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686539415, "uuid": "015fde63-62a9-4d3d-829f-89f4c6e9fd0e", "comment": "Malware payload (njrat)", "value": "0895ab1af1bf3d3f361dcb2530f2509218bba116fcd7462d05cdcf5f86886a5dab45ce26842d9abde8fc2a8c1e9f15da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686539415, "uuid": "80afbac9-1d51-44b1-8c49-4908d3a01249", "value": "T142D4D031BAC04C71DC72193359219F25A53D7D201B75BACB9FB3496A9E223C3B632762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686539415, "uuid": "a630f1be-4e3f-4494-b632-10235946ad21", "value": "aac51396886833dc961fcd7aab7711e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686539415, "uuid": "f04071ca-c0f4-4043-9cfc-a185a59d2632", "value": "12288:ugZXEAO/BUdG3gVdt7KT4OIC4J84wHM5Qiu62PJr+ymhm:ugZXoZUTVdt7KTxoSs5QhCymhm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686539415, "uuid": "df8789bc-b247-41ce-b1e5-65fe095dcca7", "value": 610339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686539415, "uuid": "ab684989-53f6-45ce-a657-84aede9e1006", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686539415, "uuid": "4cc4c0fb-9d2b-4a52-b9a3-e02d4483bbf7", "value": "c4cfbb0106571122d1cc4364513e7803.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4549018e-0938-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686584778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686584778, "uuid": "a1749c18-1742-4daa-a095-fadf0667f4db", "comment": "Malware payload", "value": "d2f4700fca8e22ae135962774f3b6d03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686584778, "uuid": "5dedef4b-c8f9-4a06-bba9-a3865ac27ec6", "comment": "Malware payload", "value": "a72adbf4aefb73bde32b6e71408d1519dd0554612fcc7ea2a5b4c07dad645c60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686584778, "uuid": "7e612aca-ba15-47b0-a05c-c0eb7a00bfb9", "comment": "Malware payload", "value": "9dab228318d05968d2fe91475067b27b9c24ada5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686584778, "uuid": "44ff8a80-49e8-4da2-b875-4d8a379539e8", "comment": "Malware payload", "value": "8b6b8ae0c5fde10a09e375f8f414c4eba37817f01f8d61d02ee8fc19cce8bf2e0c644d5f108ae8f98744b4955cda51af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686584778, "uuid": "a6e3656d-f876-466c-9d66-a9ab288e28ee", "value": "T14BA59E4BB2D6CA59C6753A398131838407E2AB157663D72BE17F36D32F13B3A2E411C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686584778, "uuid": "4a94ec79-c0ac-4684-9b6e-52c645583bd6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686584778, "uuid": "792bdea2-9fc4-4c3f-b550-7d18f55e925b", "value": "24576:V5HJx7gFZDToRIpZaQUSZDNNIum2YyhZX9uWlZX9uWfm2YyzVUYOOir8Y:ZCn/o8KSZR6uzZXlZXf5I8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686584778, "uuid": "8c2d87cf-f978-4dd1-a717-2e1747e57d11", "value": 2127360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686584778, "uuid": "5e36053e-b24a-44af-b0f0-c9fcfde971ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686584778, "uuid": "33760e3f-0bd7-4c60-b5d6-08c34f8a099c", "value": "Milanaka_patched.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dc4fcdf-08f2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (FluBot)", "timestamp": 1686554646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686554646, "uuid": "56f9a49b-4272-4e74-9ca1-1c75463b022c", "comment": "Malware payload (FluBot)", "value": "15328ea6d31bef8ddd15a81e0f5a549b", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "com.sina.weibo", "colour": "#A73A0C", "exportable": true, "hide_tag": false }, { "name": "FluBot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "voicemail", "colour": "#9EF7BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686554646, "uuid": "9b8a873c-1375-48e4-89ff-20d86be06e8f", "comment": "Malware payload (FluBot)", "value": "a778818cc08d213d1f66db5fa8b34aabc862569ecb99fd1aea37ff6ccab48400", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "com.sina.weibo", "colour": "#A73A0C", "exportable": true, "hide_tag": false }, { "name": "FluBot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "voicemail", "colour": "#9EF7BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686554646, "uuid": "81c8404e-20d1-4a9f-9cb9-8e85ee740584", "comment": "Malware payload (FluBot)", "value": "c52f12651d91a9bf0d625a879b34d194eba69ed4", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "com.sina.weibo", "colour": "#A73A0C", "exportable": true, "hide_tag": false }, { "name": "FluBot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "voicemail", "colour": "#9EF7BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686554646, "uuid": "ea2400fa-5641-4ef2-b44a-dfaab6cdb96d", "comment": "Malware payload (FluBot)", "value": "2a097dec92a81608a9a6b78206daccdf7f1d5201cf91c13987cd15e780d6bab80a8cca26e3aebbd33a2d4966e0adb7d7", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "com.sina.weibo", "colour": "#A73A0C", "exportable": true, "hide_tag": false }, { "name": "FluBot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "voicemail", "colour": "#9EF7BD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686554646, "uuid": "20e86c74-aca8-479d-b87c-5f7853e98652", "value": "T1F8F52226FEAFE10AF503D135D1688997BC0400498A08FA7B2B36914C5EFAC65A747FDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686554646, "uuid": "cf77a825-69b2-45bd-bb8d-06a1af9808ad", "value": "49152:qLzu436uB6iejEyNRe1kqqGI18iNwDelhcTUr4T1S0NwBbGJ3H5+ELr42SKn2IQI:qHuKB6BzReWqqGWNN8g4ETBaJ7n2Izl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686554646, "uuid": "68e30742-e18d-47dd-a727-bf823065108d", "value": 3412925, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686554646, "uuid": "3d5f149b-4189-4f7c-9222-a799965d3649", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686554646, "uuid": "e6fb6b20-7033-449e-916a-bdd1615c77b6", "value": "base.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e333d907-08fd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686559702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686559702, "uuid": "d9cc75b0-ef12-4291-a953-fce10e7bd06c", "comment": "Malware payload (Formbook)", "value": "435f759bb374cd35f042efc48dd34e54", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686559702, "uuid": "f6f5207c-3aae-4adf-b369-25e1e04e83fa", "comment": "Malware payload (Formbook)", "value": "a835f1cb9f73ffc075ef9b8138c8807511eea8db22a1c0edc401b327a093efaa", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686559702, "uuid": "f0d33a3c-5361-4a16-ac33-509f90cf07d5", "comment": "Malware payload (Formbook)", "value": "85c00f525c839837cb9d079ec93bbfd608eccb03", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686559702, "uuid": "6abb4a87-565a-4282-aae0-889bb2c957d3", "comment": "Malware payload (Formbook)", "value": "0107d3edb66ff015025a2bb6d86f8ee8d7b599437aed8de82707b248a50c720796857cf7e854f5db4aab7d2627986ee4", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686559702, "uuid": "072e1adb-a6e0-4cee-8757-0aa9e0d8694e", "value": "T1EB65F12C63AB8B0AC5763BFD8C205630D3F9AD5A3073D34A1EDB34EA9E75B544890593", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686559702, "uuid": "e6dc303f-7a60-4a89-acdc-7a18489b3f14", "value": "24576:LV1mOV/NOa0WXTRVYUtbS+D9+HX1uH5vzIz5Z:LVUOV/NOazfY8bZQHX1uH5vzIz7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686559702, "uuid": "a0d55d2f-bcb7-473d-beab-7226c97db6ee", "value": 1441792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686559702, "uuid": "eb93906f-70b1-482e-a45d-8e6d3dd3d126", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686559702, "uuid": "ff9c4a15-7927-4140-929b-88c640d96357", "value": "SC621092Y.ISO", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b742fca-08eb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686551851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686551851, "uuid": "a101b454-5f76-4c93-9367-ca3aaa8b430b", "comment": "Malware payload (AgentTesla)", "value": "938c074147c707510fd46c877062016f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686551851, "uuid": "fd78cc84-c955-45b4-b0b6-fdb088bf8102", "comment": "Malware payload (AgentTesla)", "value": "a84f1a442dfb370a65f911c522a613943ffdbc9a0da1b197c64bff2278806f11", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686551851, "uuid": "2927fe3e-4efe-4131-b119-1d952fe3dabc", "comment": "Malware payload (AgentTesla)", "value": "6b8f7b008ca56621d62a9edd37db074c2547208d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686551851, "uuid": "1db7d04b-c504-4004-94ec-9e7517c09e91", "comment": "Malware payload (AgentTesla)", "value": "2b1e80857484277906ce1d0e8d1eae6953639ca3ffa96175a0cd4e51269b9f827fba31df1fd02dac4126c04332acf298", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686551851, "uuid": "c548cca2-263f-4aa2-9ce8-01a37330f46d", "value": "T1A47401187E50CC4AC83352B2452A5B652E9BDE39EC205DCA22F3795FE433DD259CA372", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686551851, "uuid": "8a70b185-580f-47fd-8857-f2a9fd44cd1f", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686551851, "uuid": "3660a364-2f3e-46ec-aed6-0f2235318f99", "value": "6144:wYa6QrZs8VsFIpItuCmmuh0BIcGPiKb9poLPqCibwUgKu/cCYib9:wYCrqssoItuCTuua5no+1h/uUXib9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686551851, "uuid": "8e3c3f53-7f9e-4d64-a07e-b6deaf053bda", "value": 337717, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686551851, "uuid": "b993f322-3754-4acb-834b-1601680b37b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686551851, "uuid": "20988a51-747d-4904-8f0e-4d285f55c2e6", "value": "Inquiry_Guangzhou Tinci Materials Technology Co., Ltd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31afcb74-0935-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686583456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686583456, "uuid": "15fe0324-db12-408f-a0a3-cf34cc175611", "comment": "Malware payload (Amadey)", "value": "f125d452d4cfd90efa6ff0b4bc4e12c2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686583456, "uuid": "a28fe81d-9140-4e30-9685-1f1e7dfd7a07", "comment": "Malware payload (Amadey)", "value": "a8d25eebb258abb8283ec3124a7a95fc1c684665ce8869932591d4abfcf0a5a0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686583456, "uuid": "40768e23-5fd4-48bd-a0e6-eb66b4299e7d", "comment": "Malware payload (Amadey)", "value": "1be18b41815ebdf4049bb53d290dce80df79e55a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686583456, "uuid": "38e5960d-8f3c-4a9c-a649-93d008d4ee01", "comment": "Malware payload (Amadey)", "value": "158b10d42a7bed0aeaa93fcab756d67a791dfec1ef0eddd5bc30210125f85ee69567b4a5a0fd5effa261ae8f4ec738da", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686583456, "uuid": "e0473777-e3f8-4723-8f04-34be3d79eb82", "value": "T15B051203A7F89033DAB42B7069FA13D31B3B7CE19A7483677A841C6E4C726849935767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686583456, "uuid": "3a1e1498-8129-4141-a03e-f2e042e2ce02", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686583456, "uuid": "6019de27-84d5-4c0f-972d-2f444b625816", "value": "12288:7Mr1y90ba0iaHKGZ+lZ5gKHQHVDbtewrDNB3YzgjMNi0CS4TohKR9yaqnPFxmMxs:6yb0vH5ZE8Kutec8gz0hQJR8j8MG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686583456, "uuid": "60afe5a9-183e-4273-8962-396077f6ab7d", "value": 799744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686583456, "uuid": "894a9059-01ea-429c-983a-6613305dfa22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686583456, "uuid": "b759f829-cd08-41ff-9266-d39fcf64666b", "value": "f125d452d4cfd90efa6ff0b4bc4e12c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bae04c3-0918-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686571179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686571179, "uuid": "b24a45da-9a76-4ebd-9350-f895fe6e8d35", "comment": "Malware payload (AgentTesla)", "value": "844526020a1884981d83de18281dca48", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686571179, "uuid": "3631f73d-7b47-4a80-88ba-436533eb49db", "comment": "Malware payload (AgentTesla)", "value": "aa23406d036894ae210e0531e6014c1377bdb409619cde6143e69d0a8dc7b85b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686571179, "uuid": "0ad16ccd-20b5-42c9-905d-096e99be28e9", "comment": "Malware payload (AgentTesla)", "value": "d93f919a7708132ab546e2a712a2a189013952e0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686571179, "uuid": "9b48fc8b-015e-4c5e-9e5a-fa77561bad0a", "comment": "Malware payload (AgentTesla)", "value": "fe5108b2f44119a0e9f28d56290bba6cbdb31cfdb03b76bbf9915293ec4eb726ee9365f6f29cb4747a2dbdb36d8888c6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686571179, "uuid": "073dded6-312e-4f3a-8987-3065b09a4091", "value": "T10F05F12C22AA8B4AC47A7BFD5C20A635C3F9AD563033E35B0ED334EA5D35B1449E0563", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686571179, "uuid": "851c549d-6f88-4b76-9bce-9de9d910ba17", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686571179, "uuid": "026bd42f-9f2f-4202-9235-4d1eb2e1c487", "value": "12288:Er1O52iNoOe42KMu/N3mWhQmwmJCMpUGb4YsNdsaFA+reUw7VkxqCev2:i181mOV/NOabbW5FVreLS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686571179, "uuid": "c82de879-8de2-478f-a67d-e2f93243467e", "value": 819712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686571179, "uuid": "2287a5e3-4c06-47b4-973c-09889a81e4fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686571179, "uuid": "05469c1d-4094-46d1-821f-ba183154b2af", "value": "Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f26a632-095c-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686600256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686600256, "uuid": "89dbce62-b43b-49e4-8d2a-78599636a532", "comment": "Malware payload", "value": "72dd72b5bb40f6b3cf3e571e6973ccd4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686600256, "uuid": "b09e6de9-ac39-4b74-9070-39fbe22a39c5", "comment": "Malware payload", "value": "aa8faf73d4bb12ae7742d09e8feb04bb3b016a8724ced7846b6d87e562b9c423", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686600256, "uuid": "57781504-5741-416a-b5d5-6c3ca8c43a3c", "comment": "Malware payload", "value": "9d4fc9f998d1e8aaca493fa465c6732c25940aef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686600256, "uuid": "4e9d9d00-41ae-4b5d-9159-3e87eaad3bd0", "comment": "Malware payload", "value": "0603e811b0e341952dbd4d34e93df1e384401bb22cd73c2099a1dd0bca2c3adaa8afbd922393193ef3e4d803c451fbb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686600256, "uuid": "420d7382-8833-44e1-9382-345f012b896c", "value": "T1E3B6C043F7C280F1E69212308967B3ABC775B9148BB5C5D7B3D42BCE9A31291793B252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686600256, "uuid": "d62abc9d-ff50-4d35-b016-876ebbaec476", "value": "fee6d841774e14682f9c4a0e6af31e6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686600256, "uuid": "436c45e0-7d2b-45bb-93a2-01bbb84db1bd", "value": "196608:vGo/DiQS15aEXB4rlwDe5EXVXi/IYNvCXzAtJsv6tWKFdu9CEpVt:v01farlwDe6XVX5YNaXzcJsv6tWKFduh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686600256, "uuid": "385654e4-3e52-4e49-944d-ddaf7360449d", "value": 11415856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686600256, "uuid": "cb89409d-3e62-4396-9f2d-62a906c11e1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686600256, "uuid": "f116cac9-d2ad-4eb9-9884-d7d4af95b429", "value": "McSkill.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6ccb742-0936-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686584082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686584082, "uuid": "2a640cbd-0a33-4b96-9c43-1cc03f2041aa", "comment": "Malware payload (Mirai)", "value": "df4957def3252a66aaf86f3f5d9aaaa0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686584082, "uuid": "c27ce266-379f-4f42-85a5-96fbf3f6de01", "comment": "Malware payload (Mirai)", "value": "ab368e624dae91787f30240e88e3d73bdcf5a56d06d4dfb4c1f4f0557ff4d535", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686584082, "uuid": "6e48e1fa-9cb3-4279-be42-4c284fe2f3f6", "comment": "Malware payload (Mirai)", "value": "c8a9c4692424729c4d398e2ae455f000e0ad9419", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686584082, "uuid": "5cb3112a-5193-4080-b799-d6f765ba2620", "comment": "Malware payload (Mirai)", "value": "cdca538724d3e4f38f6229ff0510ae5857df020bb48a8ba8bb260af9b6b16100af80ad5c632e1155a5ef6839da96c062", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686584082, "uuid": "e6a96178-0187-48cc-824a-234ac08bd205", "value": "T15514C70AAB610FBBDCAFDE3702E9070525CC650722A57B363674D528F54A94F4AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686584082, "uuid": "ef04668d-51d9-4022-98dc-52e4dafb3a20", "value": "1536:tItguSTa+N8+BqU0E3EIWOdfxY1KH0DEbYTTxDwZcdd3H/t9ruyyH1lSM5tcCTP3:tItRSm+N8PU503uY9wiDC1lbtZPi6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686584082, "uuid": "14e709ab-1b39-4988-a91e-b64da404c768", "value": 198492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686584082, "uuid": "213b184d-3306-4633-a246-1959df9c8ed0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686584082, "uuid": "aad8b2a9-49de-4aa2-9a72-62f93744bacb", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af580cc1-095b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686599988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686599988, "uuid": "07a2111f-1926-4e18-867c-d1d2362f612d", "comment": "Malware payload", "value": "8d84cfc241bf15b5d902e07a812774f5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686599988, "uuid": "0fe98395-ff99-42fb-8d14-e9ccbb6dccac", "comment": "Malware payload", "value": "abaa50319a3a3dff6483c61cedad7ed82ddbc6e94a6a273e8f390202b5884578", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686599988, "uuid": "ad0c1b17-a231-48e2-8fce-31ecb8d3006e", "comment": "Malware payload", "value": "6065cbd52c265cc2d02b19b334bb3fb4d5474ed7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686599988, "uuid": "e9b4d1d1-6370-4e7b-b034-14332d2575c2", "comment": "Malware payload", "value": "5af425a6acf7c5bb1c352af6b499097c5361a86a7d14bcc8cddbb2dfbe2500bb459f168027ff14de4fd2ade0c4f710b1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686599988, "uuid": "e1569d13-0300-4d44-8863-4fe83dfd75b6", "value": "T16E52080AB7E81B26F9FF0B3258B281051375FA55AC71DB1E06E8514F1C36B1D8632BB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686599988, "uuid": "49b334b4-b0b9-401d-9eaa-8060fb000271", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686599988, "uuid": "d94c8515-baa6-4006-b386-2356039499dc", "value": "192:0sfqBSPPpkJtjeqLKagF0mONOlC5T1e9Bmtd5mjKEquuxqL3:0sfqGxkJtjXLKlRO8YbaB8d5m2/xq7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686599988, "uuid": "8d18aa0e-bceb-4b05-99bc-5b1df7553b58", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686599988, "uuid": "b9e1a590-6ab2-47ce-8206-84b061b1dee2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686599988, "uuid": "b28c133f-8f70-4988-8ded-c2cbeab22b90", "value": "SharpPrintNightmareDll.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c36f2ff6-0904-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686562655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562655, "uuid": "2b97a34e-d3e4-4fb0-9108-af361a907406", "comment": "Malware payload (Formbook)", "value": "bb1ecfbd9558146e9a7b855683b24dd4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562655, "uuid": "9f2e918c-701e-42c2-940d-14c8fae6716a", "comment": "Malware payload (Formbook)", "value": "af7efb93740b9b9ee4cd6580a3eefa8298558c9f06b463eb44b03394cde441d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562655, "uuid": "fb33a55d-e201-4f6b-84ed-c451f9fc541a", "comment": "Malware payload (Formbook)", "value": "31633f8fa757e0cbf2753ac3f5d603203282ff04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562655, "uuid": "04772008-4fba-4e5b-9a3d-fa35da785e5a", "comment": "Malware payload (Formbook)", "value": "591ce9f4b0b2b6f7535d543ee0a3ce5c0ff2ff94abd9b12fd62c57dfab665b0068401c515f818054aa73fcf2727ec3ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562655, "uuid": "7148b89d-3d0b-457d-9089-ab8edc4be339", "value": "T1F205010833FA851BC1AF3FBC0E606170C3F8A10635A3D75F5E56AE9CDD56B588A91683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562655, "uuid": "cce8dfdf-48f4-4fe0-a177-9680a58fa856", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562655, "uuid": "17815090-4419-4f8c-8e28-c55eddf4de2e", "value": "24576:+iOV/NOaRibY/BB9vtorOyxXmK97IEJBh:+iOV/NOaRibOwrOyQ67IEJBh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686562655, "uuid": "c33ad7bd-359c-4641-ad28-10b3b769f6b3", "value": 822272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686562655, "uuid": "0cf7d02c-4188-4aa6-9dc1-f6b819401a3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562655, "uuid": "4164fafb-49c3-4630-8fe5-b4419adb67a1", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd8e15c1-0901-11ee-b3cf-42010a9c0076", "comment": "Malware payload (NanoCore)", "timestamp": 1686561357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686561357, "uuid": "c8721630-39ff-452e-832f-025019525744", "comment": "Malware payload (NanoCore)", "value": "1a959bfa4af2d06504d11a22db5044f8", "object_relation": "md5", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686561357, "uuid": "eae5e448-3abb-42c0-8cc1-6b1f05847f04", "comment": "Malware payload (NanoCore)", "value": "b02497312858471a02d02f26e651e129f0fabe01ad45eac35fbdcfe73f2fa8ca", "object_relation": "sha256", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686561357, "uuid": "c6d8aed5-473b-40f3-bd47-79cbd6f50965", "comment": "Malware payload (NanoCore)", "value": "81d314a5392e55e77651c74079fc9b4a40e5d316", "object_relation": "sha1", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686561357, "uuid": "3d100d25-db94-4500-ad41-3bcdcb731add", "comment": "Malware payload (NanoCore)", "value": "503f7437acb48458979f84abc18242930012e8aca4f99b73955b297c2e710dbe4925c13f19c2894b89b78a67ea1242c7", "object_relation": "sha3-384", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686561357, "uuid": "8dd69e45-9afa-4a1e-ade5-5c0f35c11549", "value": "T1EB45E678D9AD16B3D575DBB487E44227F1829BAB301D9D6498F3338102366C234E6E2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686561357, "uuid": "8b52eb83-d474-4e6b-b329-52ab637be398", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686561357, "uuid": "27be21fd-2a27-413e-8b5b-13a46cb671c4", "value": "12288:UgnPFweJD4sTxj02IGcCLj22Zc1/156Y0PWHUyIACMmwBG9:3PFw+Lj05u222n56YWWHUxZMD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686561357, "uuid": "0b8c4c68-3774-4eaf-b6ce-be8c108bbe53", "value": 1233408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686561357, "uuid": "b7e48549-5e23-42ef-b761-61cf905b823d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686561357, "uuid": "5680d3b5-f09b-4a82-a78b-b63fe78d21f1", "value": "SOLID\u56fe\u7eb8\u6e05\u5355CFB4TS241U.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fe31011-0912-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686568448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568448, "uuid": "fd00a7aa-3dd0-4ed8-9118-5846cb478da4", "comment": "Malware payload (AgentTesla)", "value": "307e5ca11c7e007a59a1cfee7d87f18f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568448, "uuid": "634016ab-e4f1-4362-8bdb-fe5f9ca88b68", "comment": "Malware payload (AgentTesla)", "value": "b1fd0e492e22532632f9bae2ae32841b3c14a5a73a4ac491e3af3b6868466c3d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568448, "uuid": "c837b0ea-995e-419f-936b-441697d2df27", "comment": "Malware payload (AgentTesla)", "value": "ff2561cdf073f40a4ec04eaa8b504ab8a67b1e1c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568448, "uuid": "7beae50d-c52f-47df-bf90-65143bf9eb20", "comment": "Malware payload (AgentTesla)", "value": "49c9565fa1f9cf2fbcfd0785d7c7f11e509a480a858a4c5fc00e178c72c4f9f9dce4f75feba6d7f452668bc38ec80456", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568448, "uuid": "7713b7dd-cabd-4fc4-99cd-425e33c73edb", "value": "T1680482A1BA23EC63F921463076B5F26311436E237914CE552AD3B21E47F3B907C79E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568448, "uuid": "032bc7b3-2f5e-4b22-80f6-41fc03ac8982", "value": "3072:AkZ+RwPONXoRjDhIcp0fDlaGGx+cL26nApXN26FFVso9auybIxG17qPY2MAPqy0u:tZ+RwPONXoRjDhIcp0fDlavx+W26nApI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686568448, "uuid": "1a786db3-bfe7-4499-9a24-6841e1865d4d", "value": 174592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686568448, "uuid": "86744699-a900-41c9-8775-14d39641787c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568448, "uuid": "4b39526f-4c57-445b-9579-fdd02745b524", "value": "New Order.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "538aa372-095c-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686600263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686600263, "uuid": "fdef1260-a266-4e89-8af4-b1d261d1eb4a", "comment": "Malware payload", "value": "4aa76c7d35a25dc2589df869db726229", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Silver", "colour": "#9592AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686600263, "uuid": "53258ae5-bfc3-42c1-817a-74b712568013", "comment": "Malware payload", "value": "b245c7bbf3314d1c962b5687cf3d60ccc9a6665d8fa7bd3a7dda688021583280", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Silver", "colour": "#9592AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686600263, "uuid": "a2763d93-4a8b-4dd4-b679-10d8a34441d0", "comment": "Malware payload", "value": "86cce127e2ce9b5ead62623e8c09d3c19001a251", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Silver", "colour": "#9592AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686600263, "uuid": "0e10cffb-cd43-43de-811a-ca140661c1be", "comment": "Malware payload", "value": "cb88ccc9ab6c999a270c96283984fa9e354a08b59bc8130d3418f7b0a8e26551c2877a7a7e1bfd3729ea0733e44d0c8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Silver", "colour": "#9592AF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686600263, "uuid": "f7124432-6fb6-4b10-b6c8-df367e717c5e", "value": "T1CCF61A03F89510E8C4E9D1B489218162F9717C5C1B7933DB2B61F7B42B72BE49EBA790", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686600263, "uuid": "e377b478-5161-48e5-aa51-dcc405e34187", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686600263, "uuid": "a913fc96-aba2-4cb4-b37a-4c514fec5b47", "value": "98304:2+g/HBt98GZUJbegbCZbXRUeSXS8qFjEpfhjmDglY:2+g/htWXbCNRUesSbwPY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686600263, "uuid": "81d41bfa-e1c1-4da4-ac7b-508de36468d7", "value": 15488000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686600263, "uuid": "57dd20e6-13dc-4733-8bb4-8a6db8d6b4a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686600263, "uuid": "3b0b3e4a-0ae5-4d11-97f7-d9ae6542322a", "value": "sd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a189eb4d-08bc-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686531675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686531675, "uuid": "1ca9afa4-fbe9-4843-924b-39772236a770", "comment": "Malware payload", "value": "99bc6b0f3a9914247b4f4a56580247e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686531675, "uuid": "baf0dd53-a3ea-4178-a2cb-333bbd604f27", "comment": "Malware payload", "value": "b39743a26847ab29e98de03bb994d958b6a54527a25a0c63adba0448602b6433", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686531675, "uuid": "d1cf1566-8d6b-4f52-a26f-5dfdefb7f2b1", "comment": "Malware payload", "value": "2eca7ce76a985220bc2a269ce1075c596308421f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686531675, "uuid": "e5969203-111b-4ea9-a0e6-a3b723d76607", "comment": "Malware payload", "value": "b39d3a519d3b235f461da2e2f54701184c55b92eb13ead0a708387185e9d0fe69ce00366d07ff7317cb2c3d8588a5ffb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686531675, "uuid": "259c0b1c-48a7-439d-8417-ba70f44339ec", "value": "T1EA26338C60D34C7AE2B35E330512CDE0A81667F1F756988B9524D3CD8D27D1877BAA2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686531675, "uuid": "0fc7be67-8c32-4b76-9c25-ade50ca534db", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686531675, "uuid": "ce971b44-415a-4373-aefd-fd984528cb1d", "value": "98304:En771nqJS2Cm4LF0iImerOCUjE3E4D/5vgE0LTSw:2nCsLF0f7Z2mRobTS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686531675, "uuid": "61b97673-4268-4f22-8453-0ac049100bff", "value": 4508672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686531675, "uuid": "f596e138-2309-4b0d-a782-ef6259c69f84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686531675, "uuid": "fe42ed6a-2cc5-4404-86e0-de81e64a1ba4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1be55032-08ed-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686552496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686552496, "uuid": "26c26b1f-44b4-4c6f-a32a-7a3062d0310a", "comment": "Malware payload (Mirai)", "value": "43e2ca6a3bb6ec62f6c10d5a1d2a72d2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686552496, "uuid": "83f67ebe-1702-4ffb-bedf-e7bf1e89aa46", "comment": "Malware payload (Mirai)", "value": "b4df0968be8b3a6b06ef27f5a0e035b1371423c05c6dc0112f4dc3f4eb3b7c37", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686552496, "uuid": "4131280c-f7bc-4726-bf9a-08bc7863bf69", "comment": "Malware payload (Mirai)", "value": "88f1d9767ed8a11b3d4e6a338fd985297a85433a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686552496, "uuid": "55e4c2bf-eea7-4b75-84fa-85f1d87e8b0d", "comment": "Malware payload (Mirai)", "value": "8a3a9c22a4ae65a302c0c715eedaf9e0a3eef3ec7eeddb8968a563a9e2dd0342d745eafa4e86ba67843bb7776264e092", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686552496, "uuid": "f639c389-e9bd-4624-8dd7-6bb8ec243bfe", "value": "T1CA83A51E7E228FADF76D823147B74E25A69833C627E1D641E16CD6012E6034E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686552496, "uuid": "951e2ccb-54c4-4010-97be-3902bdf4b2c2", "value": "768:2ty6IP7M/kq0INRhfuN2Eo9tl/deyLYwHuRHI0I4EH6gTQ7ZDYovZ73x/nL8y8Qq:Rakdn2Eo3eQaV6TQRYo99Be037WvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686552496, "uuid": "341cfddd-b1e2-437f-a75f-a950609ec32e", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686552496, "uuid": "f4adf75c-8e04-4670-805a-66d656d9ef3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686552496, "uuid": "cef0bd3c-30b1-409c-b0ce-ff1685960b76", "value": "43e2ca6a3bb6ec62f6c10d5a1d2a72d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9720a40a-0918-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686571171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686571171, "uuid": "70ce53cc-5eb8-47e2-9ff2-9b48958727b8", "comment": "Malware payload (AgentTesla)", "value": "170ffac229cba1524186165ecfb9bac4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686571171, "uuid": "28dcca45-24c9-4ecb-9930-1e319baa74f6", "comment": "Malware payload (AgentTesla)", "value": "b60dab60a680f4940732adb7dafed3d8fb3d59f7373c801beb7a56a34ee47943", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686571171, "uuid": "f990f206-dec3-4876-a822-4fe3c39dbf4b", "comment": "Malware payload (AgentTesla)", "value": "96699d228d4e6a63d5a6b2def4d549df451f669e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686571171, "uuid": "a3cf9bc9-dfd3-46bc-a098-567d0ef0f4a0", "comment": "Malware payload (AgentTesla)", "value": "2b6cbdc223cb0dbcb38355e8dcce1d5bf6f693324d5e4f64af0144d6459eee65d904855de70a6012df935f4b591d3d11", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686571171, "uuid": "cf181f54-a58e-4923-9a8c-4aed7b89f14d", "value": "T166E423FEBF50677ECA2001A272401A35077391BF539918B969B88EA1FD3572B618CC77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686571171, "uuid": "077049ab-5691-48e6-9a63-7bd774c117df", "value": "12288:G9F3HGymvyHxyLfOzgQ/l84HrwdxTxAxybyD597A82vFHZUyeiEJlm5Cz/:GjGymvyHInQ/BHrwxdcyGrcF5Uyjoz/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686571171, "uuid": "a7ce02c9-590e-43b6-9748-491af4c6c4a1", "value": 671899, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686571171, "uuid": "97702d87-78e4-4a96-997b-40e1cf5660e5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686571171, "uuid": "7fe0701e-9c5b-4583-86a1-fc37188e32a1", "value": "Shipping Documents_1.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45b17cce-08ea-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686551277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686551277, "uuid": "0284cbb9-e30e-4a3e-a508-34f64a13ecfd", "comment": "Malware payload (AgentTesla)", "value": "2c4de78a908b2d97e85512bf3f8b924f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686551277, "uuid": "61e0bd15-1ccc-4e1a-91e0-d4bdcc57bf8c", "comment": "Malware payload (AgentTesla)", "value": "b733887c22f8a4488182a2d039e392c89aac6aee4109c55dab286c548b87bbfe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686551277, "uuid": "c088f62d-6834-4f89-8e30-5918486d0469", "comment": "Malware payload (AgentTesla)", "value": "e3c9d12014690d94a644d55ddae442353f9ab3fc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686551277, "uuid": "fab56df7-a4d1-436e-856d-3c92db48c109", "comment": "Malware payload (AgentTesla)", "value": "87991544e59a2fc2f52bc2fc720a59a389f2b631a90226007e9a2290c64de5d73e6a71fbd214e49202ca398dbc758a3f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686551277, "uuid": "17171362-527a-4130-a8bb-3bd7393e5494", "value": "T183E4F1577244C987F23B8A32CC8F8AA4131DAD6E4943C34E34955E2778BF312586EB97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686551277, "uuid": "19e6cd8b-8903-4aa3-92ab-35e667e8b074", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686551277, "uuid": "f4fb99d6-3cd8-47f1-af39-0bcaf3b70b3a", "value": "12288:PAAJRNXTyHh8UQwIon0OGp7Y9jswwGculpPJPI0ESG1S+HLQ/8Vr3CCQhwDx:PA4TyH1TIospc9jswjRpPS0011/Vr3Ce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686551277, "uuid": "b430c999-1960-415a-8025-ed96b1b72fae", "value": 687104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686551277, "uuid": "ffb20b58-0c4c-46a8-8913-cb21e7435f92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686551277, "uuid": "fa8c30c3-ee95-4053-bb9d-b0a0334becc4", "value": "Order confirmation #872635.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "591f0364-0977-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1686611869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686611869, "uuid": "dd8c0952-2b0d-4030-8b2a-8fea93a0a8c7", "comment": "Malware payload (Smoke Loader)", "value": "3c25c82959bd7080ffa4c31642d37bc8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686611869, "uuid": "0254d991-5fb2-4be8-af07-fcf6415bfd5c", "comment": "Malware payload (Smoke Loader)", "value": "b78d66de4f94fd68a2fa5181f8b2a865d43f44fba0efbff7dd3a8215ce153891", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686611869, "uuid": "322d2fd9-c4c1-45c3-802d-3275a172cc33", "comment": "Malware payload (Smoke Loader)", "value": "8a7f87f5da38e8b80f9a12b2cda135cff3b7d271", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686611869, "uuid": "93193dec-1d83-41fd-ae39-97759bcf8b1d", "comment": "Malware payload (Smoke Loader)", "value": "2994742a3d38a850b665fd6b8aa6b1907bf785ce50140405cc10455d448a1be0d7cd0ce5a7de222d9072ef12db35f987", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686611869, "uuid": "21a9136e-2541-401b-8499-f07d57280b6a", "value": "T1DC34F853EEA17F60E6354B32AE2EC6F876CEF6504E197B6A1228DA1F04B0171C563770", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686611869, "uuid": "1c6fde8c-85ee-4204-b8ad-5daa969dbc9a", "value": "0e4b3a5d9cc3d6ed1b5c0b9f8a440aa6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686611869, "uuid": "7d1e5cdc-5480-4490-904e-6cd98182698f", "value": "3072:PbEpKscjIkzeZQHlA+BEfjPqwwGP4PcR2bXw1HNzr1es7P:IpK7jIkna+ibPqR8gxbwnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686611869, "uuid": "82ae01e1-a1f0-4806-bd39-9266043069c2", "value": 248832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686611869, "uuid": "9d9a94f4-0c93-4958-95d7-c0cab75bb041", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686611869, "uuid": "c72a65a3-a8bb-4a46-bdb3-7990ad3b7507", "value": "3c25c82959bd7080ffa4c31642d37bc8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfdc37cf-0939-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686585413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686585413, "uuid": "9f6b7fcc-981f-4c7d-a6c4-a2ffb29c60e0", "comment": "Malware payload", "value": "265ce82ad99a39acbe2f26f8757804bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686585413, "uuid": "ae7e6df7-326c-4264-8d56-14a87cd14c65", "comment": "Malware payload", "value": "b7c15caac55c93b0f5cabf9f74d0f22ea855465d00e18526f08dff5a6aa4fa00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686585413, "uuid": "056a462c-9a2d-4527-b894-851a86a69941", "comment": "Malware payload", "value": "c002a3672c7d6812fadae0a2ae52a1e278282a72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686585413, "uuid": "1fc647d4-fa89-411d-85dc-5e1f52dd9fdb", "comment": "Malware payload", "value": "8e711985f2ee1333865ddc5cf0c159d2a2a906066c4b82b59558aab691fbe10e8c55795d4ac665cc5aff3a283ec65569", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686585413, "uuid": "0f9198a4-fa51-43eb-8f33-b6e2c2842ab8", "value": "T181571231325EC52BDA6A01F0692C9A9F55297EB60B7154C7B3CC6D2E1BB48C31732E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686585413, "uuid": "cbb3297a-1034-4f0d-9956-a48b5d6cff42", "value": "836688c7d21e39394af41ce9a8c2d728", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686585413, "uuid": "01850869-bcc2-49e1-9900-ae51574ec9f7", "value": "786432:7ZYuYyGXLnodoUXF+unKxjQp+T8FUnUj/nyn7:NYuYe9nkQgTnU2n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686585413, "uuid": "4b54971d-2267-4c2c-81dc-ef944824722a", "value": 27995578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686585413, "uuid": "445f1607-8b60-4fda-813c-88a551eeac9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686585413, "uuid": "f78e3eb6-820a-4dbe-9eeb-16f603bddd94", "value": "huorong.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54acfbeb-0909-11ee-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1686564617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686564617, "uuid": "a9a30766-fb6d-41bf-ad05-c5c8b5ded4aa", "comment": "Malware payload (DCRat)", "value": "2b66b04d81792b8391fb9a0a8b1cadcb", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686564617, "uuid": "ebc5f740-9180-480e-a67d-232f7a1a51e7", "comment": "Malware payload (DCRat)", "value": "b80644803f578f33e59aa51ebec2e1c6726afb4447344d8e299216797bde2747", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686564617, "uuid": "4f8c2515-03e2-4d45-bf76-50e44ef82e54", "comment": "Malware payload (DCRat)", "value": "aa2407d93eb512093bb191d19d1b4ef474dc2eb8", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686564617, "uuid": "7d9ff2a1-3e3f-4ca5-8373-677cbf49731b", "comment": "Malware payload (DCRat)", "value": "e298110df7f0096c0bdb3fc626abba71f7104f091d9f7ace320638d56a874a70cd6ae993b44d19b9b53f7be96ba59642", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686564617, "uuid": "b42acd2a-ae71-4faa-bc8d-dc383c2691cc", "value": "T1196539127E47DD12C0291637CAEF842407AEBD116B66DA1A7F9F335D65223A38D0D2CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686564617, "uuid": "40f1d77d-6c71-4aee-89d4-0512f194399d", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686564617, "uuid": "f30c6b56-047d-4339-8391-7cca3490cdf0", "value": "24576:u2G/nvxW3WieCW2efqdPsK8Vx2mxdClw3HQ0H+4R:ubA3jIqJqi+O0Qdu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686564617, "uuid": "701d5b17-8a89-425c-97af-fb13635c6875", "value": 1507980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686564617, "uuid": "13aef766-10dc-4db9-87d7-244ff3ca1382", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686564617, "uuid": "f79df781-20e9-43b9-b7f8-588e04405afd", "value": "HEUR-Backdoor.MSIL.LightStone.gen-b80644803f5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53132aa2-0904-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686562467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562467, "uuid": "a3c30931-6b51-40e6-9e88-64feadffde64", "comment": "Malware payload (RedLineStealer)", "value": "ac414f81ba659239649d5feedc903155", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562467, "uuid": "7040c935-ca15-4133-a709-8acf347ff320", "comment": "Malware payload (RedLineStealer)", "value": "b96e79b671939ee9aa47b3f065f73fa2a5098aa0725ce99b81975314dd206ffe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562467, "uuid": "4ae78602-b055-4d94-b078-616f2157481d", "comment": "Malware payload (RedLineStealer)", "value": "72bee548d11817e3d27954554892d8d6c91e44ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562467, "uuid": "72d2c856-bb60-4ba2-b879-a501e621ddb7", "comment": "Malware payload (RedLineStealer)", "value": "1b92ce9b9e90d7b4d6f7d8c485929916b52d1ab224f7548d146041386328978bd01542327db5f349b0c62a78a6c81d8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562467, "uuid": "e7311e21-7474-4138-b707-2cd01318889e", "value": "T161747B1392E57C60E9665A328E2FC6FC761EF6114F3D376A2218DA2F09B36B1C163714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562467, "uuid": "6842cfab-7751-49ab-b623-99f6a66bc1c2", "value": "71066788d95fce2cfb22e5743861df9a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562467, "uuid": "c557e1dd-58cd-4e89-a3d7-6f7372c052fe", "value": "6144:VzRxqevjD6S1AeY8V/V8WX9fcMLPhD2Yh2huCOGQ:V9xqCP1h9V/5Z/JaCO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686562467, "uuid": "c3bbc7c5-e370-4ee0-9458-47a65d3ff7a7", "value": 345600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686562467, "uuid": "904148fa-ee04-4f40-9941-594c4390417b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562467, "uuid": "0157a2c0-ecb3-447d-b764-997827b9088c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f41efc4c-08be-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686532672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686532672, "uuid": "98422032-2838-4c71-9593-00bab1830ac0", "comment": "Malware payload (Amadey)", "value": "a0eb2c23e215780a3e089f29526bd25e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686532672, "uuid": "5271750f-f121-4a97-a40a-5f6ecf875cad", "comment": "Malware payload (Amadey)", "value": "bad3617996496241bbec818780774e257355fefb24ea21ea9e224ffeb6972536", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686532672, "uuid": "46f0d94b-bf98-4b8a-a2a0-8217811a122b", "comment": "Malware payload (Amadey)", "value": "0e59ecdb5231670b5a4aa2df221ccb9fb233d8d6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686532672, "uuid": "37cbb185-9702-4ea6-8248-0e3ed618d23c", "comment": "Malware payload (Amadey)", "value": "b336a0106b2af583edc85f347ca51bd410a8e83185388a13423f3adf8c2ac872601d0c30941fe53ca6dde6e49df4103f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686532672, "uuid": "0e984339-7ff1-4719-b173-c4a74e98973e", "value": "T14F052343B3E99062C9B65BB06CF502930F757C325D2C835B278A96472CB3A80B57977B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686532672, "uuid": "744c9f82-53fd-41e7-83b4-23fe7f8e4fd3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686532672, "uuid": "f09b65aa-a1e7-4d8e-8d73-7171aba74818", "value": "24576:GyXD7ERqCdDg+TFP044AVgNrW9PgoexLCun0DN:VXHdCldTFP044fwhuZCu0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686532672, "uuid": "2dd8986f-1868-419c-b42e-7d13daa91be0", "value": 796672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686532672, "uuid": "aed07410-c4cf-4d7a-8864-55e205614da8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686532672, "uuid": "9f7d18e4-c84a-4f05-b068-713aca514af6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a8a5f84-0959-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686598879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686598879, "uuid": "9222e8ab-d5fe-4ec4-aef5-38cbe42dbf65", "comment": "Malware payload", "value": "cc10e2fefac2f5e05eba29323ff8d8a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686598879, "uuid": "3d594a60-3171-4598-bc63-004fe1489fd7", "comment": "Malware payload", "value": "bb58e339c8c729136d364ae9398de47e8b3c7b70785d8294ae51dcf07fc43c98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686598879, "uuid": "9cba3284-c856-4b48-8034-ef1acbde0ebc", "comment": "Malware payload", "value": "e6f1522b25b0bc9cabb5800d38352889f95937dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686598879, "uuid": "405f8c77-f36d-4845-b887-a27284ce2c5d", "comment": "Malware payload", "value": "2ef44b65536b17fc5d6dcdb094cce664c747daf6d62a9e8e7ef62bba39af4be526375c085bcf1b26e500ed324b42c952", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686598879, "uuid": "e65bd9eb-855d-4a6f-a8d5-10dd318924bf", "value": "T152919356A3E443B2EA7B4772AD3383104770FF11DCAAAB9D26D8551FAD93A044D13B31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686598879, "uuid": "99a8a098-4cff-4013-9939-0f6c0d63fc89", "value": "48:6+9aiQf6FzpfjcjPNMFoE5VusUNbBQIoNi1trYYlo3OlsgFZFypfbNtm:aiQAzSdE58XNN/qnzNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686598879, "uuid": "929668a1-0435-493e-8eda-77fc784c6a60", "value": 4608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686598879, "uuid": "35760567-403b-44ba-959a-9a3e9f0d39ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686598879, "uuid": "4c0fefb5-2b20-493e-a4a6-27174cb107fb", "value": "LateralPoison.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e7d9176-0935-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686583424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686583424, "uuid": "07dfcc4e-c775-47c5-b7a3-636f1fd263bb", "comment": "Malware payload (Mirai)", "value": "1982d3f1d89facb4ec8930603903b6bc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686583424, "uuid": "c61c3cb7-1a47-4d0b-929c-055b17be9a25", "comment": "Malware payload (Mirai)", "value": "bc0108ae246374ce70d36939de6b5518b6bca31d275b251890db1cb819c86c10", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686583424, "uuid": "48f5376e-ab68-4530-9e88-658eca6903fd", "comment": "Malware payload (Mirai)", "value": "f4c74acc2f8297db97fcb90c026c7d15624073f8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686583424, "uuid": "378be59e-ee77-4026-af00-15a8142a142f", "comment": "Malware payload (Mirai)", "value": "b762c85bb1cff59682a75616e10f3d1b776a82814f9a8580f4aa095006615aa0918ec91b5fdd73cc191afae32ad34504", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686583424, "uuid": "baf57a43-bd3c-4961-ae7e-7a995001db58", "value": "T1CAA2D025E345AEF4DFEF5DA452C2C2C2B6E543C6278AC8E340FEAF016506046B788D4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686583424, "uuid": "17f38021-b7f5-477c-bdcc-14b96925e60a", "value": "384:M/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5cErM4uVcqgw05VxJc:MRxsSVsMD6xiJJE5zRWN04uVcqgw096", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686583424, "uuid": "748204b9-04ec-4987-a475-9aaa5a6b9107", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686583424, "uuid": "9bd187e6-e536-4340-8d3e-c06071402eb3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686583424, "uuid": "249283c8-cdb8-4320-a7f7-3749b2b459e2", "value": "1982d3f1d89facb4ec8930603903b6bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c799ff26-0904-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686562662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562662, "uuid": "5c39fcb0-d177-45fa-8db0-58b450c93261", "comment": "Malware payload (AgentTesla)", "value": "372e743ab256dedfb201948fc5b4c12d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562662, "uuid": "b1a40c3b-ae9a-477e-a1df-cb201b416ed2", "comment": "Malware payload (AgentTesla)", "value": "bdfe53ec3b0fe84ed197930c8adeb2a6e0a5fd5183d9189fdadb27c894e687e3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562662, "uuid": "0df858b1-3158-4eae-bce1-97d9d0790c3c", "comment": "Malware payload (AgentTesla)", "value": "ec8c73373dfd04b2694793f51e8529002a7a018b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562662, "uuid": "00ed8454-06a5-442d-9c6b-69eea963413b", "comment": "Malware payload (AgentTesla)", "value": "2982a2be3291fe0c2dde61d2eda3e24163097eb9a7dbb7a18906e26d56acbe1ea7b0d5471b7610183a8bbdd5f130d782", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562662, "uuid": "1599d701-78b3-4234-9172-fd91ce57e353", "value": "T164641221D554E5B3DC620F32587B9A166AB7FE113DB5EB8B0B8C7A587B332C2810D361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562662, "uuid": "a0bd28f2-e5fd-48b1-b078-7bb5e949cedd", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562662, "uuid": "d6dc2524-db76-44ee-abb3-ee70807f77ee", "value": "6144:OYa6gOcXcUNK8xbe3QWD17RkutxPk9NfxyYb04lubSrEp:OYqOcsUBegg7RkukffEw0oueQp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686562662, "uuid": "7e3d5315-4ea6-498c-8348-c724f844b775", "value": 321850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686562662, "uuid": "54bfe61c-2382-4901-9304-c9f7da2fb53c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562662, "uuid": "37f473d0-fb6d-4bc8-ac5c-cc4d3f57963a", "value": "SWIFT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46cadf81-08ea-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686551279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686551279, "uuid": "1c869841-2e56-402e-a07f-4699cf92e89a", "comment": "Malware payload (AgentTesla)", "value": "4e6a3f02f9f9272596b24967d3db065c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686551279, "uuid": "c1d5f094-276b-431a-9eaf-3f4c96b20132", "comment": "Malware payload (AgentTesla)", "value": "be0f2eb16aeeaa2798242c634a5db4d466014ea41a45ea0f752db9ae7fcedf10", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686551279, "uuid": "54182e84-1753-4651-979b-5f71f8fe1686", "comment": "Malware payload (AgentTesla)", "value": "aa5511899c3ef379edc32a0becc4bdc0d7a03d86", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686551279, "uuid": "90a98f41-4b1d-4862-8acd-48a0aab6fdd4", "comment": "Malware payload (AgentTesla)", "value": "363398810b04e7252ce590e847e0507a661c21726dabacda71e3009b2678066e49ab166d447327ca62c83699cf41f6c3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686551279, "uuid": "cdbc16fd-9a6d-4529-b6db-015aa834c4cf", "value": "T1ADE423906CDAC25170E966A1AD9C4D9476FC2DDBA9E222C16CDA777CCA73FCC02C461C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686551279, "uuid": "d318b1c5-8fb2-4729-85e5-92f3a0746f1e", "value": "12288:6a6XdUluyd5ucIJfSOdmGqLR7X7biX+9TLxqb7VUnT7nB9hhrN3GFoMKjWpbVIuq:tfd5eJfXri7LbimXxqdUnTF9jMKjqBID", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686551279, "uuid": "be3fb045-e9a4-4528-9a9f-9d1e2c06992b", "value": 682567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686551279, "uuid": "b768e3c4-bc68-40fd-a91a-0e5b8d6aea4d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686551279, "uuid": "662c6aa1-a0cd-4ef5-984d-f5f27833b6cc", "value": "Parking List_1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aa309a3-08b9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1686530348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686530348, "uuid": "29895614-58df-44fd-be2f-069c1cc61c27", "comment": "Malware payload (GCleaner)", "value": "20aa861e4689aed3e1c3c0b189342530", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686530348, "uuid": "b7f3c79e-b3b6-4286-a046-a3e184a9af8c", "comment": "Malware payload (GCleaner)", "value": "bee2251eba48fd551c7bcad485a185f2dc1ef65076bcb6e1c968e8f113cd3fd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686530348, "uuid": "9a45b1a5-ff98-4eff-8fe5-a82602e656da", "comment": "Malware payload (GCleaner)", "value": "453ecf9e44cb7cf5faef425306cd74cced9d1e1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686530348, "uuid": "7d2df774-4b8c-4d04-8e1f-2774fb79da7c", "comment": "Malware payload (GCleaner)", "value": "6220fb6456e5743b52c36d814fff468094f05256e5ae4b3c83b7f0ae93e9432f0fd47fe7be575ec3142cf4dcee2c35ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686530348, "uuid": "ece44838-2f26-495d-916a-634911431148", "value": "T14DB522128BBDF624D0AC88F7BE9540DDB138C625B7FB422B29F7D507D065A813D2E618", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686530348, "uuid": "96a58d64-09e7-4f1a-8d4c-305855854e8f", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686530348, "uuid": "5e93d678-d759-4a0f-91a7-9393be7d511e", "value": "49152:J6dJ6sPdbgnOt1jZnjZI6/oyJ51xWjV7rETCVrzIYS3eOYf+VaFmmuvr1g7Ir86:cdMsV11HIYDD1cjVfEToE3zYf+VQmmuh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686530348, "uuid": "baa8bda8-4e4a-4c17-b0de-d72cb81b4291", "value": 2349633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686530348, "uuid": "282d15bb-5bba-4adb-a56c-3b2fe12990d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686530348, "uuid": "116e10e1-39dd-4f8a-b41d-5da875f0f55c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87a62924-0967-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686605075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686605075, "uuid": "4f252d86-a201-4316-970d-380cc7617637", "comment": "Malware payload", "value": "4809e1f1201c5c8f61eac896811544e6", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686605075, "uuid": "8f97664c-eca4-4d26-a9b4-0b9cccd84a31", "comment": "Malware payload", "value": "bfa79d2630bbae032c6f8e1f1a03f4e533699d9b6ef431e0d0c4977f8b70fc73", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686605075, "uuid": "3f827170-6f02-4e5d-a7e8-7ee9ef95c086", "comment": "Malware payload", "value": "d18323bf3e86f5b1c3fa66159c36b6908b480efe", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686605075, "uuid": "ac4ae376-973e-4820-8647-24b84b57335c", "comment": "Malware payload", "value": "7aed6d22f0d57b7d4ae196dfbf75c27d56c7446df589f604070ba0e2ad59c5bf525282aff6bd1609164757cc87fc0c34", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686605075, "uuid": "3bfd61f0-ab0d-4a92-97b9-8078cc802738", "value": "T1DB23E00A7968A123DFC3E63A384142DA527C62EC5B1CECD33E5055D7A91EC82E39678C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686605075, "uuid": "bc33664f-171d-473c-a600-6cac63bbefe5", "value": "768:Qr0Gj/NjEumiqmIOuRRwtulyK2fbdE5NVRVL0NVaBUA1TGRrEPooHbe8Ouh:INTdHL5TdE5hmN0BUakseQh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686605075, "uuid": "bb270f14-9aa1-4ac1-b777-bb46f6146bdb", "value": 46444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686605075, "uuid": "2359f3c7-8ef4-4fbc-a163-02da0bc6c214", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686605075, "uuid": "67c8fe98-fffb-4c4a-8f2a-222bf9a19706", "value": "auto-clicker-fabric-1.19.3-1.5.1-build.23.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c8cbbd2-094d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686593836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686593836, "uuid": "f9ef4060-5e86-4295-b0cf-885365893277", "comment": "Malware payload (AgentTesla)", "value": "df8f316ce18fab20d45bb9b67c68f1e4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686593836, "uuid": "f24a1b10-e185-442e-bfbd-33c893416f39", "comment": "Malware payload (AgentTesla)", "value": "c075b97afc0e7ce2b05229c5694d3043efb3a62a07aa4d0a25d49f97709ac629", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686593836, "uuid": "65b3e3ad-cf7a-4ecb-a751-6227c044a82c", "comment": "Malware payload (AgentTesla)", "value": "962d315b40aea34abc7dad945a78abec509bb189", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686593836, "uuid": "5a1e096a-4d93-4e20-9d38-2eac49bdb5ec", "comment": "Malware payload (AgentTesla)", "value": "1fb7f5f3ce37f96182f33deed841d7615fa600046511c9953ddfc86ca86e998bf740a0590b173fbec76ebf2b578ec189", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686593836, "uuid": "2a7407fd-42a9-4b7e-9594-2e26ac984503", "value": "T124F4F10573B79F6BC03A7BFD0A0411B283F815587033E7266EE365DEAE51F444AA0A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686593836, "uuid": "1c3870ed-9cbf-44d6-8383-6ca337d6b6b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686593836, "uuid": "e5ddb33c-694f-4aa0-b1be-dcbcbc84d85f", "value": "12288:gE2iNyOe42KMu/N3mWhQmwmJCMpUz0EMRRV10PxdaVc/RWgVdFY7JMH1W:T1wOV/NOaVuZdaVkR3dFY7CH1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686593836, "uuid": "dca20e1a-5843-441e-b24b-434957c1a887", "value": 754176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686593836, "uuid": "883f3750-e027-4f7e-8607-8b12a6771413", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686593836, "uuid": "bcac650d-efb7-454e-a232-5a89f3738e38", "value": "r9451993.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9018cdf3-0928-11ee-b3cf-42010a9c0076", "comment": "Malware payload (StrelaStealer)", "timestamp": 1686578031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686578031, "uuid": "9bab0a4f-c5b9-44b2-b7e8-236cc1dd97c8", "comment": "Malware payload (StrelaStealer)", "value": "2195962b4f57949b019abefc1c0b0b3a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "recupero crediti", "colour": "#F6A0AE", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686578031, "uuid": "70797a60-56a5-484f-94e4-02a6f3cf358c", "comment": "Malware payload (StrelaStealer)", "value": "c308a9f4742b755c4cb865f632dd9fef8785ff5eae95df2c16f7efab63b0ac2f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "recupero crediti", "colour": "#F6A0AE", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686578031, "uuid": "9780839b-f0b7-4491-9e6b-6a6fac53e384", "comment": "Malware payload (StrelaStealer)", "value": "6d2d3aa47b5aaecd292215d40da46a00b69cfa2b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "recupero crediti", "colour": "#F6A0AE", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686578031, "uuid": "d33a908d-cd2b-4460-96d0-170268feab16", "comment": "Malware payload (StrelaStealer)", "value": "35ab7b3cb28e20ff6460e942de703aade65a156e2a90829285161d4957f4917c2b50d19d0bef523cc0815e386fd8f2a7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "recupero crediti", "colour": "#F6A0AE", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686578031, "uuid": "f23385cf-502f-44f2-ab6e-39b5a39d9b10", "value": "T1BE250F4955A9130EC2223BEEAB6D34D2C370DA1776F8C9E3859DB7A2DD5DC368B30424", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686578031, "uuid": "b27633bc-8100-4e6a-81e5-bc37a78b3293", "value": "6144:7bFPLAHjJtF87hEJ9Il8OepSNCAl2NQEZ85Eq76R43vIxp8tcc36yvqHA/2802yZ:CklsUEqG+3Vt73vqg/d4esqdx6CYPsM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686578031, "uuid": "a3108153-4ed3-4f3d-8651-7234db6accb9", "value": 1005596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686578031, "uuid": "49eb4bf9-4ecb-4700-abcf-ca4a669e48f7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686578031, "uuid": "acd8e01a-88ed-4fba-9f35-4a121ea81b0a", "value": "puv.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba86d229-0904-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686562640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562640, "uuid": "8a0ebcf3-9d4b-45af-8ca6-df39eaecee17", "comment": "Malware payload (AgentTesla)", "value": "9825852aadf1aae2d54bf045ea2e88ce", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562640, "uuid": "84765971-8ef2-4499-a9c7-394880f5f45e", "comment": "Malware payload (AgentTesla)", "value": "c7eb221558c49c1bc163ed223f2fd9847c4f1bce98401c779cbcdd5738b54edc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562640, "uuid": "d5363305-a67a-43cd-aabb-6199e5782c12", "comment": "Malware payload (AgentTesla)", "value": "73a41d193dc4d61cbb787a73df44e7bfb3e12af5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562640, "uuid": "f73f3c81-62f2-42ce-a02b-5c6e495136fd", "comment": "Malware payload (AgentTesla)", "value": "4577b9f74e326d81b9520e378e88c60d202f4210ae837a14b865cce2b97880143c7df84978617752eb68b26493d45923", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562640, "uuid": "90370751-ceef-4a49-b56b-31b7dbd27ccd", "value": "T168059F342AFE501AF173AFB55EE4759ACAAFB373370BA85D209003864A13A41DDD153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562640, "uuid": "ecd4acc8-abab-453a-bf15-d6169de5a715", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562640, "uuid": "2d18e21a-7075-4fe8-b4d8-73f8a505fb8c", "value": "12288:tO1dzNpvxRwPX6beqZH9NZJ70N1u1NGA/Daa4Z6DhwWXdfrZ2qKUFLIxy1GunJR1:M1dzNVxx1TLp2UFLIuoq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686562640, "uuid": "2e19445e-edcb-4fc5-8c31-ab902f44c3ec", "value": 839680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686562640, "uuid": "150149a4-b451-4ef0-a491-e328540c451b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562640, "uuid": "80e3fdbd-f8df-4336-bd30-036d318f6c0b", "value": "Doc_206410002pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "419dc7cf-08ea-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1686551271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686551271, "uuid": "1d37cca5-5423-4f94-befe-d4b4f041c7ab", "comment": "Malware payload (AsyncRAT)", "value": "e52cd785679b3988ae6375a3fa0e9c56", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686551271, "uuid": "401686c2-337d-45ac-9d3d-c0a5454743b2", "comment": "Malware payload (AsyncRAT)", "value": "c808e17f32c426d4059a19c888c71348c23ddebe9ee227c70a0a56a91dea708e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686551271, "uuid": "ddc7e373-31d6-454e-be6d-15eb5c72db55", "comment": "Malware payload (AsyncRAT)", "value": "ae604395aa9b5aa52cd297739dd829532f0d064d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686551271, "uuid": "c74fa70d-55a1-4530-b274-6b19c4694d6d", "comment": "Malware payload (AsyncRAT)", "value": "bc90964322048c01c771b73b69e584e09a8a86c5c9a002d88a34e660bc9c0d8a809981df90d4ca09a8e9da902baf6a28", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686551271, "uuid": "d80ee620-68b4-4c0f-94e9-f28cfe12f9b8", "value": "T1624533259D95638F248A0B5B4F46FD6A9894A04CE42CF13A6D772F3C34D0A61CDED2B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686551271, "uuid": "2f6c0d7d-afa6-403c-b9d2-1102e1b92a10", "value": "24576:ygfptZZeBfMtiNTDmdJ0YxGgQ6aTvUoBzTszC4yiMCdGw7FJj:Z/KfMtKmdBEgQtjUoBzTX4yiVbRJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686551271, "uuid": "a1f05436-ca67-4d88-9673-ad427fb46ed9", "value": 1198991, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686551271, "uuid": "878a42ba-a6f2-4883-b404-b59ec8458b90", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686551271, "uuid": "b0771755-a38a-42bf-bcca-f473dd1911cc", "value": "Confirmation_1.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a292fd5b-08ea-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686551433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686551433, "uuid": "1e807c4d-90d3-466f-a469-2e8525a8cb10", "comment": "Malware payload (Mirai)", "value": "73321e2d8a22063073ca70b7debdf01f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686551433, "uuid": "b142c49a-82a6-487f-9971-2e967894309f", "comment": "Malware payload (Mirai)", "value": "c9730acd663e2a36e4e571081778ee4558b955f8f450161e465516d58e9b3aed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686551433, "uuid": "72d4dcc9-0cac-4f0c-986c-8b44dfa405ae", "comment": "Malware payload (Mirai)", "value": "455706e010cd8effc1c53695c49ca3f291334f87", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686551433, "uuid": "fcaa2786-f58a-4fb8-8dfe-e5017aba7892", "comment": "Malware payload (Mirai)", "value": "ae0d20aea14f568790f72cf0af02ebc9eb1e77f0e6dec15fa58c0f883b1512a3ee7c4ea9607315c71b43911236197cb7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686551433, "uuid": "9803a8ff-bde6-4d88-97c0-9492501e9dad", "value": "T1AE435BC4F643D8F5EC8705712077FB379B72E1E922A8D643D3B4DA32AC52651E606A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686551433, "uuid": "48548dc5-2596-4a08-8de0-6531317f97a1", "value": "1536:JeESt/basV2rcZhG6+KN7TqCRe9xzWOIaEjrqMhs:JeESt/basVTgW7TqCw9BtXESq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686551433, "uuid": "be331bed-e64a-4b61-8a17-1bfbd89b1bee", "value": 55632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686551433, "uuid": "1f014d2f-6496-46a8-9590-894ed553da1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686551433, "uuid": "fe694399-0bcb-4b82-8e91-e0b2519d0a4d", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10858d59-08bb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686531002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686531002, "uuid": "a27d5842-6962-412f-88f8-e9e60e9352b1", "comment": "Malware payload (RedLineStealer)", "value": "4b3ca5e2b37d6674b5b0637b16c8d909", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686531002, "uuid": "77abcf29-b777-4c3c-b3e6-9384741c99c6", "comment": "Malware payload (RedLineStealer)", "value": "c9cd1023a5fd49b3221d9b0ca4f5abbfc4b70df9bd25c99b5eac270d1a091814", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686531002, "uuid": "617a8b87-8572-4003-9b43-5475947e24ed", "comment": "Malware payload (RedLineStealer)", "value": "cf57691325f33c267820fee4c5b428353604f9c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686531002, "uuid": "33632294-f2a3-48ec-9308-4df4a25005d3", "comment": "Malware payload (RedLineStealer)", "value": "45828e0729ecdbfe128fee8df3432fe42532486f9aa2cf2312a9131b72ad79b3c868e4a071d548d90f8091a5851a9cd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686531002, "uuid": "120b3764-d82c-4b63-8c14-f17f9908fb8e", "value": "T176249E306861E73EE9C5BC741DBCC5E965A56C50065846EBF78A0EFA8BA05F0287F1C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686531002, "uuid": "88010cd1-e027-4aef-9a28-36b1c564b482", "value": "7b9f66d4832876035770a6addf78ddba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686531002, "uuid": "e4456f48-9236-4794-a3b9-85b21bea2cbb", "value": "3072:Zfipf9tJTxcsmBHIargKo3P+KbQPD1Ap75v09v9xnTxK:Z6rPmaSKbs1O58G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686531002, "uuid": "a50c022f-c143-466c-a56a-e3d4c1368c4c", "value": 216048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686531002, "uuid": "203f2914-8afb-423f-9e45-78cbaae19b8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686531002, "uuid": "da90b6b5-06bd-457a-b49e-bf902b013e62", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcc8236b-0939-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1686585461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686585461, "uuid": "0ffb052b-80d5-4735-9ad2-10838dcc2095", "comment": "Malware payload (Cobalt Strike)", "value": "e9bd0275990757418d51187c56713ddf", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686585461, "uuid": "11c1be5a-df54-4dff-8704-1281047a63c9", "comment": "Malware payload (Cobalt Strike)", "value": "ccea51593adf4c6a3205a2caa943ab3ed52c918d2dd3c218ba56ef61775d563e", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686585461, "uuid": "bc65f0c7-930f-41c9-9648-3bd561dae767", "comment": "Malware payload (Cobalt Strike)", "value": "0ecbe1a9993abcdd1c5af2c491c83e05667c2f26", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686585461, "uuid": "65d2c291-483c-41ae-8834-e0d7a2d213bb", "comment": "Malware payload (Cobalt Strike)", "value": "16e0ba1e46c364eb100fd167344f1b01455defa2d0a7c14799651697ec622d84c147783372d7e0ba48a003a097543e5d", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686585461, "uuid": "2eea2e03-8cb4-448d-b804-cb6ed00262fa", "value": "T1F8754A077C9090BAD4AA9231896592E177307C540B3123D73B50BBFE2F767D86E7A368", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686585461, "uuid": "72edc59b-c80c-4c3c-9e93-b5003cb44e06", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686585461, "uuid": "c45baa70-86ad-4421-a30f-f38b13a571e3", "value": "24576:wn0j0lPVX/E/k/Jn+/I+vJCPh8fgCO5IJ2BfD1UL:w0j0lt8/yJn+/LvJCugCOWCfD1U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686585461, "uuid": "ff6b1645-c467-401d-98f7-f41e93f331e4", "value": 1588736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686585461, "uuid": "d162ab0f-794c-4736-b96e-23ce20ff40b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686585461, "uuid": "c2c2b3d8-2cff-4f9e-95be-477c09620276", "value": "\u706b\u7ed2\u6076\u6027\u6728\u9a6c\u4e13\u6740\u5de5\u5177.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10b0b3ba-090f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686567080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686567080, "uuid": "bae2765f-b61a-4465-99ae-ea2346ba7f0e", "comment": "Malware payload (AgentTesla)", "value": "1131ba4c449adfb6c5013ecbc84be5fd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686567080, "uuid": "e23b5f94-739d-429f-9c64-0c47e23fbc01", "comment": "Malware payload (AgentTesla)", "value": "cd7d0874b89cf5f39df34b8556809388e038c59f1b8740184fb4f3f901eb8829", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686567080, "uuid": "325de7b0-a2b5-4db1-bc43-e5b4f0942cfe", "comment": "Malware payload (AgentTesla)", "value": "a43a7b56367b525c3e614f32c66a2024d11e4273", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686567080, "uuid": "6f26a789-eade-4d9b-80fe-41023aef37c9", "comment": "Malware payload (AgentTesla)", "value": "cb6aee082247ba930dd8a65f7fd90aab8fa54d0aa951b8ecbfbe19d852065ad3e287d34e61506d2d579eb39f6854c59b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686567080, "uuid": "42995ab1-1e70-423a-b17a-58747c3c3ccc", "value": "T1C954121475A0C11BFDE2A7300D36266DAEA8F9165F69035B3380296C7CB3A55E90D7F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686567080, "uuid": "837dfe56-f9f8-41cc-9752-6263725d4e9e", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686567080, "uuid": "a1fb9a45-484e-4bff-81d6-4f9429d5ac0b", "value": "6144:/Ya6Iy9ZUjW6p/pR0R4xJKgVurPm2q+Evrthb91/ywdqC8BNF9SxS2njX0:/Y+sKWaR0R0J/0PAVZh6oq3NF9N2njE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686567080, "uuid": "f6fd65bc-91c4-4b33-8101-0a25688d9f91", "value": 306165, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686567080, "uuid": "c4b781ee-c80d-46c2-97ac-6207cd1f2aa4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686567080, "uuid": "ee5e5574-8451-4904-bdbf-18ef79294f27", "value": "Zwrot towaru _103396.docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "093d2888-095c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1686600139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686600139, "uuid": "3558a320-55a3-4387-bac3-7a2d2aca3506", "comment": "Malware payload (njrat)", "value": "a92ef911215a303fc49de97c4c6d837f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686600139, "uuid": "f5a22c5a-a12f-4d61-8d51-b0e9d98d29dc", "comment": "Malware payload (njrat)", "value": "cd9c6c3774a1465f229f729469ac9a73561f883a3f980625198571dc9c82a4c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686600139, "uuid": "7e213664-d6e3-4b1c-b10d-c2825f6dccee", "comment": "Malware payload (njrat)", "value": "cfbb4b778d946dde68746cc8160f75f02f975d1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686600139, "uuid": "e01aa48e-7779-4c4e-9d97-f63e714e027d", "comment": "Malware payload (njrat)", "value": "51855006f34ecae3b977103fff8cd3fd2718de357c4093526d3000a71dfbd9e39ad75497c71792115ce9a758d33ea40b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686600139, "uuid": "bf5ebb02-0bb8-42e8-8f51-d117b85f8178", "value": "T1D0B2194E3FA98856C5BC1B7496A6965003B091470423EE3FCCC554CBAFB36DA2D48EF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686600139, "uuid": "655f37d1-71b6-470f-95d8-6c72c3f99649", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686600139, "uuid": "8e82dbee-dc37-4ab8-910a-c64f46fc57bc", "value": "384:yY324bcgPiJLQrfARGSRUJsbY6ZgvSMBD3t8mRvR6JZlbw8hqIusZzZmM:lL2s+tRyRpcnus", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686600139, "uuid": "35b66ada-f9db-44d2-ab02-3da79c83cf6f", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686600139, "uuid": "1ffd0ea4-3519-4ab2-a530-5ee5e0ae1bd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686600139, "uuid": "55c285ed-991b-460f-9924-2567b45c563a", "value": "Server.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24c0dc2a-08ed-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686552511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686552511, "uuid": "3f45f7d7-6423-4803-84ab-64573792ba97", "comment": "Malware payload (Mirai)", "value": "a4dbf66426277ef260725c9a048862a6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686552511, "uuid": "3a129d1f-0cae-4600-a01d-b175d6574dde", "comment": "Malware payload (Mirai)", "value": "ce78a68a7ac6cc1392ab1dd7cfc00b3dfec49d95e5cab77771d1887eeb19ecc2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686552511, "uuid": "9ef72591-6770-4de6-8190-bf2f6087718f", "comment": "Malware payload (Mirai)", "value": "70ad4b1077e77dee70464d0dddb422813959b47f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686552511, "uuid": "54f9a904-4f09-4786-b4a6-aca3537ec46a", "comment": "Malware payload (Mirai)", "value": "c90b0778873cedbbf334fc90b12cf7f60f46a12730e856b9056d85baa4f00960d85161131034100eb333370b2543f633", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686552511, "uuid": "37b3aeda-f4a2-4ea2-8cb0-1d698ba20b94", "value": "T17673F756B8814B12C5D5127AFA2E128E332317FCE3DFB2129E206B2477C696B0E37D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686552511, "uuid": "85445702-23a8-42c1-b36e-4778b12536bb", "value": "1536:2lntExPgXkpdDHkM7kdxy4up+WkcaoN0sIci7XzWv+AcY5sYIWu:bxIXCdEdBnlcaZXzWv+AcYuRz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686552511, "uuid": "92b5700f-9de3-4d9c-9427-713e25d4f253", "value": 79160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686552511, "uuid": "5d32f4c0-6a18-4b3f-9493-afc534fd56bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686552511, "uuid": "9eaa70ca-d551-442d-9940-19b4cfc92860", "value": "a4dbf66426277ef260725c9a048862a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e557856a-092c-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686579892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686579892, "uuid": "d1f00673-ddab-4491-b296-be0478547b41", "comment": "Malware payload", "value": "108f07dd293996d6e0968dd3ba6bdd06", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686579892, "uuid": "693ccb59-87fc-4aa9-a3bb-121c84e88a70", "comment": "Malware payload", "value": "cefb85adc5f67e1f506ecddd929e7abf85f5868c9a03589dedc3c65137533772", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686579892, "uuid": "d5f6c2c5-8cc9-4c1a-b781-8d08707866dd", "comment": "Malware payload", "value": "dac3e02e45028d4cc309cf73119c49b8526ec40a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686579892, "uuid": "908b70fd-4b50-4c5c-91e0-f5b79b983a54", "comment": "Malware payload", "value": "478d77bdce165b52a447c4b463ec504287f1a0009be475d4ae1391f12b6bbb8d081429209a68771f63f3971affdedcb6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686579892, "uuid": "81cc0207-3274-4000-aab2-ffb910c22961", "value": "T19443074AF981AF00D4E521FAFE4E524A335357ACE3FE72029E115B25778A95F0F36902", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686579892, "uuid": "bcbdbb98-30f3-435b-8671-1714c4236a68", "value": "1536:15nfi49iDMsoYHicERwb8cWeTelzyCPi2qzYxLGCS:jiHRH5ERwb8cM7qkoC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686579892, "uuid": "c2fac665-1ca0-4424-b67d-4c73933a2598", "value": 58188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686579892, "uuid": "bd33db13-e1e6-4ae3-bd91-6b70ef5010ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686579892, "uuid": "c4401631-35a6-495d-99f2-33e2790f8827", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4702d06-08cd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1686539115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686539115, "uuid": "70521492-b6d5-4337-bed8-7e50e98e2dec", "comment": "Malware payload (njrat)", "value": "c47ab566d6ea85d027927ce1090a1fc2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686539115, "uuid": "d83a664e-8a90-4da2-966d-4107d4664943", "comment": "Malware payload (njrat)", "value": "d0e0d585d9d3840cc31c2367e97215d025f2bb80f21e38a81294fd41277871d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686539115, "uuid": "c4b31b0e-f925-4733-b074-726034d4f889", "comment": "Malware payload (njrat)", "value": "f2d76803ce7b3bcacc04465e1b81332969cc8096", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686539115, "uuid": "74a4ccd8-5bdb-44ee-9e1d-9e82805ee56b", "comment": "Malware payload (njrat)", "value": "62a4b28c5d74554dc3ea6fb9d14a70071e19afd51dbce253843cca0131193ef634b48ba2bc7b8498e26fa7b4b53177c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686539115, "uuid": "bebf49b2-49bb-45a0-8612-01be09e4bb57", "value": "T1B0032A4D7FE181A8C4FD067B05B2D41207BBE04B6A23DD0E8EE564EA37636C58B54AF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686539115, "uuid": "fab40c03-c549-4b75-ab96-0c0ae7463ee7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686539115, "uuid": "9b30b4a6-2aba-4aae-ae49-a91945307bdb", "value": "384:9mOq0IiejvCVLO309QmykrtG+dA+VfwvOSiKrAF+rMRTyN/0L+EcoinblneHQM3R:fLdGdkrgYRwWS9rM+rMRa8Nu6Jt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686539115, "uuid": "5d4c7483-34c5-42f1-a70c-962b122bae13", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686539115, "uuid": "a9898cec-457b-410b-9536-6e67c6159d50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686539115, "uuid": "2dbd9880-940a-4d82-86f9-0c8a44f54c54", "value": "c47ab566d6ea85d027927ce1090a1fc2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "583c0a0d-0943-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686589534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686589534, "uuid": "a56734b3-0b75-4ab3-a7f2-77b524cb70f7", "comment": "Malware payload", "value": "0c0a3d01c45f66056d607bbad486b39b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686589534, "uuid": "eb3d5164-bd1a-4e4e-88fc-667497740b80", "comment": "Malware payload", "value": "d158f3cfb47665928c5d304495fa99050a9e4c5b8d54332d400eec78bd7f98b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686589534, "uuid": "1c3340b6-60da-4430-8c0a-d65af1c88a14", "comment": "Malware payload", "value": "d96aa9b9fe3a0515d70f3e909f00c865dfc5821c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686589534, "uuid": "95127bf1-fe08-4ec9-9f9f-87f9a231c3f5", "comment": "Malware payload", "value": "fcf4cead6f6467494168ee39e36220d7a3fbbda8f226341bc5a2050def8140fddd4d864984ed530f877a0678f2270b4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686589534, "uuid": "446cbf9d-e42e-40f2-8a36-6cb9d5c8caba", "value": "T1D4245A52F240D871D305273259A2D5E4E939BD385894D04FF23C7EFA5AB23A3596328F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686589534, "uuid": "606d5172-6c8a-4070-9afc-ee4d7160172c", "value": "a1e2978a1231fce7a99dd60881e648fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686589534, "uuid": "42eb6ef9-c754-407a-8491-b53fa641988e", "value": "3072:1JqmvLa0w5DElSlF8Af4a3uG+07J4txJt:1JqmvLaNyWFzv+07J4Jt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686589534, "uuid": "1d91fa61-3090-4398-937d-71473fdfef7c", "value": 209776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686589534, "uuid": "6bfc46d1-c23b-4f6a-907a-0a45eccac926", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686589534, "uuid": "80e3425d-b1e7-4811-97ed-7bd0cffa1ef0", "value": "edgchrv5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7c47fd3-08ed-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1686552811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686552811, "uuid": "ca26e7ef-5dd9-47e5-b446-12428a9c0afc", "comment": "Malware payload (GuLoader)", "value": "b9a2cfe0cdff20eaf39f986878c4fc2a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686552811, "uuid": "431f3105-a0c2-4f8d-bb16-ebb41c95ede8", "comment": "Malware payload (GuLoader)", "value": "d268693524fc895727d54f8aa8e74b98477528850b911fc65ef156127dff161a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686552811, "uuid": "e59d9e40-dc58-4614-90df-a09c34d66de5", "comment": "Malware payload (GuLoader)", "value": "35bea10b11027f49744357035b143b0adc8a1627", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686552811, "uuid": "315419c7-01f1-4dcc-b8aa-a6cc2a9527a4", "comment": "Malware payload (GuLoader)", "value": "83e2a78f81953cb2e632ac66cd8706c585e413e0aa78a3ced21341dae6b54deb73262bf1cab384f135dfc4d080fb4fd6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686552811, "uuid": "7cb4bada-27b7-4801-9c89-614c77c6c152", "value": "T18DD49D23DE1A81D9E86931F21423980B11BD6CBD65A6746A717FF6295C3B203CD0F93E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686552811, "uuid": "a0d4760c-6c58-4717-97bd-14fe2c3f55df", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686552811, "uuid": "1309bfac-2173-410c-a96c-6257671c6482", "value": "6144:s9X0GTN2TRZV13cWT6MyjVRjmdStA21cogHwT3bRojTdQFVhKAzBz572DCm3A+BT:i0tphuKAlz57RiRMy1aOHsy5z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686552811, "uuid": "3185068e-17b5-43cd-8823-cd3c3cda91dc", "value": 633624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686552811, "uuid": "709c90b4-ec68-42c1-a83f-53fd6265020e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686552811, "uuid": "d3f40df9-7610-4e9d-8a49-610413ff5f4b", "value": "b9a2cfe0cdff20eaf39f986878c4fc2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "308fef01-0905-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686562838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562838, "uuid": "75e1f7cc-d592-4fa1-9b7e-981d38fa6fbe", "comment": "Malware payload", "value": "cd69180573f163a28dfc97e7144d0c4e", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562838, "uuid": "29e7aaac-399c-4f3a-800a-5a9a0f254ba7", "comment": "Malware payload", "value": "d278717dbce509860c885815695b5ad962a0dc060158aae662308d53dee92156", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562838, "uuid": "8cf03adf-424c-4f0d-a220-40e345dd4338", "comment": "Malware payload", "value": "a59301cdc2f324011bc36b5eb3916a37d7e76007", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562838, "uuid": "b0170025-0ecb-4bed-bb26-f04da3e886f9", "comment": "Malware payload", "value": "31d277153ca659ee252777a3201236d0e786a29098bbb629f11e003cbe52cdf56f817f24efde08ab8faddb516424147c", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562838, "uuid": "27af81bf-49b0-466c-9f20-3dfae8e4df1d", "value": "T17B72FB9DC38B0568CF812BB9176B2F88425CB63EF74951B27578573036E9C3B492683C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562838, "uuid": "6be69244-98b7-4e6e-ad04-b7e6c96546a3", "value": "384:mVIyF+FNwjKHwpqGVuLiaRMGRRp8wVXSQ3iLYc2TVnJeA:al0IjrqGVuLiaD8wVXv3iLYckZr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686562838, "uuid": "dd63ef20-4c5e-4373-bbde-9b4e6552138e", "value": 16836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686562838, "uuid": "bbb177ce-ca90-419e-af78-087325fb2224", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562838, "uuid": "4075f583-6253-41bf-85a3-50e8416cf777", "value": "POX-X4501226854_WJO-001.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83ff67a3-08f3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686555247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686555247, "uuid": "1ed6e47b-bbce-432a-b476-b2782b018389", "comment": "Malware payload (Mirai)", "value": "ccafe6df7ff97a54dd03552f8081e874", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686555247, "uuid": "cb882fcf-78fc-4d0f-b7b4-17c16c17647b", "comment": "Malware payload (Mirai)", "value": "d2f1f18d716320157b45b419ba468eea0522ef9819b90c43faabf077261636cc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686555247, "uuid": "c59287b1-a1f7-419d-b5e1-d3d3dc37a5f8", "comment": "Malware payload (Mirai)", "value": "b7d82a15ef1d02c1b3264ba80328471a9444c5a9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686555247, "uuid": "7fafb9c4-ae2b-4ecb-8b4e-cbe369152f43", "comment": "Malware payload (Mirai)", "value": "1c82369402afe3a7c50d0d970d30cdf54c939152bda0e3a747e6140110b08511c8a523464d17c9559dbd07b47f76ae90", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686555247, "uuid": "6712baad-127b-4920-993b-ddecffe97816", "value": "T1B4B308C29A93BDB3D5C2EAFD67BAE3100AF394366B6B4651F3D85C70C55A984310836C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686555247, "uuid": "b8be1171-85dc-435d-ba86-0f756a8aaaef", "value": "1536:iuSyL4YxzTcBYZnJS/FJlCTKft30gURfl+Q/8B1iBGt9Awvj9EzRgtXdZtH:NvXZnAJETKfx0fj+/X5vREzRYXdZtH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686555247, "uuid": "c50eecd1-8649-48af-8cb2-0af61fcbe411", "value": 109401, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686555247, "uuid": "cc3f332d-12c6-4b1c-985c-4186c82f00f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686555247, "uuid": "af09c846-a666-4b6d-a243-e2543b23934e", "value": "ccafe6df7ff97a54dd03552f8081e874", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf98a3eb-0904-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686562649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562649, "uuid": "087987d6-38e1-471d-bb8d-90b0718b3c45", "comment": "Malware payload (AgentTesla)", "value": "efa53d48a12ae904fbe8b8d1cb5c6bfd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562649, "uuid": "e6a5a18e-956e-44de-bc91-19e233b9fae1", "comment": "Malware payload (AgentTesla)", "value": "d42a484bf737e8207f34da4c145571f8cc387e941f85d5b9c5fd07b51094bc59", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562649, "uuid": "70f6313d-892c-4ab8-9ee2-376a1be5c05e", "comment": "Malware payload (AgentTesla)", "value": "4091b9bc4a764ff228b1efe160b1cca5fe8d9095", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562649, "uuid": "1dbab9f7-1ccc-4254-b184-fbaf2b146292", "comment": "Malware payload (AgentTesla)", "value": "b3774fc510a0deb89b6a7b4624e310b15b7263ba30cc3fb214f2a9a584f59809210f5ec4279a6d9c36e5aa6aa9d2ea6e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562649, "uuid": "0c214a96-f436-413c-930d-58c710e674fc", "value": "T1BF65122863FB476ED4BB6FFA1930027493FA28657577E3460E9270C99D26F150B40AE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562649, "uuid": "0b4556f2-8a8b-4812-b0e2-892468402cf3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562649, "uuid": "200d9fbd-33ee-45c6-8f64-6795f12da74c", "value": "24576:zFROyqGUL8sjKvG43MHsNkaNGgwgpqrGrFrHykecOI34vDnhQ/hbHEm3QN0zaR5t:TNqGo8/vzMARGgwgpqrGr5y7nI3KDnae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686562649, "uuid": "3fa1d857-ca2b-46d8-a29d-96746f2c1491", "value": 1540096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686562649, "uuid": "448f9e81-843e-4b05-8102-9c81eed33aae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562649, "uuid": "f215acb7-ef12-4a4a-aab6-5e4e5ddd87bb", "value": "Optus LLC Quotation Request.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3213faf-0936-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686584103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686584103, "uuid": "3ccafc9b-7857-4153-9fad-c17e077426b4", "comment": "Malware payload (Mirai)", "value": "27f6e2a3d3f0c782d930dd445b7826e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686584103, "uuid": "fd47a47f-94be-49f5-91a3-2a2d2a899ed9", "comment": "Malware payload (Mirai)", "value": "d550b26511cf915d5d9c0828ba52b6985950c17231b862ae27ecd0ef7460a40b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686584103, "uuid": "0fcfbe5d-61a4-4ac3-a038-7df14af593fe", "comment": "Malware payload (Mirai)", "value": "9bcd2ecd375b2373a05553a9198d52b74860532e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686584103, "uuid": "ce176094-f755-4290-ad6e-bf31e28703a2", "comment": "Malware payload (Mirai)", "value": "f2430c973ff16c1f9c0f80ca1e2f90203b88daf0934075ec7204ef8c6498909fce7bcc2585cf0ae4903a8cb9f594b570", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686584103, "uuid": "a2503f73-6267-467c-9de6-7ac00033e8f5", "value": "T184143B46EA408B13C0D627B9FA9F42453323A758D7EB73059528AFB43F8779E4E23506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686584103, "uuid": "23073a56-7b47-40d1-97f5-54fa517ef32b", "value": "6144:u9HOpjY4ravaZ6xYP6YRAwIKi1XM/RwTnv:u9HaY4ravaZ6xYiyLK1c/2Tv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686584103, "uuid": "da40eef3-76d3-4a80-9f4d-9b65c99de34c", "value": 202057, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686584103, "uuid": "87c98f09-3051-48de-8a09-59fb8817526f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686584103, "uuid": "42c17262-8e9d-47a4-a2ea-159feb568f59", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1baf010d-08be-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686532309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686532309, "uuid": "0d45ceff-8d6b-4e11-a6e0-af50fc8cebc1", "comment": "Malware payload (RedLineStealer)", "value": "ca792a29effa70d92182871baac8edea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686532309, "uuid": "7e347564-03d1-4e9b-b387-bd37e7b82411", "comment": "Malware payload (RedLineStealer)", "value": "d717d812825207c54a3d391be73c08b460408ea915bf1d5f672c1bfecfb7ed8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686532309, "uuid": "cf63a53f-4548-48e5-8618-c13eb7e84b62", "comment": "Malware payload (RedLineStealer)", "value": "6ee5a35a95f6c4e338bb6ae819ae1e406a509fbb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686532309, "uuid": "0c27e97c-136b-4d6f-a9f7-210e2461aa06", "comment": "Malware payload (RedLineStealer)", "value": "096a09fcbb9f99eeca8d54ca54fecc3acd9dc5301a003f1a6fe97b872ba02ada8cc9bd7c7432cf3d9ee11ddee4a20411", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686532309, "uuid": "5fdf78eb-d99c-4938-9444-4723adf4d41e", "value": "T10164D00075A0C836E6F385349835D6EC2A3BF872A964C58B72443F6F6D32F819E5635E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686532309, "uuid": "51dc8f04-20d8-4a04-9d9a-e1c5b70ae1dc", "value": "3fa0d4fa381293581a648748e6290804", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686532309, "uuid": "86a99b9b-be07-43e7-8a1d-54a581e6ae92", "value": "3072:FM69UqbkE6lc6h54cOa5ADzjthpfLwEcBaf6d/jfTlyfA/E8LeBxqH/TVReh0q3:WaD6X95ADzpDwEyjGAVLu0HLKe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686532309, "uuid": "fc76070a-7953-4a59-b65c-042eadac809d", "value": 331264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686532309, "uuid": "090db59b-a15d-4c1d-b7aa-f0f77062497e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686532309, "uuid": "240b9daa-384e-4c14-8f27-74cdd792dd82", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d6341f3-08f3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686555236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686555236, "uuid": "35b0cb28-a2d1-4ec6-b0db-18a819e9a77a", "comment": "Malware payload (Mirai)", "value": "f2fba1349577a4e1bc7f91674dec46ab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686555236, "uuid": "6ce46f2a-fb92-47ed-97fd-7135bfa92354", "comment": "Malware payload (Mirai)", "value": "d77eda3d0506ff1a3fab298362827155fde13f3179589416c5a685beb7eb896b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686555236, "uuid": "3f21fd2e-89c0-4f80-8034-cc2c164034c3", "comment": "Malware payload (Mirai)", "value": "6790c998d2df5755d7cacb308819494a3be46188", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686555236, "uuid": "f961732f-0ac3-46a1-91ad-cf9f7973c7e4", "comment": "Malware payload (Mirai)", "value": "ad78d5c5e4dc0fce49c49e8723dfb81f5c54ff414a6eb7961ed36cc7695b2e4b0cf81bcd585a8bc5754fef52452fbb53", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686555236, "uuid": "79c1423d-1b28-4171-8e43-75c5f7cadbb3", "value": "T14CC3D5C1BD427E37C3C2ABB7EBAFC1483BE2971493972341A4985FF05A1B98D1D09259", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686555236, "uuid": "a1e366f8-c2e5-4efc-934a-864bdc5966c8", "value": "3072:JzVyMNulY5Ra5A2dmVjjSkQNdXvVOsf9FvVJkF:bu+a5A24VjjWdXvVOsf9FvVJkF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686555236, "uuid": "0a790603-202f-4114-baa9-40f50e1be156", "value": 122221, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686555236, "uuid": "3e6f4676-7c6c-45ab-975d-63f5bee902c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686555236, "uuid": "0eb7f09c-c655-402e-9583-89d406d95a0d", "value": "f2fba1349577a4e1bc7f91674dec46ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb8bbd93-08bf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1686533114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686533114, "uuid": "0e2e83b7-ef34-4359-a5a2-bee5ffdcecf1", "comment": "Malware payload (njrat)", "value": "c1fe9d30d0e68db7d12e51b84cc7c5ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686533114, "uuid": "da09c3a2-26dd-4c43-afcb-667075dc0cf9", "comment": "Malware payload (njrat)", "value": "d91ce4d753b5d0c4a80fc837d83b9c2ddbb49a22f70536e9e7c23f395e3e45ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686533114, "uuid": "bd79dce7-604a-43dd-9e8e-806950b0c980", "comment": "Malware payload (njrat)", "value": "4aeb621755a1fa628e29551fbcaedaf4905b22e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686533114, "uuid": "863b2fae-5d98-4abe-a69b-c8dbefc331b0", "comment": "Malware payload (njrat)", "value": "f5c16daf3ca509e62d0336b8a9e012c23c81162e6b02825ef02dc210464d5a83a9b079910d1e9a75433de6415cf52721", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686533114, "uuid": "5e06de2f-895e-4c01-b723-256ebc8b416d", "value": "T125B3C54973D46427E07F76F75431F3008E74B4C71612A39F49E128AADA33AC44F99AEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686533114, "uuid": "ae432be4-6749-46fe-81b0-846b031e53b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686533114, "uuid": "ff36b1aa-92ee-436d-acc9-074c13f13e48", "value": "1536:t+7kVbPGHz88EbE1pjEwzGi1dDxD/gSh+u:t+0PGHzmI1mi1d1Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686533114, "uuid": "db8319bc-2b32-41d8-bcec-e998ecf2836a", "value": 110592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686533114, "uuid": "2ae175d0-91da-4f49-af43-5cbf76e31ffa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686533114, "uuid": "7aebc104-6888-4dc5-8bd8-58d8d6cc3284", "value": "c1fe9d30d0e68db7d12e51b84cc7c5ec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02a7e5b3-093c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686586384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686586384, "uuid": "b5bc7931-6f42-4478-9872-d6febb3580f1", "comment": "Malware payload (Amadey)", "value": "3a369041440eec907acb1b854150c12c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686586384, "uuid": "427e8866-1ade-40be-bebc-b7ae3ff316dc", "comment": "Malware payload (Amadey)", "value": "da11108b7fb14023a20b5d1316e9a5853690b80e079e77a1879ea9a446ef392a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686586384, "uuid": "2ea15fa8-719e-4f8b-9ce6-d99edba05b82", "comment": "Malware payload (Amadey)", "value": "f6d8aefb071b76daa9f0d2258c9d09a935dfd81e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686586384, "uuid": "d7bdd6f1-e5f6-4f5c-91ac-ac70d547a63f", "comment": "Malware payload (Amadey)", "value": "e018b9ece376dee2c0dcf233780c9df58501c4554ae65d01ba0a049eb5128204ff4f36ad89733cb44d31f08e03557500", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686586384, "uuid": "0c9025ba-7a02-4f0d-9c91-c1c37aed29db", "value": "T195052203E7E89432ECB6273028F703931B36BD619C7887673396E96E5C72691613536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686586384, "uuid": "5d59f02f-4433-4e07-bbd5-d1425d255978", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686586384, "uuid": "733b2a39-7a2b-46f3-bf32-9c48dddf128f", "value": "12288:cMrvy90QTR7+xBhqWkRH4n9Q5Cac1ZER65LomG1wCa2RbHTuIbBcvQFH:zy7g3Q9YGC/Z1LoWCLnuItcvyH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686586384, "uuid": "8c3e4c40-42ed-4133-b177-f0c79c8e9d4a", "value": 797184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686586384, "uuid": "8fbbb319-c24d-4737-b196-c29d613e86d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686586384, "uuid": "8bf1d00c-d75c-42fc-b5e3-ceefeed94518", "value": "3a369041440eec907acb1b854150c12c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97834d3b-094d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1686593935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686593935, "uuid": "7e38ff78-c00a-4dcd-a1d7-2db8706b7a97", "comment": "Malware payload (GuLoader)", "value": "b9d8b743d655b0b8f3a27e7dbbe33f28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686593935, "uuid": "686e5f0e-acb5-4e2d-be61-cd673caf679a", "comment": "Malware payload (GuLoader)", "value": "da181fbccfc1486333cb302261b5d8389c8dfd60039a8f2cd77e6849295247a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686593935, "uuid": "441f1994-6231-472c-82de-f0e71c289d8c", "comment": "Malware payload (GuLoader)", "value": "6db3026e9d89c1517d046f7605b77e41266be736", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686593935, "uuid": "c6d3bba2-cd41-4e03-a23a-476dc9ba8590", "comment": "Malware payload (GuLoader)", "value": "e147c6ec9b62979c02834efb845e89bdb839062e3ca7d27070dd16ff0c7ad41116f6b1492d605b13cd5d8dd1b685e5a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686593935, "uuid": "4dc5ae6b-9501-4af7-8415-50ffb35a2bf5", "value": "T15BE401023D5898DBEE2D2AB01877D56E2BB3386447419A0B7AE5FEC7B9123535C0F94C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686593935, "uuid": "e72ad639-63b1-4d48-acdb-823aa0614d18", "value": "57e98d9a5a72c8d7ad8fb7a6a58b3daf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686593935, "uuid": "a0d56ae6-72f2-449b-839b-441d9117cb67", "value": "12288:R1mr+NBo/oJei4YBa6OjAGPA+HinM+nlRffmIgCeG3bZmUjWh6svpLgLlmQ:R1TBowJT4+dOjAeHin1lVXgJG3FjJgpe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686593935, "uuid": "699b480e-9577-47f1-a9f7-f8798f6e1549", "value": 699918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686593935, "uuid": "315d5606-7d1c-4556-bdf0-533130ce4c03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686593935, "uuid": "ae771c6d-90bc-4c97-b371-4cbfea053cca", "value": "rJustificanteTRF776328529233.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c1cfb63-08ed-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686552469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686552469, "uuid": "909727b3-b11b-4e77-9e39-7a7623ad8675", "comment": "Malware payload (Mirai)", "value": "1573bbde9eff40c23b8b42767f56abc0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686552469, "uuid": "51cb87a3-db8c-4b15-a7c5-2d6b9403ca55", "comment": "Malware payload (Mirai)", "value": "db31e7ffb4d8e937d4726317ac2986d9fa76269e9b4c7b0b25c5bd4f8e357ade", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686552469, "uuid": "7363875e-a363-4ac4-8dd5-56a4675b8076", "comment": "Malware payload (Mirai)", "value": "412651858dd53c8a39a5c030afd3316dedfe607c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686552469, "uuid": "b47b58be-0058-4ea8-897b-207bdf2e8868", "comment": "Malware payload (Mirai)", "value": "94b0851a58e885f889ba4bab5dc3fc6defd0e5ac0fe18aa8b0bd3ccb0a008189cff5fef364854c21a1af5cda60ae15d0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686552469, "uuid": "55a05494-d613-4b97-a035-e23cd2a5b208", "value": "T1FF632851F8819A13C6D1127BFA6E02CD3B2613E8E3DF72179D225F2037C696B0D27A95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686552469, "uuid": "9e9d4cf1-2372-4d77-a3fd-9e2911d8483d", "value": "1536:rNHlxvmiiBmLv/RN/59Gyi4BxF+2YWfwz2vvWz:rNprxkp4BxF+5sbvu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686552469, "uuid": "d7933e16-f8a1-4550-97bb-d17e23758622", "value": 66920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686552469, "uuid": "08a10358-ecd2-4a16-b8e5-f87c64335849", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686552469, "uuid": "196e4ec9-8cd1-4647-bdd4-5ae00413a624", "value": "1573bbde9eff40c23b8b42767f56abc0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b820a4e2-0904-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686562636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562636, "uuid": "f6e4dea4-9605-4941-8112-40f05cab203d", "comment": "Malware payload (AgentTesla)", "value": "62b9923a4c681e6552f3074ad1069ef2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562636, "uuid": "8f118f54-5ffc-4993-bdbc-434a70757e0f", "comment": "Malware payload (AgentTesla)", "value": "dc3631d8ee7b78d238da3818d231b5f8a9cb1b3a6540643b792d1fc3e9a7ab62", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562636, "uuid": "aa8c12a6-f0b2-4d31-bdf8-7eb14fbe86f5", "comment": "Malware payload (AgentTesla)", "value": "14102ea7ea5f90ac22e0a824b4d3a0a41fdab57d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562636, "uuid": "1dcbdb3f-c306-400e-a872-fa547ed9a81d", "comment": "Malware payload (AgentTesla)", "value": "c18c69ada0b248e953cd8841c181f3e7c33be03875f0652a51a67403d831b5aebefa9dabf1bb74160dad8713dd84c3d7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562636, "uuid": "830da49a-c88b-4dbf-a488-f40b4990a3fb", "value": "T10FF31768D2CB4D31F32E4074C4AD311816BAE1575617E75E0DA1ACF73E4AF83722E8A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562636, "uuid": "d1f16151-6302-449e-a79a-430f9ab38c9f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562636, "uuid": "04f4d26f-0f36-404a-aa18-db0295cd4e0a", "value": "3072:SIHVFK2vUzm7Zx99j5msYdCe6yMImchhk2MMcGzUk9SGcE5:SIjK69z6YyM6OWc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686562636, "uuid": "d7edea65-9886-4fdf-9260-54a3862ec54b", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686562636, "uuid": "f907f008-ab39-436f-a860-94691f9e1c63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562636, "uuid": "1b4f6c32-8919-4066-8b9d-5dfeacc159b9", "value": "dc3631d8ee7b78d238da3818d231b5f8a9cb1b3a6540643b792d1fc3e9a7ab62", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "652fabbe-08e5-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686549183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686549183, "uuid": "2ba641fd-d7ea-44a5-9f1f-6c61f34f6108", "comment": "Malware payload", "value": "18de0cc6af559b80698181bce1ab907b", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686549183, "uuid": "07ce1565-fe34-45e9-bf39-aca7d4870077", "comment": "Malware payload", "value": "dd25bc697a9aad7c792ffd9f16336da1d59f7cb6c86dcec38dc41222d5467db9", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686549183, "uuid": "9e5aa00b-81f5-489d-ab68-b8dc28519afa", "comment": "Malware payload", "value": "0f6a2c4bf38d18dab312bfa2693456eee9a22f53", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686549183, "uuid": "23e82d2d-9c55-4c61-9e98-5c653885e456", "comment": "Malware payload", "value": "31d2630aacb48af8876d8da841790de845fc370ea6d38b9874ce3475bf73dd75c5a420ec8c4eb2138866b2937730a8e5", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686549183, "uuid": "2cb50fc6-2dc4-4813-bfde-05f888de0163", "value": "T1BFC228565B8C4C61E36AE8BB875DE00E08FCF62634C255D4BD9DE2707B3D14E0B6A1B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686549183, "uuid": "7cda4b8f-87d2-41c6-a900-8a69b71e34b7", "value": "768:5JczduXKblpYZ5xWXlEJrEtCajIAeoY5W/M028yfn2xmcE6v:adPbW50X0rSjIAeZ0/MUyfn2oI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686549183, "uuid": "385310e9-79de-4e95-bc21-f010ab3aed17", "value": 26271, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686549183, "uuid": "8ff742df-a3a8-4083-be26-9d6d0fb2c51c", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686549183, "uuid": "14bd9bf4-a61e-40c6-bfdf-53ae5023a807", "value": "18de0cc6af559b80698181bce1ab907b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a4806b2-0932-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686582236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686582236, "uuid": "410a9bb8-096c-477a-85b4-4bfca806dd4a", "comment": "Malware payload", "value": "e90555b4cfab85b7ab171052cf232415", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686582236, "uuid": "cd885d4e-fa26-44e3-8c30-73178fa60751", "comment": "Malware payload", "value": "dde1febe20ae5c40950945964039f36717171d2e517329ba1e74bbc930a87559", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686582236, "uuid": "2e7b0d7a-46c1-49c7-937f-5038c8482c15", "comment": "Malware payload", "value": "badd3d5b1020495952cdafd26438bb020918aba3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686582236, "uuid": "01e7597c-5515-4225-835d-aee7ae7218c4", "comment": "Malware payload", "value": "e74bd4e8c21d254aa051eb7cdc7e1e9cebd52feedc46e13ef37048340ba28d782860e81a5ae086aa196f2f6f2cae3898", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686582236, "uuid": "68860427-2de9-4c41-aa3a-88a71838a1f1", "value": "T14002325AFBA5CD3FD898433888BB47707270E89C5F4247332204A5752E05BD85FAA9CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686582236, "uuid": "3c8e283b-0214-4a18-91fd-b5268411552a", "value": "96:RFTRVB+BCo0SnBcN1uMReuK3Aw/VTVw70suuBzEBqSiVeP:RFnwQIB0uPCw/RupKsSi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686582236, "uuid": "4da04afc-bf71-4106-a262-7f7f5b0a6d2f", "value": 8352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686582236, "uuid": "84b049bc-b7c7-48fb-ac97-77236a0d28b1", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686582236, "uuid": "94f26b88-c7a7-467a-b8c9-c673d536d093", "value": "e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cf45f89-095e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RecordBreaker)", "timestamp": 1686601219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686601219, "uuid": "f82cbc1a-6707-4ffd-a69f-9b99c563380c", "comment": "Malware payload (RecordBreaker)", "value": "ac2905ab89ac3a775a7b3b729f8f25a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686601219, "uuid": "5098ad8c-b4c5-4649-82e2-fe2ff00bb444", "comment": "Malware payload (RecordBreaker)", "value": "de250df1e7489a671f81a4c2e6d8d878fc8e0a31dfe36b6a716fda90d5b16bb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686601219, "uuid": "6842cda0-38ce-43d0-a6c0-8b378319b52c", "comment": "Malware payload (RecordBreaker)", "value": "7e5d373c72c8ef3069aab13cf042a88dcf83c473", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686601219, "uuid": "4783474d-d73f-41e5-a84d-fd9afeca5fef", "comment": "Malware payload (RecordBreaker)", "value": "3b937acfcb6246ded3a27365e5d3c7ab1eb614a4ef70dc4fa03b16821f693ea19bbc841e8abbea340a2cef6e0a65d889", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686601219, "uuid": "40b9acf3-7b27-4d8b-868b-ff4869a8abbb", "value": "T1D834F813DEE17F64E6358B32AE2EC6E837CEB5118F19776652289A1F05B01B1C963370", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686601219, "uuid": "3c302fd3-e5f0-40e7-b463-de04887e03b3", "value": "7f87b3efdf116f7ab8f1afe2047eb9b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686601219, "uuid": "67631dc9-c9cb-4f3a-ae33-47d83562fb49", "value": "3072:gKoOPj4nC0Yi4hIshjXCtKdHinMlCuEIvGSQk5xZC1rlorkswu:QOPsC0Y8sCwHiWC7ISor", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686601219, "uuid": "1bbd7630-e90c-46ef-ba7b-a45a40ae0eba", "value": 248832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686601219, "uuid": "5e1f0b12-dec1-40c2-b678-6f351e7b6586", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686601219, "uuid": "541c5507-5cd5-4033-9768-75b0761df66f", "value": "ac2905ab89ac3a775a7b3b729f8f25a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0783d6c-091b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686572582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686572582, "uuid": "9d210cad-8fc3-4229-9b04-de33e71f829e", "comment": "Malware payload", "value": "4cb7400d87e6435171bdbf920e578bc5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686572582, "uuid": "c3261546-8f6c-4f10-9693-1fecd343113a", "comment": "Malware payload", "value": "de74ecc1a1ff950bc1cecc5c588fad67f169ed083bc5562a90ae8cc9834bf482", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686572582, "uuid": "f3194f1e-70ab-4824-8763-8d01db3103f4", "comment": "Malware payload", "value": "88ac8d5c45c1923fd31fd6f45ad3b15e9ef0d05c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686572582, "uuid": "c17b0051-5bb2-453f-b977-e3362901a9a9", "comment": "Malware payload", "value": "0bb69375514bc61053d10acbcaefb9a0cbe6185c49e2a46b8d5dad46d09418139f42208a93ecc9bfd44815eaea3903e5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686572582, "uuid": "6a64c08c-ab1e-41f3-ba78-17f76b21453e", "value": "T123C2844919E34952A3B7F0761BDED4187A5BC1974B0DDE207DAC42D6BF90039D2F8AC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686572582, "uuid": "f3c0b5fc-88ce-492f-bb6d-2963b37cb501", "value": "384:rsAAHe4XDp2fv6Mf8JSN6WWabfd43+yZzB3l5:rsAke4XDp2fv5f8J7WWARy1B3D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686572582, "uuid": "ae784803-0150-4517-929a-f725e35dc03f", "value": 27983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686572582, "uuid": "d656ae3e-3861-4671-8427-440b389019f2", "value": "text/x-perl", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686572582, "uuid": "4ede50aa-8b0a-407d-9b1f-8d24e7a9fa60", "value": "reps", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fad4ec58-0912-11ee-b3cf-42010a9c0076", "comment": "Malware payload (LgoogLoader)", "timestamp": 1686568761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568761, "uuid": "8ef9b884-b6a2-4e9b-a976-565e8b19c51b", "comment": "Malware payload (LgoogLoader)", "value": "3dea18962bbc54787a0715e84b9d463a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568761, "uuid": "f210d594-e87b-46b9-aafc-9c4051a83a31", "comment": "Malware payload (LgoogLoader)", "value": "def47cbe5de9b42a8024427f3183ed92d42aea9dffb1ed8b0aa8fd49d26fa26e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568761, "uuid": "8065f05a-1711-4af9-98ac-67bead0f56dd", "comment": "Malware payload (LgoogLoader)", "value": "111a364cab17d093538d1f35e99bef22b034eb73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568761, "uuid": "cdd9caa1-2476-4338-b2de-130df86b2306", "comment": "Malware payload (LgoogLoader)", "value": "4afc805e4275d38a04273711c3ab14d1b8dc2cfea70b1733487acce4a86bf8958bd52ae3728f0631cf7d9a8654905caf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568761, "uuid": "ed33ad5e-e392-46cc-b697-e6d17e416669", "value": "T1F094E7667A1044F3CC2916F5A83BC9A0777B7D7ED578024922ECB3495FF72A64822783", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568761, "uuid": "98deff0d-3d36-4c4e-b009-0267a54b1147", "value": "3072:FDeHrC2edASgrXx0ooARRMkAHFIxobrvZkJv6SjaFvVmuLyRpPS68urGh3Lzs/v6:tx2egmooARiXCFT2Fp6SQaofZA9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686568761, "uuid": "dc654fd1-27cf-4985-99c2-6865b36fa2d1", "value": 412160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686568761, "uuid": "7360221e-5275-499e-acc8-32302d8db5d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568761, "uuid": "25cd3bd5-aff4-45bb-9ad0-12e6d483f26d", "value": "3dea18962bbc54787a0715e84b9d463a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8b9a5f6-0970-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686609023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686609023, "uuid": "e88a8656-e3e8-4659-9e76-acceada11067", "comment": "Malware payload", "value": "ee19941e6cdefb1ffa86366bc413e5ca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686609023, "uuid": "7d5dc58f-2764-49cb-b527-2b5c85c60e7b", "comment": "Malware payload", "value": "dfc0c38b1fe02c3f9ef6187b5bb3d16db49c387ea8514d8d875dcfd509a46063", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686609023, "uuid": "72f0c225-69f8-4d9e-8b52-53ba77774988", "comment": "Malware payload", "value": "77db6fdc8aa17adc30bc3b36eab1a4211773e480", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686609023, "uuid": "8562e8ea-c894-4ded-82ff-896e3354512a", "comment": "Malware payload", "value": "9334cb40bbc052cd147b1c9268069cc2c1f95a14afaa256ea537fe0c16453fdad7f00f29daccee273bba9074d4de56e7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686609023, "uuid": "6b84d087-2f0f-49b3-aee5-488f88781644", "value": "T1CE646C13DEE17F60E6354B32AE2EC6F876DEF5104E187B665228AA1F04B01B1C963771", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686609023, "uuid": "23c1662f-365e-48e5-87d9-d9bf248d41ca", "value": "0e4b3a5d9cc3d6ed1b5c0b9f8a440aa6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686609023, "uuid": "c72ce522-698a-4372-a444-45eb9f0165da", "value": "6144:WIOihikBBk/qRYmHABn4hVagjGnTlFC0l9a9fiDopzH:Wxih1uqOmG4C2ils6Dop", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686609023, "uuid": "76f0ed87-80c8-40dc-914e-39543d5e1882", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686609023, "uuid": "d0bb0c31-abab-4bb9-bbf2-ed01445244c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686609023, "uuid": "054773d5-5181-417e-ad64-37ae31c6922d", "value": "ee19941e6cdefb1ffa86366bc413e5ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ead44d8-08ed-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686552474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686552474, "uuid": "343c080b-cf98-4aed-a5ce-ad045c035e76", "comment": "Malware payload (Mirai)", "value": "00f9e3fa2af932e7030d2c3b6a57bdd1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686552474, "uuid": "1f9e2eb8-b4f2-4c31-8fa8-f7f89a28d32c", "comment": "Malware payload (Mirai)", "value": "e076274665f42fd2fc6cba371acb22f03abb18dcf065c4a71df6362fcb61995b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686552474, "uuid": "5fa70b0b-17ee-4854-81c7-fe5a4ae6f681", "comment": "Malware payload (Mirai)", "value": "648ea098827a7c44810887758e569fff58d1d3bf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686552474, "uuid": "b54da456-0411-4af0-8c49-b069b3c5f50f", "comment": "Malware payload (Mirai)", "value": "73e34b5ce360384c945f447c6e5019e9254f3193f683457659a40acc228aa95cf5e3f2292ee5c7b983cfaf9485ade84d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686552474, "uuid": "97a3b8dd-2b76-4eee-b053-8e69c45fc4bd", "value": "T1D0534B02B31C0E07D0A31AB0253F5BD197BEEAD022F4F684656F979A9671E365181FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686552474, "uuid": "3d49908d-2d9e-48b3-a165-022c9dcbf58d", "value": "768:SEE5hjcoCkhVRGfRnbmX7/mG1nRy5U65XPy5EMca/p9OyDQvSFRMNYL6FV+tg6wA:+5HAdOmGGJ5XPAdFOyUaFRMNae+aTWgO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686552474, "uuid": "b634a3fe-a4db-4af0-92fe-29aa6a4615d4", "value": 62996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686552474, "uuid": "88129a8c-a3f0-436f-aec1-555e85248ddd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686552474, "uuid": "026d786a-9c86-44f7-8800-95ceaa884b28", "value": "00f9e3fa2af932e7030d2c3b6a57bdd1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3cac90b-0904-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1686562629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562629, "uuid": "ba65e554-326a-4d7d-b270-88336caf5d4d", "comment": "Malware payload (GuLoader)", "value": "2485db036d2e65980fb46b3e5ea5f6c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562629, "uuid": "c37208bd-5744-4aa5-9a78-b6471279ce62", "comment": "Malware payload (GuLoader)", "value": "e17e5969be5267263e1adbf361e80599ae406eaaf348713344cd652ef423a3ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562629, "uuid": "925af007-9f1e-43d9-a877-8656f20e260f", "comment": "Malware payload (GuLoader)", "value": "3cbedd972ad8228b19e92fa661bc292248988537", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562629, "uuid": "afcfb881-770d-4a3c-9b17-5c1ef3c8dcec", "comment": "Malware payload (GuLoader)", "value": "f9022496417b9bf8d57f0fbb86eb763aecd619020d12a0f0186dbb0ca17b1bc117377c3a02848cd182452659dba9e096", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562629, "uuid": "86de05c8-a3f7-4a73-863a-98ac4b9cccf2", "value": "T15084E007358084AAEE7E1DF6A62B40C177DADCBAD118964D3BC937560FF22C2583971B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562629, "uuid": "9e155549-40ce-4739-b19c-50205e85544f", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562629, "uuid": "196ac1e1-0bdb-4f0b-963c-6b88de395701", "value": "12288:SzvLurdIpkj2x7SRsoluyJGpRiBTwbpv/QOhCQKwFXW:4LurdIGSx23vGzi5YRQNmXW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686562629, "uuid": "e98797f8-d14a-4adc-ad6c-93025d7b5479", "value": 403000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686562629, "uuid": "86ba9c64-284b-4263-a018-4eecc80ac42e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562629, "uuid": "5a3792ca-411c-40a2-9196-5e7ac508db2d", "value": "2023-06- demande de BPE (Q18-417) - arc1800288.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c55a3fe1-08f1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (StrelaStealer)", "timestamp": 1686554498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686554498, "uuid": "84f3d061-3343-43d2-9e3d-2d95dc2abc94", "comment": "Malware payload (StrelaStealer)", "value": "8bb1cafea281b255df83be52d72f7c02", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "recupero crediti", "colour": "#F6A0AE", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686554498, "uuid": "12333483-1023-47e7-8ec2-1bd8df3226e1", "comment": "Malware payload (StrelaStealer)", "value": "e30523409e15df91594b6720294dc036a9e0cc5b41a3a022a2cd930f8dba9081", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "recupero crediti", "colour": "#F6A0AE", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686554498, "uuid": "673034a0-cee6-40f3-8325-dc30a49a1ed4", "comment": "Malware payload (StrelaStealer)", "value": "afd4e11bae65a3890a7c9bcaab7aba5457d11e49", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "recupero crediti", "colour": "#F6A0AE", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686554498, "uuid": "a0ef7fc4-c0fa-423d-a63c-86512cd470a2", "comment": "Malware payload (StrelaStealer)", "value": "bf8f033677dace65e266248a8dcc7bdd09b8b8566e2702fddac9310335f19fdaa52a9573702feb568c2092d45dc68817", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "recupero crediti", "colour": "#F6A0AE", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686554498, "uuid": "37b88565-30cc-4bb5-bf35-66ba6edd41af", "value": "T13625ED4954A8130EC2323BEEAB6D34D2C3709A1776F9C9E3859DB7A2DD5DC368B70424", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686554498, "uuid": "dd25fb02-a64b-4096-b4ba-730a32e3a1d6", "value": "12288:5KAl2RvJjQedJjgLbpL36scEjB1/pzJxEQvn0MqCY4Hj:502evc1dJOo0E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686554498, "uuid": "4ef31ae7-344b-4979-bbc9-e937e50a2147", "value": 981020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686554498, "uuid": "4ff43d30-766a-4123-8889-f8d63b58654f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686554498, "uuid": "fce1f8f0-e1a2-4c9f-ab1b-910a418609e5", "value": "js.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cacb9b6-0905-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1686563020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686563020, "uuid": "30354c90-03be-40db-83a3-da186bacc4f0", "comment": "Malware payload (GCleaner)", "value": "44e643ece58970034d64ed10e87699aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686563020, "uuid": "c319fed6-15a9-4b73-b538-668203dd1714", "comment": "Malware payload (GCleaner)", "value": "e72635f5f3ef72e10339b89e86a859604de9ea7e25d36daa7a9e87529802322d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686563020, "uuid": "5e2a218e-92d3-47ad-881c-1f42c788227b", "comment": "Malware payload (GCleaner)", "value": "00796642acb55918576db0f0d1634534127180cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686563020, "uuid": "6f36f4ce-57b1-4bc0-b9a4-836bf667bac0", "comment": "Malware payload (GCleaner)", "value": "a58104e727e3a5fdb2f4ec9b89d9f61f5787d0d5f576623d18238ee579f6700d11e3c43fca45b8fbc3a9ba67e1a92906", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686563020, "uuid": "7bf7e0f8-c84b-475c-a7a5-6a5fcc3b130a", "value": "T1FF44F1A13DE1C832FAB770388D31CBA4697F75326570C94B77E422AA5E326C19A35347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686563020, "uuid": "eedf395b-16e2-4b99-b045-d981aac0d934", "value": "23ba604235b7c155c424e2b60455c2fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686563020, "uuid": "240c1805-51dd-45fd-867c-b13c4bd42535", "value": "3072:SRNlhPgQioDLwFhHrsj+qMn2xaxFkX1CR6uwowNxrKMoD6N0gbv3Lcq5c7VSj+n:8niM2RqMCaxc1CzUNNKZDSSn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686563020, "uuid": "5cfcf4bc-40e3-4b5b-83ec-af52debe8df2", "value": 262144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686563020, "uuid": "007fbbe2-97fd-4222-aeeb-a9df693c0920", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686563020, "uuid": "8b76487b-5b17-4382-9391-da092a7ccb8a", "value": "44e643ece58970034d64ed10e87699aa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d94a09f9-0912-11ee-b3cf-42010a9c0076", "comment": "Malware payload (LgoogLoader)", "timestamp": 1686568705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568705, "uuid": "346a8fab-4ab0-48b5-85e1-1790c57b5a7b", "comment": "Malware payload (LgoogLoader)", "value": "194e670dffccd5785da26231d032e808", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568705, "uuid": "f803dcc8-9a63-45c3-a6a6-bfa7eea8dbf9", "comment": "Malware payload (LgoogLoader)", "value": "e8483e9918697dc2fd3b4fc0fde38795851312dd38c1a6c83acdcaba47f8de7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568705, "uuid": "38616483-d468-4ed6-af14-6793dd6e2d69", "comment": "Malware payload (LgoogLoader)", "value": "0a6ce468233b96041edc69330a0efa4b90194b4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568705, "uuid": "9304c150-e064-4786-a077-dfaa01a4bb77", "comment": "Malware payload (LgoogLoader)", "value": "a2f7a28e2c3e1ad1574fcca53f8c5364374d778f3848f9a6f0403e068863af4c00ce644ee28e18bf8db7da0b6ee1a4b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568705, "uuid": "2c9213b6-677d-4e28-9f61-298360f7e2f3", "value": "T16594F8667B1044F3CC2A16F5A83B89A0777B7D7ED578024922DCB3495FF72A64822783", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568705, "uuid": "0c84ec5e-9159-4d7d-b500-71970cea57a4", "value": "3072:eZSUo1eprSwrXx0ooARRMkAHFIxobrvZkJv6SjaFvVmuLyRpPS68urGh3Lzs/vqq:enpNmooARiXCFT2Fp6SQaofZAC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686568705, "uuid": "856281f2-e025-4e27-b0fa-387a83857613", "value": 413184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686568705, "uuid": "9773f797-07ab-4847-aa64-2b34de254034", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568705, "uuid": "1ccbb278-9d26-416d-9aa3-13960002c4fb", "value": "194e670dffccd5785da26231d032e808.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "277c2549-08ed-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686552515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686552515, "uuid": "6d9ebd71-238e-4b67-8d3f-cb2e59de6321", "comment": "Malware payload (Mirai)", "value": "756d97406377af8fdc91c66281f0d145", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686552515, "uuid": "11c472db-22b2-4a2c-9b81-8aed9e9ddf3a", "comment": "Malware payload (Mirai)", "value": "e9992feb2c467626f7780b63e31cc93c86d2896f028b94768a1677d7d69de7e6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686552515, "uuid": "adf0ff7f-79b6-41b4-96c2-f1fe148e5a63", "comment": "Malware payload (Mirai)", "value": "e2144899d360bf898b8df0431bb5973aacee16d5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686552515, "uuid": "0bec6da1-1a94-4801-bfac-dc536c00e15a", "comment": "Malware payload (Mirai)", "value": "82e3181958c4fc9a8136c64b6336b5c573b52d7d710ad6a7ba309f7bbf65a903733bd83a65124396121e7dc59ccd9512", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686552515, "uuid": "c59e4c2a-f93f-40f4-9745-69c9cdd3b8c7", "value": "T1BE83D606BB510FF7DC6FCD370AE91702348C594A22A97B367634D828F65B24B59E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686552515, "uuid": "33b18cf3-800f-493e-a4d1-cf8279af5ac2", "value": "1536:iVLymx1KxRkj752dCexuV/8UZlDwfkJ4MYfWv:iVLyIUGFezxu5VD1e6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686552515, "uuid": "0c5ae161-af9a-4a9e-894f-4a8cbc8b3070", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686552515, "uuid": "1014edde-2228-462c-ba25-0e2540961893", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686552515, "uuid": "e38015e0-242d-4ca0-9ee4-c9676c78d2f9", "value": "756d97406377af8fdc91c66281f0d145", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f4a9d23-0913-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1686568822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568822, "uuid": "0a8e7950-b41f-4124-bc6a-9d409a21f681", "comment": "Malware payload (GCleaner)", "value": "c6415efa40699d8a88460fc1937acd92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568822, "uuid": "be8cf2ce-cbbc-4d0e-afb4-67c72a14c32c", "comment": "Malware payload (GCleaner)", "value": "e9aae00f52b7382b463b38496310979d66eb032642a6434a051b73f403d2eda3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568822, "uuid": "1c43d622-a763-4ae2-bbcd-0c6e8bdd0bfd", "comment": "Malware payload (GCleaner)", "value": "b2983439be7df20e5631949313a852b8ec95488e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568822, "uuid": "d3d372a9-d023-4894-8150-6734a1225963", "comment": "Malware payload (GCleaner)", "value": "59f7634f12339e38a0f814514deeeea19661a47815e5ca88e2e22d49846c35606a8d88cc4aeadeca5e7c2daf9186dbda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568822, "uuid": "188cdc34-de2d-4995-9aa8-e3dfb65b50df", "value": "T1CE54D06139F0C832EDF655308831D3E5267BB8676438958BB6683B6B6D333C26A71353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568822, "uuid": "dfcf4fc4-4d36-4e9c-af2d-442078737d4a", "value": "1b96bbe7f35030dff720bfd4a2e62f20", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568822, "uuid": "bdd3ff32-07e3-40a6-a4bc-852db5e107d5", "value": "6144:FbR/1k4NjGJlWATh9Th7+922gVm+AUqpUDrFt:/9E92gI+AaFt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686568822, "uuid": "645af56f-70e5-4125-9f4d-b421709c046a", "value": 285184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686568822, "uuid": "448ac6f9-8bbd-4bbf-822a-0f6826be4e67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568822, "uuid": "c87daeab-ab6e-4a4f-99aa-dad93f4282e3", "value": "c6415efa40699d8a88460fc1937acd92.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a0b99d1-08f3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686555231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686555231, "uuid": "9257b6a9-a5ed-482f-93cc-d8bfc7f283b7", "comment": "Malware payload (Mirai)", "value": "636591a94cd773a64d79b320f54bbc7e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686555231, "uuid": "ed5132cb-7a39-44a1-b03e-6a80fc233e10", "comment": "Malware payload (Mirai)", "value": "e9e484366820b82e8edeed7e8deef04d2963efc9590f4b44f165cae41fad988b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686555231, "uuid": "4287a68d-2643-45f6-a31e-915d123c801c", "comment": "Malware payload (Mirai)", "value": "6cd638c657e84402733a59caa7bd460bf2ab1519", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686555231, "uuid": "1619c903-5a5f-4926-9abf-dae52f87cb54", "comment": "Malware payload (Mirai)", "value": "9ad563b5f5e0e488bb5cc53ab7a95ed068f63c791bdba42b0d24c4f0706b33b1162bafde81365c8c152a9d52f3eda1aa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686555231, "uuid": "eba36ba0-2b25-4900-89c6-33b086d8b44d", "value": "T14EB309C39AA27E77D1C6EBF5BAE6D53057E358000B570EB5E1D9CAA4811F9CC7408368", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686555231, "uuid": "2f57aa45-57c3-4fb5-8cce-1b18a84f1f2c", "value": "3072:bDDhRakMw3Zqh1MabcpNxUAAvDbdvDfzfSMdUpF:bD//MN7N03UHDbdvDfzfSMdUpF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686555231, "uuid": "1ad0ccc8-453d-408c-9dd3-12fd1edc170e", "value": 113875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686555231, "uuid": "9634bc9e-4c59-4633-8fa7-b37d4efa22f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686555231, "uuid": "bc03ca22-186f-4f1a-8691-cedfa692a25f", "value": "636591a94cd773a64d79b320f54bbc7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c66846bd-0904-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686562660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562660, "uuid": "81794b2d-a88f-4a6e-a63f-666ac91d70cf", "comment": "Malware payload (AgentTesla)", "value": "21f1e02ce3a995d1799b99f36217c9d2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562660, "uuid": "b2ab0a58-b4c4-4039-8341-9fe746ac2cec", "comment": "Malware payload (AgentTesla)", "value": "ea9f2431a64fc69fa9fdc839c8526744ede33f35a8e0a7b703fa2e03382c49d2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562660, "uuid": "358ec42f-caed-41ee-bf50-25881e93aac1", "comment": "Malware payload (AgentTesla)", "value": "ebc1e5e614023e61e614695df862e09d47511428", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562660, "uuid": "c17b24f0-241f-4d23-be01-9bdc69af6539", "comment": "Malware payload (AgentTesla)", "value": "8ceb251b13b6a49fef81c46827db9749a357bdab283832270e0e1c848ac4c06ff9354470ce6c452498c0b3decbe3085c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562660, "uuid": "cb12e8e3-5130-45af-856c-521a4a1aed06", "value": "T16F05E09862FAAF1BC4BA6BFD0450207083F556AB313FD2874DD7A4DEAD64F450A40E93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562660, "uuid": "8ed2341b-4fb7-440c-8293-3963987129a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562660, "uuid": "ad652f4b-5a9e-4563-b64a-482844863c13", "value": "24576:pUlRuJOyqGUL89cHCPR+0irMoLmc0plJ:pUlRuJNqGo89AC7sbmcK7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686562660, "uuid": "1e1f12f3-a816-46a0-b2d1-08f8d5a24666", "value": 821248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686562660, "uuid": "2ec5aa84-d317-453c-aa16-626d98de6c0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562660, "uuid": "9fa0ed6c-2a31-41ed-a7c4-39dfabdc4fa7", "value": "shipping documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50bdac48-0912-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686568476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568476, "uuid": "cf31fd3f-008a-46fe-8e30-3310fe557b99", "comment": "Malware payload (Formbook)", "value": "383e9c29384fb2db8dd898f47411ed37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568476, "uuid": "821087d2-3427-427f-bfc6-2c1f6926871b", "comment": "Malware payload (Formbook)", "value": "eb10b3bf216ea86f24001ad1891c9c1d7233e5b68e1b516695b9f242662d3682", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568476, "uuid": "e7a732a5-3347-4b16-a1d3-ade14be6a4dc", "comment": "Malware payload (Formbook)", "value": "ca927ce8b80597692e23035e4ec5c60b754376b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568476, "uuid": "3c41fdf6-e723-45a3-8233-bdefec183c3d", "comment": "Malware payload (Formbook)", "value": "dcfdd00160787cb54beb9c3f1b7493b1f50b2d5f619cdb3ebfebbbaeb4134e0530e71fdf95c48a918e23ca083188a097", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568476, "uuid": "f16e260f-df14-49ed-a218-9c8ed1d0664a", "value": "T134F4235182C89433D0F34C7978BAD3570FFB56CC28484E0B07945F5939AAAC7A54F6AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568476, "uuid": "52740238-af76-4963-b395-97e2ea6bb7c5", "value": "7fd61eafe142870d6d0380163804a642", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568476, "uuid": "e2caa068-1e48-4268-ac7a-0989da957a02", "value": "12288:GbM9JBOV+YpQZkFxaJ8AxUDYNo38GICEFgSRTyBvInkxlh3e4NFJuE7q+foNihl1:r9JahpQZshArNBXCEySRTyBIkxa4N3eg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686568476, "uuid": "3af8c434-1110-4dc2-8ba3-2f0726768a1d", "value": 782399, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686568476, "uuid": "1a4e82e9-17a7-4951-aed6-3530392845b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568476, "uuid": "110ec995-486f-4151-922d-1779d2333668", "value": "E-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1960ce6e-0913-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686568812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568812, "uuid": "e50df866-7234-408a-9597-7a03570ea769", "comment": "Malware payload", "value": "118bb21ad1ec48caf943202be2ec6b70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568812, "uuid": "4b9b0eec-fb51-4858-b8b8-80a7bb4443cb", "comment": "Malware payload", "value": "ebc2b8933b5fb454a2200fed7ff95d1d255fe0f90a2f10a2a409ba1d1d110ca4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568812, "uuid": "1f734331-f943-4e1b-b7fd-51c84e4dde6e", "comment": "Malware payload", "value": "ed07e1fe85c237c05b0e7dcfc41f49081a97d807", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568812, "uuid": "67e2c48a-d3e1-404d-860f-ae17d695863e", "comment": "Malware payload", "value": "a061a6e2ffd00a83dfa6c78dd3aa2dd1581922755a637df5de271c0fad45afa6b4f47c9d1346e3953763048147137785", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568812, "uuid": "cc45e060-cbc6-4c62-b3ab-1274a9d54414", "value": "T1A546339B2A8D41B8C5C41F309A075FDE26F21D3519258838A8C6BEC93637EF5B45F893", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568812, "uuid": "87c34faf-49ee-4cbb-aa37-1038afa02374", "value": "61f8fe009fd5fb28895d7f92e405cf04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568812, "uuid": "959ca8e7-faad-4117-9129-5d71eb9ff07f", "value": "98304:1sI05YFbDp2rSGDZ5VgO3ZRuiHJX/4dmn9/eUa8XHqVLI+MtirwwrLksbqalibwD:1505YFbDg20Z8OJ0O5/4di9XP6csrHrM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686568812, "uuid": "6a3be036-17f4-4321-b70e-1455fad7ef59", "value": 5733888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686568812, "uuid": "9d1feb44-0804-4841-a557-4fc7f7d44e52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568812, "uuid": "c6041838-de23-476d-8578-0f9649d07a47", "value": "118bb21ad1ec48caf943202be2ec6b70.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b68ad78e-0906-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686563493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686563493, "uuid": "4b139568-03cd-48c4-8e9a-6ba053387bac", "comment": "Malware payload (AgentTesla)", "value": "3960099dce9068289ae2d38c8166b542", "object_relation": "md5", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686563493, "uuid": "3dfefd7a-ef38-4f4b-aee3-923e981e299b", "comment": "Malware payload (AgentTesla)", "value": "ec154d3b498aef3034508eb012bdac5e47e56f2b34313d78f4ef9d7259be8a4d", "object_relation": "sha256", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686563493, "uuid": "b42ce2a8-1ca7-44be-97e8-1fc954ccdbf8", "comment": "Malware payload (AgentTesla)", "value": "d42b434ac94594f2ce6129cd5a220fb97335c2ba", "object_relation": "sha1", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686563493, "uuid": "3ed3a79c-0e33-4486-9aa8-54119d418fdc", "comment": "Malware payload (AgentTesla)", "value": "827ecd75a9a50ac92808e45008d4cff199a74e1bb8a47d7d737428c2fd5e23eaaa28f9fca3c0a03aa82b214f547feabc", "object_relation": "sha3-384", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686563493, "uuid": "d00e58a1-3d00-4e5d-82f6-38c98331d1b7", "value": "T1D95423AD291B76A56E14C4456D57D762F4EC6B9C20C3313DA3CE3247C8ED1102E2EBDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686563493, "uuid": "a90aaa3c-0b19-48ed-929c-c4a4a2f991cd", "value": "6144:Ed14bEWhA5/ZgH8QWcrQPhIuF0HR8iV0oanece9Vi:Ed14s/qH8QWcrQPOZHR8iVTseLvi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686563493, "uuid": "0635ab90-877d-4f51-8e2b-2287133f5ada", "value": 294985, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686563493, "uuid": "bc4477b5-ce4f-4809-a692-a28c0fed2fda", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686563493, "uuid": "fe0c28bb-230d-434d-9bef-a0e5e0dbf8d6", "value": "RFQ_0932000.PDF.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c17edc1b-0904-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686562652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562652, "uuid": "a1643845-ebe1-42ce-b4a0-efe8d82950d4", "comment": "Malware payload (Formbook)", "value": "5acb5b6a18f284bb3e57b91abe3f5154", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562652, "uuid": "068ac850-9846-4ee3-9a87-2f1eb4d6fecd", "comment": "Malware payload (Formbook)", "value": "ec38cccab250329be8413042a8ba0c3269393abaa95fea96259185d2cc22d1b3", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562652, "uuid": "2ed2acf5-58ad-441d-b671-47057ba21e1e", "comment": "Malware payload (Formbook)", "value": "cd65d74b7afc8a7a3aae9d26502405a4738d46ed", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562652, "uuid": "8313e9dd-1211-405b-8549-e9017f1bd769", "comment": "Malware payload (Formbook)", "value": "826b884d731bea83a112a9235813f05ac1f2589d7a58ac1c4992b2351783eff57b704f52dd4a4b0d65eb84b79bfaa9ac", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562652, "uuid": "33642eba-0dcc-4cb1-ad7d-ef9604c25ab5", "value": "T10FE433F5781FE10E869C6E46645185C9CC877321F1C4B8CEC5696730E888ECEEAB2977", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562652, "uuid": "430f9128-67b5-433d-ba4b-2b8c19d989b0", "value": "12288:j/GrzB4zRNmxJ/HMFe8X5d5UEarAHr5Wjsl7c88N9xVxcqEn6vsqFvsieDdVJpL:j/GPujkstJdaVAHr59c8oYqE6vRvWL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686562652, "uuid": "e1900dd8-8153-4542-859a-9cfc91609196", "value": 712484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686562652, "uuid": "6d68c331-447e-4c5c-a75d-227eec2b2a14", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562652, "uuid": "8998ba92-fcee-478e-9dac-359d68b82d5f", "value": "Revised invoice.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fb574d8-0906-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Tofsee)", "timestamp": 1686563454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686563454, "uuid": "7219f644-6e5f-4257-b1d6-e62943b261d5", "comment": "Malware payload (Tofsee)", "value": "8c0518e91b11908548df5ded37899a6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686563454, "uuid": "081ff797-1e79-4395-b4c8-06d5e2785154", "comment": "Malware payload (Tofsee)", "value": "ed3341bb3db572210528590643bca9c8f1045b2e161c2493aa39d0c646d22477", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686563454, "uuid": "ea9b15df-44c2-440f-982e-68f6b06ed9e8", "comment": "Malware payload (Tofsee)", "value": "0fd3849d649ce01b458339cb3caa36cd5e1393a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686563454, "uuid": "bcb528b1-1e18-4050-9cbf-d7b073d3116e", "comment": "Malware payload (Tofsee)", "value": "75c3b9c31c634772a5e8474f0d3c33febfdd85560587ea454d7c86e5060a5f6cde6740fa9f6f374cdbf5e6288f1cda38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686563454, "uuid": "08d2313b-2641-45e7-a15a-bd68a77c63b9", "value": "T10044171392E17D64E9255A728E2EC6FC762EF6104F7D376A1218DA2F09B32B2C173711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686563454, "uuid": "0843c807-4e40-42f2-b307-fbf2ad9eae20", "value": "71066788d95fce2cfb22e5743861df9a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686563454, "uuid": "2f51292d-9b2a-4d99-8ebf-3e2322a81c6f", "value": "3072:KAeFDqYp8kKlBImSHgaa3jKuw2WJ6utlvOikRvTGZhGnhcnUOKynruv:7eF6JlB7ShyKuw2WJBvN3Zac", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686563454, "uuid": "24a4295e-eaab-4ef0-a05c-4b016c868964", "value": 254464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686563454, "uuid": "75220c32-e1a7-4d23-858f-1266cbd1656a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686563454, "uuid": "300455ff-48c6-4aa3-a198-e1732cc4c04f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8daed18-0936-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686584139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686584139, "uuid": "a8195f4b-2b34-4733-b4b7-0e9faf3aac37", "comment": "Malware payload (Mirai)", "value": "70992a14dba77174835e39bc60443b89", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686584139, "uuid": "a95dd53a-fcf1-4897-bd6c-7e364168c0c8", "comment": "Malware payload (Mirai)", "value": "ed58fa16ec3f12355ba401460f1fbd4b7559d18cf9846f02bf8aaa9a523cbcd2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686584139, "uuid": "5d4ff7ef-e90f-4cb7-adab-05c570bc8610", "comment": "Malware payload (Mirai)", "value": "13af247873fcaf4b4bd6bfd24e9192c67481735a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686584139, "uuid": "bbb41e95-d19d-473f-aa61-d5aa3773b739", "comment": "Malware payload (Mirai)", "value": "1402cc58fcb244088ef1de06deaf77e3f9a71862075bb2d65e981955cf327decda682914bbad1bd4ad2906ef6a0a7fbc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686584139, "uuid": "ca3948c5-c819-4aa8-b8c0-cd0403eb8cc9", "value": "T167E33C02B30C0947D2632EF43A3F27D193EFEA8121E4F644795FAA8A9171E325546EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686584139, "uuid": "b9685923-181b-49c2-a53c-5d45f46b0c7d", "value": "1536:Of8VWxGa/sTlh4pzJxpdv/0wtnP/vqgtf6uGpSwCiiPNqvAgYyc+QWe8TL/XK3ae:eGXgNJxnn9XX63SwYdg5re", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686584139, "uuid": "916f8927-a8a1-44d6-aaff-ec7e64cb9cb3", "value": 150200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686584139, "uuid": "07b6c3f2-5cd5-4317-aeab-a4d1a649da01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686584139, "uuid": "e1c7ad8f-f1cc-4709-96e3-0d36d9d3d48b", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc717bce-092c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686579850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686579850, "uuid": "fb8896d7-7a95-4118-8fee-6f58bab6d86f", "comment": "Malware payload (Mirai)", "value": "69a0d40e625c3a7e72a59d2c6a41e200", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686579850, "uuid": "a600c7a4-aaf9-46fb-9142-7a3b8b464a44", "comment": "Malware payload (Mirai)", "value": "ed6d51d681ca91549c66acbc3cf277a289b59f93be04fce7e200f9ec1aef2d10", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686579850, "uuid": "9652563b-a499-41f6-a78d-fc5bc8e84969", "comment": "Malware payload (Mirai)", "value": "adab43f0317b6771d6ad4445379192615309ff41", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686579850, "uuid": "5ccd2939-e782-4b10-85e8-92082521b16a", "comment": "Malware payload (Mirai)", "value": "1c96f10a148b891aa6db594a02365855bdcd73fdfe976d026ec4c88a19c9309b5ac90fa1772443ad9ff17a91dec80809", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686579850, "uuid": "d42fb63c-aaac-44ac-a26a-2f6b2a34b554", "value": "T1F8E21A4AB891CE17C5D162BBF61F82DF3726538CE1DE7303DD066F553A8A81B0A2E541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686579850, "uuid": "4384de17-875e-4360-802e-3c2e3a7b5539", "value": "768:KrPUnkoR1f9yzhLO4GP33XojP8ylBudypuhrkMS:OykoR1fPP4kyjveLS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686579850, "uuid": "8e03ba0a-8b25-4784-bd04-495e69f57bb3", "value": 32916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686579850, "uuid": "9b07331d-1ffd-4e2c-b3bd-210496c6f69c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686579850, "uuid": "88e8b15d-1bdb-40be-87ce-fc64f0a47fae", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f2d441f-095a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686599531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686599531, "uuid": "685350ca-85e5-4961-9661-78520cffab5b", "comment": "Malware payload (Formbook)", "value": "c83359f746eb240727873f83f3881db0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686599531, "uuid": "3271dbb5-ec5c-4382-8288-0d953d382f28", "comment": "Malware payload (Formbook)", "value": "ee7dd18f59e73fc4569a7a2564d52d6ee55b19757f89f57b17e35f32eb88327b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686599531, "uuid": "2330ce63-a5b7-488b-8d92-a24cf5d6300f", "comment": "Malware payload (Formbook)", "value": "d2bf8a67d2a29e8a48ad685e3e586fde9a7e48a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686599531, "uuid": "26d6e868-4576-4f3b-8aa9-50790ba62e58", "comment": "Malware payload (Formbook)", "value": "299094ca5e974e717d6f1e2aee849633429bb7a9bb0ccb5e89a9292c2adb35fe26606ae3fd81c3eaf107628a43447cff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686599531, "uuid": "36a14beb-d29d-4677-a2ce-7b0a9ec2dc22", "value": "T114A36F6FBF594890C21D1A740FB2D53582703E332787CFBAB8D5314A5A329E4E9521EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686599531, "uuid": "c56bcc78-0d86-45cb-95ab-9b23f631b30b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686599531, "uuid": "fdca1c63-becc-426c-b67d-84b48f481c53", "value": "1536:n1C8TP7w1ZJFfw9VGzlxjrR751lNz0UCdkV/L7e:1CaP7wHnfw9QxlN5T6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686599531, "uuid": "4573c358-b801-498a-8318-57aa20ddbc2f", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686599531, "uuid": "99fc849b-b2a1-4973-9bfd-0178fdae2cfa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686599531, "uuid": "b3b2250d-9e74-46c1-9d1f-5ea28d496255", "value": "update1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "702f7714-08f3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686555214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686555214, "uuid": "3c7e9c36-cacb-44e0-8239-0fa2d2463344", "comment": "Malware payload (Mirai)", "value": "56351ec969b3dd4985250d999332e431", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686555214, "uuid": "54a71e46-d25e-4dcb-9509-125f2f06e300", "comment": "Malware payload (Mirai)", "value": "f0e3ce5cdaef0ff2d87d6ed45f4bc439e8b6aba6bf4ad01e6a77e30cd4591479", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686555214, "uuid": "8b3dd3d4-0f63-42f1-bac5-603e6a684035", "comment": "Malware payload (Mirai)", "value": "2f4eb6cd395b26573dda77524cdf3e453af610fc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686555214, "uuid": "ea927806-be9f-4f2c-b28e-daf0f6465f8b", "comment": "Malware payload (Mirai)", "value": "9d7267803348cc0c66f826425fe0f23623407f52d4d4f6a3fccd837a87dc7243b6b288fd73c072385d3158d7bb49d02b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686555214, "uuid": "6fb553c5-ab2c-4eef-84d4-edbaeebfb914", "value": "T1B3E3C89A7D61BFBFF3DDD2748BF3D62052D6668127A04382F19CDE480E246C9641E398", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686555214, "uuid": "93b440f2-c840-4b93-bcce-79e34aab909b", "value": "3072:DDbF/MH520oumyMhL4aKEW1hvGt4zwUQtjF:nb42vrJLyz1hvGt4zwUQtjF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686555214, "uuid": "3e8f589f-a332-46ec-a668-9f3149bde9c4", "value": 143371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686555214, "uuid": "47004df9-72bd-4643-a93f-c715d3cd2ede", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686555214, "uuid": "37c65b07-21a1-4e43-82a2-76508484c942", "value": "56351ec969b3dd4985250d999332e431", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76a35e36-08f3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686555225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686555225, "uuid": "36332357-1163-42be-97d4-6270d972b9d5", "comment": "Malware payload (Mirai)", "value": "e4bb97c3961cd1531d2d55925609cef9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686555225, "uuid": "2fd7f007-798f-4334-a648-0fcfcdff1cee", "comment": "Malware payload (Mirai)", "value": "f16c4f1cfbfc008071b17154bdcac71e57c562d49876c9d98cf27c5fa472a427", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686555225, "uuid": "703cd3c0-a3c0-4135-9141-dad28ed981b9", "comment": "Malware payload (Mirai)", "value": "5b58a53396b0cd94e1001bdc2246e41360d2b173", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686555225, "uuid": "da3d2b11-7bcc-4d7a-a3ef-8a6ce97463e1", "comment": "Malware payload (Mirai)", "value": "e04ce688589b6c6a9b63850dcd4f18fc12ae9fc3f8d8a477db69109bb141df7b1f6467355a565bc729a88a4682c58f0a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686555225, "uuid": "e0848cf7-475f-4f71-bef0-ec481cfaab64", "value": "T1B4C3F6C1AD027E37C3C2ABB7EBAFC14837E2974493973341A4996FF05A0B98D1D19259", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686555225, "uuid": "e909419b-d5a6-49cb-ba64-798b773d3092", "value": "3072:lkVByhtKPl3qt5z9qCgGj2f9lCFgvgxvfFgyVXUF:ttMqt5zDgGjoCevgxvfFgyVXUF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686555225, "uuid": "a658736b-e3b5-4233-b6dd-330aefc332f9", "value": 128935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686555225, "uuid": "a9238c5f-b249-45ee-b446-44b97ed7f096", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686555225, "uuid": "8304b82e-9831-4d22-8ae4-d5e7f58f3a44", "value": "e4bb97c3961cd1531d2d55925609cef9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7fadbd6-08de-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686546315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686546315, "uuid": "f4539a5e-67e9-47d6-9726-6a78d8e02768", "comment": "Malware payload", "value": "2f7b4a8bfe11b8195b332e58ec9ad34d", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686546315, "uuid": "237539df-594e-4b8b-afa5-a1fef5778687", "comment": "Malware payload", "value": "f1dec33f2053a7b013ed90ccf3e5e179730adfa3688931838aac7b228f1580c2", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686546315, "uuid": "502a6de2-da67-4fe3-9f86-6c3d6e24ca9d", "comment": "Malware payload", "value": "3d957d8bd6332cdf436bda2cfe08037b89b40061", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686546315, "uuid": "3d4d4ad4-5f65-4217-9e93-73ee0ad11deb", "comment": "Malware payload", "value": "4d248aca88bc23298ae52d6cc922a9cf59073521aeb96d240b360eefaf13eb10861212bd184050d182abc52ff7ac41b6", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686546315, "uuid": "150c4946-369e-4728-9c0a-9b2a8232a40b", "value": "T120D2D65AE78B02B48F4112B2671F0E8996BDB23EB35155B2346C837433E9C3D42766BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686546315, "uuid": "fb8ea0d6-5a3f-43ef-9aab-a90f59755148", "value": "768:IFx0XaIsnPRIa4fwJMrw1gEwXtez5kiE0Ufl:If0Xvx3EMrw1gDezHE0Ufl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686546315, "uuid": "cd62738f-1569-4bc3-b15e-1c35980e0f30", "value": 29813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686546315, "uuid": "e7495272-4ec6-42f5-a7d8-c27277fdd40e", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686546315, "uuid": "9c0f73e8-1c72-4b84-845e-b824d3131eaf", "value": "2f7b4a8bfe11b8195b332e58ec9ad34d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8357067-08eb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1686551899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686551899, "uuid": "fc3cdd85-1a4d-4dc8-b55a-26f6a5240268", "comment": "Malware payload (GuLoader)", "value": "ce441467473fe4591e7b1230b7530b98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686551899, "uuid": "dc19d724-25e5-49d0-9314-ebaf93a2c681", "comment": "Malware payload (GuLoader)", "value": "f23660b5a9d0d42308f475a24e1d6ba3a1803f952c16ed6fd70a53592701361d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686551899, "uuid": "e751a965-0622-4d72-a6bb-87e8ab6f25e5", "comment": "Malware payload (GuLoader)", "value": "762efe62870108867c19793484585e509d2abba5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686551899, "uuid": "0af6bbc7-18ec-4cfb-a971-4b980c220231", "comment": "Malware payload (GuLoader)", "value": "196506ba619b00ebfa4ae49bf8dd63a283e81cda3637e9e9298633dbaea0a521b09c1e7ea5a50a7d3847a7cf6980861f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686551899, "uuid": "d3ebec9a-1a77-47cb-96df-c8481df5a3ef", "value": "T10634124A37F4D063C9A289B95E757A737FB5A90B2864630F03605B5C3E22351AF2D31E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686551899, "uuid": "80b09a43-aca6-4b3b-8189-1c47e2f43c2e", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686551899, "uuid": "ff7ed234-04e4-4635-84ec-231dd84294f2", "value": "6144:64t6LsL6K+H3xdq5gGiROl3qc/KZ8K608j7mdp/G:6kL6KGxdq5gGiROm8j7mdpu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686551899, "uuid": "2224c230-21b0-4c0e-85f0-a32eeb590fdd", "value": 251696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686551899, "uuid": "3a09c311-033c-418f-a0fc-ee19f267d624", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686551899, "uuid": "32c9c722-20ed-4484-a9f7-dbf193365016", "value": "Our ref 00055306900123111 ME00598.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7489c043-093f-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686587863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686587863, "uuid": "43ae73ec-d9a1-4bb0-9f8a-19baa03104c8", "comment": "Malware payload", "value": "65faddab9784289f8ba392f328871227", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686587863, "uuid": "c9e770a2-c428-463c-9d2d-1ab12486d640", "comment": "Malware payload", "value": "f250bc5734ffad4a59e2cb017f85e495fc8070056c01c5002470567b7179f62d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686587863, "uuid": "caa4c51d-1316-41cd-b70f-fbf0b0de6b0c", "comment": "Malware payload", "value": "77899e516c9025c0dff0e66127b1cfe00c20131b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686587863, "uuid": "c49f2b98-1eee-4e28-8484-3d1bc9c0c05c", "comment": "Malware payload", "value": "0285d069673a3370f08c8e39f2444e39cbe91e5f3e8366fe3574bcc6ed11cc73194cea39b597acf8630ff9e0ca0d16f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686587863, "uuid": "3780a521-8d5d-4945-988b-e19a873e1a2b", "value": "T1296412B5318D1A9EC4213134C89EAFCE8DF1A1418295C76BD41F67AD3E1B7B1061A2BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686587863, "uuid": "5a8e3284-512e-4ac6-b3a6-d10b216f85ab", "value": "6144:41fEWN5x7rVw2wHFpXeJj4daMHMZn8FO5oPP7MHHhfZ9GlN:41fEWn7ZvwHLOJsdX7PPInhfZ9c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686587863, "uuid": "c811859e-5cf4-437e-9709-afc7e589d7f3", "value": 318464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686587863, "uuid": "ed5f6ccf-8291-4f2e-a99b-a381d4fdbd4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686587863, "uuid": "50a34455-70e1-41ca-9643-c8a3a9fe649c", "value": "RussiaHack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "222e7c54-08ed-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686552506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686552506, "uuid": "e482eb64-3956-45cc-a408-09132f954bf0", "comment": "Malware payload (Mirai)", "value": "38fecaff05fcaa7e090c9bb7bbfdae2b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686552506, "uuid": "e92edb88-2fe8-4fe8-ab0a-5dc12a957c45", "comment": "Malware payload (Mirai)", "value": "f3340acf8218511e9cbb672c9e82d20680f1fe8f19e5fcb8e79562d7f7dde58b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686552506, "uuid": "3c617509-f106-4437-bc91-252abeba6035", "comment": "Malware payload (Mirai)", "value": "bbc73c484a21df39afda7a323470dbd32b2aba45", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686552506, "uuid": "09605512-be20-44db-a77a-7225c520cf05", "comment": "Malware payload (Mirai)", "value": "66b35d2bb96f2d43de5a3e1da1b0023dde1addad7be3de5f7573886b318dca97180d51baa8bb646227fae562e309eaa4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686552506, "uuid": "e0a214a5-4ac7-4f7a-b706-3b7acdba2c1f", "value": "T1C5438C37E96E1E74C04641B074748EB56F23B5C883972EB61AAAC2795483E9CF504FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686552506, "uuid": "5a2f3d35-5e04-451d-b74e-63ec51fbe0f1", "value": "1536:Vaa0brW/Od9hlCRHeKbKYXwKEpPDCMC2+W3:Vv0brWGd9XlKeYypPDL+C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686552506, "uuid": "a200b50e-6a4e-4c94-9899-79dd45064fd5", "value": 58740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686552506, "uuid": "4722b6bf-20f1-4ee0-9a33-fe4d4fe96433", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686552506, "uuid": "f3449532-4ae4-430c-9f32-12f2215fdab3", "value": "38fecaff05fcaa7e090c9bb7bbfdae2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d568735d-0928-11ee-b3cf-42010a9c0076", "comment": "Malware payload (StrelaStealer)", "timestamp": 1686578147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686578147, "uuid": "542bff19-5bc5-497a-8300-96535215c0e3", "comment": "Malware payload (StrelaStealer)", "value": "9fa8a7248878e07e20094d101d5f21d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recupero crediti", "colour": "#F6A0AE", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686578147, "uuid": "cc5ee838-603f-47d3-b80f-29cfcf740db0", "comment": "Malware payload (StrelaStealer)", "value": "f3fe692959c5078378e8221aa1da93b566c99737586291f2e2de88218d4df166", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recupero crediti", "colour": "#F6A0AE", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686578147, "uuid": "ff005c43-9588-4793-8c02-8cdca481c14b", "comment": "Malware payload (StrelaStealer)", "value": "fe1765890ba7546b91faf7f09f962a326b0644cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recupero crediti", "colour": "#F6A0AE", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686578147, "uuid": "08a692ab-0396-49c6-883a-c1d210d333df", "comment": "Malware payload (StrelaStealer)", "value": "bd7f9adba3780c9436610298d174ba71060683f3d1e97da331f9e82ec4ee9fdb9db1c68050eb9d53e54182a309aee009", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recupero crediti", "colour": "#F6A0AE", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686578147, "uuid": "f7ca04ce-f138-49e0-ac26-617a73b84a2a", "value": "T16C646CBD78EB690AFE618C382FFCB761877B34A98657C7F144A8603015204E7DC56A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686578147, "uuid": "54502f3f-487f-4ce9-b0fc-1538362f2c1b", "value": "fcfbe5457e76d2ac347d7db113c0ca3b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686578147, "uuid": "1dee7a39-41b9-4091-a210-762073bcbda5", "value": "6144:ECV3OPCgqgrWK3FhbyIt+w8zgjOiGx2VTKnx:EC0Tl6mr/OqVKx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686578147, "uuid": "d4ef5d6b-5692-4624-9a51-5e5f43eeeecd", "value": 335083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686578147, "uuid": "ceb2cb72-83a9-4234-ab57-5041ac9d09d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686578147, "uuid": "e7fe92e5-016f-473c-91ba-2ac07c1f04f2", "value": "FE6WRF.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53796d2d-08f9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1686557743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686557743, "uuid": "4b26f1eb-e808-47ca-8a2e-767154beb2a1", "comment": "Malware payload (SnakeKeylogger)", "value": "8447ee4d42df3dfd7ec4f1cb4ec14e7b", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686557743, "uuid": "04992a91-3787-40e1-a1e8-0de938ce7352", "comment": "Malware payload (SnakeKeylogger)", "value": "f8e39bd0a813aea93939649fb467351f3ebc603e08d4a05b5529b922e6cc8abc", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686557743, "uuid": "789a5dca-e429-43d9-af7b-e11e5256c7af", "comment": "Malware payload (SnakeKeylogger)", "value": "2541f9e81fb898572c2eecef9fc3a3ff7dc49ed9", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686557743, "uuid": "b94b1a6c-fff7-488c-a531-3070157dab60", "comment": "Malware payload (SnakeKeylogger)", "value": "57c8b080d8dbf60ae74bcc3e77e06bb771239fcf30da0918aacc0b399ebad0cd31e850f545c3d8ae69a24b42a4dd284d", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686557743, "uuid": "9042fd86-56fa-4a14-9c81-d58499acd352", "value": "T19A230261EBC94FBC5153E3C5E6D788F404137BF86BBB9064B6F93124B2729278502B64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686557743, "uuid": "b7ac1b3b-0674-43ae-a07c-54c22d8f0ac4", "value": "768:gCWNn+/PLfISs6oq9ERQEHM+ocrrBoUT3Iu1FB6DVhdgcJZvrNSS+ox83Qz:Swn8R6oq9E1ZVBjT3fcjTl+y8k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686557743, "uuid": "a57000fb-2ae1-4c2a-9b41-d06fc9151228", "value": 48513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686557743, "uuid": "2123aa57-6ee6-4627-95f3-792601651284", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686557743, "uuid": "f19d3388-e8c0-4f26-9e22-3c460d00d7df", "value": "INV_PKEX0521219.PDF.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a12ad9e-08f3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686555204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686555204, "uuid": "12962af3-653c-442b-b7ff-e11586870a61", "comment": "Malware payload (Mirai)", "value": "49008207c4fa7cede1beb62491c35f5e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686555204, "uuid": "5b515aa2-5cac-484e-9d7d-9d0bc7cac1e7", "comment": "Malware payload (Mirai)", "value": "f918cef2c403dbaff43e946ca0ade67064c44fec94cb0f54138c1e4c8abb4350", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686555204, "uuid": "700be4da-e27f-4cdd-9a09-9b1dfe2b7a9d", "comment": "Malware payload (Mirai)", "value": "7898bdddffc14a58295cd00c8c664045e0186131", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686555204, "uuid": "16dadc20-c782-4fef-8a0e-d2b4caa287d5", "comment": "Malware payload (Mirai)", "value": "2806285119fb7e4210e3a82ff355ee5ce73167a988cd9344083582560ff1ccddea2470deb9495a1e7f883afe8e67ba16", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686555204, "uuid": "871dbe08-a584-462d-ace1-d04a40a240bd", "value": "T1B0C33A91AD267D37C1C9F6F661F7C220F6F352056BB601097CE51E989B1EBC0311A3AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686555204, "uuid": "e1c64525-7867-40c7-b25b-b4b48c940063", "value": "1536:nWExd+Isj9NG4Vdgiu1uW0ByzJHYM54x+TIt4Fv4pvbv6fL0TgL5dROF:V/0GSgjYWEwJHY84Ufobv6fLwY5dROF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686555204, "uuid": "ec8c591f-b981-45cc-a5f0-ceb66b402f15", "value": 125155, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686555204, "uuid": "ba22993d-8e12-492e-9b71-ca384a31af16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686555204, "uuid": "c7fc16f4-3a73-4175-bf6d-ea7f55b70747", "value": "49008207c4fa7cede1beb62491c35f5e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f5d3b8a-0939-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686585251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686585251, "uuid": "6b3fb6ee-0c01-43f0-872a-ad231a20a347", "comment": "Malware payload", "value": "9f67f9343b41f350872d89a852c87209", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686585251, "uuid": "cd58fcdc-a00c-4e95-b993-78a54f4b77a9", "comment": "Malware payload", "value": "f954f2b083a6c1fd61fd66522a6c32f450bc2481914c26f70ecc91422048c8e9", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686585251, "uuid": "dc2bbe23-5b02-42ad-b08d-3a09795a4968", "comment": "Malware payload", "value": "d6864cdf1e5c8761b8f7185b7d7bca7c12cb0711", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686585251, "uuid": "283e2488-ce7a-4471-b4dd-73afde9af536", "comment": "Malware payload", "value": "7e9adacb9fb34829094ba949e5352b9b4869ae9230a4d42107788ab3ada9dcefd4cd9d43658d18e531fc2f336b4214e1", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686585251, "uuid": "dfad6bf9-ec6d-4b57-a0db-3b440adda4da", "value": "T134E56C2176839076C1A33571FE0BA3B6AE789F331B70528756903FB83E307D25529A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686585251, "uuid": "d09b2d2c-24ee-4e08-9c64-47660d848cfa", "value": "f42e00c9b7c651b71f822b600b328e4f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686585251, "uuid": "11323692-95ea-479f-879e-e84f0ed761e2", "value": "98304:a4Sh1B2EuR3rUjOtJ6qMM+m8tOiLYd5KEn5sI5KDk5qrwCEf0HUc9I1O:af18frUjwK9SGI+bEcHUc9I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686585251, "uuid": "e72e473a-7e43-409b-bcbc-9735499d4985", "value": 3177984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686585251, "uuid": "01c321a7-d3bc-417b-8b33-73aef0722978", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686585251, "uuid": "375b7b36-9f9a-440f-a5aa-f2f7f58573db", "value": "\uff08\u5a5a\u59fb.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a95bb49-0912-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686568519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568519, "uuid": "a3e5fa68-28df-44e7-acc8-8370f733d32d", "comment": "Malware payload (AgentTesla)", "value": "ddf77570f9ca80d37061d5309d84fb20", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568519, "uuid": "27cbcef6-e7b4-4ad9-a3bf-e8ec8a354253", "comment": "Malware payload (AgentTesla)", "value": "f9b536d2ba94bc4720cebc07ed39fc7643bdaea35b09b7112a09fef013123ca6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568519, "uuid": "3a388cec-02ac-4fd4-b7f7-5b387f4ef4d6", "comment": "Malware payload (AgentTesla)", "value": "0e5194c9b6012caa59b54f51a6fae4cb2eb80e67", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686568519, "uuid": "04a3fc01-6c68-4524-8677-24dcafcbb7b9", "comment": "Malware payload (AgentTesla)", "value": "2d8570538de72d0d28f6ee2dfc35a1e4771d834bd4c3fb4aa5be56b535438a2306cc8c5299e05808bd6ee6f636acc4da", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568519, "uuid": "8f3ca561-5bff-4045-8f18-36c84f5df112", "value": "T1BEF3114362EA4DC8B5F62A9B5A7751344BF7BD99687DC69D00CC640E0BE3A4C88607F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568519, "uuid": "43d69579-68dd-4611-9b6c-2f846b805d4d", "value": "1536:prZccvQvgpdpPZU+ogsUJW4Wrle/PhG+/kery+bGW:ugpdpe+og0S7N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686568519, "uuid": "1e9c0bf6-845f-433f-8ad6-45b194427624", "value": 165332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686568519, "uuid": "e4dca37a-71b1-4b0b-a106-3c0f05b598a2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686568519, "uuid": "34c334cd-cc81-4182-93d0-2949f02c1eaf", "value": "Listed specification.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11a40e2a-08ed-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686552479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686552479, "uuid": "40714b12-ef11-47dd-8a5b-559144cd8cc9", "comment": "Malware payload (Mirai)", "value": "379d52bffd444e229e72b9cc47202256", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686552479, "uuid": "95d014af-6f1b-4373-a6cb-f8e7577bf98f", "comment": "Malware payload (Mirai)", "value": "fbcec53dadc81cfa89ef88b87ec8224ba3e17ce61d6c4253898392f055798bf6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686552479, "uuid": "6e3b05bf-11d3-4840-9830-ec3c3f1e7c10", "comment": "Malware payload (Mirai)", "value": "ba9da8beabeea551c8d3d6c408c93fbd045bf0e7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686552479, "uuid": "2d2337a5-7f13-4fb9-8059-59ca496cd19c", "comment": "Malware payload (Mirai)", "value": "c8dd0ad3647448cb95171ee7c2a909a76d87a4b218703ac43c7c2a3e873fe34eb1390e455eab757be1faaa993b8b3c8c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686552479, "uuid": "88ca1d67-39df-4fbb-bd63-37d328a4a3f5", "value": "T11B03E752BC829A67C2E1137ABA6E5A8D333163D8D2CF7217D9214B207AD651F0D23F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686552479, "uuid": "55c16e77-c8cc-4c16-be5e-620392c1147f", "value": "768:wgJMCbqsG5f0OtnlUlYOJFFARwAtb9LnWwaCv+bz1CX2bXoT0/NZwW:wub1G5fPlUlDf43aw9v+5bbMW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686552479, "uuid": "b6850548-a754-4448-b65b-a6b52cd84453", "value": 40756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686552479, "uuid": "a91d89dd-1cc3-4a3e-b508-2d2efd80efe2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686552479, "uuid": "9201f274-44e4-456b-882e-a08b0e0b432f", "value": "379d52bffd444e229e72b9cc47202256", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d2e0cbd-0942-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686589032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686589032, "uuid": "4b383c36-29c5-4dc1-a557-7f813894d665", "comment": "Malware payload (RedLineStealer)", "value": "4ba9e1b30a139933dcebca3353ea46a8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686589032, "uuid": "f63e8a18-8eca-4d95-9600-5031ac65ba51", "comment": "Malware payload (RedLineStealer)", "value": "fc7a2d08160f299450390086b02c5b02277e1eb8c7cab88bb4313594d0c0cb67", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686589032, "uuid": "1ded404c-f0e6-4bbd-8dfd-2186880fe36a", "comment": "Malware payload (RedLineStealer)", "value": "6acf5ee2f09d84c2c910eb10da849370bed5a1ae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686589032, "uuid": "8596b078-6b49-4e30-9eb0-c83525fc427d", "comment": "Malware payload (RedLineStealer)", "value": "a8260568b8cb6501255d60e0094252337f23a22b6459d18cec94f770f26b46e1e388407f3b84767d8cc5a80fec9c1ca1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686589032, "uuid": "8b6406aa-2166-472c-85c3-346cc73de200", "value": "T156051253B7E884B3E8B627B09EF903831B353CF15671672B7615A94E18B3784A931336", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686589032, "uuid": "2f3b2b82-8558-496a-a132-8eb8f69a5372", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686589032, "uuid": "ab47e864-a51e-47ad-bc7f-885eb76af19b", "value": "12288:EMrFy900Zf07Cm8+FGUh/QVnBuhAhagv9W0bMzsFeodBRJDU02Ht3w9T5MVcuZ:RyZZMem8+o26IihagEdszvR2N3kzu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686589032, "uuid": "5ebbd02b-f6ac-4b43-be19-0f8bc5e5c7fc", "value": 800256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686589032, "uuid": "60d352d2-2a4c-4d13-a320-932ec581611f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686589032, "uuid": "b0627c84-685c-4a58-9078-ff8ad8f17989", "value": "4ba9e1b30a139933dcebca3353ea46a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35a14935-091e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686573584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686573584, "uuid": "2b88da19-375b-449a-9da0-cbf448af5f6c", "comment": "Malware payload (Loki)", "value": "3e99bc45eb58bd3a8d974d3d73397fb6", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686573584, "uuid": "83698276-ee12-488a-bb0c-2f26fed83a69", "comment": "Malware payload (Loki)", "value": "fe58d4144a078ceb396c7465d2553f87bc86a9054486a3fae8ec9a132853e45d", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686573584, "uuid": "ac684e4c-6cb4-425e-918b-d35d2cee8e6b", "comment": "Malware payload (Loki)", "value": "2a003049dabeefe7b7b78428d470ecd99676e5bf", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686573584, "uuid": "c4ef4b1e-be44-4bba-84ba-475b45a532a6", "comment": "Malware payload (Loki)", "value": "8bc1f93f96afeaebf57dfe60165f74875269738675695d11abc1cfd63c7b34cf96063b14cf9b47119da48ecea79d9f3a", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686573584, "uuid": "53e2da2d-eb75-45f7-8d40-91b97ebb8a3a", "value": "T17583D0E663059433F125997D84E67233510BF2803BFB56EA356D19ED0F078908FB938A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686573584, "uuid": "83593be3-2dfd-48a3-b0e1-12ca265e721d", "value": "768:FKgh/unGNXdLsMlNsCfdTBwgW3JisGo6wMhF:wgh/HNNIMcClTgJisvK3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686573584, "uuid": "0dffe2e7-cf58-421c-8e1d-51eaadb6956b", "value": 88064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686573584, "uuid": "89dbf308-36b3-409a-98a9-e194212b98b8", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686573584, "uuid": "323e0484-f06c-4730-ab12-ba5d88a2d270", "value": "Fatura_No 509600_92023_print_01.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53c41db6-0904-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686562468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562468, "uuid": "15074b8a-e8d2-4ae5-803b-61a643d672b8", "comment": "Malware payload (AgentTesla)", "value": "5e182ccf4156322e8c083b22aa6ec731", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562468, "uuid": "086d8e22-743d-4951-8477-4ce61b5c9a6f", "comment": "Malware payload (AgentTesla)", "value": "feb5ecbe032c4c81268dde1395cfeb1d2a418780de95e6ec4666cd1a32c108c5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562468, "uuid": "4e463b34-38db-4b5d-aac5-bf27b067434b", "comment": "Malware payload (AgentTesla)", "value": "3f6dcd420d043b35a81af9323a09e1ebd2662e36", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686562468, "uuid": "20e70302-30eb-4b1c-b288-19456e895c2f", "comment": "Malware payload (AgentTesla)", "value": "dc3994ab941d1128a5fb8c9e51e2c18f47bf3ee41947db6e586b04e740375ecd55b91d703adb1196c2e612a53586ca17", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562468, "uuid": "23e6c3b2-6843-48ad-a54e-27f6cc9ead8e", "value": "T11512D704FBA86533E97D8BF1A4A253400777728129B2DBDE3C8E4D8A0BD77844562B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562468, "uuid": "c7bf3529-26b2-4e47-b5c2-2a5093560c78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562468, "uuid": "8bd25d95-5eb1-48a6-a80c-6df33d826faa", "value": "96:jmKoyA2mr8CvhQBHfM+Bzm6GcKquEkkDKpHJrr1qfoumtY/RZvGg8HWt2l2Jomsv:jm352mhvJ6GQu6hU27986oBXRHt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686562468, "uuid": "82248fe0-203f-4259-9ebb-4f0be22129dc", "value": 9728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686562468, "uuid": "707fdd93-3b3f-456b-bbc8-c3252e7be469", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686562468, "uuid": "a81b93ab-aa95-4510-ae47-89fe6814faf3", "value": "ROCA - PO - 4501226854_Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c7c9f3d-08c1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1686533626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686533626, "uuid": "f952716b-2c06-4597-84ab-ea33d4dfb2f8", "comment": "Malware payload (ArkeiStealer)", "value": "feb4898eb95980e76f9d0a123ba1f45a", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686533626, "uuid": "9f37b0b3-8f94-4375-8a69-67bdb6c0457b", "comment": "Malware payload (ArkeiStealer)", "value": "ff7597b3fd399d2793c61def07bf375e562cebe7c336161fc9115a594d567174", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686533626, "uuid": "6e34d531-c28b-4012-b19f-499c85308585", "comment": "Malware payload (ArkeiStealer)", "value": "7690e6746f8a091bc0b0e13f52f1209298799461", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686533626, "uuid": "125cbc1c-0538-427a-b7f4-93eaf2374a50", "comment": "Malware payload (ArkeiStealer)", "value": "b11d6d88ad01dd9457790a1d5f5110e1b0dc972d7ba1f70eacff28d117b95a5318327910f386bf9d436e6c55bd1de925", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686533626, "uuid": "eaf2ea0c-f4eb-48a6-b602-fde568f5844d", "value": "T15FE4E05B743E988AC2491BF190D5002D36ACAD12F0E2ED733D987DA74676BD704CB98E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686533626, "uuid": "99d40d43-615d-45be-8668-91c0c2961468", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686533626, "uuid": "1a42926d-b709-433d-b6dd-07368e3e42a4", "value": "12288:8VG8j1/s+QdnBW8FvFUFtXB+bxStveXTZZvFBVhjpoksUyg1W5qvGoVZjkR:8bj1/s+QdnfviQStvcZ9BVhHeqvGoVZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686533626, "uuid": "9ab0b6a2-831c-4702-b91d-23abbf92e923", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686533626, "uuid": "a7434a77-c112-4f71-8441-e9d780ad6360", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686533626, "uuid": "b915d6e9-751b-4e0d-841d-e225637bee18", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85272f13-090d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686566416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686566416, "uuid": "1dd697cf-2568-4904-9222-f1bdabaf057a", "comment": "Malware payload (Loki)", "value": "5bb531c7447815b2017c747b1215074a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686566416, "uuid": "279f4c22-c95a-4e37-839b-61ba362bb13b", "comment": "Malware payload (Loki)", "value": "ff927067632cbc9312282420e5ed0e75505e871970b76c169cd57f0ca52c3d84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686566416, "uuid": "0dc1f19e-f003-42be-acdf-9ddb5f4ad598", "comment": "Malware payload (Loki)", "value": "e7bbe6326fbaf2e378dbe007ff3cf5e042818e47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686566416, "uuid": "399982ae-97b9-44df-b4ff-4213cd7407f3", "comment": "Malware payload (Loki)", "value": "8d293ca37ee430dec919f2f00c4b2ece0ebad110b4a137a24ec668c26c5802e1ab442f6b9c42ae75864a1d39a2f1bae9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686566416, "uuid": "45cc2526-003f-4659-9a78-f66076e91138", "value": "T13CF4F12C22A78B4EC47A7BFD4D146630D3F9AD963173E34A4EC338EA9C3571449916A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686566416, "uuid": "8680048e-228a-4a96-99d8-e09cd53e2fb2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686566416, "uuid": "a397eab0-c106-4976-9e26-7580ae950238", "value": "12288:vH8Y52iNoOe42KMu/N3mWhQmwmJCMpUUe1TDXEjAF/M/hueJ8iBkNm3M+ECCQUI:P8e1mOV/NOaYdwsF/M/xJIYdECM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686566416, "uuid": "666ca652-125e-4387-8c25-4d28269424fb", "value": 748032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686566416, "uuid": "aba3c7f2-3369-4b1e-bb2f-af2f4133edd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686566416, "uuid": "e9036d52-5207-4073-ac93-ad529125904e", "value": "5bb531c7447815b2017c747b1215074a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b85c84f2-0901-11ee-b3cf-42010a9c0076", "comment": "Malware payload (NanoCore)", "timestamp": 1686561348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686561348, "uuid": "48bd2363-6ba9-4b51-9a69-bb86d1b755d1", "comment": "Malware payload (NanoCore)", "value": "600ab5b45f38e87464a5e184ea4d0c48", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686561348, "uuid": "e1ef6760-f912-4fad-bb9b-d2c58f300277", "comment": "Malware payload (NanoCore)", "value": "fff2c607be574e67b4b40c56b805dd459c946aaaf1bf8b2f5bf24f48fa7c7279", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686561348, "uuid": "7181c70d-eaf6-44c8-a39f-a41090316fa8", "comment": "Malware payload (NanoCore)", "value": "b0e3f836e625840956d1aa125f0378688718bd8f", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686561348, "uuid": "c584bde2-25ed-416c-8de4-933504652050", "comment": "Malware payload (NanoCore)", "value": "3b2f1944a53aab145e9f0ba485b1caea28084b9d1db6dac77b68844b5be8e0b94ea42e8bb818db899eb7cb5ff8c114d4", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686561348, "uuid": "b6258b9d-7c47-4434-b812-05a423c20252", "value": "T1ACD423E1D2014534B63385B50B39092E6BFA4D8D0DDC978A9E6E94CE3AFCF80B512DB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686561348, "uuid": "f704b8ef-f996-481b-8c3f-db7afdca2b86", "value": "12288:wzDwyWlb0JGS52BoaY6dUV0QQFMboeGw8bRxJko/WBan4U6UNpWo:Jy+EGS52Bk6ddQQuMeGPx4an4U6Vo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686561348, "uuid": "fb0d898a-cf06-4d88-9b2e-5206858a40bc", "value": 619928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686561348, "uuid": "22104815-11e2-4ec2-a48c-1f4033d20212", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686561348, "uuid": "67b5cd98-f4d8-44a0-be45-fe1f08cbff63", "value": "SOLID\u56fe\u7eb8\u6e05\u5355CFB4TS241U.Tar.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }